Win32/Sojaner.MemoryScanner/MemoryScanner.cs

#region Logging Defines
// include this any class or method that required logging, and comment-out what is not needed

#region Enabled logging levels
#define LOGGING_ENABLE_INFO
#define LOGGING_ENABLE_WARN
#define LOGGING_ENABLE_DEBUG
#define LOGGING_ENABLE_VERBOSEDEBUG
#define LOGGING_ENABLE_ERROR
#define LOGGING_ENABLE_VERBOSEERROR
//#define LOGGING_ENABLE_PROFILER
#endregion
#endregion
using System;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics;
using System.Threading;
using System.Runtime.InteropServices;
using RomCheater.Logging;
using System.IO;
using Sojaner.MemoryScanner.MemoryProviers;
using Microsoft.Win32.SafeHandles;
using Microsoft.Win32.Interop;
using System.ComponentModel;
using ManagedWinapi;
using RomCheater.PluginFramework.Events;

namespace Sojaner.MemoryScanner
{
    // code borrowed from: http://www.codeproject.com/KB/cs/sojaner_memory_scanner.aspx    
    #region ProcessMemoryReader class
    //Thanks goes to Arik Poznanski for P/Invokes and methods needed to read and write the Memory
    //For more information refer to "Minesweeper, Behind the scenes" article by Arik Poznanski at Codeproject.com
    internal class ProcessMemoryReader : IMemoryReader, IMemoryWriter, IFileWriter, IPatchMemory,IReadMemory, IAcceptsBytesReadEvent
    {
        // constants information can be found in <winnt.h>
        [Flags]
        enum ProcessAccessFlags : uint
        {
            All = 0x001F0FFF,
            Terminate = 0x00000001,
            CreateThread = 0x00000002,
            VMOperation = 0x00000008,
            VMRead = 0x00000010,
            VMWrite = 0x00000020,
            DupHandle = 0x00000040,
            SetInformation = 0x00000200,
            QueryInformation = 0x00000400,
            Synchronize = 0x00100000
        }
        [Flags]
        public enum AllocationProtect : uint
        {
            // http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx
            NONE = 0,
            PAGE_NOACCESS = 0x00000001,
            PAGE_READONLY = 0x00000002,
            PAGE_READWRITE = 0x00000004,
            PAGE_WRITECOPY = 0x00000008,
            PAGE_EXECUTE = 0x00000010,
            PAGE_EXECUTE_READ = 0x00000020,
            PAGE_EXECUTE_READWRITE = 0x00000040,
            PAGE_EXECUTE_WRITECOPY = 0x00000080,     
            PAGE_GUARD = 0x00000100,
            PAGE_NOCACHE = 0x00000200,
            PAGE_WRITECOMBINE = 0x00000400
        }
        [StructLayout(LayoutKind.Sequential)]
        public struct MEMORY_BASIC_INFORMATION
        {
            public IntPtr BaseAddress;
            public IntPtr AllocationBase;
            public AllocationProtect AllocationProtect;
            public IntPtr RegionSize;
            public uint State;
            public uint Protect;
            public uint Type;
        }

        public ProcessMemoryReader()
        {
        }
        public event BaseEventHandler<OnBytesReadEventArgs> OnBytesRead;
        /// <summary>   
        /// Process from which to read          
        /// </summary>
        public Process ReadProcess
        {
            get
            {
                return m_ReadProcess;
            }
            set
            {
                m_ReadProcess = value;
            }
        }

        private Process m_ReadProcess = null;

