RomCheater/Docking/FloatingRamDumperDialog.cs

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using WeifenLuo.WinFormsUI.Docking;
using RomCheater.PluginFramework.Interfaces;
using System.Diagnostics;
using System.IO;
using RomCheater.Logging;
using System.Reflection;

namespace RomCheater.Docking
{
    public partial class FloatingRamDumperDialog : DockContent, IProcessConfig, IAcceptsPlugin<IConfigPlugin>
    {
        #region sub-classes
        private const int BYTE_CORRECTION_VALUE = 23;
        public enum DumpSize
        {
            Bytes,
            KiloBytes,
            MegaBytes,
            GigaBytes,
        }
        #endregion
        private DumpSize dumpSize = DumpSize.Bytes;

        public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
        public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
        public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
       
        private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
        {
            txtStart.Value = 0;
            txtEnd.Value = int.MaxValue;
        }


        #region IProcessConfig Members
        public Process AcceptedProcess { get; set; }
        #endregion
        #region IAcceptsPlugin<IConfigPlugin> Members
        public IConfigPlugin AcceptedPlugin { get; set; }
        #endregion
        #region ram-dump specific
        private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
        private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
        private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
        private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
        private void btnCalcEndAddr_Click(object sender, EventArgs e)
        {
            ulong start = 0;
            ulong end = 0;
            start = txtStart.Value;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.KiloBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.MegaBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.GigaBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
            }
        }
        private void btnCalcStartAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            end = txtEnd.ToInt64();
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start; ;
                    break;
                case DumpSize.KiloBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start; ;
                    break;
                case DumpSize.MegaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start; ;
                    break;
                case DumpSize.GigaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start;
                    break;
            }
        }
        private void btnCalcDumpSize_Click(object sender, EventArgs e)
        {
            ulong start = txtStart.Value;
            ulong end = txtEnd.Value;
            ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
                    break;
                case DumpSize.KiloBytes:
                    txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
                    break;
                case DumpSize.MegaBytes:
                    txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
                    break;
                case DumpSize.GigaBytes:
                    txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
                    break;
            }
        }
        private void btnDumpRam_Click(object sender, EventArgs e)
        {
            if (this.AcceptedProcess == null)
            {
                MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            DialogResult result = dumpsaver.ShowDialog();
            if (result != DialogResult.OK) return;
            DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
        }
        #endregion

