Win32/Sojaner.MemoryScanner/MemoryScanner.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics;
using System.Threading;
using System.Runtime.InteropServices;
using RomCheater.Logging;
using System.IO;
using Sojaner.MemoryScanner.MemoryProviers;
using Microsoft.Win32.SafeHandles;
using Microsoft.Win32.Interop;
using System.ComponentModel;
using ManagedWinapi;

namespace Sojaner.MemoryScanner
{
    // code borrowed from: http://www.codeproject.com/KB/cs/sojaner_memory_scanner.aspx    
    #region ProcessMemoryReader class
    //Thanks goes to Arik Poznanski for P/Invokes and methods needed to read and write the Memory
    //For more information refer to "Minesweeper, Behind the scenes" article by Arik Poznanski at Codeproject.com
    internal class ProcessMemoryReader : IMemoryReader, IMemoryWriter, IFileWriter, IPatchMemory,IReadMemory
    {
        // constants information can be found in <winnt.h>
        [Flags]
        public enum ProcessAccessType
        {
            PROCESS_TERMINATE = (0x0001),
            PROCESS_CREATE_THREAD = (0x0002),
            PROCESS_SET_SESSIONID = (0x0004),
            PROCESS_VM_OPERATION = (0x0008),
            PROCESS_VM_READ = (0x0010),
            PROCESS_VM_WRITE = (0x0020),
            PROCESS_DUP_HANDLE = (0x0040),
            PROCESS_CREATE_PROCESS = (0x0080),
            PROCESS_SET_QUOTA = (0x0100),
            PROCESS_SET_INFORMATION = (0x0200),
            PROCESS_QUERY_INFORMATION = (0x0400)
        }
        [Flags]
        public enum AllocationProtect : uint
        {
            // http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx
            NONE = 0,
            PAGE_NOACCESS = 0x00000001,
            PAGE_READONLY = 0x00000002,
            PAGE_READWRITE = 0x00000004,
            PAGE_WRITECOPY = 0x00000008,
            PAGE_EXECUTE = 0x00000010,
            PAGE_EXECUTE_READ = 0x00000020,
            PAGE_EXECUTE_READWRITE = 0x00000040,
            PAGE_EXECUTE_WRITECOPY = 0x00000080,     
            PAGE_GUARD = 0x00000100,
            PAGE_NOCACHE = 0x00000200,
            PAGE_WRITECOMBINE = 0x00000400
        }
        [StructLayout(LayoutKind.Sequential)]
        public struct MEMORY_BASIC_INFORMATION
        {
            public IntPtr BaseAddress;
            public IntPtr AllocationBase;
            public AllocationProtect AllocationProtect;
            public IntPtr RegionSize;
            public uint State;
            public uint Protect;
            public uint Type;
        }

        public ProcessMemoryReader()
        {
        }

        /// <summary>   
        /// Process from which to read          
        /// </summary>
        public Process ReadProcess
        {
            get
            {
                return m_ReadProcess;
            }
            set
            {
                m_ReadProcess = value;
            }
        }

        private Process m_ReadProcess = null;

        //SafeWaitHandle handle;
        private static IntPtr m_hProcess = IntPtr.Zero;

        public void OpenProcess()
        {
            try
            {
                //                      m_hProcess = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ, 1, (uint)m_ReadProcess.Id);
                //if (!TokenAdjuster.AdjustProcessTokenPrivileges("SeDebugPrivilege"))
                //{
                //    logger.Warn.WriteLine("Failed to set SeDebugPrivilege on current process");
                //}
                ProcessAccessType access;
                access = ProcessAccessType.PROCESS_VM_READ
                    | ProcessAccessType.PROCESS_VM_WRITE
                    | ProcessAccessType.PROCESS_VM_OPERATION;
                //m_hProcess = ProcessMemoryReaderApi.OpenProcess((uint)access, 1, (uint)m_ReadProcess.Id);
               m_hProcess = ProcessMemoryReaderApi.OpenProcess((uint)access, 1, (uint)m_ReadProcess.Id);
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
        }

        public void CloseHandle()
        {
            try
            {
                SafeWaitHandle handle = new SafeWaitHandle(m_ReadProcess.Handle, false);
                if (handle.IsInvalid) { return; }
                if (handle.IsClosed) { return; }
                handle.Close();
                handle = null;
                //m_hProcess = IntPtr.Zero;
                //string stack_trace = System.Environment.StackTrace;
                //int iRetValue;
                //iRetValue = ProcessMemoryReaderApi.CloseHandle(m_hProcess);
                //if (iRetValue == 0)
                //{
                //    throw new Exception("CloseHandle failed");
                //}
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
        }
        /// <summary>
        /// ProcessMemoryReader is a class that enables direct reading a process memory
        /// </summary>
        private class ProcessMemoryReaderApi
        {
           
