RomCheater/Docking/FloatingRamDumperDialog.cs

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using WeifenLuo.WinFormsUI.Docking;
using RomCheater.PluginFramework.Interfaces;
using System.Diagnostics;
using System.IO;
using RomCheater.Logging;
using System.Reflection;
using Sojaner.MemoryScanner.MemoryProviers;
using Sojaner.MemoryScanner;

namespace RomCheater.Docking
{
    public partial class FloatingRamDumperDialog : DockContent, 
        IAcceptsPlugin<IConfigPlugin>,
        IAcceptsProcess<Process>,
        IAcceptsProcessAndConfig
    {
        #region sub-classes
        private const int BYTE_CORRECTION_VALUE = 23;
        public enum DumpSize
        {
            Bytes,
            KiloBytes,
            MegaBytes,
            GigaBytes,
        }
        #endregion
        private DumpSize dumpSize = DumpSize.Bytes;

        public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
        public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
        public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
       
        private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
        {
            txtStart.Value = MemorySizeConstants.MinimumAddress;
            txtEnd.Value = MemorySizeConstants.MinimumAddress + MemorySizeConstants.MaximumAddressSize;
        }


        #region  IAcceptsProcess<Process> Members
        public Process AcceptedProcess { get; set; }
        #endregion
        #region IAcceptsPlugin<IConfigPlugin> Members
        public IConfigPlugin AcceptedPlugin { get; set; }
        #endregion
        #region ram-dump specific
        private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
        private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
        private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
        private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
        private void btnCalcEndAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            start = txtStart.Value;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.KiloBytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.MegaBytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.GigaBytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
            }
        }
        private void btnCalcStartAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            end = txtEnd.ToInt64();
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
                case DumpSize.KiloBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
                case DumpSize.MegaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
                case DumpSize.GigaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
            }
        }
        private void btnCalcDumpSize_Click(object sender, EventArgs e)
        {
            long start = txtStart.Value;
            long end = txtEnd.Value;
            long byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
                    break;
                case DumpSize.KiloBytes:
                    txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
                    break;
                case DumpSize.MegaBytes:
                    txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
                    break;
                case DumpSize.GigaBytes:
                    txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
                    break;
            }
        }
        private void btnDumpRam_Click(object sender, EventArgs e)
        {
            if (this.AcceptedProcess == null)
            {
                MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            DialogResult result = dumpsaver.ShowDialog();
            if (result != DialogResult.OK) return;
            DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
        }
        #endregion

        #region memory support
        private void DumpRam(long start, long end, string filename)
        {
            uint byte_count = (uint)(end - start);
            string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
            if (arch == ProcessorAssemblyArchitecture.x86)
            {
                // intptr is 4 bytes on x86
                if (end > int.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.x64)
            {
                // inptr is 8 bytes on x64
                if (end > uint.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
            {
                if (IntPtr.Size == 4) //x86
                {
                    if (end > int.MaxValue)
                        logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
                }
                else if (IntPtr.Size == 8) //x64
                {
                }
                else // unknown
                {
                    if (end > uint.MaxValue)
                        logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
                }
            }
            else
            {
                throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
            }
            DumpRam(start, byte_count, filename);
        }
        private void DumpRam(long start, uint count, string filename)
        {
            if (this.AcceptedProcess == null) return;    
            int bytesReadSize;
            using (GenericMemoryProvider provider = new GenericMemoryProvider((IAcceptsProcessAndConfig)this))
            {
                provider.OpenProvider();
                if (provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize))
                {
                    MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
                }
                else
                {
                    MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
                }
                provider.CloseProvider();
            }

            //ProcessMemoryReader provider = new ProcessMemoryReader();
            //provider.ReadProcess = this.AcceptedProcess;
            //provider.OpenProcess();
            //provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize);
            //provider.CloseHandle();

