137 |
break; |
break; |
138 |
} |
} |
139 |
} |
} |
140 |
|
|
141 |
|
private void btnDumpRam_Click(object sender, EventArgs e) |
142 |
|
{ |
143 |
|
if (this.AcceptedProcess == null) |
144 |
|
{ |
145 |
|
MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error); |
146 |
|
return; |
147 |
|
} |
148 |
|
DialogResult result = dumpsaver.ShowDialog(); |
149 |
|
if (result != DialogResult.OK) return; |
150 |
|
DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName); |
151 |
|
} |
152 |
|
|
153 |
|
|
154 |
|
#region memory support |
155 |
|
private void DumpRam(ulong start, ulong end, string filename) |
156 |
|
{ |
157 |
|
uint byte_count = (uint)(end - start); |
158 |
|
DumpRam(start, byte_count, filename); |
159 |
|
} |
160 |
|
private void DumpRam(ulong start, uint count, string filename) |
161 |
|
{ |
162 |
|
if (this.AcceptedProcess == null) return; |
163 |
|
Sojaner.MemoryScanner.ProcessMemoryReader reader = new Sojaner.MemoryScanner.ProcessMemoryReader(); |
164 |
|
reader.ReadProcess = this.AcceptedProcess; |
165 |
|
reader.OpenProcess(); |
166 |
|
int bytesReadSize; |
167 |
|
byte[] data = reader.ReadProcessMemory((IntPtr)(uint)start, count, out bytesReadSize); |
168 |
|
reader.CloseHandle(); |
169 |
|
} |
170 |
|
#endregion |
171 |
} |
} |
172 |
} |
} |