RomCheater/Docking/FloatingRamDumperDialog.cs

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using WeifenLuo.WinFormsUI.Docking;
using RomCheater.PluginFramework.Interfaces;
using System.Diagnostics;
using System.IO;
using RomCheater.Logging;
using System.Reflection;
using Sojaner.MemoryScanner.MemoryProviers;
using Sojaner.MemoryScanner;

namespace RomCheater.Docking
{
    public partial class FloatingRamDumperDialog : DockContent, 
        IAcceptsPlugin<IConfigPlugin>,
        IAcceptsProcess<Process>,
        IAcceptsProcessAndConfig
    {
        #region sub-classes
        private const int BYTE_CORRECTION_VALUE = 23;
        public enum DumpSize
        {
            Bytes,
            KiloBytes,
            MegaBytes,
            GigaBytes,
        }
        #endregion
        private DumpSize dumpSize = DumpSize.Bytes;

        public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
        public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
        public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
       
        private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
        {
            txtStart.Value = MemorySizeConstants.MinimumAddress;
            txtEnd.Value = MemorySizeConstants.MaximumAddress;
        }


        #region  IAcceptsProcess<Process> Members
        public Process AcceptedProcess { get; set; }
        #endregion
        #region IAcceptsPlugin<IConfigPlugin> Members
        public IConfigPlugin AcceptedPlugin { get; set; }
        #endregion
        #region ram-dump specific
        private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
        private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
        private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
        private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
        private void btnCalcEndAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            start = txtStart.Value;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.KiloBytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.MegaBytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
                case DumpSize.GigaBytes:
                    end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
                    txtEnd.Value = end;
                    break;
            }
        }
        private void btnCalcStartAddr_Click(object sender, EventArgs e)
        {
            long start = 0;
            long end = 0;
            end = txtEnd.ToInt64();
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
                case DumpSize.KiloBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
                case DumpSize.MegaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
                case DumpSize.GigaBytes:
                    start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
                    txtStart.Value = (long)start;
                    break;
            }
        }
        private void btnCalcDumpSize_Click(object sender, EventArgs e)
        {
            long start = txtStart.Value;
            long end = txtEnd.Value;
            long byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
            switch (dumpSize)
            {
                case DumpSize.Bytes:
                    txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
                    break;
                case DumpSize.KiloBytes:
                    txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
                    break;
                case DumpSize.MegaBytes:
                    txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
                    break;
                case DumpSize.GigaBytes:
                    txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
                    break;
            }
        }
        private void btnDumpRam_Click(object sender, EventArgs e)
        {
            if (this.AcceptedProcess == null)
            {
                MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            DialogResult result = dumpsaver.ShowDialog();
            if (result != DialogResult.OK) return;
            DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
        }
        #endregion

        #region memory support
        private void DumpRam(long start, long end, string filename)
        {
            uint byte_count = (uint)(end - start);
            string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
            if (arch == ProcessorAssemblyArchitecture.x86)
            {
                // intptr is 4 bytes on x86
                if (end > int.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.x64)
            {
                // inptr is 8 bytes on x64
                if (end > uint.MaxValue)
                    logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
            }
            else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
            {
                if (IntPtr.Size == 4) //x86
                {
                    if (end > int.MaxValue)
                        logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
                }
                else if (IntPtr.Size == 8) //x64
                {
                }
                else // unknown
                {
                    if (end > uint.MaxValue)
                        logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
                }
            }
            else
            {
                throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
            }
            DumpRam(start, byte_count, filename);
        }
        private void DumpRam(long start, uint count, string filename)
        {
            if (this.AcceptedProcess == null) return;    
            int bytesReadSize;
            Sojaner.MemoryScanner.MemoryProviers.GenericMemoryProvider provider = new Sojaner.MemoryScanner.MemoryProviers.GenericMemoryProvider((IAcceptsProcessAndConfig)this);
            provider.OpenProvider();
            if (provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize))
            {
                MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
            }
            else
            {
                MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
            provider.CloseProvider();

            //ProcessMemoryReader provider = new ProcessMemoryReader();
            //provider.ReadProcess = this.AcceptedProcess;
            //provider.OpenProcess();
            //provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize);
            //provider.CloseHandle();

