-
-
Notifications
You must be signed in to change notification settings - Fork 66
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
8 changed files
with
856 additions
and
390 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,20 +1,38 @@ | ||
using System; | ||
using System.Collections.Concurrent; | ||
using System.Diagnostics; | ||
using System.Text; | ||
using System.Threading; | ||
using System.Threading.Tasks; | ||
using static Memory.Imps; | ||
|
||
namespace Memory; | ||
|
||
public partial class Mem | ||
namespace Memory | ||
{ | ||
public string ReadStringMemory(nuint address, int length = 32, bool zeroTerminated = true, Encoding? stringEncoding = null) | ||
public partial class Mem | ||
{ | ||
stringEncoding ??= Encoding.UTF8; | ||
|
||
var memoryNormal = new byte[length]; | ||
if (ReadProcessMemory(MProc.Handle, address, memoryNormal, (UIntPtr)length, 0)) | ||
/// <summary> | ||
/// Read a string value from an address. | ||
/// </summary> | ||
/// <param name="code">address, module + pointer + offset, module + offset OR label in .ini file.</param> | ||
/// <param name="file">path and name of ini file. (OPTIONAL)</param> | ||
/// <param name="length">length of bytes to read (OPTIONAL)</param> | ||
/// <param name="zeroTerminated">terminate string at null char</param> | ||
/// <param name="stringEncoding">System.Text.Encoding.UTF8 (DEFAULT). Other options: ascii, unicode, utf32, utf7</param> | ||
/// <returns></returns> | ||
public string ReadString(string code, string file = "", int length = 32, bool zeroTerminated = true, System.Text.Encoding stringEncoding = null) | ||
{ | ||
return zeroTerminated ? stringEncoding.GetString(memoryNormal).Split('\0')[0] : stringEncoding.GetString(memoryNormal); | ||
} | ||
if (stringEncoding == null) | ||
stringEncoding = System.Text.Encoding.UTF8; | ||
|
||
return ""; | ||
byte[] memoryNormal = new byte[length]; | ||
UIntPtr theCode = GetCode(code, file); | ||
if (theCode == null || theCode == UIntPtr.Zero || theCode.ToUInt64() < 0x10000) | ||
return ""; | ||
|
||
if (ReadProcessMemory(mProc.Handle, theCode, memoryNormal, (UIntPtr)length, IntPtr.Zero)) | ||
return (zeroTerminated) ? stringEncoding.GetString(memoryNormal).Split('\0')[0] : stringEncoding.GetString(memoryNormal); | ||
else | ||
return ""; | ||
} | ||
} | ||
} |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,97 +1,120 @@ | ||
using System; | ||
using System.Runtime.InteropServices; | ||
using System.Text; | ||
|
||
namespace Memory; | ||
|
||
public static partial class Imps | ||
namespace Memory | ||
{ | ||
[LibraryImport("kernel32.dll")] | ||
public static partial nint OpenProcess(uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId); | ||
|
||
[LibraryImport("kernel32.dll", EntryPoint = "VirtualQueryEx")] | ||
public static partial nuint Native_VirtualQueryEx(nint hProcess, nuint lpAddress, out MemoryBasicInformation32 lpBuffer, nuint dwLength); | ||
|
||
[LibraryImport("kernel32.dll", EntryPoint = "VirtualQueryEx")] | ||
public static partial nuint Native_VirtualQueryEx(nint hProcess, nuint lpAddress, out MemoryBasicInformation64 lpBuffer, nuint dwLength); | ||
|
||
[LibraryImport("kernel32.dll")] | ||
public static partial void GetSystemInfo(out SystemInfo lpSystemInfo); | ||
|
||
[LibraryImport("kernel32.dll")] | ||
[return: MarshalAs(UnmanagedType.Bool)] | ||
public static partial void ReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress, IntPtr lpBuffer, UIntPtr nSize, out ulong lpNumberOfBytesRead); | ||
|
||
[LibraryImport("kernel32.dll")] | ||
[return: MarshalAs(UnmanagedType.Bool)] | ||
