Log of /trunk/Win32/Sojaner.MemoryScanner

---

Revision 889 - Directory Listing
Modified Wed Sep 17 04:55:52 2014 UTC (6 years, 4 months ago) by william

---

Revision 831 - Directory Listing
Modified Mon Sep 15 23:10:17 2014 UTC (6 years, 4 months ago) by william

+ remove AnyCpu arch

---

Revision 826 - Directory Listing
Modified Mon Sep 15 21:22:35 2014 UTC (6 years, 4 months ago) by william

+ fix-up processor targets

---

Revision 812 - Directory Listing
Modified Tue Apr 15 14:52:10 2014 UTC (6 years, 9 months ago) by william

+ update logging to use Enterpise.Logging -- more work is still needed

---

Revision 807 - Directory Listing
Modified Mon Apr 7 12:55:47 2014 UTC (6 years, 9 months ago) by william

+ fix memoryscanner when reading process memory at once for UIMemoryViewer:
** read 16 bytes at a time (this way data won't disseapper from the memory view)

---

Revision 791 - Directory Listing
Modified Mon Apr 7 11:10:04 2014 UTC (6 years, 9 months ago) by william

+ fixup cpu arch

---

Revision 686 - Directory Listing
Modified Mon Jun 17 09:31:52 2013 UTC (7 years, 7 months ago) by william

+ massive move of source files

---

Revision 679 - Directory Listing
Modified Mon Jun 17 07:31:15 2013 UTC (7 years, 7 months ago) by william

+ move some data into pluginframework

---

Revision 657 - Directory Listing
Modified Sun Jun 9 04:03:36 2013 UTC (7 years, 7 months ago) by william

fix ram dump to file:
* dump memory in 32mb chunks, this fixes issues with not being able to hold over 2GB in managed objects

---

Revision 656 - Directory Listing
Modified Sun Jun 9 02:08:32 2013 UTC (7 years, 7 months ago) by william

---

Revision 620 - Directory Listing
Modified Sat Jun 8 06:48:29 2013 UTC (7 years, 7 months ago) by william

+ add SectionData class
* translate the SectionHeader addresses using the VirtualRVA

---

Revision 619 - Directory Listing
Modified Sat Jun 8 05:42:00 2013 UTC (7 years, 7 months ago) by william

---

Revision 618 - Directory Listing
Modified Sat Jun 8 04:59:44 2013 UTC (7 years, 7 months ago) by william

---

Revision 617 - Directory Listing
Modified Sat Jun 8 04:53:19 2013 UTC (7 years, 7 months ago) by william

---

Revision 616 - Directory Listing
Modified Sat Jun 8 04:29:28 2013 UTC (7 years, 7 months ago) by william

---

Revision 615 - Directory Listing
Modified Sat Jun 8 04:29:12 2013 UTC (7 years, 7 months ago) by william

---

Revision 614 - Directory Listing
Modified Sat Jun 8 04:15:41 2013 UTC (7 years, 7 months ago) by william

---

Revision 613 - Directory Listing
Modified Sat Jun 8 03:56:47 2013 UTC (7 years, 7 months ago) by william

---

Revision 612 - Directory Listing
Modified Sat Jun 8 03:55:09 2013 UTC (7 years, 7 months ago) by william

---

Revision 611 - Directory Listing
Modified Sat Jun 8 03:35:12 2013 UTC (7 years, 7 months ago) by william

---

Revision 610 - Directory Listing
Modified Sat Jun 8 03:26:17 2013 UTC (7 years, 7 months ago) by william

---

Revision 609 - Directory Listing
Modified Sat Jun 8 03:19:35 2013 UTC (7 years, 7 months ago) by william

---

Revision 608 - Directory Listing
Modified Sat Jun 8 03:17:34 2013 UTC (7 years, 7 months ago) by william

add: [TypeConverter(typeof(ExpandableObjectConverter))]

