public static List <MemoryPage> CondensePages(List <MEMORY_BASIC_INFORMATION> pages, int maxPageSize) { List <MemoryPage> newPages = new List <MemoryPage>(); MemoryPage mp = null; int i = 0; while (i < pages.Count) { while (i < pages.Count && !ProcessMemoryMapper.PageAccessible(pages[i])) { if (mp != null) { newPages.Add(mp); mp = null; } i++; } while (i < pages.Count && ProcessMemoryMapper.PageAccessible(pages[i])) { if (mp == null) { mp = new MemoryPage(pages[i]); } else if (mp.RegionSize + pages[i].RegionSize > maxPageSize) { newPages.Add(mp); mp = null; break; } else { mp.Add(pages[i]); } i++; } } if (mp != null) { newPages.Add(mp); } return(newPages); }
public void ScanMemoryNew(object memoryScanParameters) { ProcessMemoryReader pr = null; try { MemoryScanParameters parameters = (MemoryScanParameters)memoryScanParameters; Parameters = parameters; byte[] valToFind = parameters.ValToFind; int maxMemoryLocation = parameters.MaxLocation; int minMemoryLocation = parameters.MinLocation; uint startLocation = parameters.StartLocation; bm = new BoyerMoore(valToFind); pr = parameters.Reader; List <MEMORY_BASIC_INFORMATION> pages = ProcessMemoryMapper.GetMemoryMap(pr.ReadProcess); List <MemoryPage> memPages = ProcessMemoryMapper.CondensePages(pages, 4096 * 4); int r = memPages.Count / 2; for (int i = 0; i < memPages.Count; i++) { uint low = (uint)memPages[i].BaseAddress; uint high = low + memPages[i].RegionSize; if (startLocation >= low && startLocation < high) { r = i; } } int l = r - 1; int bytesRead = 0; int lastPercentage = 0; Decimal onePercentAmount = memPages.Count / 100.0M; pr.OpenProcess(); while (r < memPages.Count || l >= 0) { if (Cancel) { this.ScanCanceled(this, new ScanCanceledEventArgs()); Cancel = false; return; } if ((r - l) / (Decimal)memPages.Count > lastPercentage / 100M) { lastPercentage++; this.ScanProgressChanged(this, new ScanProgressChangedEventArgs(lastPercentage)); } if (r < memPages.Count) { MemoryPage mbi = memPages[r]; byte[] valToTest = pr.ReadProcessMemory(mbi.BaseAddress, mbi.RegionSize, out bytesRead); if (bytesRead == 0) { r++; continue; } int foundIndex = ArrayIndexOf(valToTest, valToFind); if (foundIndex >= 0) { this.ScanCompleted(this, new ScanCompletedEventArgs(new [] { (uint)mbi.BaseAddress + (uint)foundIndex })); return; } } if (l >= 0) { MemoryPage mbi = memPages[l]; byte[] valToTest = pr.ReadProcessMemory(mbi.BaseAddress, mbi.RegionSize, out bytesRead); if (bytesRead == 0) { l--; continue; } int foundIndex = ArrayIndexOf(valToTest, valToFind); if (foundIndex >= 0) { this.ScanCompleted(this, new ScanCompletedEventArgs(new[] { (uint)mbi.BaseAddress + (uint)foundIndex })); return; } } if (r < memPages.Count) { r++; } if (l >= 0) { l--; } } this.ScanCompleted(this, new ScanCompletedEventArgs(null)); } catch (Exception ex) { this.ScanCanceled(this, new ScanCanceledEventArgs() { Exception = ex }); } finally { pr.CloseHandle(); } }