        
            [DllImport("kernel32.dll")]
            public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);

            // function declarations are found in the MSDN and in <winbase.h> 

            //          HANDLE OpenProcess(
            //                  DWORD dwDesiredAccess,  // access flag
            //                  BOOL bInheritHandle,    // handle inheritance option
            //                  DWORD dwProcessId       // process identifier
            //                  );
            [DllImport("kernel32.dll")]
            public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);

            //          BOOL CloseHandle(
            //                  HANDLE hObject   // handle to object
            //                  );
            [DllImport("kernel32.dll")]
            public static extern Int32 CloseHandle(IntPtr hObject);

            //          BOOL ReadProcessMemory(
            //                  HANDLE hProcess,              // handle to the process
            //                  LPCVOID lpBaseAddress,        // base of memory area
            //                  LPVOID lpBuffer,              // data buffer
            //                  SIZE_T nSize,                 // number of bytes to read
            //                  SIZE_T * lpNumberOfBytesRead  // number of bytes read
            //                  );
            [DllImport("kernel32.dll", SetLastError = true)]
            public static extern bool ReadProcessMemory(
              IntPtr hProcess,
              IntPtr lpBaseAddress,
              [Out] byte[] lpBuffer,
              uint dwSize,
              out int lpNumberOfBytesRead
             );

            //          BOOL WriteProcessMemory(
            //                  HANDLE hProcess,                // handle to process
            //                  LPVOID lpBaseAddress,           // base of memory area
            //                  LPCVOID lpBuffer,               // data buffer
            //                  SIZE_T nSize,                   // count of bytes to write
            //                  SIZE_T * lpNumberOfBytesWritten // count of bytes written
            //                  );
            [DllImport("kernel32.dll", SetLastError = true)]
            public static extern bool WriteProcessMemory(
                IntPtr hProcess,
                IntPtr lpBaseAddress, 
                byte[] lpBuffer, 
                uint nSize, 
                out UIntPtr lpNumberOfBytesWritten);


        }

        #region IMemoryReader Members
        #region public bool ReadFirstNonZeroByte(uint MemoryAddress, uint bytesToRead, out int address)
        public bool ReadFirstNonZeroByte(int MemoryAddress, uint bytesToRead, out int address)
        {
            //logger.Info.WriteLine("Dumping memory (0x{0:x8}-0x{1:x8}) from pid=({2})", MemoryAddress, MemoryAddress + bytesToRead, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
            address = 0;
            uint byte_alignment = 1;
            // get common init parameters
            //InitMemoryDump(out byte_alignment);
            int mem_address = MemoryAddress;
            uint _bytesToRead = bytesToRead;
            byte[] buffer = new byte[] { };
            try
            {
                //using (MemoryStream ms = new MemoryStream())
                //{
                //    //BinaryWriter bw = new BinaryWriter(ms);
                //    //foreach (byte b in data) { bw.Write(b); }
                for (uint i = 0; i <= bytesToRead; )
                {
                    if (_bytesToRead < byte_alignment)
                    {
                        _bytesToRead = bytesToRead;
                        buffer = new byte[_bytesToRead];
                    }
                    else
                    {
                        _bytesToRead = byte_alignment;
                        buffer = new byte[byte_alignment];
                    }
                    int bytesRead = 0;
                    ReadProcessMemory(mem_address, _bytesToRead, out bytesRead, out buffer);
                    if (buffer.Length == 0 && bytesRead == 0)
                    {
                        throw new Exception(string.Format("Failed to read memory from process: {0}", ReadProcess.ToString()));
                    }
                    //bw.Write(buffer);
                    //bw.Flush();
                    if (_bytesToRead < byte_alignment)
                    {
                        i += _bytesToRead;
                        mem_address += (int)_bytesToRead;
                    }
                    else
                    {
                        i += byte_alignment;
                        mem_address += (int)byte_alignment;
                    }
                    for (uint j = 0; j < buffer.Length; j++)
                    {
                        if (buffer[j] != 0)
                        {
                            address = mem_address;
                            break;
                        }
                    }
                    if (address != 0)
                        break;
                }
                //    bw.Close();
                //}
                //logger.Info.WriteLine("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({2})", MemoryAddress, MemoryAddress + bytesToRead, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
                return true;
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("ReadFirstNonZeroByte() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (OutOfMemoryException ex)
            {
                logger.Error.WriteLine("ReadFirstNonZeroByte(): OutOfMemoryException");
                logger.Error.WriteLine(ex.ToString());
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine("ReadFirstNonZeroByte(): Exception");
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            return false;
        }
        #endregion

