10 |
using RomCheater.PluginFramework.Interfaces; |
using RomCheater.PluginFramework.Interfaces; |
11 |
using System.Diagnostics; |
using System.Diagnostics; |
12 |
using System.IO; |
using System.IO; |
13 |
|
using RomCheater.Logging; |
14 |
|
using System.Reflection; |
15 |
|
|
16 |
namespace RomCheater.Docking |
namespace RomCheater.Docking |
17 |
{ |
{ |
18 |
public partial class FloatingRamDumperDialog : DockContent, IProcessConfig |
public partial class FloatingRamDumperDialog : DockContent, IProcessConfig, IAcceptsPlugin<IConfigPlugin> |
19 |
{ |
{ |
20 |
#region sub-classes |
#region sub-classes |
21 |
private const int BYTE_CORRECTION_VALUE = 23; |
private const int BYTE_CORRECTION_VALUE = 23; |
40 |
} |
} |
41 |
|
|
42 |
|
|
43 |
#region IProcessConfig Members' |
#region IProcessConfig Members |
44 |
public Process AcceptedProcess { get; set; } |
public Process AcceptedProcess { get; set; } |
45 |
#endregion |
#endregion |
46 |
#region IAcceptsPlugin<IConfigPlugin> Members |
#region IAcceptsPlugin<IConfigPlugin> Members |
47 |
public IConfigPlugin AcceptedPlugin { get; set; } |
public IConfigPlugin AcceptedPlugin { get; set; } |
48 |
#endregion |
#endregion |
49 |
|
#region ram-dump specific |
50 |
private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) |
private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; } |
51 |
{ |
private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; } |
52 |
dumpSize = DumpSize.Bytes; |
private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; } |
53 |
} |
private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; } |
|
|
|
|
private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) |
|
|
{ |
|
|
dumpSize = DumpSize.KiloBytes; |
|
|
} |
|
|
|
|
|
private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) |
|
|
{ |
|
|
dumpSize = DumpSize.MegaBytes; |
|
|
} |
|
|
|
|
|
private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) |
|
|
{ |
|
|
dumpSize = DumpSize.GigaBytes; |
|
|
} |
|
|
|
|
54 |
private void btnCalcEndAddr_Click(object sender, EventArgs e) |
private void btnCalcEndAddr_Click(object sender, EventArgs e) |
55 |
{ |
{ |
56 |
ulong start = 0; |
ulong start = 0; |
59 |
switch (dumpSize) |
switch (dumpSize) |
60 |
{ |
{ |
61 |
case DumpSize.Bytes: |
case DumpSize.Bytes: |
62 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE; |
63 |
txtEnd.Value = end; |
txtEnd.Value = end; |
64 |
break; |
break; |
65 |
case DumpSize.KiloBytes: |
case DumpSize.KiloBytes: |
66 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE; |
67 |
txtEnd.Value = end; |
txtEnd.Value = end; |
68 |
break; |
break; |
69 |
case DumpSize.MegaBytes: |
case DumpSize.MegaBytes: |
70 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE; |
71 |
txtEnd.Value = end; |
txtEnd.Value = end; |
72 |
break; |
break; |
73 |
case DumpSize.GigaBytes: |
case DumpSize.GigaBytes: |
74 |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + start) - BYTE_CORRECTION_VALUE; |
end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE; |
75 |
txtEnd.Value = end; |
txtEnd.Value = end; |
76 |
break; |
break; |
77 |
} |
} |
78 |
} |
} |
|
|
|
79 |
private void btnCalcStartAddr_Click(object sender, EventArgs e) |
private void btnCalcStartAddr_Click(object sender, EventArgs e) |
80 |
{ |
{ |
81 |
long start = 0; |
long start = 0; |
85 |
{ |
{ |
86 |
case DumpSize.Bytes: |
case DumpSize.Bytes: |
87 |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE; |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE; |
88 |
txtStart.Value = (ulong)start;; |
txtStart.Value = (ulong)start; ; |
89 |
break; |
break; |
90 |