        //SafeWaitHandle handle;
        //private IntPtr handle = IntPtr.Zero;
        //SafeWaitHandle m_hProcess; /* unused */
        //public void OpenProcess()
        //{
        //    try
        //    {
        //        //                    m_hProcess = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ, 1, (uint)m_ReadProcess.Id);
        //        //if (!TokenAdjuster.AdjustProcessTokenPrivileges("SeDebugPrivilege"))
        //        //{
        //        //    logger.Warn.WriteLine("Failed to set SeDebugPrivilege on current process");
        //        //}
        //        ProcessAccessFlags access;
        //        access = ProcessAccessFlags.VMRead
        //            | ProcessAccessFlags.VMWrite
        //            | ProcessAccessFlags.VMOperation;
        //        //m_hProcess = ProcessMemoryReaderApi.OpenProcess((uint)access, 1, (uint)m_ReadProcess.Id);
        //        handle = ProcessMemoryReaderApi.OpenProcess(access, true, m_ReadProcess.Id);
        //        //m_hProcess = new SafeWaitHandle(handle, false);
        //    }
        //    catch (SEHException ex)
        //    {
        //        logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
        //        logger.Error.WriteLine(ex.ToString());
        //        throw ex;
        //    }
        //    catch (Exception ex)
        //    {
        //        logger.Error.WriteLine(ex.ToString());
        //        throw ex;
        //    }
        //}

        //public void CloseHandle()
        //{
        //    try
        //    {
        //        ////if (handle.IsInvalid) { return; }
        //        ////if (handle.IsClosed) { return; }
        //        //m_hProcess.Close();
        //        //m_hProcess.Dispose();
        //        //m_hProcess = null;
        //        //handle = IntPtr.Zero;
        //        //m_ReadProcess = null;
        //        //string stack_trace = System.Environment.StackTrace;
        //        int iRetValue;
        //        iRetValue = ProcessMemoryReaderApi.CloseHandle(handle);
        //        handle = IntPtr.Zero;
        //        ReadProcess = null;
        //        if (iRetValue == 0)
        //        {
        //            throw new Exception("CloseHandle failed");
        //        }
        //    }
        //    catch (SEHException ex)
        //    {
        //        logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
        //        logger.Error.WriteLine(ex.ToString());
        //        throw ex;
        //    }
        //    catch (Exception ex)
        //    {
        //        logger.Error.WriteLine(ex.ToString());
        //        throw ex;
        //    }
        //}
        ///// <summary>
        ///// ProcessMemoryReader is a class that enables direct reading a process memory
        ///// </summary>
        //private class ProcessMemoryReaderApi
        ////{
        //[DllImport("kernel32.dll")]
        //public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);

        //    // function declarations are found in the MSDN and in <winbase.h> 

        //    //                HANDLE OpenProcess(
        //    //                        DWORD dwDesiredAccess,  // access flag
        //    //                        BOOL bInheritHandle,    // handle inheritance option
        //    //                        DWORD dwProcessId       // process identifier
        //    //                        );
        //    [DllImport("kernel32.dll")]
        //    public static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);

        //    //                BOOL CloseHandle(
        //    //                        HANDLE hObject   // handle to object
        //    //                        );
        //    [DllImport("kernel32.dll")]
        //    public static extern Int32 CloseHandle(IntPtr hObject);

        //    //                BOOL ReadProcessMemory(
        //    //                        HANDLE hProcess,              // handle to the process
        //    //                        LPCVOID lpBaseAddress,        // base of memory area
        //    //                        LPVOID lpBuffer,              // data buffer
        //    //                        SIZE_T nSize,                 // number of bytes to read
        //    //                        SIZE_T * lpNumberOfBytesRead  // number of bytes read
        //    //                        );
        //    [DllImport("kernel32.dll", SetLastError = true)]
        //    public static extern bool ReadProcessMemory(
        //      IntPtr hProcess,
        //      IntPtr lpBaseAddress,
        //      [Out] byte[] lpBuffer,
        //      uint dwSize,
        //      out int lpNumberOfBytesRead
        //     );

        //    //                BOOL WriteProcessMemory(
        //    //                        HANDLE hProcess,                // handle to process
        //    //                        LPVOID lpBaseAddress,           // base of memory area
        //    //                        LPCVOID lpBuffer,               // data buffer
        //    //                        SIZE_T nSize,                   // count of bytes to write
        //    //                        SIZE_T * lpNumberOfBytesWritten // count of bytes written
        //    //                        );
        //    [DllImport("kernel32.dll", SetLastError = true)]
        //    public static extern bool WriteProcessMemory(
        //        IntPtr hProcess,
        //        IntPtr lpBaseAddress, 
        //        byte[] lpBuffer, 
        //        uint nSize, 
        //        out UIntPtr lpNumberOfBytesWritten);