---

Revision 607 - Directory Listing
Modified Sat Jun 8 02:13:11 2013 UTC (7 years, 7 months ago) by william

---

Revision 600 - Directory Listing
Modified Fri Jun 7 10:27:53 2013 UTC (7 years, 7 months ago) by william

---

Revision 599 - Directory Listing
Modified Fri Jun 7 09:55:01 2013 UTC (7 years, 7 months ago) by william

---

Revision 598 - Directory Listing
Modified Fri Jun 7 09:40:01 2013 UTC (7 years, 7 months ago) by william

---

Revision 578 - Directory Listing
Modified Thu Jun 6 08:18:44 2013 UTC (7 years, 7 months ago) by william

---

Revision 576 - Directory Listing
Modified Thu Jun 6 07:49:01 2013 UTC (7 years, 7 months ago) by william

---

Revision 575 - Directory Listing
Modified Thu Jun 6 07:46:38 2013 UTC (7 years, 7 months ago) by william

---

Revision 543 - Directory Listing
Modified Wed Jun 5 21:33:24 2013 UTC (7 years, 7 months ago) by william

---

Revision 521 - Directory Listing
Modified Wed Jun 5 07:06:53 2013 UTC (7 years, 7 months ago) by william

---

Revision 519 - Directory Listing
Modified Wed Jun 5 04:40:00 2013 UTC (7 years, 7 months ago) by william

---

Revision 518 - Directory Listing
Modified Wed Jun 5 04:31:26 2013 UTC (7 years, 7 months ago) by william

+ fix update speed of progress logging to amount of memory read

---

Revision 517 - Directory Listing
Modified Wed Jun 5 03:49:00 2013 UTC (7 years, 7 months ago) by william

---

Revision 513 - Directory Listing
Modified Wed Jun 5 00:46:53 2013 UTC (7 years, 7 months ago) by william

---

Revision 493 - Directory Listing
Modified Mon Jun 3 22:18:34 2013 UTC (7 years, 7 months ago) by william

MemoryScanner: ReadMemory (mem.read() -> was not updating bitData)

---

Revision 477 - Directory Listing
Modified Mon Jun 3 18:35:45 2013 UTC (7 years, 7 months ago) by william

revert r471: pass process informatin by using the process's PID, instead of passing the process as a reference

+ pass the process instead

---

Revision 473 - Directory Listing
Modified Mon Jun 3 09:21:03 2013 UTC (7 years, 7 months ago) by william

---

Revision 471 - Directory Listing
Modified Mon Jun 3 07:13:44 2013 UTC (7 years, 7 months ago) by william

+ pass process informatin by using the process's PID, instead of passing the process as a reference

---

Revision 468 - Directory Listing
Modified Mon Jun 3 05:35:20 2013 UTC (7 years, 7 months ago) by william

---

Revision 446 - Directory Listing
Modified Sun Jun 2 19:52:03 2013 UTC (7 years, 7 months ago) by william

+ fix search cancel/reset

---

Revision 429 - Directory Listing
Modified Tue May 28 15:16:05 2013 UTC (7 years, 8 months ago) by william

+ fix search so that the result count(s) match

---

Revision 428 - Directory Listing
Modified Tue May 28 13:32:28 2013 UTC (7 years, 8 months ago) by william

+ fix memory scanner and memory providers to read and write process memory simulataneously without crashing due to null process handle
*** this has been done using ProcessMemoryChunk for all memory read/write operations
** we no longer need to open and close native handles to the process

---

Revision 427 - Directory Listing
Modified Tue May 28 12:39:42 2013 UTC (7 years, 8 months ago) by william

only disable: #define LOGGING_ENABLE_PROFILER
in MemoryScanner.cs

---

Revision 425 - Directory Listing
Modified Tue May 28 12:33:14 2013 UTC (7 years, 8 months ago) by william

---

Revision 424 - Directory Listing
Modified Tue May 28 12:03:10 2013 UTC (7 years, 8 months ago) by william

revert r423
+  do not close provider - keep it open for shared access

---

Revision 423 - Directory Listing
Modified Tue May 28 11:58:22 2013 UTC (7 years, 8 months ago) by william

