RomCheater/Docking/FloatingRamDumperDialog.cs

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using WeifenLuo.WinFormsUI.Docking;
using RomCheater.PluginFramework.Interfaces;
using System.Diagnostics;
using System.IO;
using RomCheater.Logging;
using System.Reflection;
using Sojaner.MemoryScanner.MemoryProviers;

namespace RomCheater.Docking
{
    public partial class FloatingRamDumperDialog : DockContent, 
        IAcceptsPlugin<IConfigPlugin>,
        IAcceptsProcess<Process>,
        IAcceptsProcessAndConfig
    {
        #region sub-classes
        private const int BYTE_CORRECTION_VALUE = 23;
        public enum DumpSize
        {
            Bytes,
            KiloBytes,
            MegaBytes,
            GigaBytes,
        }
        #endregion
        private DumpSize dumpSize = DumpSize.Bytes;

        public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
        public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
        public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
       
        private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
        {
            txtStart.Value = 0;
            txtEnd.Value = int.MaxValue;
        }


        #region  IAcceptsProcess<Process> Members
        public Process AcceptedProcess { get; set; }
        #endregion
        #region IAcceptsPlugin<IConfigPlugin> Members
        public IConfigPlugin AcceptedPlugin { get; set; }
        #endregion
        #region ram-dump specific
        private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
        private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
        private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
        private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
        private void btnCalcEndAddr_Click(object sender, EventArgs e)
        {
            ulong start = 0;
            ulong end = 0;
            start = txtStart.Value;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.KiloBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.MegaBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.GigaBytes:
                    end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
            }
        }
        private void btnCalcStartAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            end = txtEnd.ToInt64();
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start; ;
                    break;
                case DumpSize.KiloBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start; ;
                    break;
                case DumpSize.MegaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start; ;
                    break;
                case DumpSize.GigaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (ulong)start;
                    break;
            }
        }
        private void btnCalcDumpSize_Click(object sender, EventArgs e)
        {
            ulong start = txtStart.Value;
            ulong end = txtEnd.Value;
            ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
                    break;
                case DumpSize.KiloBytes:
                    txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
                    break;
                case DumpSize.MegaBytes:
                    txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
                    break;
                case DumpSize.GigaBytes:
                    txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
                    break;
            }
        }
        private void btnDumpRam_Click(object sender, EventArgs e)
        {
            if (this.AcceptedProcess == null)
            {
                MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            DialogResult result = dumpsaver.ShowDialog();
            if (result != DialogResult.OK) return;
            DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
        }
        #endregion