        //}

        #region IMemoryReader Members
        #region public bool ReadFirstNonZeroByte(uint MemoryAddress, uint bytesToRead, out int address)
        public bool ReadFirstNonZeroByte(ulong MemoryAddress, ulong bytesToRead, out ulong address)
        {
            //logger.Info.WriteLine("Dumping memory (0x{0:x8}-0x{1:x8}) from pid=({2})", MemoryAddress, MemoryAddress + bytesToRead, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
            address = 0;
            uint byte_alignment = 1;
            // get common init parameters
            //InitMemoryDump(out byte_alignment);
            ulong mem_address = MemoryAddress;
            ulong _bytesToRead = bytesToRead;
            byte[] buffer = new byte[] { };
            try
            {
                //using (MemoryStream ms = new MemoryStream())
                //{
                //    //BinaryWriter bw = new BinaryWriter(ms);
                //    //foreach (byte b in data) { bw.Write(b); }
                for (ulong i = 0; i <= bytesToRead; )
                {
                    if (_bytesToRead < byte_alignment)
                    {
                        _bytesToRead = bytesToRead;
                        buffer = new byte[_bytesToRead];
                    }
                    else
                    {
                        _bytesToRead = byte_alignment;
                        buffer = new byte[byte_alignment];
                    }
                    ulong bytesRead = 0;
                    ReadProcessMemory(mem_address, _bytesToRead, out bytesRead, out buffer);
                    if (buffer.Length == 0 && bytesRead == 0)
                    {
                        throw new Exception(string.Format("Failed to read memory from process: {0}", ReadProcess.ToString()));
                    }
                    //bw.Write(buffer);
                    //bw.Flush();
                    if (_bytesToRead < byte_alignment)
                    {
                        i += _bytesToRead;
                        mem_address += (ulong)_bytesToRead;
                    }
                    else
                    {
                        i += byte_alignment;
                        mem_address += (ulong)byte_alignment;
                    }
                    for (uint j = 0; j < buffer.Length; j++)
                    {
                        if (buffer[j] != 0)
                        {
                            address = mem_address;
                            break;
                        }
                    }
                    if (address != 0)
                        break;
                }
                //    bw.Close();
                //}
                //logger.Info.WriteLine("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({2})", MemoryAddress, MemoryAddress + bytesToRead, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
                return true;
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("ReadFirstNonZeroByte() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (OutOfMemoryException ex)
            {
                logger.Error.WriteLine("ReadFirstNonZeroByte(): OutOfMemoryException");
                logger.Error.WriteLine(ex.ToString());
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine("ReadFirstNonZeroByte(): Exception");
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            return false;
        }
        #endregion


        public List<MEMORY_REGION_INFORMATION> QueryMemoryRegions(ulong start, ulong size)
        {
            List<MEMORY_REGION_INFORMATION> regions = new List<MEMORY_REGION_INFORMATION>();
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)0, 0))
            {
                regions = mem.QueryMemoryRegions(start, size);
            }
            return regions;
        }

        public void UpdateAddressArray(ulong[] addresses, ulong size, out byte[][] values)
        {
            // size = size of data to read at each address
            values = new byte[addresses.Length][];
            for (int x = 0; x < values.Length; x++) { values[x] = new byte[size]; }

            for (ulong i = 0; i < (ulong)addresses.Length; i++)
            {
                byte[] data = new byte[size];
                ulong bytesRead = 0;
                var address = addresses[i];
                this.ReadProcessMemory(address, size, out bytesRead, out data);
                values[i] = data;
            }
        }


        public void ReadProcessMemoryAtOnce(ulong MemoryAddress, ulong bytesToRead, object UserState)
        {
            uint size = 128;
            //int count = 0;
            for (ulong j = MemoryAddress; j < (MemoryAddress + bytesToRead); j += size)
            {
                using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)j, (int)size))
                {
                    byte[] bigMem = mem.Read();
                    //count += bigMem.Length;
                    if (this.OnBytesRead != null)
                    {
                        OnBytesReadEventArgs t = new OnBytesReadEventArgs(this, UserState, bigMem, j, bytesToRead);
                        this.OnBytesRead.Invoke(t);
                        if (t.Canceled)
                        {
                            bigMem = null;
                            break;
                        }
                        