+  do not close provider - keep it open for shared access

---

Revision 419 - Directory Listing
Modified Tue May 28 11:08:26 2013 UTC (7 years, 8 months ago) by william

+ stop complaining about exception variables not being used:  changed from 'throw;' to 'throw ex;'
+ comment-out currently unsued variables:
 FloatingMemorySearcher.cs:
  static int col_Found_Frozen = 3;
  static int col_Added_Frozen = 3;
 MemoryScanner.cs:
  SafeWaitHandle m_hProcess;

---

Revision 415 - Directory Listing
Modified Fri Jun 22 08:33:51 2012 UTC (8 years, 7 months ago) by william

---

Revision 414 - Directory Listing
Modified Fri Jun 22 08:21:18 2012 UTC (8 years, 7 months ago) by william

---

Revision 411 - Directory Listing
Modified Thu Jun 21 21:07:34 2012 UTC (8 years, 7 months ago) by william

---

Revision 409 - Directory Listing
Modified Thu Jun 21 20:02:40 2012 UTC (8 years, 7 months ago) by william

---

Revision 408 - Directory Listing
Modified Thu Jun 21 18:10:21 2012 UTC (8 years, 7 months ago) by william

---

Revision 404 - Directory Listing
Modified Thu Jun 21 12:51:57 2012 UTC (8 years, 7 months ago) by william

---

Revision 399 - Directory Listing
Modified Wed Jun 20 13:24:49 2012 UTC (8 years, 7 months ago) by william

---

Revision 398 - Directory Listing
Modified Wed Jun 20 12:16:34 2012 UTC (8 years, 7 months ago) by william

MemmoryProvider: using statements

---

Revision 393 - Directory Listing
Modified Wed Jun 20 10:40:24 2012 UTC (8 years, 7 months ago) by william

ReadMemoryAtOnce(): don't attempt to buffer the data

---

Revision 387 - Directory Listing
Modified Tue Jun 19 11:54:38 2012 UTC (8 years, 7 months ago) by william

use Buffer.BlockCopy in ReadMemoryAtOnce

---

Revision 379 - Directory Listing
Modified Tue Jun 19 08:09:02 2012 UTC (8 years, 7 months ago) by william

+ correctly read linker timedatestamp
// This field holds the number of seconds since December 31st, 1969, at 4:00 P.M.

---

Revision 378 - Directory Listing
Modified Tue Jun 19 07:56:36 2012 UTC (8 years, 7 months ago) by william

use uint instead of int for memory addresses

---

Revision 377 - Directory Listing
Modified Sun Jun 10 07:55:18 2012 UTC (8 years, 7 months ago) by william

---

Revision 370 - Directory Listing
Modified Sun Jun 10 05:40:24 2012 UTC (8 years, 7 months ago) by william

+ add support to write ascii character when memory region cannot be read

---

Revision 366 - Directory Listing
Modified Sun Jun 10 03:14:42 2012 UTC (8 years, 7 months ago) by william

---

Revision 361 - Directory Listing
Modified Sun Jun 10 01:33:21 2012 UTC (8 years, 7 months ago) by william

---

Revision 359 - Directory Listing
Modified Sun Jun 10 01:09:58 2012 UTC (8 years, 7 months ago) by william

---

Revision 358 - Directory Listing
Modified Sun Jun 10 01:09:09 2012 UTC (8 years, 7 months ago) by william

---

Revision 357 - Directory Listing
Modified Sun Jun 10 00:47:58 2012 UTC (8 years, 7 months ago) by william

---

Revision 354 - Directory Listing
Modified Sat Jun 9 21:46:37 2012 UTC (8 years, 7 months ago) by william

---

Revision 352 - Directory Listing
Modified Sat Jun 9 21:11:02 2012 UTC (8 years, 7 months ago) by william

