RomCheater/Docking/FloatingRamDumperDialog.cs

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using WeifenLuo.WinFormsUI.Docking;
using RomCheater.PluginFramework.Interfaces;
using System.Diagnostics;
using System.IO;
using RomCheater.Logging;
using System.Reflection;

namespace RomCheater.Docking
{
    public partial class FloatingRamDumperDialog : DockContent, IProcessConfig
    {
        #region sub-classes
        private const int BYTE_CORRECTION_VALUE = 23;
        public enum DumpSize
        {
            Bytes,
            KiloBytes,
            MegaBytes,
            GigaBytes,
        }
        #endregion
        private DumpSize dumpSize = DumpSize.Bytes;

        public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
        public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
        public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
       
        private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
        {
            txtStart.Value = 0;
            txtEnd.Value = int.MaxValue;
        }


        #region IProcessConfig Members'
        public Process AcceptedProcess { get; set; }
        #endregion
        #region IAcceptsPlugin<IConfigPlugin> Members
        public IConfigPlugin AcceptedPlugin { get; set; }
        #endregion

        private void radioBTNBytes_CheckedChanged(object sender, EventArgs e)
        {
            dumpSize = DumpSize.Bytes;
        }

        private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e)
        {
            dumpSize = DumpSize.KiloBytes;
        }

        private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e)
        {
            dumpSize = DumpSize.MegaBytes;
        }

        private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e)
        {
            dumpSize = DumpSize.GigaBytes;
        }

        private void btnCalcEndAddr_Click(object sender, EventArgs e)
        {
            ulong start = 0;
            ulong end = 0;
            start = txtStart.Value;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.KiloBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.MegaBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.GigaBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
            }
        }

        private void btnCalcStartAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            end = txtEnd.ToInt64();
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start;;
                    break;
                case DumpSize.KiloBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start;;
                    break;
                case DumpSize.MegaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start;;
                    break;
                case DumpSize.GigaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start;
                    break;
            }
        }

        private void btnCalcDumpSize_Click(object sender, EventArgs e)
        {
            ulong start = txtStart.Value;
            ulong end = txtEnd.Value;
            ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
                    break;
                case DumpSize.KiloBytes:
                    txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
                    break;
                case DumpSize.MegaBytes:
                    txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
                    break;
                case DumpSize.GigaBytes:
                    txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
                    break;
            }
        }

        private void btnDumpRam_Click(object sender, EventArgs e)
        {
            if (this.AcceptedProcess == null)
            {
                MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            DialogResult result = dumpsaver.ShowDialog();
            if (result != DialogResult.OK) return;
            DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
        }


