Пример #1
0
        /// <summary>
        /// Reads memory of the <see cref="Process"/> provided at the address specified.
        /// </summary>
        /// <param name="hProcess">Pointer to process where read memory.</param>
        /// <param name="address">Address of the process at which memory reading should occur.</param>
        /// <param name="size">Amount of bytes to read.</param>
        /// <returns>Memory read as an array of bytes.</returns>
        public static byte[] ReadMemory(IntPtr hProcess, uint address, int size)
        {
            var array      = new byte[size];
            int bytes_read = 0;

            NativeCall.VirtualProtect(hProcess, (IntPtr)address, (UIntPtr)size, 4, out var old);
            NativeCall.ReadProcessMemory(hProcess, (IntPtr)address, array, (uint)size, bytes_read);
            NativeCall.VirtualProtect(hProcess, (IntPtr)address, (UIntPtr)size, old, out old);
            return(array);
        }
Пример #2
0
        /// <summary>
        /// Reads memory of the <see cref="Process"/> provided at the address specified.
        /// </summary>
        /// <param name="process">Process where read memory.</param>
        /// <param name="address">Address of the process at which memory reading should occur.</param>
        /// <param name="size">Amount of bytes to read.</param>
        /// <returns>Memory read as an array of bytes.</returns>
        public static byte[] ReadMemory(Process process, uint address, int size)
        {
            var array      = new byte[size];
            int bytes_read = 0;
            var hProcess   = NativeCall.OpenProcess(ProcessAccessFlags.All, false, process.Id);

            NativeCall.VirtualProtect(hProcess, (IntPtr)address, (UIntPtr)size, 4, out var old);
            NativeCall.ReadProcessMemory(hProcess, (IntPtr)address, array, (uint)size, bytes_read);
            NativeCall.VirtualProtect(hProcess, (IntPtr)address, (UIntPtr)size, old, out old);
            NativeCall.CloseHandle(hProcess);
            return(array);
        }