public static partial bool ReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress, byte[] lpBuffer, UIntPtr nSize, IntPtr lpNumberOfBytesRead); | ||
|
||
[LibraryImport("kernel32.dll")] | ||
[return: MarshalAs(UnmanagedType.Bool)] | ||
public static partial bool IsWow64Process(nint hProcess, [MarshalAs(UnmanagedType.Bool)] out bool lpSystemInfo); | ||
|
||
public const uint MemCommit = 0x00001000; | ||
|
||
public const uint Readonly = 0x02; | ||
public const uint Readwrite = 0x04; | ||
public const uint WriteCopy = 0x08; | ||
public const uint ExecuteReadwrite = 0x40; | ||
public const uint ExecuteWriteCopy = 0x80; | ||
public const uint Execute = 0x10; | ||
public const uint ExecuteRead = 0x20; | ||
|
||
public const uint Guard = 0x100; | ||
public const uint NoAccess = 0x01; | ||
|
||
public const uint MemPrivate = 0x20000; | ||
public const uint MemImage = 0x1000000; | ||
public const uint MemMapped = 0x40000; | ||
|
||
public struct SystemInfo | ||
{ | ||
public ushort ProcessorArchitecture; | ||
private ushort _reserved; | ||
public uint PageSize; | ||
public nuint MinimumApplicationAddress; | ||
public nuint MaximumApplicationAddress; | ||
public nint ActiveProcessorMask; | ||
public uint NumberOfProcessors; | ||
public uint ProcessorType; | ||
public uint AllocationGranularity; | ||
public ushort ProcessorLevel; | ||
public ushort ProcessorRevision; | ||
} | ||
|
||
public struct MemoryBasicInformation32 | ||
{ | ||
public nuint BaseAddress; | ||
public nuint AllocationBase; | ||
public uint AllocationProtect; | ||
public uint RegionSize; | ||
public uint State; | ||
public uint Protect; | ||
public uint Type; | ||
} | ||
|
||
public struct MemoryBasicInformation64 | ||
{ | ||
public nuint BaseAddress; | ||
public nuint AllocationBase; | ||
public uint AllocationProtect; | ||
public uint Alignment1; | ||
public ulong RegionSize; | ||
public uint State; | ||
public uint Protect; | ||
public uint Type; | ||
public uint Alignment2; | ||
} | ||
|
||
public struct MemoryBasicInformation | ||
public class Imps | ||
{ | ||
public nuint BaseAddress; | ||
public nuint AllocationBase; | ||
public uint AllocationProtect; | ||
public long RegionSize; | ||
public uint State; | ||
public uint Protect; | ||
public uint Type; | ||
[DllImport("kernel32.dll")] | ||
public static extern IntPtr OpenProcess( | ||
UInt32 dwDesiredAccess, | ||
bool bInheritHandle, | ||
Int32 dwProcessId | ||
); | ||
|
||
#if WINXP | ||
#else | ||
[DllImport("kernel32.dll", EntryPoint = "VirtualQueryEx")] | ||
public static extern UIntPtr Native_VirtualQueryEx(IntPtr hProcess, UIntPtr lpAddress, | ||
out MEMORY_BASIC_INFORMATION32 lpBuffer, UIntPtr dwLength); | ||
|
||
[DllImport("kernel32.dll", EntryPoint = "VirtualQueryEx")] | ||
public static extern UIntPtr Native_VirtualQueryEx(IntPtr hProcess, UIntPtr lpAddress, | ||
out MEMORY_BASIC_INFORMATION64 lpBuffer, UIntPtr dwLength); | ||
|
||
[DllImport("kernel32.dll")] | ||
public static extern void GetSystemInfo(out SYSTEM_INFO lpSystemInfo); | ||
#endif | ||
|
||
|
||
[DllImport("kernel32.dll", CharSet = CharSet.Unicode)] | ||
public static extern uint GetPrivateProfileString( | ||
string lpAppName, | ||
string lpKeyName, | ||
string lpDefault, | ||
StringBuilder lpReturnedString, | ||
uint nSize, | ||
string lpFileName); | ||
|
||
[DllImport("kernel32.dll")] | ||
public static extern bool ReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, UIntPtr nSize, IntPtr lpNumberOfBytesRead); | ||
|
||
[DllImport("kernel32.dll")] | ||
