private void OnSeekOverun(object sender, SeekOverunEventArgs e)
{
ProcessExtensions.MEMORY_BASIC_INFORMATION memBasicInfo;
ulong address = 0;
switch (e.Location)
{
case ProcessSeekOrigin.BeginningOfProcessMemory:
address = (ulong)e.Offset;
break;
case ProcessSeekOrigin.Begin:
address = baseAddress + (ulong)e.Offset;
break;
case ProcessSeekOrigin.Current:
address = baseAddress + (ulong)(baseStream.Position + e.Offset);
break;
case ProcessSeekOrigin.End:
address = baseAddress + (ulong)(baseStream.Length + e.Offset);
break;
}
e.Position = (long)address;
e.ContinueBaseSeek = false;
memBasicInfo = ProcessExtensions.GetMemoryInfo(hProcess, address);
if (memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.Readonly | memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.ReadWrite | memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.ExecuteRead | memBasicInfo.Protect == ProcessExtensions.AllocationProtectEnum.ExecuteReadWrite)
{
var offsetFromBase = (long)(address - baseAddress);
e.MemoryAllocated = true;
e.ContinueBaseSeek = true;
e.BaseSeekOrigin = SeekOrigin.Begin;
e.BaseOffset = offsetFromBase;
if (memBasicInfo.AllocationBase.As <ulong>() != baseAddress && (offsetFromBase > systemInfo.AllocationGranularity || offsetFromBase < 0))
{
if (!regions.ContainsKey((ulong)memBasicInfo.AllocationBase))
{
regions.Add((ulong)memBasicInfo.AllocationBase, new ProcessBinaryReader(hProcess, (IntPtr)memBasicInfo.AllocationBase, (ulong)memBasicInfo.RegionSize));
processDiagnostics.RegisterRegion((ulong)memBasicInfo.BaseAddress, (ulong)memBasicInfo.AllocationBase, (int)memBasicInfo.AllocationProtect, (ulong)memBasicInfo.RegionSize, (int)memBasicInfo.State, (int)memBasicInfo.Protect, (int)memBasicInfo.Type);
}
e.OutOfRegionPosition = true;
}
else
{
e.OutOfRegionPosition = false;
}
}
else
{
throw new Win32Exception(unchecked ((int)0xc0000005), string.Format("Attempt to read memory marked as {0} by {1}", memBasicInfo.Protect, this.GetType().FullName));
}
}