        public void ReadProcessMemoryAtOnce(uint MemoryAddress, uint bytesToRead, out int bytesRead, out byte[] data)
        {
            Stopwatch st = new Stopwatch();
            st.Start();
            uint size = 1024 * 64;
            List<byte> buffer_list = new List<byte>();
            for (uint j = MemoryAddress; j < bytesToRead; j += size)
            {
                ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)j, (int)size);
                byte[] bigMem = mem.Read();
                foreach (byte b in bigMem) { buffer_list.Add(b); }
                bigMem = null;
            }
            bytesRead = buffer_list.Count;
            data = new byte[bytesToRead];
            data.Initialize();
            Buffer.BlockCopy(buffer_list.ToArray(), 0, data, 0, (int)bytesToRead);
            st.Stop();
            logger.Profiler.WriteLine("ReadProcessMemoryAtOnce(): start=0x{0:x8} end=0x{1:x8} took {2:0.0000} seconds", MemoryAddress, MemoryAddress + bytesToRead, st.Elapsed.TotalSeconds);
        }

        #region public void ReadProcessMemory(int MemoryAddress, uint bytesToRead, out int bytesRead, out byte[] data)
        public void ReadProcessMemory(int MemoryAddress, uint bytesToRead, out int bytesRead, out byte[] data)
        {
            ReadProcessMemory((uint)MemoryAddress, bytesToRead, out bytesRead, out data);
        }
        public void ReadProcessMemory(uint MemoryAddress, uint bytesToRead, out int bytesRead, out byte[] data)
        {
            try
            {
                bytesRead = 0;
                data = new byte[bytesToRead];
                const int alignment = 1;
                List<byte> buffer_list = new List<byte>();
                uint _MemoryAddress = MemoryAddress;
                for (int i = 0; i < bytesToRead; i++)
                {
                    byte[] buffer = new byte[alignment];
                    int _bytesRead = 0;
                    MEMORY_BASIC_INFORMATION m;
                    ProcessMemoryReaderApi.VirtualQueryEx(m_ReadProcess.Handle, (IntPtr)_MemoryAddress, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));

                    if (m.AllocationProtect.HasFlag(AllocationProtect.PAGE_NOACCESS) ||
                        m.AllocationProtect == 0)
                    {
                        uint OrignalAddress = _MemoryAddress;
                        while (m.AllocationProtect.HasFlag(AllocationProtect.PAGE_NOACCESS) || m.AllocationProtect == 0)
                        {
                            ProcessMemoryReaderApi.VirtualQueryEx(m_ReadProcess.Handle, (IntPtr)_MemoryAddress, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
                            _MemoryAddress++;
                            buffer_list.Add(0);
                        }
                        _MemoryAddress--;
                        uint diff = _MemoryAddress - OrignalAddress;
                        i += (int)diff;
                        buffer_list.RemoveAt(buffer_list.Count-1);
                    }

                    ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)_MemoryAddress, buffer, alignment, out _bytesRead);
                    int LastError = Marshal.GetLastWin32Error();
                    if (LastError != ResultWin32.ERROR_SUCCESS)
                    {
                        string ErrorName = ResultWin32.GetErrorName(LastError);
                    }
                    if (_bytesRead > 0)
                    {
                        foreach (byte b in buffer)
                        {
                            buffer_list.Add(b);
                        }
                        _MemoryAddress += (uint)buffer.Length;
                    }
                }
                bytesRead = buffer_list.Count;
                Buffer.BlockCopy(buffer_list.ToArray(), 0, data, 0, (int)bytesToRead);
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("ReadProcessMemory() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine("ReadProcessMemory(): Exception");
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
        }
        #endregion
        #endregion

        #region IMemoryWriter Members
        #region public void WriteProcessMemory(uint MemoryAddress, byte[] bytesToWrite, out int bytesWritten)
        public void WriteProcessMemory(int MemoryAddress, byte[] bytesToWrite, out int bytesWritten)
        {
            uint _bytesWritten = 0;
            WriteProcessMemory((uint)MemoryAddress, bytesToWrite, out _bytesWritten);
            bytesWritten = (int)_bytesWritten;
        }
        public void WriteProcessMemory(uint MemoryAddress, byte[] bytesToWrite, out uint bytesWritten)
        {
            try
            {
                uint _bytesWritten = 0;
                uint _MemoryAddress = MemoryAddress;
                for (int i = 0; i < bytesToWrite.Length; i++)
                {
                    UIntPtr _ptrBytesWritten = UIntPtr.Zero;
                    byte[] buffer = new byte[] { bytesToWrite[i] };
                    ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)_MemoryAddress, buffer, (uint)buffer.Length, out _ptrBytesWritten);
                    _MemoryAddress++;
                    _bytesWritten++;
                }
                bytesWritten = _bytesWritten;
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("WriteProcessMemory() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (Exception ex)
            {

                logger.Error.WriteLine("WriteProcessMemory() Exception");
                logger.Error.WriteLine(ex.ToString());
                bytesWritten = 0;
                throw ex;
            }
        }
         #endregion
        #endregion