public static extern bool ReadProcessMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] IntPtr lpBuffer, UIntPtr nSize, out ulong lpNumberOfBytesRead); | ||
|
||
[DllImport("kernel32")] | ||
public static extern bool IsWow64Process(IntPtr hProcess, out bool lpSystemInfo); | ||
|
||
// used for memory allocation | ||
public const uint MEM_FREE = 0x10000; | ||
public const uint MEM_COMMIT = 0x00001000; | ||
public const uint MEM_RESERVE = 0x00002000; | ||
|
||
public const uint PAGE_READONLY = 0x02; | ||
public const uint PAGE_READWRITE = 0x04; | ||
public const uint PAGE_WRITECOPY = 0x08; | ||
public const uint PAGE_EXECUTE_READWRITE = 0x40; | ||
public const uint PAGE_EXECUTE_WRITECOPY = 0x80; | ||
public const uint PAGE_EXECUTE = 0x10; | ||
public const uint PAGE_EXECUTE_READ = 0x20; | ||
|
||
public const uint PAGE_GUARD = 0x100; | ||
public const uint PAGE_NOACCESS = 0x01; | ||
|
||
public const uint MEM_PRIVATE = 0x20000; | ||
public const uint MEM_IMAGE = 0x1000000; | ||
public const uint MEM_MAPPED = 0x40000; | ||
|
||
|
||
public struct SYSTEM_INFO | ||
{ | ||
public ushort processorArchitecture; | ||
ushort reserved; | ||
public uint pageSize; | ||
public UIntPtr minimumApplicationAddress; | ||
public UIntPtr maximumApplicationAddress; | ||
public IntPtr activeProcessorMask; | ||
public uint numberOfProcessors; | ||
public uint processorType; | ||
public uint allocationGranularity; | ||
public ushort processorLevel; | ||
public ushort processorRevision; | ||
} | ||
|
||
public struct MEMORY_BASIC_INFORMATION32 | ||
{ | ||
public UIntPtr BaseAddress; | ||
public UIntPtr AllocationBase; | ||
public uint AllocationProtect; | ||
public uint RegionSize; | ||
public uint State; | ||
public uint Protect; | ||
public uint Type; | ||
} | ||
|
||
public struct MEMORY_BASIC_INFORMATION64 | ||
{ | ||
public UIntPtr BaseAddress; | ||
public UIntPtr AllocationBase; | ||
public uint AllocationProtect; | ||
public uint __alignment1; | ||
public ulong RegionSize; | ||
public uint State; | ||
public uint Protect; | ||
public uint Type; | ||
public uint __alignment2; | ||
} | ||
|
||
public struct MEMORY_BASIC_INFORMATION | ||
{ | ||
public UIntPtr BaseAddress; | ||
public UIntPtr AllocationBase; | ||
public uint AllocationProtect; | ||
public long RegionSize; | ||
public uint State; | ||
public uint Protect; | ||
public uint Type; | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,8 +1,15 @@ | ||
namespace Memory; | ||
using System; | ||
|
||
internal struct MemoryRegionResult | ||
namespace Memory | ||
{ | ||
public nuint CurrentBaseAddress { get; init; } | ||
public long RegionSize { get; init; } | ||
public nuint RegionBase { get; init; } | ||
/// <summary> | ||
/// AoB scan information. | ||
/// </summary> | ||
struct MemoryRegionResult | ||
{ | ||
public UIntPtr CurrentBaseAddress { get; set; } | ||
public long RegionSize { get; set; } | ||
public UIntPtr RegionBase { get; set; } | ||
|
||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,10 +1,16 @@ | ||
using System; | ||
using System.Diagnostics; | ||
|
||
namespace Memory; | ||
|
||
public class Proc | ||
namespace Memory | ||
{ | ||
public Process Process { get; set; } = new(); | ||
public nint Handle { get; set; } | ||
public bool Is64Bit { get; set; } | ||
/// <summary> | ||
/// Information about the opened process. | ||
/// </summary> | ||
public class Proc | ||
{ | ||
public Process Process { get; set; } | ||
public IntPtr Handle { get; set; } | ||
public bool Is64Bit { get; set; } | ||
public ProcessModule MainModule { get; set; } | ||
} | ||
} |
Oops, something went wrong.