public static object HEXPatternToString(WatchMemoryObject watchMemoryObject)
{
string hex = "";
foreach (byte b in watchMemoryObject.Data)
{
hex += string.Format("{0:x2} ", b);
}
return(hex);
}
public static byte[] ReadProcessMemory(WatchMemoryObject watchMemoryObject)
{
byte[] buffer = new byte[watchMemoryObject.MaxSize];
ProcessData processData = watchMemoryObject.ProcessData;
bool successful = ReadProcessMemory(processData.ProcessHandle, (UIntPtr)watchMemoryObject.BaseAddress, buffer, buffer.Length, IntPtr.Zero);
if (!successful)
{
watchMemoryObject.LastError = string.Format("Could not read memory: {0}", Win32Error.GetLastWin32Error());
return(null);
}
return(buffer);
}
private void AddWatch(ClientContext clientContext)
{
// Starting offset in 'data'
int offset = sizeof(UInt32);
// Remote processes don't have memory watching support, ignore their pleas
if (clientContext.IsRemote)
{
return;
}
// Layout of the AddWatch data chunk:
// - Length (4b), Type string (*b)
// - Length (4b), Name string (*b)
// - Root handle (categories) (4b)
// - Cross-process handle (4b)
// - Base ptr (8b)
// - Max size (4b)
int typeLength = BitConverter.ToInt32(clientContext.Data, offset); offset += sizeof(Int32);
string typeString = Encoding.ASCII.GetString(clientContext.Data, offset, typeLength); offset += typeLength;
int nameLength = BitConverter.ToInt32(clientContext.Data, offset); offset += sizeof(Int32);
string nameString = Encoding.ASCII.GetString(clientContext.Data, offset, nameLength); offset += nameLength;
UInt32 rootHandle = BitConverter.ToUInt32(clientContext.Data, offset); offset += sizeof(UInt32);
UInt32 handle = BitConverter.ToUInt32(clientContext.Data, offset); offset += sizeof(UInt32);
UInt64 basePtr = BitConverter.ToUInt64(clientContext.Data, offset); offset += sizeof(UInt64);
UInt32 maxSize = BitConverter.ToUInt32(clientContext.Data, offset); offset += sizeof(UInt32);
WatchMemoryObject watchMemoryObject = new WatchMemoryObject()
{
ProcessData = clientContext.ProcessData,
BaseAddress = basePtr,
Name = nameString,
Type = typeString,
MaxSize = maxSize,
Handle = handle
};
clientContext.ProcessData.AddWatchBaseObject(rootHandle, watchMemoryObject);
if (WatchMemoryObjectAdd != null)
{
WatchMemoryObjectAdd(watchMemoryObject);
}
}
public object Convert(WatchMemoryObject watchMemoryObject)
{
if (!conversionFunctions.ContainsKey(watchMemoryObject.Type))
{
return(null);
}
try
{
object result = conversionFunctions[watchMemoryObject.Type](watchMemoryObject);
return(result);
}
catch (SystemException excpt)
{
return(string.Format("Conversion function threw an exception: {0}!", excpt.ToString()));
}
}
public static object UTF8StringToString(WatchMemoryObject watchMemoryObject)
{
return(Encoding.UTF8.GetString(watchMemoryObject.Data, 0, (int)watchMemoryObject.MaxSize));
}
public static object Float64ToString(WatchMemoryObject watchMemoryObject)
{
return(BitConverter.ToDouble(watchMemoryObject.Data, 0).ToString());
}
public static object ANSIStringToString(WatchMemoryObject watchMemoryObject)
{
return(Encoding.Default.GetString(watchMemoryObject.Data, 0, (int)watchMemoryObject.MaxSize));
}
public static object UInt64ToString(WatchMemoryObject watchMemoryObject)
{
return(BitConverter.ToUInt64(watchMemoryObject.Data, 0).ToString());
}
public static object UInt8ToString(WatchMemoryObject watchMemoryObject)
{
return(watchMemoryObject.Data[0].ToString());
}
public static object Int32ToString(WatchMemoryObject watchMemoryObject)
{
return(BitConverter.ToInt32(watchMemoryObject.Data, 0).ToString());
}
public static object Int8ToString(WatchMemoryObject watchMemoryObject)
{
return(((SByte)watchMemoryObject.Data[0]).ToString());
}
public static object BoolToString(WatchMemoryObject watchMemoryObject)
{
return(watchMemoryObject.Data[0] > 0 ? "true" : "false");
}
