/[RomCheater]/trunk/RomCheater/Docking/FloatingRamDumperDialog.cs
ViewVC logotype

Contents of /trunk/RomCheater/Docking/FloatingRamDumperDialog.cs

Parent Directory Parent Directory | Revision Log Revision Log


Revision 196 - (show annotations) (download)
Thu May 31 05:52:41 2012 UTC (8 years, 3 months ago) by william
File size: 8559 byte(s)
+ add some event code
+ add memeory view  dialog (wip)

1 using System;
2 using System.Collections.Generic;
3 using System.ComponentModel;
4 using System.Data;
5 using System.Drawing;
6 using System.Linq;
7 using System.Text;
8 using System.Windows.Forms;
9 using WeifenLuo.WinFormsUI.Docking;
10 using RomCheater.PluginFramework.Interfaces;
11 using System.Diagnostics;
12 using System.IO;
13 using RomCheater.Logging;
14 using System.Reflection;
15
16 namespace RomCheater.Docking
17 {
18 public partial class FloatingRamDumperDialog : DockContent, IProcessConfig, IAcceptsPlugin<IConfigPlugin>
19 {
20 #region sub-classes
21 private const int BYTE_CORRECTION_VALUE = 23;
22 public enum DumpSize
23 {
24 Bytes,
25 KiloBytes,
26 MegaBytes,
27 GigaBytes,
28 }
29 #endregion
30 private DumpSize dumpSize = DumpSize.Bytes;
31
32 public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.AcceptedProcess = null; }
33 public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
34 public FloatingRamDumperDialog(IConfigPlugin config, Process process) : this() { this.AcceptedPlugin = config; this.AcceptedProcess = process; }
35
36 private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
37 {
38 txtStart.Value = 0;
39 txtEnd.Value = int.MaxValue;
40 }
41
42
43 #region IProcessConfig Members
44 public Process AcceptedProcess { get; set; }
45 #endregion
46 #region IAcceptsPlugin<IConfigPlugin> Members
47 public IConfigPlugin AcceptedPlugin { get; set; }
48 #endregion
49 #region ram-dump specific
50 private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
51 private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
52 private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
53 private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
54 private void btnCalcEndAddr_Click(object sender, EventArgs e)
55 {
56 ulong start = 0;
57 ulong end = 0;
58 start = txtStart.Value;
59 switch (dumpSize)
60 {
61 case DumpSize.Bytes:
62 end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
63 txtEnd.Value = end;
64 break;
65 case DumpSize.KiloBytes:
66 end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
67 txtEnd.Value = end;
68 break;
69 case DumpSize.MegaBytes:
70 end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
71 txtEnd.Value = end;
72 break;
73 case DumpSize.GigaBytes:
74 end = (ulong)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
75 txtEnd.Value = end;
76 break;
77 }
78 }
79 private void btnCalcStartAddr_Click(object sender, EventArgs e)
80 {
81 long start = 0;
82 long end = 0;
83 end = txtEnd.ToInt64();
84 switch (dumpSize)
85 {
86 case DumpSize.Bytes:
87 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
88 txtStart.Value = (ulong)start; ;
89 break;
90 case DumpSize.KiloBytes:
91 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
92 txtStart.Value = (ulong)start; ;
93 break;
94 case DumpSize.MegaBytes:
95 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
96 txtStart.Value = (ulong)start; ;
97 break;
98 case DumpSize.GigaBytes:
99 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
100 txtStart.Value = (ulong)start;
101 break;
102 }
103 }
104 private void btnCalcDumpSize_Click(object sender, EventArgs e)
105 {
106 ulong start = txtStart.Value;
107 ulong end = txtEnd.Value;
108 ulong byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
109 switch (dumpSize)
110 {
111 case DumpSize.Bytes:
112 txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
113 break;
114 case DumpSize.KiloBytes:
115 txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
116 break;
117 case DumpSize.MegaBytes:
118 txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
119 break;
120 case DumpSize.GigaBytes:
121 txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
122 break;
123 }
124 }
125 private void btnDumpRam_Click(object sender, EventArgs e)
126 {
127 if (this.AcceptedProcess == null)
128 {
129 MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
130 return;
131 }
132 DialogResult result = dumpsaver.ShowDialog();
133 if (result != DialogResult.OK) return;
134 DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
135 }
136 #endregion
137
138 #region memory support
139 private void DumpRam(ulong start, ulong end, string filename)
140 {
141 uint byte_count = (uint)(end - start);
142 string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
143 if (arch == ProcessorAssemblyArchitecture.x86)
144 {
145 // intptr is 4 bytes on x86
146 if (end > int.MaxValue)
147 logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
148 }
149 else if (arch == ProcessorAssemblyArchitecture.x64)
150 {
151 // inptr is 8 bytes on x64
152 if (end > uint.MaxValue)
153 logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
154 }
155 else
156 {
157 throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86 or x64 but we have: {0}", arch));
158 }
159 DumpRam(start, byte_count, filename);
160 }
161 private void DumpRam(ulong start, uint count, string filename)
162 {
163 if (this.AcceptedProcess == null) return;
164 Sojaner.MemoryScanner.ProcessMemoryReader reader = new Sojaner.MemoryScanner.ProcessMemoryReader();
165 reader.ReadProcess = this.AcceptedProcess;
166 reader.OpenProcess();
167 int bytesReadSize;
168 if (reader.DumpMemory(this.AcceptedProcess,filename, (uint)start, count, out bytesReadSize))
169 {
170 MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
171 }
172 else
173 {
174 MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.AcceptedProcess.Id, AcceptedProcess.ProcessName)), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
175 }
176 reader.CloseHandle();
177 }
178 #endregion
179 }
180 }

  ViewVC Help
Powered by ViewVC 1.1.22