                    }
                    bigMem = null;
                }
            }
        }
        public void ReadProcessMemoryAtOnce(ulong MemoryAddress, ulong bytesToRead, out ulong bytesRead, out byte[] data)
        {
            Stopwatch st = new Stopwatch();
            st.Start();
            List<byte> buffer_list = new List<byte>();
            //for (uint j = MemoryAddress; j < (MemoryAddress+bytesToRead); j += size)
            //{
            //    using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)j, (int)bytesToRead))
            //    {
            //        byte[] bigMem = mem.Read();
            //        foreach (byte b in bigMem) { buffer_list.Add(b); }
            //        bigMem = null;
            //    }
            //}

            
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)MemoryAddress, (int)bytesToRead))
            {
                byte[] bigMem = mem.Read();
                foreach (byte b in bigMem) { buffer_list.Add(b); }
                bigMem = null;
            }

            bytesRead = (ulong)buffer_list.Count;
            data = new byte[bytesToRead];
            data.Initialize();
            Buffer.BlockCopy(buffer_list.ToArray(), 0, data, 0, (int)bytesToRead);
            st.Stop();
            logger.Profiler.WriteLine("ReadProcessMemoryAtOnce(): start=0x{0:x8} end=0x{1:x8} took {2:0.0000} seconds", MemoryAddress, MemoryAddress + bytesToRead, st.Elapsed.TotalSeconds);
        }
        #region public void ReadProcessMemory(int MemoryAddress, uint bytesToRead, out int bytesRead, out byte[] data)
        public void ReadProcessMemory(long MemoryAddress, long bytesToRead, out ulong bytesRead, out byte[] data)
        {
            ReadProcessMemory((ulong)MemoryAddress, (ulong)bytesToRead, out bytesRead, out data);
        }
        public void ReadProcessMemory(ulong MemoryAddress, ulong bytesToRead, out ulong bytesRead, out byte[] data)
        {
            try
            {
                ReadProcessMemoryAtOnce(MemoryAddress, bytesToRead, out bytesRead, out data);
                //bytesRead = 0;
                //data = new byte[bytesToRead];
                //const int alignment = 1;
                //List<byte> buffer_list = new List<byte>();
                //uint _MemoryAddress = MemoryAddress;
                //for (int i = 0; i < bytesToRead; i++)
                //{
                //    byte[] buffer = new byte[alignment];
                //    int _bytesRead = 0;
                //    MEMORY_BASIC_INFORMATION m;
                //    ProcessMemoryReaderApi.VirtualQueryEx(m_ReadProcess.Handle, (IntPtr)_MemoryAddress, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));

                //    if (m.AllocationProtect.HasFlag(AllocationProtect.PAGE_NOACCESS) ||
                //        m.AllocationProtect == 0)
                //    {
                //        uint OrignalAddress = _MemoryAddress;
                //        while (m.AllocationProtect.HasFlag(AllocationProtect.PAGE_NOACCESS) || m.AllocationProtect == 0)
                //        {
                //            ProcessMemoryReaderApi.VirtualQueryEx(m_ReadProcess.Handle, (IntPtr)_MemoryAddress, out m, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
                //            _MemoryAddress++;
                //            buffer_list.Add(0);
                //        }
                //        _MemoryAddress--;
                //        uint diff = _MemoryAddress - OrignalAddress;
                //        i += (int)diff;
                //        buffer_list.RemoveAt(buffer_list.Count-1);
                //    }

                //    ProcessMemoryReader.ProcessMemoryReaderApi.ReadProcessMemory(handle, (IntPtr)_MemoryAddress, buffer, alignment, out _bytesRead);
                //    int LastError = Marshal.GetLastWin32Error();
                //    if (LastError != ResultWin32.ERROR_SUCCESS)
                //    {
                //        string ErrorName = ResultWin32.GetErrorName(LastError);
                //    }
                //    if (_bytesRead > 0)
                //    {
                //        foreach (byte b in buffer)
                //        {
                //            buffer_list.Add(b);
                //        }
                //        _MemoryAddress += (uint)buffer.Length;
                //    }
                //}
                //bytesRead = buffer_list.Count;
                //Buffer.BlockCopy(buffer_list.ToArray(), 0, data, 0, (int)bytesToRead);
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("ReadProcessMemory() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine("ReadProcessMemory(): Exception");
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
        }
        #endregion
        #endregion

