예제 #1
0
    public bool ReadMemoryAt(long address, int bytesToRead, out byte[] buffer)
    {
        buffer = new byte[bytesToRead];
        IntPtr read = new IntPtr();

#if DEBUG
        MEMORY_BASIC_INFORMATION memInfo;
        int dwLength = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));

        WrapperWinAPI.VirtualQueryEx(m_ProcessHandle, (IntPtr)address, out memInfo, dwLength);
#endif

        return(WrapperWinAPI.ReadProcessMemory(m_ProcessHandle, new IntPtr(address), buffer, bytesToRead, out read));
    }
예제 #2
0
    public bool ReadMemory(out Dictionary <IntPtr, byte[]> dictionary)
    {
        dictionary = new Dictionary <IntPtr, byte[]>();

        if (!IsBound())
        {
            return(false);
        }

        SYSTEM_INFO sysInfo;

        WrapperWinAPI.GetSystemInfo(out sysInfo);

        IntPtr start = new IntPtr(0);
        IntPtr end   = sysInfo.lpMaximumApplicationAddress;

        long current = 0;

        MEMORY_BASIC_INFORMATION memInfo;
        int dwLength = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));

        while (current <= end.ToInt64() && WrapperWinAPI.VirtualQueryEx(m_ProcessHandle, (IntPtr)current, out memInfo, dwLength) != 0)
        {
            if (memInfo.State == StateEnum.MEM_COMMIT && memInfo.Protect == AllocationProtectEnum.PAGE_READWRITE)
            {
                byte[] buffer = new byte[memInfo.RegionSize.ToInt32()];
                IntPtr read   = new IntPtr(0);

                IntPtr baseAddr = new IntPtr((long)memInfo.BaseAddress);

                if (WrapperWinAPI.ReadProcessMemory(m_ProcessHandle, baseAddr, buffer, buffer.Length, out read))
                {
                    dictionary.Add(baseAddr, buffer);
                }
            }

            // next memory chunck.
            current = (long)memInfo.BaseAddress + (long)memInfo.RegionSize;
        }

        return(dictionary.Count > 0);
    }