sobinist

Untitled

Mar 30th, 2016
369
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 2.30 KB | None | 0 0
  1. // REQUIRED CONSTS
  2.  
  3. const int PROCESS_QUERY_INFORMATION = 0x0400;
  4. const int MEM_COMMIT = 0x00001000;
  5. const int PAGE_READWRITE = 0x04;
  6. const int PROCESS_WM_READ = 0x0010;
  7.  
  8.  
  9. // REQUIRED METHODS
  10.  
  11. [DllImport("kernel32.dll")]
  12. public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
  13.  
  14. [DllImport("kernel32.dll")]
  15. public static extern bool ReadProcessMemory(int hProcess, int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
  16.  
  17. [DllImport("kernel32.dll")]
  18. static extern void GetSystemInfo(out SYSTEM_INFO lpSystemInfo);
  19.  
  20. [DllImport("kernel32.dll", SetLastError = true)]
  21. static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);
  22.  
  23.  
  24. // REQUIRED STRUCTS
  25.  
  26. public struct MEMORY_BASIC_INFORMATION {
  27.   public int BaseAddress;
  28.   public int AllocationBase;
  29.   public int AllocationProtect;
  30.   public int RegionSize;
  31.   public int State;
  32.   public int Protect;
  33.   public int lType;
  34. }
  35.  
  36.  
  37. public struct SYSTEM_INFO {
  38.   public ushort processorArchitecture;
  39.   ushort reserved;
  40.   public uint pageSize;
  41.   public IntPtr minimumApplicationAddress;
  42.   public IntPtr maximumApplicationAddress;
  43.   public IntPtr activeProcessorMask;
  44.   public uint numberOfProcessors;
  45.   public uint processorType;
  46.   public uint allocationGranularity;
  47.   public ushort processorLevel;
  48.   public ushort processorRevision;
  49. }
  50.  
  51. public static void locateMemoryForProcess(Process process) {
  52.  
  53.     long addrCount = 0;
  54.  
  55.     SYSTEM_INFO sys_info = new SYSTEM_INFO();
  56.     GetSystemInfo(out sys_info);
  57.  
  58.     IntPtr proc_min_address = sys_info.minimumApplicationAddress;
  59.     IntPtr proc_max_address = sys_info.maximumApplicationAddress;
  60.  
  61.     long proc_min_address_l = (long)proc_min_address;
  62.     long proc_max_address_l = (long)proc_max_address;
  63.  
  64.     IntPtr processHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_WM_READ, false, process.Id);
  65.  
  66.     MEMORY_BASIC_INFORMATION mem_basic_info = new MEMORY_BASIC_INFORMATION();
  67.  
  68.     int bytesRead = 0;  // number of bytes read with ReadProcessMemory
  69.  
  70.     uint infoSize = (uint)System.Runtime.InteropServices.Marshal.SizeOf(mem_basic_info);
  71.     VirtualQueryEx(processHandle, proc_min_address, out mem_basic_info, infoSize);
  72.  
  73.     var err = Marshal.GetLastWin32Error();
  74.     Console.WriteLine("Error : " + err);
  75.  
  76.     ...
Add Comment
Please, Sign In to add comment