+ remove AnyCpu arch
+ fix-up processor targets
+ update logging to use Enterpise.Logging -- more work is still needed
+ fix memoryscanner when reading process memory at once for UIMemoryViewer: ** read 16 bytes at a time (this way data won't disseapper from the memory view)
+ fixup cpu arch
+ massive move of source files
+ move some data into pluginframework
fix ram dump to file: * dump memory in 32mb chunks, this fixes issues with not being able to hold over 2GB in managed objects
+ add SectionData class * translate the SectionHeader addresses using the VirtualRVA
add: [TypeConverter(typeof(ExpandableObjectConverter))]
+ fix update speed of progress logging to amount of memory read
MemoryScanner: ReadMemory (mem.read() -> was not updating bitData)
revert r471: pass process informatin by using the process's PID, instead of passing the process as a reference + pass the process instead
+ pass process informatin by using the process's PID, instead of passing the process as a reference
+ fix search cancel/reset
+ fix search so that the result count(s) match
+ fix memory scanner and memory providers to read and write process memory simulataneously without crashing due to null process handle *** this has been done using ProcessMemoryChunk for all memory read/write operations ** we no longer need to open and close native handles to the process
only disable: #define LOGGING_ENABLE_PROFILER in MemoryScanner.cs
revert r423 + do not close provider - keep it open for shared access
+ do not close provider - keep it open for shared access
+ stop complaining about exception variables not being used: changed from 'throw;' to 'throw ex;' + comment-out currently unsued variables: FloatingMemorySearcher.cs: static int col_Found_Frozen = 3; static int col_Added_Frozen = 3; MemoryScanner.cs: SafeWaitHandle m_hProcess;
MemmoryProvider: using statements
ReadMemoryAtOnce(): don't attempt to buffer the data
use Buffer.BlockCopy in ReadMemoryAtOnce
+ correctly read linker timedatestamp // This field holds the number of seconds since December 31st, 1969, at 4:00 P.M.
use uint instead of int for memory addresses
+ add support to write ascii character when memory region cannot be read
+redeclaration
+ fix ReadMemory() methods
+ add section byte data
+ add DataSectionFlags
+ only add an image section if it's raw data size is not zero
- revert back to last working revision
+ wip for data direcory tables
PEData add Is32bitAssembly()
+ add event for being able to subscribe to PEReader updates
GetDateTimeFromDosDateTime iYear = 1970 (not 1980)
+ add rest of properties to currently present structures for property grid support
+ more property grid implementation work
+ add support for displaying PE Struct data into property grid (read-only)
+ add internal logging override (so it can be turned on/off for performance reasons)
+ setup logging format
fix format of IMAGE_NT_HEADERS
+ IMAGE_NT_HEADERS->IMAGE_FILE_HEADER set FieldOffset to 8 to not overlapp Signature + add exception handling that will bubble up from the using statement
+ more wip
use SafeWaitHandle in when closing process handle
set provider null after close to free memory
ReadProcessMemory(): make sure to set byte array capacity :: data = new byte[bytesToRead];
set internal access specifier on ProcessMemoryReader class (must use memory provider classes)
remove code to use MemoryScanner from r204 (I think we fixed the error in the last commit)
ReadProcessMemory(): byte[] buffer = new byte[] { }; ==> byte[] buffer = new byte[bytesToRead]; (the lack of capacity was causing errors to be thrown)
+ add variant classes that use MemoryScanner from r204
change address from uint to int
+ catch, log and throw errors
+ add exception logic to ensure provider is open
change int in method to uint
remove
+ overhaul memory scanner
ignore CS0436: importing conflicting types (AssemblyConfig)
DumpMemoryToByteArray(): set byte_alignment to 1
+ add support to automatically goto the first address that has a non-zero byte
+ initial support for memoryview and getting ram from process for display
+ add success/failure messages for ram dump
+ fix memory dump when bytes to read is less than buffer amount
DumpMemory(): write out using 100mb blocks
+ add support to dump ram to file (even if it is ~2gb or more)
Force the use of the enum values for these types
public struct IMAGE_FILE_HEADER
{
public MachineType Machine;
public DllCharacteristicsType Characteristics;
}
+ add support to parse an exe
+ add support for selecting process by different means
removed these obsolete files