/[RomCheater]/trunk/Win32/Sojaner.MemoryScanner/MemoryScanner.cs
ViewVC logotype

Annotation of /trunk/Win32/Sojaner.MemoryScanner/MemoryScanner.cs

Parent Directory Parent Directory | Revision Log Revision Log


Revision 156 - (hide annotations) (download)
Mon May 28 04:14:03 2012 UTC (8 years, 7 months ago) by william
File size: 6560 byte(s)
+ add support for selecting process by different means

1 william 88 using System;
2     using System.Collections.Generic;
3     using System.Text;
4     using System.Diagnostics;
5     using System.Threading;
6     using System.Runtime.InteropServices;
7 william 156 using RomCheater.Logging;
8 william 88
9     namespace Sojaner.MemoryScanner
10     {
11     // code borrowed from: http://www.codeproject.com/KB/cs/sojaner_memory_scanner.aspx
12     #region ProcessMemoryReader class
13     //Thanks goes to Arik Poznanski for P/Invokes and methods needed to read and write the Memory
14     //For more information refer to "Minesweeper, Behind the scenes" article by Arik Poznanski at Codeproject.com
15     public class ProcessMemoryReader
16     {
17    
18     public ProcessMemoryReader()
19     {
20     }
21    
22     /// <summary>
23     /// Process from which to read
24     /// </summary>
25     public Process ReadProcess
26     {
27     get
28     {
29     return m_ReadProcess;
30     }
31     set
32     {
33     m_ReadProcess = value;
34     }
35     }
36    
37     private Process m_ReadProcess = null;
38    
39     private IntPtr m_hProcess = IntPtr.Zero;
40    
41     public void OpenProcess()
42     {
43     // m_hProcess = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ, 1, (uint)m_ReadProcess.Id);
44     ProcessMemoryReaderApi.ProcessAccessType access;
45     access = ProcessMemoryReaderApi.ProcessAccessType.PROCESS_VM_READ
46     | ProcessMemoryReaderApi.ProcessAccessType.PROCESS_VM_WRITE
47     | ProcessMemoryReaderApi.ProcessAccessType.PROCESS_VM_OPERATION;
48     m_hProcess = ProcessMemoryReaderApi.OpenProcess((uint)access, 1, (uint)m_ReadProcess.Id);
49     }
50    
51     public void CloseHandle()
52     {
53     try
54     {
55     int iRetValue;
56     iRetValue = ProcessMemoryReaderApi.CloseHandle(m_hProcess);
57     if (iRetValue == 0)
58     {
59     throw new Exception("CloseHandle failed");
60     }
61     }
62     catch (Exception ex)
63     {
64     //System.Windows.Forms.MessageBox.Show(ex.Message, "error", System.Windows.Forms.MessageBoxButtons.OK, System.Windows.Forms.MessageBoxIcon.Warning);
65     throw ex;
66     }
67     }
68    
69     public byte[] ReadProcessMemory(IntPtr MemoryAddress, uint bytesToRead, out int bytesRead)
70     {
71 william 156 try
72     {
73     byte[] buffer = new byte[bytesToRead - 1];
74 william 88
75 william 156 IntPtr ptrBytesRead;
76     ProcessMemoryReaderApi.ReadProcessMemory(m_hProcess, MemoryAddress, buffer, bytesToRead, out ptrBytesRead);
77 william 88
78 william 156 bytesRead = ptrBytesRead.ToInt32();
79 william 88
80 william 156 return buffer;
81     }
82     catch (OutOfMemoryException ex)
83     {
84     logger.Error.WriteLine("ReadProcessMemory(): OutOfMemoryException");
85     logger.Error.WriteLine(ex.ToString());
86     }
87     catch (Exception ex)
88     {
89     logger.Error.WriteLine("ReadProcessMemory(): Exception");
90     logger.Error.WriteLine(ex.ToString());
91     }
92     bytesRead = 0;
93     return new byte[] { };
94 william 88 }
95    
96     public void WriteProcessMemory(IntPtr MemoryAddress, byte[] bytesToWrite, out int bytesWritten)
97     {
98     IntPtr ptrBytesWritten;
99     ProcessMemoryReaderApi.WriteProcessMemory(m_hProcess, MemoryAddress, bytesToWrite, (uint)bytesToWrite.Length, out ptrBytesWritten);
100    
101     bytesWritten = ptrBytesWritten.ToInt32();
102     }
103    
104    
105     /// <summary>
106     /// ProcessMemoryReader is a class that enables direct reading a process memory
107     /// </summary>
108     class ProcessMemoryReaderApi
109     {
110     // constants information can be found in <winnt.h>
111     [Flags]
112     public enum ProcessAccessType
113     {
114     PROCESS_TERMINATE = (0x0001),
115     PROCESS_CREATE_THREAD = (0x0002),
116     PROCESS_SET_SESSIONID = (0x0004),
117     PROCESS_VM_OPERATION = (0x0008),
118     PROCESS_VM_READ = (0x0010),
119     PROCESS_VM_WRITE = (0x0020),
120     PROCESS_DUP_HANDLE = (0x0040),
121     PROCESS_CREATE_PROCESS = (0x0080),
122     PROCESS_SET_QUOTA = (0x0100),
123     PROCESS_SET_INFORMATION = (0x0200),
124     PROCESS_QUERY_INFORMATION = (0x0400)
125     }
126    
127     // function declarations are found in the MSDN and in <winbase.h>
128    
129     // HANDLE OpenProcess(
130     // DWORD dwDesiredAccess, // access flag
131     // BOOL bInheritHandle, // handle inheritance option
132     // DWORD dwProcessId // process identifier
133     // );
134     [DllImport("kernel32.dll")]
135     public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);
136    
137     // BOOL CloseHandle(
138     // HANDLE hObject // handle to object
139     // );
140     [DllImport("kernel32.dll")]
141     public static extern Int32 CloseHandle(IntPtr hObject);
142    
143     // BOOL ReadProcessMemory(
144     // HANDLE hProcess, // handle to the process
145     // LPCVOID lpBaseAddress, // base of memory area
146     // LPVOID lpBuffer, // data buffer
147     // SIZE_T nSize, // number of bytes to read
148     // SIZE_T * lpNumberOfBytesRead // number of bytes read
149     // );
150     [DllImport("kernel32.dll")]
151     public static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);
152    
153     // BOOL WriteProcessMemory(
154     // HANDLE hProcess, // handle to process
155     // LPVOID lpBaseAddress, // base of memory area
156     // LPCVOID lpBuffer, // data buffer
157     // SIZE_T nSize, // count of bytes to write
158     // SIZE_T * lpNumberOfBytesWritten // count of bytes written
159     // );
160     [DllImport("kernel32.dll")]
161     public static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesWritten);
162    
163    
164     }
165     }
166     #endregion
167     }

  ViewVC Help
Powered by ViewVC 1.1.22