public override byte[] ReadMemory(long address, int size) { byte[] buffer = new byte[size]; UIntPtr numBytes; int error = 0; if (IsWow64() && !IsWow64Process(processHandle)) { int status = NtDll.NtWow64ReadVirtualMemory64(processHandle, (long)address, buffer, size, out numBytes); error = NtDll.RtlNtStatusToDosError(status); } else { bool success = Kernel32.ReadProcessMemory(processHandle, checked ((IntPtr)address), buffer, size, out numBytes); if (!success) { error = Marshal.GetLastWin32Error(); } } if (error != 0 && error != 299 || (error == 299 && size > 0 && numBytes == UIntPtr.Zero)) { throw new Win32Exception(error); } if (numBytes != (UIntPtr)size) { Array.Resize(ref buffer, (int)numBytes); } return(buffer); }
public override int WriteMemory(long address, byte[] data) { UIntPtr numBytes; int error = 0; if (IsWow64() && !IsWow64Process(processHandle)) { int status = NtDll.NtWow64WriteVirtualMemory64(processHandle, address, data, data.Length, out numBytes); error = NtDll.RtlNtStatusToDosError(status); } else { bool success = Kernel32.WriteProcessMemory(processHandle, checked ((IntPtr)address), data, data.Length, out numBytes); if (!success) { error = Marshal.GetLastWin32Error(); } } if (error != 0 && error != 299 || (error == 299 && data.Length > 0 && numBytes == UIntPtr.Zero)) { throw new Win32Exception(error); } return((int)numBytes); }