        }
        #endregion
    }
}
1	william	148	using System;
2			using System.Collections.Generic;
3			using System.ComponentModel;
4			using System.Data;
5			using System.Drawing;
6			using System.Linq;
7			using System.Text;
8			using System.Windows.Forms;
9			using WeifenLuo.WinFormsUI.Docking;
10	william	153	using RomCheater.PluginFramework.Interfaces;
11			using System.Diagnostics;
12	william	157	using System.IO;
13	william	164	using RomCheater.Logging;
14			using System.Reflection;
15	william	238	using Sojaner.MemoryScanner.MemoryProviers;
16	william	252	using Sojaner.MemoryScanner;
17	william	148
18			namespace RomCheater.Docking
19			{
20	william	243	public partial class FloatingRamDumperDialog : DockContent,
21			IAcceptsPlugin<IConfigPlugin>,
22			IAcceptsProcess<Process>,
23			IAcceptsProcessAndConfig
24	william	148	{
25	william	154	#region sub-classes
26			private const int BYTE_CORRECTION_VALUE = 23;
27			public enum DumpSize
28			{
29			Bytes,
30			KiloBytes,
31			MegaBytes,
32			GigaBytes,
33			}
34			#endregion
35			private DumpSize dumpSize = DumpSize.Bytes;
36
37	william	153	public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
38			public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
39			public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
40	william	154
41	william	148	private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
42			{
43	william	282	txtStart.Value = MemorySizeConstants.MinimumAddress;
44	william	382	txtEnd.Value = MemorySizeConstants.MinimumAddress + MemorySizeConstants.MaximumAddressSize;
45	william	148	}
46	william	153
47
48	william	238	#region IAcceptsProcess<Process> Members
49	william	153	public Process AcceptedProcess { get; set; }
50			#endregion
51			#region IAcceptsPlugin<IConfigPlugin> Members
52			public IConfigPlugin AcceptedPlugin { get; set; }
53			#endregion
54	william	196	#region ram-dump specific
55			private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
56			private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
57			private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
58			private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
59	william	154	private void btnCalcEndAddr_Click(object sender, EventArgs e)
60			{
61	william	249	long start = 0;
62			long end = 0;
63	william	154	start = txtStart.Value;
64			switch (dumpSize)
65			{
66			case DumpSize.Bytes:
67	william	249	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
68	william	154	txtEnd.Value = end;
69			break;
70			case DumpSize.KiloBytes:
71	william	249	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
72	william	154	txtEnd.Value = end;
73			break;
74			case DumpSize.MegaBytes:
75	william	249	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
76	william	154	txtEnd.Value = end;
77			break;
78			case DumpSize.GigaBytes:
79	william	249	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
80	william	154	txtEnd.Value = end;
81			break;
82			}
83			}
84			private void btnCalcStartAddr_Click(object sender, EventArgs e)
85			{
86			long start = 0;
87			long end = 0;
88			end = txtEnd.ToInt64();
89			switch (dumpSize)
90			{
91			case DumpSize.Bytes:
92			start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
93	william	249	txtStart.Value = (long)start;
94	william	154	break;
95			case DumpSize.KiloBytes:
96			start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
97	william	249	txtStart.Value = (long)start;
98	william	154	break;
99			case DumpSize.MegaBytes:
100			start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
101	william	249	txtStart.Value = (long)start;
102	william	154	break;
103			case DumpSize.GigaBytes:
104			start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
105	william	249	txtStart.Value = (long)start;
106	william	154	break;
107			}
108			}
109			private void btnCalcDumpSize_Click(object sender, EventArgs e)
110			{
111	william	249	long start = txtStart.Value;
112			long end = txtEnd.Value;
113			long byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
114	william	154	switch (dumpSize)
115			{
116			case DumpSize.Bytes:
117			txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
118			break;
119			case DumpSize.KiloBytes:
120			txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
121			break;
122			case DumpSize.MegaBytes:
123			txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
124			break;
125			case DumpSize.GigaBytes:
126			txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
127			break;
128			}
129			}
130	william	156	private void btnDumpRam_Click(object sender, EventArgs e)
131			{
132			if (this.AcceptedProcess == null)
133			{
134			MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
135			return;
136			}
137			DialogResult result = dumpsaver.ShowDialog();
138			if (result != DialogResult.OK) return;
139			DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
140			}
141	william	196	#endregion
142	william	156
143			#region memory support
144	william	249	private void DumpRam(long start, long end, string filename)
145	william	156	{
146			uint byte_count = (uint)(end - start);
147	william	168	string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
148			if (arch == ProcessorAssemblyArchitecture.x86)
149			{
150			// intptr is 4 bytes on x86
151	william	164	if (end > int.MaxValue)
152	william	168	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
153			}
154			else if (arch == ProcessorAssemblyArchitecture.x64)
155			{
156			// inptr is 8 bytes on x64
157			if (end > uint.MaxValue)
158			logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
159			}
160	william	246	else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
161			{
162			if (IntPtr.Size == 4) //x86
163			{
164			if (end > int.MaxValue)
165			logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
166			}
167			else if (IntPtr.Size == 8) //x64
168			{
169			}
170			else // unknown
171			{
172			if (end > uint.MaxValue)
173			logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
174			}
175			}
176	william	168	else
177			{
178	william	246	throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
179	william	168	}
180	william	156	DumpRam(start, byte_count, filename);
181			}
182	william	249	private void DumpRam(long start, uint count, string filename)
183	william	156	{
184	william	252	if (this.AcceptedProcess == null) return;
185			int bytesReadSize;
186	william	398	using (GenericMemoryProvider provider = new GenericMemoryProvider((IAcceptsProcessAndConfig)this))
187	william	169	{
188	william	398	provider.OpenProvider();
189			if (provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize))
190			{
191			MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
192			}
193			else
194			{
195			MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
196			}
197			provider.CloseProvider();
198	william	169	}
199	william	252
200			//ProcessMemoryReader provider = new ProcessMemoryReader();
201			//provider.ReadProcess = this.AcceptedProcess;
202			//provider.OpenProcess();
203			//provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize);
204			//provider.CloseHandle();
205
206	william	156	}
207			#endregion
208	william	148	}
209			}