/[RomCheater]/trunk/RomCheater/Docking/FloatingRamDumperDialog.cs
ViewVC logotype

Contents of /trunk/RomCheater/Docking/FloatingRamDumperDialog.cs

Parent Directory Parent Directory | Revision Log Revision Log


Revision 471 - (show annotations) (download)
Mon Jun 3 07:13:44 2013 UTC (7 years, 11 months ago) by william
File size: 10320 byte(s)
+ pass process informatin by using the process's PID, instead of passing the process as a reference

1 #region Logging Defines
2 // include this any class or method that required logging, and comment-out what is not needed
3
4 #region Enabled logging levels
5 #define LOGGING_ENABLE_INFO
6 #define LOGGING_ENABLE_WARN
7 #define LOGGING_ENABLE_DEBUG
8 #define LOGGING_ENABLE_VERBOSEDEBUG
9 #define LOGGING_ENABLE_ERROR
10 #define LOGGING_ENABLE_VERBOSEERROR
11 #define LOGGING_ENABLE_PROFILER
12 #endregion
13 #endregion
14 using System;
15 using System.Collections.Generic;
16 using System.ComponentModel;
17 using System.Data;
18 using System.Drawing;
19 using System.Linq;
20 using System.Text;
21 using System.Windows.Forms;
22 using WeifenLuo.WinFormsUI.Docking;
23 using RomCheater.PluginFramework.Interfaces;
24 using System.Diagnostics;
25 using System.IO;
26 using RomCheater.Logging;
27 using System.Reflection;
28 using Sojaner.MemoryScanner.MemoryProviers;
29 using Sojaner.MemoryScanner;
30 using libWin32.Win32.Threading;
31
32 namespace RomCheater.Docking
33 {
34 public partial class FloatingRamDumperDialog : DockContent,
35 IAcceptsPlugin<IConfigPlugin>,
36 IAcceptsProcess,
37 IAcceptsProcessAndConfig
38 {
39 #region sub-classes
40 private const int BYTE_CORRECTION_VALUE = 23;
41 public enum DumpSize
42 {
43 Bytes,
44 KiloBytes,
45 MegaBytes,
46 GigaBytes,
47 }
48 #endregion
49 private DumpSize dumpSize = DumpSize.Bytes;
50
51 public FloatingRamDumperDialog() { InitializeComponent(); this.AcceptedPlugin = null; this.ProcessPID = 0; }
52 public FloatingRamDumperDialog(IConfigPlugin config) : this() { this.AcceptedPlugin = config; }
53 public FloatingRamDumperDialog(IConfigPlugin config, int pid) : this() { this.AcceptedPlugin = config; this.ProcessPID = pid; }
54
55 private void FloatingRamDumperDialog_Load(object sender, EventArgs e)
56 {
57 txtStart.Value = MemorySizeConstants.MinimumAddress;
58 txtEnd.Value = MemorySizeConstants.MinimumAddress + MemorySizeConstants.MaximumAddressSize;
59 }
60
61
62 #region IAcceptsProcess<Process> Members
63 public int ProcessPID { get; set; }
64 #endregion
65 #region IAcceptsPlugin<IConfigPlugin> Members
66 public IConfigPlugin AcceptedPlugin { get; set; }
67 #endregion
68 #region ram-dump specific
69 private void radioBTNBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.Bytes; }
70 private void radioBTNKiloBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.KiloBytes; }
71 private void radioBTNMegaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.MegaBytes; }
72 private void radioBTNGigaBytes_CheckedChanged(object sender, EventArgs e) { dumpSize = DumpSize.GigaBytes; }
73 private void btnCalcEndAddr_Click(object sender, EventArgs e)
74 {
75 long start = 0;
76 long end = 0;
77 start = txtStart.Value;
78 switch (dumpSize)
79 {
80 case DumpSize.Bytes:
81 end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1.0 + (double)start) + BYTE_CORRECTION_VALUE;
82 txtEnd.Value = end;
83 break;
84 case DumpSize.KiloBytes:
85 end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000.0 + (double)start) + BYTE_CORRECTION_VALUE;
86 txtEnd.Value = end;
87 break;
88 case DumpSize.MegaBytes:
89 end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
90 txtEnd.Value = end;
91 break;
92 case DumpSize.GigaBytes:
93 end = (long)(Convert.ToDouble(txtDumpSize.Text) * 1000000000.0 + (double)start) + BYTE_CORRECTION_VALUE;
94 txtEnd.Value = end;
95 break;
96 }
97 }
98 private void btnCalcStartAddr_Click(object sender, EventArgs e)
99 {
100 long start = 0;
101 long end = 0;
102 end = txtEnd.ToInt64();
103 switch (dumpSize)
104 {
105 case DumpSize.Bytes:
106 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1.0)) + BYTE_CORRECTION_VALUE;
107 txtStart.Value = (long)start;
108 break;
109 case DumpSize.KiloBytes:
110 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000.0)) + BYTE_CORRECTION_VALUE;
