Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // REQUIRED CONSTS
- const int PROCESS_QUERY_INFORMATION = 0x0400;
- const int MEM_COMMIT = 0x00001000;
- const int PAGE_READWRITE = 0x04;
- const int PROCESS_WM_READ = 0x0010;
- // REQUIRED METHODS
- [DllImport("kernel32.dll")]
- public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
- [DllImport("kernel32.dll")]
- public static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
- [DllImport("kernel32.dll")]
- static extern void GetSystemInfo(out SYSTEM_INFO lpSystemInfo);
- [DllImport("kernel32.dll", SetLastError = true)]
- static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);
- // REQUIRED STRUCTS
- public struct MEMORY_BASIC_INFORMATION {
- public int BaseAddress;
- public int AllocationBase;
- public int AllocationProtect;
- public int RegionSize;
- public int State;
- public int Protect;
- public int lType;
- }
- public struct SYSTEM_INFO {
- public ushort processorArchitecture;
- ushort reserved;
- public uint pageSize;
- public IntPtr minimumApplicationAddress;
- public IntPtr maximumApplicationAddress;
- public IntPtr activeProcessorMask;
- public uint numberOfProcessors;
- public uint processorType;
- public uint allocationGranularity;
- public ushort processorLevel;
- public ushort processorRevision;
- }
- public static void locateMemoryForProcess(Process process) {
- long addrCount = 0;
- SYSTEM_INFO sys_info = new SYSTEM_INFO();
- GetSystemInfo(out sys_info);
- IntPtr proc_min_address = sys_info.minimumApplicationAddress;
- IntPtr proc_max_address = sys_info.maximumApplicationAddress;
- long proc_min_address_l = (long)proc_min_address;
- long proc_max_address_l = (long)proc_max_address;
- IntPtr processHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_WM_READ, false, process.Id);
- MEMORY_BASIC_INFORMATION mem_basic_info = new MEMORY_BASIC_INFORMATION();
- int bytesRead = 0; // number of bytes read with ReadProcessMemory
- uint infoSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(mem_basic_info);
- VirtualQueryEx(processHandle, proc_min_address, out mem_basic_info, infoSize);
- var err = Marshal.GetLastWin32Error();
- Console.WriteLine("Error : " + err);
- ...
Add Comment
Please, Sign In to add comment