---

Revision 351 - Directory Listing
Modified Sat Jun 9 20:52:19 2012 UTC (8 years, 7 months ago) by william

---

Revision 350 - Directory Listing
Modified Sat Jun 9 20:07:18 2012 UTC (8 years, 7 months ago) by william

+redeclaration

---

Revision 348 - Directory Listing
Modified Fri Jun 8 04:23:30 2012 UTC (8 years, 7 months ago) by william

---

Revision 347 - Directory Listing
Modified Fri Jun 8 04:03:02 2012 UTC (8 years, 7 months ago) by william

---

Revision 346 - Directory Listing
Modified Fri Jun 8 04:02:44 2012 UTC (8 years, 7 months ago) by william

+ fix ReadMemory() methods

---

Revision 345 - Directory Listing
Modified Fri Jun 8 03:17:40 2012 UTC (8 years, 7 months ago) by william

---

Revision 344 - Directory Listing
Modified Fri Jun 8 02:52:18 2012 UTC (8 years, 7 months ago) by william

+ add section byte data

---

Revision 343 - Directory Listing
Modified Fri Jun 8 02:25:34 2012 UTC (8 years, 7 months ago) by william

+ add DataSectionFlags

---

Revision 342 - Directory Listing
Modified Fri Jun 8 02:02:28 2012 UTC (8 years, 7 months ago) by william

+ only add an image section if it's raw data size is not zero

---

Revision 341 - Directory Listing
Modified Fri Jun 8 01:59:32 2012 UTC (8 years, 7 months ago) by william

- revert back to last working revision

---

Revision 340 - Directory Listing
Modified Fri Jun 8 01:12:08 2012 UTC (8 years, 7 months ago) by william

+ wip for data direcory tables

---

Revision 339 - Directory Listing
Modified Fri Jun 8 00:20:39 2012 UTC (8 years, 7 months ago) by william

---

Revision 337 - Directory Listing
Modified Thu Jun 7 23:48:29 2012 UTC (8 years, 7 months ago) by william

---

Revision 336 - Directory Listing
Modified Thu Jun 7 21:47:14 2012 UTC (8 years, 7 months ago) by william

---

Revision 324 - Directory Listing
Modified Thu Jun 7 17:42:57 2012 UTC (8 years, 7 months ago) by william

PEData add Is32bitAssembly()

---

Revision 323 - Directory Listing
Modified Thu Jun 7 16:33:41 2012 UTC (8 years, 7 months ago) by william

+ add event for being able to subscribe to PEReader updates

---

Revision 322 - Directory Listing
Modified Tue Jun 5 23:20:12 2012 UTC (8 years, 7 months ago) by william

---

Revision 321 - Directory Listing
Modified Tue Jun 5 23:12:53 2012 UTC (8 years, 7 months ago) by william

GetDateTimeFromDosDateTime iYear = 1970 (not 1980)

---

Revision 320 - Directory Listing
Modified Tue Jun 5 19:18:20 2012 UTC (8 years, 7 months ago) by william

+ add rest of properties to currently present structures for property grid support

---

Revision 319 - Directory Listing
Modified Tue Jun 5 18:39:06 2012 UTC (8 years, 7 months ago) by william

+ more property grid implementation work

---

Revision 318 - Directory Listing
Modified Tue Jun 5 17:57:37 2012 UTC (8 years, 7 months ago) by william

+ add support for displaying PE Struct data into property grid (read-only)

---

Revision 299 - Directory Listing
Modified Tue Jun 5 11:36:17 2012 UTC (8 years, 7 months ago) by william

+ add internal logging override (so it can be turned on/off for performance reasons)

---

Revision 294 - Directory Listing
Modified Tue Jun 5 10:48:07 2012 UTC (8 years, 7 months ago) by william