        #region memory support
        private void DumpRam(ulong start, ulong end, string filename)
        {
            uint byte_count = (uint)(end - start);
            string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
            if (arch == ProcessorAssemblyArchitecture.x86)
            {
                // intptr is 4 bytes on x86
                if (end > int.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.x64)
            {
                // inptr is 8 bytes on x64
                if (end > uint.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
            }
            else
            {
                throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch));
            }
            DumpRam(start, byte_count, filename);
        }
        private void DumpRam(ulong start, uint count, string filename)
        {
            if (this.AcceptedProcess == null) return;
            Sojaner.MemoryScanner.ProcessMemoryReader reader = new Sojaner.MemoryScanner.ProcessMemoryReader();
            reader.ReadProcess = this.AcceptedProcess;
            reader.OpenProcess();
            int bytesReadSize;
            if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize))
            {
                MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
            }
            else
            {
                MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
            reader.CloseHandle();            
        }
        #endregion
    }
}
Revision:	196
Committed:	Thu May 31 05:52:41 2012 UTC (11 years, 6 months ago) by william
File size:	8559 byte(s)
Log Message:	+ add some event code + add memeory view dialog (wip)
#	Content
1	using System;
2	using System.Collections.Generic;
3	using System.ComponentModel;
4	using System.Data;
5	using System.Drawing;
6	using System.Linq;
7	using System.Text;
8	using System.Windows.Forms;
9	using WeifenLuo.WinFormsUI.Docking;
10	using RomCheater.PluginFramework.Interfaces;
11	using System.Diagnostics;
12	using System.IO;
13	using RomCheater.Logging;
14	using System.Reflection;
15
16	namespace RomCheater.Docking
17	{
18	public partial class FloatingRamDumperDialog : DockContent, IProcessConfig, IAcceptsPlugin<IConfigPlugin>
19	{
20	#region sub-classes
21	private const int BYTE_CORRECTION_VALUE = 23;
22	public enum DumpSize
23	{
24	Bytes,
25	KiloBytes,
26	MegaBytes,
27	GigaBytes,
28	}
29	#endregion
30	private DumpSize dumpSize = DumpSize.Bytes;
31
32	public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
33	public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
34	public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
35
36	private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
37	{
38	txtStart.Value = 0;
39	txtEnd.Value = int.MaxValue;
40	}
41
42
43	#region IProcessConfig Members
44	public Process AcceptedProcess { get; set; }
45	#endregion
46	#region IAcceptsPlugin<IConfigPlugin> Members
47	public IConfigPlugin AcceptedPlugin { get; set; }
48	#endregion
49	#region ram-dump specific
50	private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
51	private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
52	private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
53	private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
54	private void btnCalcEndAddr_Click(object sender, EventArgs e)
55	{
56	ulong start = 0;
57	ulong end = 0;
58	start = txtStart.Value;
59	switch (dumpSize)
60	{
61	case DumpSize.Bytes:
62	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
63	txtEnd.Value = end;
64	break;
65	case DumpSize.KiloBytes:
66	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
67	txtEnd.Value = end;
68	break;
69	case DumpSize.MegaBytes:
70	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
71	txtEnd.Value = end;
72	break;
73	case DumpSize.GigaBytes:
74	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
75	txtEnd.Value = end;
76	break;
77	}
78	}
79	private void btnCalcStartAddr_Click(object sender, EventArgs e)
80	{
81	long start = 0;
82	long end = 0;
83	end = txtEnd.ToInt64();
84	switch (dumpSize)
85	{
86	case DumpSize.Bytes:
87	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
88	txtStart.Value = (ulong)start; ;
89	break;
90	case DumpSize.KiloBytes:
91	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
92	txtStart.Value = (ulong)start; ;
93	break;
94	case DumpSize.MegaBytes:
95	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
96	txtStart.Value = (ulong)start; ;
97	break;
98	case DumpSize.GigaBytes:
99	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
100	txtStart.Value = (ulong)start;
101	break;
102	}
103	}
104	private void btnCalcDumpSize_Click(object sender, EventArgs e)
105	{
106	ulong start = txtStart.Value;
107	ulong end = txtEnd.Value;
108	ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
109	switch (dumpSize)
110	{
111	case DumpSize.Bytes:
112	txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
113	break;
114	case DumpSize.KiloBytes:
115	txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
116	break;
117	case DumpSize.MegaBytes:
118	txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
119	break;
120	case DumpSize.GigaBytes:
121	txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
122	break;
123	}
124	}
125	private void btnDumpRam_Click(object sender, EventArgs e)
126	{
127	if (this.AcceptedProcess == null)
128	{
129	MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
130	return;
131	}
132	DialogResult result = dumpsaver.ShowDialog();
133	if (result != DialogResult.OK) return;
134	DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
135	}
136	#endregion
137
138	#region memory support
139	private void DumpRam(ulong start, ulong end, string filename)
140	{
141	uint byte_count = (uint)(end - start);
142	string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
143	if (arch == ProcessorAssemblyArchitecture.x86)
144	{
145	// intptr is 4 bytes on x86
146	if (end > int.MaxValue)
147	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
148	}
149	else if (arch == ProcessorAssemblyArchitecture.x64)
150	{
151	// inptr is 8 bytes on x64
152	if (end > uint.MaxValue)
153	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
154	}
155	else
156	{
157	throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch));
158	}
159	DumpRam(start, byte_count, filename);
160	}
161	private void DumpRam(ulong start, uint count, string filename)
162	{
163	if (this.AcceptedProcess == null) return;
164	Sojaner.MemoryScanner.ProcessMemoryReader reader = new Sojaner.MemoryScanner.ProcessMemoryReader();
165	reader.ReadProcess = this.AcceptedProcess;
166	reader.OpenProcess();
167	int bytesReadSize;
168	if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize))
169	{
170	MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
171	}
172	else
173	{
174	MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
175	}
176	reader.CloseHandle();
177	}
178	#endregion
179	}
180	}