        #region IMemoryWriter Members
        #region public void WriteProcessMemory(uint MemoryAddress, byte[] bytesToWrite, out int bytesWritten)
        public void WriteProcessMemory(long MemoryAddress, byte[] bytesToWrite, out ulong bytesWritten)
        {
            ulong _bytesWritten = 0;
            WriteProcessMemory((ulong)MemoryAddress, bytesToWrite, out _bytesWritten);
            bytesWritten = (ulong)_bytesWritten;
        }
        public void WriteProcessMemory(ulong MemoryAddress, byte[] bytesToWrite, out ulong bytesWritten)
        {
            try
            {
                //uint _bytesWritten = 0;
                ulong _MemoryAddress = MemoryAddress;

                using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)MemoryAddress, (int)bytesToWrite.Length))
                {
                    mem.Write(0, bytesToWrite);
                }

                //for (int i = 0; i < bytesToWrite.Length; i++)
                //{
                //    UIntPtr _ptrBytesWritten = UIntPtr.Zero;
                //    byte[] buffer = new byte[] { bytesToWrite[i] };
                //    ProcessMemoryReaderApi.WriteProcessMemory(handle, (IntPtr)_MemoryAddress, buffer, (uint)buffer.Length, out _ptrBytesWritten);
                //    _MemoryAddress++;
                //    _bytesWritten++;
                //}
                //bytesWritten = _bytesWritten;
                bytesWritten = (uint)bytesToWrite.Length;
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("WriteProcessMemory() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (Exception ex)
            {

                logger.Error.WriteLine("WriteProcessMemory() Exception");
                logger.Error.WriteLine(ex.ToString());
                bytesWritten = 0;
                throw ex;
            }
        }
         #endregion
        #endregion

        #region IFileWriter Members
        #region public bool WriteProcessMemoryToFile(string filename, uint MemoryAddress, uint bytesToRead, out int bytesRead)
        public bool WriteProcessMemoryToFile(string filename, ulong MemoryAddress, ulong bytesToRead, out ulong bytesRead)
        {
            //logger.Info.WriteLine("Dumping memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", MemoryAddress, MemoryAddress + bytesToRead, filename, string.Format("0x{0:x4} {1}.exe", ppid.Id, ppid.ProcessName));
            bytesRead = 0;
            ulong _bytesRead = 0;
            //uint byte_alignment = 102400;
            ulong address = MemoryAddress;
            //ulong _bytesToRead = bytesToRead;
            byte[] buffer = new byte[] { };
            try
            {
                const ulong MEM_1KB = 1024;
                const ulong MEM_1MB = MEM_1KB * MEM_1KB;
                const ulong ByteChunkSize = MEM_1MB * 32;
                FileInfo fi = new FileInfo(filename);
                if (fi.Exists)
                    fi.Delete();
                using (FileStream fs = new FileStream(filename, FileMode.CreateNew, FileAccess.ReadWrite, FileShare.ReadWrite))
                {
                    using (BinaryWriter bw = new BinaryWriter(fs))
                    {
                        ulong addr = MemoryAddress;
                        for (ulong i = 0; i < bytesToRead; i += ByteChunkSize)
                        {
                            addr += i;
                            this.ReadProcessMemory(addr, ByteChunkSize, out bytesRead, out buffer);
                            if (bytesRead == ByteChunkSize)
                            {
                                _bytesRead += ByteChunkSize;
                                foreach (var b in buffer)
                                {
                                    bw.Write(b);
                                }
                            }
                            else
                            {
                                throw new InvalidOperationException("Failed to read a byte from memory");
                            }
                        }
                        bw.Flush();
                        bw.Close();                        
                    }
                    bytesRead = _bytesRead;
                }
                logger.Info.WriteLine("Succefully dumped memory (0x{0:x8}-0x{1:x8}) from pid=({3}) to file {2}", MemoryAddress, MemoryAddress + bytesToRead, filename, string.Format("0x{0:x4} {1}.exe", ReadProcess.Id, ReadProcess.ProcessName));
                return true;
            }
            catch (SEHException ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile() SEHException was thrown: (0x{0:x8}) - {1}", ex.ErrorCode, ex.Message);
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            catch (OutOfMemoryException ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile(): Exception");
                logger.Error.WriteLine(ex.ToString());
            }
            catch (Exception ex)
            {
                logger.Error.WriteLine("WriteProcessMemoryToFile(): Exception");
                logger.Error.WriteLine(ex.ToString());
                throw ex;
            }
            return false;
        }
        #endregion
        #endregion