+ setup logging format

---

Revision 293 - Directory Listing
Modified Tue Jun 5 10:27:16 2012 UTC (8 years, 7 months ago) by william

fix format of IMAGE_NT_HEADERS

---

Revision 290 - Directory Listing
Modified Tue Jun 5 09:30:32 2012 UTC (8 years, 7 months ago) by william

+ IMAGE_NT_HEADERS->IMAGE_FILE_HEADER set FieldOffset to 8 to not overlapp Signature
+ add exception handling that will bubble up from the using statement

---

Revision 286 - Directory Listing
Modified Tue Jun 5 02:19:13 2012 UTC (8 years, 7 months ago) by william

+ more wip

---

Revision 284 - Directory Listing
Modified Tue Jun 5 01:50:38 2012 UTC (8 years, 7 months ago) by william

use SafeWaitHandle in when closing process handle

---

Revision 283 - Directory Listing
Modified Tue Jun 5 01:50:13 2012 UTC (8 years, 7 months ago) by william

set provider null after close to free memory

---

Revision 273 - Directory Listing
Modified Sun Jun 3 21:26:28 2012 UTC (8 years, 7 months ago) by william

ReadProcessMemory(): make sure to set byte array capacity :: data = new byte[bytesToRead];

---

Revision 258 - Directory Listing
Modified Sun Jun 3 17:26:59 2012 UTC (8 years, 7 months ago) by william

---

Revision 257 - Directory Listing
Modified Sun Jun 3 16:51:35 2012 UTC (8 years, 7 months ago) by william

set internal access specifier on ProcessMemoryReader class (must use memory provider classes)

---

Revision 255 - Directory Listing
Modified Sun Jun 3 16:45:47 2012 UTC (8 years, 7 months ago) by william

remove code to use MemoryScanner from r204 (I think we fixed the error in the last commit)

---

Revision 254 - Directory Listing
Modified Sun Jun 3 16:44:42 2012 UTC (8 years, 7 months ago) by william

ReadProcessMemory(): byte[] buffer = new byte[] { }; ==> byte[] buffer = new byte[bytesToRead]; (the lack of capacity was causing errors to be thrown)

---

Revision 253 - Directory Listing
Modified Sun Jun 3 16:41:16 2012 UTC (8 years, 7 months ago) by william

---

Revision 251 - Directory Listing
Modified Sun Jun 3 16:32:58 2012 UTC (8 years, 7 months ago) by william

+ add variant classes that use MemoryScanner from r204

---

Revision 249 - Directory Listing
Modified Sun Jun 3 16:09:05 2012 UTC (8 years, 7 months ago) by william

change address from uint to int

---

Revision 248 - Directory Listing
Modified Sun Jun 3 15:28:16 2012 UTC (8 years, 7 months ago) by william

---

Revision 247 - Directory Listing
Modified Sun Jun 3 15:27:23 2012 UTC (8 years, 7 months ago) by william

+ catch, log and throw errors

---

Revision 246 - Directory Listing
Modified Sun Jun 3 15:15:51 2012 UTC (8 years, 7 months ago) by william

---

Revision 245 - Directory Listing
Modified Sun Jun 3 14:50:09 2012 UTC (8 years, 7 months ago) by william

+ add exception logic to ensure provider is open

---

Revision 235 - Directory Listing
Modified Sun Jun 3 12:44:26 2012 UTC (8 years, 7 months ago) by william

change int in method to uint

---

Revision 232 - Directory Listing
Modified Sun Jun 3 12:37:44 2012 UTC (8 years, 7 months ago) by william

remove

---

Revision 231 - Directory Listing
Modified Sun Jun 3 12:36:47 2012 UTC (8 years, 7 months ago) by william

+ overhaul memory scanner

---

Revision 229 - Directory Listing
Modified Sat Jun 2 18:31:40 2012 UTC (8 years, 7 months ago) by william

---

Revision 212 - Directory Listing
Modified Sat Jun 2 10:33:38 2012 UTC (8 years, 7 months ago) by william

ignore CS0436: importing conflicting types (AssemblyConfig)

