public static List <MemoryPage> CondensePages(List <MEMORY_BASIC_INFORMATION> pages, int maxPageSize)
{
List <MemoryPage> newPages = new List <MemoryPage>();
MemoryPage mp = null;
int i = 0;
while (i < pages.Count)
{
while (i < pages.Count && !ProcessMemoryMapper.PageAccessible(pages[i]))
{
if (mp != null)
{
newPages.Add(mp);
mp = null;
}
i++;
}
while (i < pages.Count && ProcessMemoryMapper.PageAccessible(pages[i]))
{
if (mp == null)
{
mp = new MemoryPage(pages[i]);
}
else if (mp.RegionSize + pages[i].RegionSize > maxPageSize)
{
newPages.Add(mp);
mp = null;
break;
}
else
{
mp.Add(pages[i]);
}
i++;
}
}
if (mp != null)
{
newPages.Add(mp);
}
return(newPages);
}
public void ScanMemoryNew(object memoryScanParameters)
{
ProcessMemoryReader pr = null;
try
{
MemoryScanParameters parameters = (MemoryScanParameters)memoryScanParameters;
Parameters = parameters;
byte[] valToFind = parameters.ValToFind;
int maxMemoryLocation = parameters.MaxLocation;
int minMemoryLocation = parameters.MinLocation;
uint startLocation = parameters.StartLocation;
bm = new BoyerMoore(valToFind);
pr = parameters.Reader;
List <MEMORY_BASIC_INFORMATION> pages = ProcessMemoryMapper.GetMemoryMap(pr.ReadProcess);
List <MemoryPage> memPages = ProcessMemoryMapper.CondensePages(pages, 4096 * 4);
int r = memPages.Count / 2;
for (int i = 0; i < memPages.Count; i++)
{
uint low = (uint)memPages[i].BaseAddress;
uint high = low + memPages[i].RegionSize;
if (startLocation >= low && startLocation < high)
{
r = i;
}
}
int l = r - 1;
int bytesRead = 0;
int lastPercentage = 0;
Decimal onePercentAmount = memPages.Count / 100.0M;
pr.OpenProcess();
while (r < memPages.Count || l >= 0)
{
if (Cancel)
{
this.ScanCanceled(this, new ScanCanceledEventArgs());
Cancel = false;
return;
}
if ((r - l) / (Decimal)memPages.Count > lastPercentage / 100M)
{
lastPercentage++;
this.ScanProgressChanged(this, new ScanProgressChangedEventArgs(lastPercentage));
}
if (r < memPages.Count)
{
MemoryPage mbi = memPages[r];
byte[] valToTest = pr.ReadProcessMemory(mbi.BaseAddress, mbi.RegionSize, out bytesRead);
if (bytesRead == 0)
{
r++;
continue;
}
int foundIndex = ArrayIndexOf(valToTest, valToFind);
if (foundIndex >= 0)
{
this.ScanCompleted(this, new ScanCompletedEventArgs(new [] { (uint)mbi.BaseAddress + (uint)foundIndex }));
return;
}
}
if (l >= 0)
{
MemoryPage mbi = memPages[l];
byte[] valToTest = pr.ReadProcessMemory(mbi.BaseAddress, mbi.RegionSize, out bytesRead);
if (bytesRead == 0)
{
l--;
continue;
}
int foundIndex = ArrayIndexOf(valToTest, valToFind);
if (foundIndex >= 0)
{
this.ScanCompleted(this, new ScanCompletedEventArgs(new[] { (uint)mbi.BaseAddress + (uint)foundIndex }));
return;
}
}
if (r < memPages.Count)
{
r++;
}
if (l >= 0)
{
l--;
}
}
this.ScanCompleted(this, new ScanCompletedEventArgs(null));
}
catch (Exception ex)
{
this.ScanCanceled(this, new ScanCanceledEventArgs()
{
Exception = ex
});
}
finally
{
pr.CloseHandle();
}
}