case DumpSize.KiloBytes: |
case DumpSize.KiloBytes: |
91 |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE; |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE; |
92 |
txtStart.Value = (ulong)start;; |
txtStart.Value = (ulong)start; ; |
93 |
break; |
break; |
94 |
case DumpSize.MegaBytes: |
case DumpSize.MegaBytes: |
95 |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE; |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE; |
96 |
txtStart.Value = (ulong)start;; |
txtStart.Value = (ulong)start; ; |
97 |
break; |
break; |
98 |
case DumpSize.GigaBytes: |
case DumpSize.GigaBytes: |
99 |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE; |
start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE; |
101 |
break; |
break; |
102 |
} |
} |
103 |
} |
} |
|
|
|
104 |
private void btnCalcDumpSize_Click(object sender, EventArgs e) |
private void btnCalcDumpSize_Click(object sender, EventArgs e) |
105 |
{ |
{ |
106 |
ulong start = txtStart.Value; |
ulong start = txtStart.Value; |
122 |
break; |
break; |
123 |
} |
} |
124 |
} |
} |
|
|
|
125 |
private void btnDumpRam_Click(object sender, EventArgs e) |
private void btnDumpRam_Click(object sender, EventArgs e) |
126 |
{ |
{ |
127 |
if (this.AcceptedProcess == null) |
if (this.AcceptedProcess == null) |
133 |
if (result != DialogResult.OK) return; |
if (result != DialogResult.OK) return; |
134 |
DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName); |
DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName); |
135 |
} |
} |
136 |
|
#endregion |
137 |
|
|
138 |
#region memory support |
#region memory support |
139 |
private void DumpRam(ulong start, ulong end, string filename) |
private void DumpRam(ulong start, ulong end, string filename) |
140 |
{ |
{ |
141 |
uint byte_count = (uint)(end - start); |
uint byte_count = (uint)(end - start); |
142 |
|
string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly); |
143 |
|
if (arch == ProcessorAssemblyArchitecture.x86) |
144 |
|
{ |
145 |
|
// intptr is 4 bytes on x86 |
146 |
|
if (end > int.MaxValue) |
147 |
|
logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue); |
148 |
|
} |
149 |
|
else if (arch == ProcessorAssemblyArchitecture.x64) |
150 |
|
{ |
151 |
|
// inptr is 8 bytes on x64 |
152 |
|
if (end > uint.MaxValue) |
153 |
|
logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue); |
154 |
|
} |
155 |
|
else |
156 |
|
{ |
157 |
|
throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch)); |
158 |
|
} |
159 |
DumpRam(start, byte_count, filename); |
DumpRam(start, byte_count, filename); |
160 |
} |
} |
161 |
private void DumpRam(ulong start, uint count, string filename) |
private void DumpRam(ulong start, uint count, string filename) |
165 |
reader.ReadProcess = this.AcceptedProcess; |
reader.ReadProcess = this.AcceptedProcess; |
166 |
reader.OpenProcess(); |
reader.OpenProcess(); |
167 |
int bytesReadSize; |
int bytesReadSize; |
168 |
byte[] data = reader.ReadProcessMemory((IntPtr)(uint)start, count, out bytesReadSize); |
if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize)) |
169 |
reader.CloseHandle(); |
{ |
170 |
using (FileStream fs = new FileStream(filename, FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.ReadWrite)) |
MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information); |
171 |
{ |
} |
172 |
BinaryWriter bw = new BinaryWriter(fs); |
else |
173 |
foreach (byte b in data) { bw.Write(b); } |
{ |
174 |
bw.Flush(); |
MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error); |
|
bw.Close(); |
|
175 |
} |
} |
176 |
|
reader.CloseHandle(); |
177 |
} |
} |
178 |
#endregion |
#endregion |
179 |
} |
} |