        #region memory support
        private void DumpRam(ulong start, ulong end, string filename)
        {
            uint byte_count = (uint)(end - start);
            string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
            if (arch == ProcessorAssemblyArchitecture.x86)
            {
                // intptr is 4 bytes on x86
                if (end > int.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.x64)
            {
                // inptr is 8 bytes on x64
                if (end > uint.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
            }
            else
            {
                throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch));
            }
            DumpRam(start, byte_count, filename);
        }
        private void DumpRam(ulong start, uint count, string filename)
        {
            if (this.AcceptedProcess == null) return;
            Sojaner.MemoryScanner.ProcessMemoryReader reader = new Sojaner.MemoryScanner.ProcessMemoryReader();
            reader.ReadProcess = this.AcceptedProcess;
            reader.OpenProcess();
            int bytesReadSize;
            if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize))
            {
                MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
            }
            else
            {
                MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
            reader.CloseHandle();            
        }
        #endregion
    }
}
Revision:	169
Committed:	Mon May 28 08:49:42 2012 UTC (11 years, 6 months ago) by william
File size:	8613 byte(s)
Log Message:	+ add success/failure messages for ram dump
#	Content
1	using System;
2	using System.Collections.Generic;
3	using System.ComponentModel;
4	using System.Data;
5	using System.Drawing;
6	using System.Linq;
7	using System.Text;
8	using System.Windows.Forms;
9	using WeifenLuo.WinFormsUI.Docking;
10	using RomCheater.PluginFramework.Interfaces;
11	using System.Diagnostics;
12	using System.IO;
13	using RomCheater.Logging;
14	using System.Reflection;
15
16	namespace RomCheater.Docking
17	{
18	public partial class FloatingRamDumperDialog : DockContent, IProcessConfig
19	{
20	#region sub-classes
21	private const int BYTE_CORRECTION_VALUE = 23;
22	public enum DumpSize
23	{
24	Bytes,
25	KiloBytes,
26	MegaBytes,
27	GigaBytes,
28	}
29	#endregion
30	private DumpSize dumpSize = DumpSize.Bytes;
31
32	public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
33	public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
34	public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
35
36	private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
37	{
38	txtStart.Value = 0;
39	txtEnd.Value = int.MaxValue;
40	}
41
42
43	#region IProcessConfig Members'
44	public Process AcceptedProcess { get; set; }
45	#endregion
46	#region IAcceptsPlugin<IConfigPlugin> Members
47	public IConfigPlugin AcceptedPlugin { get; set; }
48	#endregion
49
50	private void radioBTNBytes_CheckedChanged(object sender, EventArgs e)
51	{
52	dumpSize = DumpSize.Bytes;
53	}
54
55	private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e)
56	{
57	dumpSize = DumpSize.KiloBytes;
58	}
59
60	private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e)
61	{
62	dumpSize = DumpSize.MegaBytes;
63	}
64
65	private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e)
66	{
67	dumpSize = DumpSize.GigaBytes;
68	}
69
70	private void btnCalcEndAddr_Click(object sender, EventArgs e)
71	{
72	ulong start = 0;
73	ulong end = 0;
74	start = txtStart.Value;
75	switch (dumpSize)
76	{
77	case DumpSize.Bytes:
78	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
79	txtEnd.Value = end;
80	break;
81	case DumpSize.KiloBytes:
82	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
83	txtEnd.Value = end;
84	break;
85	case DumpSize.MegaBytes:
86	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
87	txtEnd.Value = end;
88	break;
89	case DumpSize.GigaBytes:
90	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
91	txtEnd.Value = end;
92	break;
93	}
94	}
95
96	private void btnCalcStartAddr_Click(object sender, EventArgs e)
97	{
98	long start = 0;
99	long end = 0;
100	end = txtEnd.ToInt64();
101	switch (dumpSize)
102	{
103	case DumpSize.Bytes:
104	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
105	txtStart.Value = (ulong)start;;
106	break;
107	case DumpSize.KiloBytes:
108	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
109	txtStart.Value = (ulong)start;;
110	break;
111	case DumpSize.MegaBytes:
112	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
113	txtStart.Value = (ulong)start;;
114	break;
115	case DumpSize.GigaBytes:
116	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
117	txtStart.Value = (ulong)start;
118	break;
119	}
120	}
121
122	private void btnCalcDumpSize_Click(object sender, EventArgs e)
123	{
124	ulong start = txtStart.Value;
125	ulong end = txtEnd.Value;
126	ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
127	switch (dumpSize)
128	{
129	case DumpSize.Bytes:
130	txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
131	break;
132	case DumpSize.KiloBytes:
133	txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
134	break;
135	case DumpSize.MegaBytes:
136	txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
137	break;
138	case DumpSize.GigaBytes:
139	txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
140	break;
141	}
142	}
143
144	private void btnDumpRam_Click(object sender, EventArgs e)
145	{
146	if (this.AcceptedProcess == null)
147	{
148	MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
149	return;
150	}
151	DialogResult result = dumpsaver.ShowDialog();
152	if (result != DialogResult.OK) return;
153	DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
154	}
155
156
157	#region memory support
158	private void DumpRam(ulong start, ulong end, string filename)
159	{
160	uint byte_count = (uint)(end - start);
161	string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
162	if (arch == ProcessorAssemblyArchitecture.x86)
163	{
164	// intptr is 4 bytes on x86
165	if (end > int.MaxValue)
166	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
167	}
168	else if (arch == ProcessorAssemblyArchitecture.x64)
169	{
170	// inptr is 8 bytes on x64
171	if (end > uint.MaxValue)
172	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
173	}
174	else
175	{
176	throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch));
177	}
178	DumpRam(start, byte_count, filename);
179	}
180	private void DumpRam(ulong start, uint count, string filename)
181	{
182	if (this.AcceptedProcess == null) return;
183	Sojaner.MemoryScanner.ProcessMemoryReader reader = new Sojaner.MemoryScanner.ProcessMemoryReader();
184	reader.ReadProcess = this.AcceptedProcess;
185	reader.OpenProcess();
186	int bytesReadSize;
187	if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize))
188	{
189	MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
190	}
191	else
192	{
193	MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
194	}
195	reader.CloseHandle();
196	}
197	#endregion
198	}
199	}