        #region IFileWriter Members
        #region public bool WriteProcessMemoryToFile(string filename, uint MemoryAddress, uint bytesToRead, out int bytesRead)
        public bool WriteProcessMemoryToFile(string filename, int MemoryAddress, uint bytesToRead, out int bytesRead)
        {
            //logger.Info.WriteLine("Dumping memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", MemoryAddress, MemoryAddress + bytesToRead, filename, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
            bytesRead = 0;
            uint byte_alignment = 102400;
            int address = MemoryAddress;
            uint _bytesToRead = bytesToRead;
            byte[] buffer = new byte[] { };
            try
            {
                FileInfo fi = new FileInfo(filename);
                if (fi.Exists)
                    fi.Delete();
                using (FileStream fs = new FileStream(filename, FileMode.CreateNew, FileAccess.ReadWrite, FileShare.ReadWrite))
                {
                    BinaryWriter bw = new BinaryWriter(fs);
                    //foreach (byte b in data) { bw.Write(b); }

                    for (uint i = 0; i <= bytesToRead; )
                    {
                        if (_bytesToRead < byte_alignment)
                        {
                            _bytesToRead = bytesToRead;
                            buffer = new byte[_bytesToRead];
                        }
                        else
                        {
                            _bytesToRead = byte_alignment;
                            buffer = new byte[byte_alignment];
                        }
                        ReadProcessMemory(address, _bytesToRead, out bytesRead, out buffer);
                        bw.Write(buffer);
                        bw.Flush();

                        if (_bytesToRead < byte_alignment)
                        {
                            i += _bytesToRead;
                            address += (int)_bytesToRead;
                        }
                        else
                        {
                            i += byte_alignment;
                            address += (int)byte_alignment;
                        }


                    }
                    bw.Close();
                }
                logger.Info.WriteLine("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", MemoryAddress, MemoryAddress + bytesToRead, filename, string.Format("0x{0:x4} {1}.exe", ReadProcess.Id, ReadProcess.ProcessName));
                return true;
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (OutOfMemoryException ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile(): Exception");
                logger.Error.WriteLine(ex.ToString());
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile(): Exception");
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            return false;
        }
        #endregion
        #endregion

        #region IPatchMemory members
        #region public virtual bool PatchMemory(uint address, byte value)
        public virtual bool PatchMemory(uint address, byte value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            byte check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, sbyte value)
        public virtual bool PatchMemory(uint address, sbyte value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            sbyte check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, ushort value)
        public virtual bool PatchMemory(uint address, ushort value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            ushort check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, short value)
        public virtual bool PatchMemory(uint address, short value)
        {           
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            short check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, uint value)
        public virtual bool PatchMemory(uint address, uint value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            uint check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, int value)
        public virtual bool PatchMemory(uint address, int value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            int check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, ulong value)
        public virtual bool PatchMemory(uint address, ulong value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            ulong check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, long value)
        public virtual bool PatchMemory(uint address, long value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            UIntPtr ptrBytesWritten;
            ProcessMemoryReaderApi.WriteProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            if (ptrBytesWritten.ToUInt32() == 0)
                return false;
            long check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #endregion

        #region IReadMemory members
        #region public virtual bool ReadMemory(uint address, out byte value)
        public virtual bool ReadMemory(uint address, out byte value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(byte);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = bitData[0];
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out sbyte value)
        public virtual bool ReadMemory(uint address, out sbyte value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(sbyte);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = Convert.ToSByte(bitData[0]);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out ushort value)
        public virtual bool ReadMemory(uint address, out ushort value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(ushort);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = BitConverter.ToUInt16(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out short value)
        public virtual bool ReadMemory(uint address, out short value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(short);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = BitConverter.ToInt16(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out uint value)
        public virtual bool ReadMemory(uint address, out uint value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(uint);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = BitConverter.ToUInt32(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out int value)
        public virtual bool ReadMemory(uint address, out int value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(int);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = BitConverter.ToInt32(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out ulong value)
        public virtual bool ReadMemory(uint address, out ulong value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(ulong);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = BitConverter.ToUInt64(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out long value)
        public virtual bool ReadMemory(uint address, out long value)
        {
            value = 0;           
            try
            {
                int bytesRead;
                uint size = sizeof(long);
                byte[] bitData = new byte[size];
                ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(m_ReadProcess.Handle, (IntPtr)address, bitData, size, out bytesRead);
                if (bytesRead == 0)
                    return false;
                value = BitConverter.ToInt64(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #endregion
    }
    #endregion
}
Revision:	404
Committed:	Thu Jun 21 12:51:57 2012 UTC (10 years, 7 months ago) by william
File size:	33809 byte(s)
Log Message: