10 |
using RomCheater.PluginFramework.Interfaces; |
using RomCheater.PluginFramework.Interfaces; |
11 |
using System.Diagnostics; |
using System.Diagnostics; |
12 |
using System.IO; |
using System.IO; |
13 |
|
using RomCheater.Logging; |
14 |
|
using System.Reflection; |
15 |
|
|
16 |
namespace RomCheater.Docking |
namespace RomCheater.Docking |
17 |
{ |
{ |
75 |
switch (dumpSize) |
switch (dumpSize) |
76 |
{ |
{ |
77 |
case DumpSize.Bytes: |
case DumpSize.Bytes: |
78 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE; |
79 |
txtEnd.Value = end; |
txtEnd.Value = end; |
80 |
break; |
break; |
81 |
case DumpSize.KiloBytes: |
case DumpSize.KiloBytes: |
82 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE; |
83 |
txtEnd.Value = end; |
txtEnd.Value = end; |
84 |
break; |
break; |
85 |
case DumpSize.MegaBytes: |
case DumpSize.MegaBytes: |
86 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE; |
87 |
txtEnd.Value = end; |
txtEnd.Value = end; |
88 |
break; |
break; |
89 |
case DumpSize.GigaBytes: |
case DumpSize.GigaBytes: |
90 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE; |
91 |
txtEnd.Value = end; |
txtEnd.Value = end; |
92 |
break; |
break; |
93 |
} |
} |
158 |
private void DumpRam(ulong start, ulong end, string filename) |
private void DumpRam(ulong start, ulong end, string filename) |
159 |
{ |
{ |
160 |
uint byte_count = (uint)(end - start); |
uint byte_count = (uint)(end - start); |
161 |
|
string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly); |
162 |
|
if (arch == ProcessorAssemblyArchitecture.x86) |
163 |
|
{ |
164 |
|
// intptr is 4 bytes on x86 |
165 |
|
if (end > int.MaxValue) |
166 |
|
logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue); |
167 |
|
} |
168 |
|
else if (arch == ProcessorAssemblyArchitecture.x64) |
169 |
|
{ |
170 |
|
// inptr is 8 bytes on x64 |
171 |
|
if (end > uint.MaxValue) |
172 |
|
logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue); |
173 |
|
} |
174 |
|
else |
175 |
|
{ |
176 |
|
throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch)); |
177 |
|
} |
178 |
DumpRam(start, byte_count, filename); |
DumpRam(start, byte_count, filename); |
179 |
} |
} |
180 |
private void DumpRam(ulong start, uint count, string filename) |
private void DumpRam(ulong start, uint count, string filename) |
184 |
reader.ReadProcess = this.AcceptedProcess; |
reader.ReadProcess = this.AcceptedProcess; |
185 |
reader.OpenProcess(); |
reader.OpenProcess(); |
186 |
int bytesReadSize; |
int bytesReadSize; |
187 |
byte[] data = reader.ReadProcessMemory((IntPtr)(uint)start, count, out bytesReadSize); |
if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize)) |
188 |
reader.CloseHandle(); |
{ |
189 |
using (FileStream fs = new FileStream(filename, FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.ReadWrite)) |
MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information); |
190 |
{ |
} |
191 |
BinaryWriter bw = new BinaryWriter(fs); |
else |
192 |
foreach (byte b in data) { bw.Write(b); } |
{ |
193 |
bw.Flush(); |
MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error); |
|
bw.Close(); |
|
194 |
} |
} |
195 |
|
reader.CloseHandle(); |
196 |
} |
} |
197 |
#endregion |
#endregion |
198 |
} |
} |