        #region memory support
        private void DumpRam(ulong start, ulong end, string filename)
        {
            uint byte_count = (uint)(end - start);
            string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
            if (arch == ProcessorAssemblyArchitecture.x86)
            {
                // intptr is 4 bytes on x86
                if (end > int.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.x64)
            {
                // inptr is 8 bytes on x64
                if (end > uint.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
            {
                if (IntPtr.Size == 4) //x86
                {
                    if (end > int.MaxValue)
                        logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
                }
                else if (IntPtr.Size == 8) //x64
                {
                }
                else // unknown
                {
                    if (end > uint.MaxValue)
                        logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
                }
            }
            else
            {
                throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
            }
            DumpRam(start, byte_count, filename);
        }
        private void DumpRam(ulong start, uint count, string filename)
        {
            if (this.AcceptedProcess == null) return;            
            GenericMemoryProvider provider = new GenericMemoryProvider((IAcceptsProcessAndConfig)this);
            provider.OpenProvider();
            int bytesReadSize;
            if (provider.WriteProcessMemoryToFile(filename, (uint)start, count, out bytesReadSize))
            {
                MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
            }
            else
            {
                MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
            provider.CloseProvider();
        }
        #endregion
    }
}
Revision:	246
Committed:	Sun Jun 3 15:15:51 2012 UTC (10 years, 8 months ago) by william
File size:	9446 byte(s)
Log Message:
#	Content
1	using System;
2	using System.Collections.Generic;
3	using System.ComponentModel;
4	using System.Data;
5	using System.Drawing;
6	using System.Linq;
7	using System.Text;
8	using System.Windows.Forms;
9	using WeifenLuo.WinFormsUI.Docking;
10	using RomCheater.PluginFramework.Interfaces;
11	using System.Diagnostics;
12	using System.IO;
13	using RomCheater.Logging;
14	using System.Reflection;
15	using Sojaner.MemoryScanner.MemoryProviers;
16
17	namespace RomCheater.Docking
18	{
19	public partial class FloatingRamDumperDialog : DockContent,
20	IAcceptsPlugin<IConfigPlugin>,
21	IAcceptsProcess<Process>,
22	IAcceptsProcessAndConfig
23	{
24	#region sub-classes
25	private const int BYTE_CORRECTION_VALUE = 23;
26	public enum DumpSize
27	{
28	Bytes,
29	KiloBytes,
30	MegaBytes,
31	GigaBytes,
32	}
33	#endregion
34	private DumpSize dumpSize = DumpSize.Bytes;
35
36	public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
37	public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
38	public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
39
40	private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
41	{
42	txtStart.Value = 0;
43	txtEnd.Value = int.MaxValue;
44	}
45
46
47	#region IAcceptsProcess<Process> Members
48	public Process AcceptedProcess { get; set; }
49	#endregion
50	#region IAcceptsPlugin<IConfigPlugin> Members
51	public IConfigPlugin AcceptedPlugin { get; set; }
52	#endregion
53	#region ram-dump specific
54	private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
55	private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
56	private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
57	private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
58	private void btnCalcEndAddr_Click(object sender, EventArgs e)
59	{
60	ulong start = 0;
61	ulong end = 0;
62	start = txtStart.Value;
63	switch (dumpSize)
64	{
65	case DumpSize.Bytes:
66	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
67	txtEnd.Value = end;
68	break;
69	case DumpSize.KiloBytes:
70	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
71	txtEnd.Value = end;
72	break;
73	case DumpSize.MegaBytes:
74	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
75	txtEnd.Value = end;
76	break;
77	case DumpSize.GigaBytes:
78	end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
79	txtEnd.Value = end;
80	break;
81	}
82	}
83	private void btnCalcStartAddr_Click(object sender, EventArgs e)
84	{
85	long start = 0;
86	long end = 0;
87	end = txtEnd.ToInt64();
88	switch (dumpSize)
89	{
90	case DumpSize.Bytes:
91	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
92	txtStart.Value = (ulong)start; ;
93	break;
94	case DumpSize.KiloBytes:
95	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
96	txtStart.Value = (ulong)start; ;
97	break;
98	case DumpSize.MegaBytes:
99	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
100	txtStart.Value = (ulong)start; ;
101	break;
102	case DumpSize.GigaBytes:
103	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
104	txtStart.Value = (ulong)start;
105	break;
106	}
107	}
108	private void btnCalcDumpSize_Click(object sender, EventArgs e)
109	{
110	ulong start = txtStart.Value;
111	ulong end = txtEnd.Value;
112	ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
113	switch (dumpSize)
114	{
115	case DumpSize.Bytes:
116	txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
117	break;
118	case DumpSize.KiloBytes:
119	txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
120	break;
121	case DumpSize.MegaBytes:
122	txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
123	break;
124	case DumpSize.GigaBytes:
125	txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
126	break;
127	}
128	}
129	private void btnDumpRam_Click(object sender, EventArgs e)
130	{
131	if (this.AcceptedProcess == null)
132	{
133	MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
134	return;
135	}
136	DialogResult result = dumpsaver.ShowDialog();
137	if (result != DialogResult.OK) return;
138	DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
139	}
140	#endregion
141
142	#region memory support
143	private void DumpRam(ulong start, ulong end, string filename)
144	{
145	uint byte_count = (uint)(end - start);
146	string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
147	if (arch == ProcessorAssemblyArchitecture.x86)
148	{
149	// intptr is 4 bytes on x86
150	if (end > int.MaxValue)
151	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
152	}
153	else if (arch == ProcessorAssemblyArchitecture.x64)
154	{
155	// inptr is 8 bytes on x64
156	if (end > uint.MaxValue)
157	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
158	}
159	else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
160	{
161	if (IntPtr.Size == 4) //x86
162	{
163	if (end > int.MaxValue)
164	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
165	}
166	else if (IntPtr.Size == 8) //x64
167	{
168	}
169	else // unknown
170	{
171	if (end > uint.MaxValue)
172	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
173	}
174	}
175	else
176	{
177	throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
178	}
179	DumpRam(start, byte_count, filename);
180	}
181	private void DumpRam(ulong start, uint count, string filename)
182	{
183	if (this.AcceptedProcess == null) return;
184	GenericMemoryProvider provider = new GenericMemoryProvider((IAcceptsProcessAndConfig)this);
185	provider.OpenProvider();
186	int bytesReadSize;
187	if (provider.WriteProcessMemoryToFile(filename, (uint)start, count, out bytesReadSize))
188	{
189	MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
190	}
191	else
192	{
193	MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
194	}
195	provider.CloseProvider();
196	}
197	#endregion
198	}
199	}