        }
        #endregion
    }
}
1	using System;
2	using System.Collections.Generic;
3	using System.ComponentModel;
4	using System.Data;
5	using System.Drawing;
6	using System.Linq;
7	using System.Text;
8	using System.Windows.Forms;
9	using WeifenLuo.WinFormsUI.Docking;
10	using RomCheater.PluginFramework.Interfaces;
11	using System.Diagnostics;
12	using System.IO;
13	using RomCheater.Logging;
14	using System.Reflection;
15	using Sojaner.MemoryScanner.MemoryProviers;
16	using Sojaner.MemoryScanner;
17
18	namespace RomCheater.Docking
19	{
20	public partial class FloatingRamDumperDialog : DockContent,
21	IAcceptsPlugin<IConfigPlugin>,
22	IAcceptsProcess<Process>,
23	IAcceptsProcessAndConfig
24	{
25	#region sub-classes
26	private const int BYTE_CORRECTION_VALUE = 23;
27	public enum DumpSize
28	{
29	Bytes,
30	KiloBytes,
31	MegaBytes,
32	GigaBytes,
33	}
34	#endregion
35	private DumpSize dumpSize = DumpSize.Bytes;
36
37	public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
38	public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
39	public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
40
41	private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
42	{
43	txtStart.Value = MemorySizeConstants.MinimumAddress;
44	txtEnd.Value = MemorySizeConstants.MaximumAddress;
45	}
46
47
48	#region IAcceptsProcess<Process> Members
49	public Process AcceptedProcess { get; set; }
50	#endregion
51	#region IAcceptsPlugin<IConfigPlugin> Members
52	public IConfigPlugin AcceptedPlugin { get; set; }
53	#endregion
54	#region ram-dump specific
55	private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
56	private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
57	private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
58	private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
59	private void btnCalcEndAddr_Click(object sender, EventArgs e)
60	{
61	long start = 0;
62	long end = 0;
63	start = txtStart.Value;
64	switch (dumpSize)
65	{
66	case DumpSize.Bytes:
67	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
68	txtEnd.Value = end;
69	break;
70	case DumpSize.KiloBytes:
71	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
72	txtEnd.Value = end;
73	break;
74	case DumpSize.MegaBytes:
75	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
76	txtEnd.Value = end;
77	break;
78	case DumpSize.GigaBytes:
79	end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
80	txtEnd.Value = end;
81	break;
82	}
83	}
84	private void btnCalcStartAddr_Click(object sender, EventArgs e)
85	{
86	long start = 0;
87	long end = 0;
88	end = txtEnd.ToInt64();
89	switch (dumpSize)
90	{
91	case DumpSize.Bytes:
92	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
93	txtStart.Value = (long)start;
94	break;
95	case DumpSize.KiloBytes:
96	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
97	txtStart.Value = (long)start;
98	break;
99	case DumpSize.MegaBytes:
100	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
101	txtStart.Value = (long)start;
102	break;
103	case DumpSize.GigaBytes:
104	start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
105	txtStart.Value = (long)start;
106	break;
107	}
108	}
109	private void btnCalcDumpSize_Click(object sender, EventArgs e)
110	{
111	long start = txtStart.Value;
112	long end = txtEnd.Value;
113	long byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
114	switch (dumpSize)
115	{
116	case DumpSize.Bytes:
117	txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
118	break;
119	case DumpSize.KiloBytes:
120	txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
121	break;
122	case DumpSize.MegaBytes:
123	txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
124	break;
125	case DumpSize.GigaBytes:
126	txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
127	break;
128	}
129	}
130	private void btnDumpRam_Click(object sender, EventArgs e)
131	{
132	if (this.AcceptedProcess == null)
133	{
134	MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
135	return;
136	}
137	DialogResult result = dumpsaver.ShowDialog();
138	if (result != DialogResult.OK) return;
139	DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
140	}
141	#endregion
142
143	#region memory support
144	private void DumpRam(long start, long end, string filename)
145	{
146	uint byte_count = (uint)(end - start);
147	string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
148	if (arch == ProcessorAssemblyArchitecture.x86)
149	{
150	// intptr is 4 bytes on x86
151	if (end > int.MaxValue)
152	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
153	}
154	else if (arch == ProcessorAssemblyArchitecture.x64)
155	{
156	// inptr is 8 bytes on x64
157	if (end > uint.MaxValue)
158	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
159	}
160	else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
161	{
162	if (IntPtr.Size == 4) //x86
163	{
164	if (end > int.MaxValue)
165	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
166	}
167	else if (IntPtr.Size == 8) //x64
168	{
169	}
170	else // unknown
171	{
172	if (end > uint.MaxValue)
173	logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
174	}
175	}
176	else
177	{
178	throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
179	}
180	DumpRam(start, byte_count, filename);
181	}
182	private void DumpRam(long start, uint count, string filename)
183	{
184	if (this.AcceptedProcess == null) return;
185	int bytesReadSize;
186	Sojaner.MemoryScanner.MemoryProviers.GenericMemoryProvider provider = new Sojaner.MemoryScanner.MemoryProviers.GenericMemoryProvider((IAcceptsProcessAndConfig)this);
187	provider.OpenProvider();
188	if (provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize))
189	{
190	MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
191	}
192	else
193	{
194	MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
195	}
196	provider.CloseProvider();
197
198	//ProcessMemoryReader provider = new ProcessMemoryReader();
199	//provider.ReadProcess = this.AcceptedProcess;
200	//provider.OpenProcess();
201	//provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize);
202	//provider.CloseHandle();
203
204	}
205	#endregion
206	}
207	}