111 txtStart.Value = (long)start;
112 break;
113 case DumpSize.MegaBytes:
114 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000.0)) + BYTE_CORRECTION_VALUE;
115 txtStart.Value = (long)start;
116 break;
117 case DumpSize.GigaBytes:
118 start = (long)((double)end - (Convert.ToDouble(txtDumpSize.Text) * 1000000000.0)) + BYTE_CORRECTION_VALUE;
119 txtStart.Value = (long)start;
120 break;
121 }
122 }
123 private void btnCalcDumpSize_Click(object sender, EventArgs e)
124 {
125 long start = txtStart.Value;
126 long end = txtEnd.Value;
127 long byte_diff = (end - start) + BYTE_CORRECTION_VALUE;
128 switch (dumpSize)
129 {
130 case DumpSize.Bytes:
131 txtDumpSize.Text = string.Format("{0:n2}", (double)byte_diff);
132 break;
133 case DumpSize.KiloBytes:
134 txtDumpSize.Text = string.Format("{0:n3}", (double)byte_diff / 1000.0);
135 break;
136 case DumpSize.MegaBytes:
137 txtDumpSize.Text = string.Format("{0:n6}", (double)byte_diff / 1000000.0);
138 break;
139 case DumpSize.GigaBytes:
140 txtDumpSize.Text = string.Format("{0:n9}", (double)byte_diff / 1000000000.0);
141 break;
142 }
143 }
144 private void btnDumpRam_Click(object sender, EventArgs e)
145 {
146 if (this.ProcessPID == 0)
147 {
148 MessageBox.Show("Please select a process to dump memory from", "", MessageBoxButtons.OK, MessageBoxIcon.Error);
149 return;
150 }
151 DialogResult result = dumpsaver.ShowDialog();
152 if (result != DialogResult.OK) return;
153 DumpRam(txtStart.Value, txtEnd.Value, dumpsaver.FileName);
154 }
155 #endregion
156
157 #region memory support
158 private void DumpRam(long start, long end, string filename)
159 {
160 uint byte_count = (uint)(end - start);
161 string arch = ProcessorAssemblyArchitecture.GetProcessorArchitecture(typeof(FloatingRamDumperDialog).Assembly);
162 if (arch == ProcessorAssemblyArchitecture.x86)
163 {
164 // intptr is 4 bytes on x86
165 if (end > int.MaxValue)
166 logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
167 }
168 else if (arch == ProcessorAssemblyArchitecture.x64)
169 {
170 // inptr is 8 bytes on x64
171 if (end > uint.MaxValue)
172 logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
173 }
174 else if (arch == ProcessorAssemblyArchitecture.AnyCpu)
175 {
176 if (IntPtr.Size == 4) //x86
177 {
178 if (end > int.MaxValue)
179 logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x86, this will exceed the max value for IntPtr", int.MaxValue);
180 }
181 else if (IntPtr.Size == 8) //x64
182 {
183 }
184 else // unknown
185 {
186 if (end > uint.MaxValue)
187 logger.Warn.WriteLine("Warning: DumpRam(): ending address is greater than 0x{0:x8} and we are running x64, this will exceed the max value for UIntPtr", int.MaxValue);
188 }
189 }
190 else
191 {
192 throw new InvalidProgramException(string.Format("Unexcepted processor aritecture: expected x86, x64, or AnyCpu(Msil) but we have: {0}", arch));
193 }
194 DumpRam(start, byte_count, filename);
195 }
196 private void DumpRam(long start, uint count, string filename)
197 {
198 if (this.ProcessPID == 0) return;
199 int bytesReadSize;
200 using (GenericMemoryProvider provider = new GenericMemoryProvider((IAcceptsProcessAndConfig)this))
201 {
202 provider.OpenProvider();
203 if (provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize))
204 {
205 MessageBox.Show(string.Format("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.ProcessPID, ProcessUtils.ProcessName(this.ProcessPID))), "", MessageBoxButtons.OK, MessageBoxIcon.Information);
206 }
207 else
208 {
209 MessageBox.Show(string.Format("Failed to dump memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", start, start + count, filename, string.Format("0x{0:x4} {1}.exe", this.ProcessPID, ProcessUtils.ProcessName(this.ProcessPID))), "", MessageBoxButtons.OK, MessageBoxIcon.Error);
210 }
211 provider.CloseProvider();
212 }
213
214 //ProcessMemoryReader provider = new ProcessMemoryReader();
215 //provider.ReadProcess = this.AcceptedProcess;
216 //provider.OpenProcess();
217 //provider.WriteProcessMemoryToFile(filename, (int)start, count, out bytesReadSize);
218 //provider.CloseHandle();
219
220 }
221 #endregion
222 }
223 }

  ViewVC Help
Powered by ViewVC 1.1.22