        #region IPatchMemory members
        #region public virtual bool PatchMemory(uint address, byte value)
        public virtual bool PatchMemory(ulong address, byte value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //ProcessMemoryReaderApi.WriteProcessMemory(handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            byte check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, sbyte value)
        public virtual bool PatchMemory(ulong address, sbyte value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //ProcessMemoryReaderApi.WriteProcessMemory(handle, (IntPtr)address, bitData, (uint)bitData.Length, out ptrBytesWritten);
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            sbyte check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, ushort value)
        public virtual bool PatchMemory(ulong address, ushort value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            ushort check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, short value)
        public virtual bool PatchMemory(ulong address, short value)
        {           
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            short check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, uint value)
        public virtual bool PatchMemory(ulong address, uint value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            uint check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, int value)
        public virtual bool PatchMemory(ulong address, int value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            int check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, ulong value)
        public virtual bool PatchMemory(ulong address, ulong value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            ulong check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #region public virtual bool PatchMemory(uint address, long value)
        public virtual bool PatchMemory(ulong address, long value)
        {
            byte[] bitData = BitConverter.GetBytes(value);
            //UIntPtr ptrBytesWritten;
            using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address,(int)bitData.Length))
            {
                mem.Write(0, bitData);
            }
            //if (ptrBytesWritten.ToUInt32() == 0)
            //    return false;
            long check = 0;
            ReadMemory(address, out check);
            if (check == value) return true;
            return false;
        }
        #endregion
        #endregion

        #region IReadMemory members
        #region public virtual bool ReadMemory(uint address, out byte value)
        public virtual bool ReadMemory(ulong address, out byte value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(byte);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }                
                //if (bytesRead == 0)
                //    return false;
                value = bitData[0];
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out sbyte value)
        public virtual bool ReadMemory(ulong address, out sbyte value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(sbyte);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = Convert.ToSByte(bitData[0]);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out ushort value)
        public virtual bool ReadMemory(ulong address, out ushort value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(ushort);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = BitConverter.ToUInt16(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out short value)
        public virtual bool ReadMemory(ulong address, out short value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(short);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = BitConverter.ToInt16(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out uint value)
        public virtual bool ReadMemory(ulong address, out uint value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(uint);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = BitConverter.ToUInt32(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out int value)
        public virtual bool ReadMemory(ulong address, out int value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(int);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = BitConverter.ToInt32(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out ulong value)
        public virtual bool ReadMemory(ulong address, out ulong value)
        {
            value = 0;           
            try
            {
                //int bytesRead;
                uint size = sizeof(ulong);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = BitConverter.ToUInt64(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #region public virtual bool ReadMemory(uint address, out long value)
        public virtual bool ReadMemory(ulong address, out long value)
        {
            value = 0;           
            try
            {
               // int bytesRead;
                uint size = sizeof(long);
                byte[] bitData = new byte[size];
              using (ProcessMemoryChunk mem = new ProcessMemoryChunk(m_ReadProcess, (IntPtr)address, (int)size))
                {
                   bitData = mem.Read(0, (int)size);
                }  
                //if (bytesRead == 0)
                //    return false;
                value = BitConverter.ToInt64(bitData, 0);
                return true;
            }
            catch
            {
                value = 0x00;
                return false;
            }
        }
        #endregion
        #endregion
    }
    #endregion
}
Revision:	657
Committed:	Sun Jun 9 04:03:36 2013 UTC (10 years, 6 months ago) by william
File size:	38926 byte(s)
Log Message:	fix ram dump to file: * dump memory in 32mb chunks, this fixes issues with not being able to hold over 2GB in managed objects