---

Revision 204 - Directory Listing
Modified Thu May 31 09:08:24 2012 UTC (8 years, 7 months ago) by william

DumpMemoryToByteArray(): set byte_alignment to 1

---

Revision 203 - Directory Listing
Modified Thu May 31 09:03:53 2012 UTC (8 years, 7 months ago) by william

+ add support to automatically goto the first address that has a non-zero byte

---

Revision 200 - Directory Listing
Modified Thu May 31 07:29:44 2012 UTC (8 years, 7 months ago) by william

---

Revision 198 - Directory Listing
Modified Thu May 31 07:13:43 2012 UTC (8 years, 7 months ago) by william

+ initial support for memoryview and getting ram from process for display

---

Revision 185 - Directory Listing
Modified Mon May 28 10:21:03 2012 UTC (8 years, 8 months ago) by william

---

Revision 182 - Directory Listing
Modified Mon May 28 10:08:44 2012 UTC (8 years, 8 months ago) by william

---

Revision 179 - Directory Listing
Modified Mon May 28 09:42:27 2012 UTC (8 years, 8 months ago) by william

---

Revision 177 - Directory Listing
Modified Mon May 28 09:37:16 2012 UTC (8 years, 8 months ago) by william

---

Revision 172 - Directory Listing
Modified Mon May 28 09:15:17 2012 UTC (8 years, 8 months ago) by william

---

Revision 171 - Directory Listing
Modified Mon May 28 08:56:42 2012 UTC (8 years, 8 months ago) by william

---

Revision 169 - Directory Listing
Modified Mon May 28 08:49:42 2012 UTC (8 years, 8 months ago) by william

+ add success/failure messages for ram dump

---

Revision 167 - Directory Listing
Modified Mon May 28 08:31:56 2012 UTC (8 years, 8 months ago) by william

+ fix memory dump when bytes to read is less than buffer amount

---

Revision 166 - Directory Listing
Modified Mon May 28 08:14:02 2012 UTC (8 years, 8 months ago) by william

DumpMemory(): write out using 100mb blocks

---

Revision 164 - Directory Listing
Modified Mon May 28 07:49:48 2012 UTC (8 years, 8 months ago) by william

---

Revision 162 - Directory Listing
Modified Mon May 28 07:12:37 2012 UTC (8 years, 8 months ago) by william

+ add support to dump ram to file (even if it is ~2gb or more)

---

Revision 161 - Directory Listing
Modified Mon May 28 05:55:59 2012 UTC (8 years, 8 months ago) by william

---

Revision 160 - Directory Listing
Modified Mon May 28 05:30:14 2012 UTC (8 years, 8 months ago) by william

Force the use of the enum values for these types
public struct IMAGE_FILE_HEADER
{
  public MachineType Machine;
  public DllCharacteristicsType Characteristics;
}

---

Revision 159 - Directory Listing
Modified Mon May 28 05:22:28 2012 UTC (8 years, 8 months ago) by william

+ add support to parse an exe

---

Revision 156 - Directory Listing
Modified Mon May 28 04:14:03 2012 UTC (8 years, 8 months ago) by william

+ add support for selecting process by different means

---

Revision 119 - Directory Listing
Modified Thu May 10 18:34:26 2012 UTC (8 years, 8 months ago) by william

---

Revision 117 - Directory Listing
Modified Thu May 10 18:12:06 2012 UTC (8 years, 8 months ago) by william

---

Revision 91 - Directory Listing
Modified Wed May 9 21:02:31 2012 UTC (8 years, 8 months ago) by william

removed these obsolete files

---

Revision 90 - Directory Listing
Modified Wed May 9 21:00:22 2012 UTC (8 years, 8 months ago) by william

---

Revision 89 - Directory Listing
Modified Wed May 9 21:00:02 2012 UTC (8 years, 8 months ago) by william

---

Revision 88 - Directory Listing
Added Wed May 9 20:52:20 2012 UTC (8 years, 8 months ago) by william