Topics: Void type Pages: 14 (1097 words) Published: August 18, 2012
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;

namespace ProcessMemoryReaderLib
class ProcessMemoryReaderApi
public const uint PROCESS_VM_READ = (0x0010);
public const uint PROCESS_VM_WRITE = (0x0020);
public const uint PROCESS_VM_OPERATION = (0x0008);
public const uint PAGE_READWRITE = 0x0004;
public const int WM_SYSCOMMAND = 0x0112;
public const int WM_ACTIVATE = 0x6;
public const int WM_HOTKEY = 0x0312;
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)] public static extern void mouse_event(long dwFlags, long dx, long dy, long cButtons, long dwExtraInfo); [DllImport("kernel32.dll")]

public static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);

public static extern Int32 CloseHandle(IntPtr hObject);

public static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);

public static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesWritten);

[DllImport("kernel32", SetLastError = true)]
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, UInt32 dwSize, uint flAllocationType, uint flProtect);

[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, UInt32 dwSize, uint flNewProtect, out uint lpflOldProtect);

[DllImport("user32.dll", SetLastError = true)]
public static extern bool UnregisterHotKey(IntPtr hWnd, int id);

public static extern int GetKeyState(int vKey);

public class ProcessMemoryReader
public ProcessMemoryReader()
public Process ReadProcess
return m_ReadProcess;
m_ReadProcess = value;
private Process m_ReadProcess = null;
private IntPtr m_hProcess = IntPtr.Zero;
public void OpenProcess()
m_hProcess = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ | ProcessMemoryReaderApi.PROCESS_VM_WRITE | ProcessMemoryReaderApi.PROCESS_VM_OPERATION, 1, (uint)m_ReadProcess.Id); }

public void CloseHandle()
int iRetValue;
iRetValue = ProcessMemoryReaderApi.CloseHandle(m_hProcess); if (iRetValue == 0)
throw new Exception("CloseHandle failed");

#region ReadMem
public int ReadMem(int MemoryAddress, uint bytesToRead, out byte[] buffer) {
IntPtr procHandle = ProcessMemoryReaderApi.OpenProcess(ProcessMemoryReaderApi.PROCESS_VM_READ | ProcessMemoryReaderApi.PROCESS_VM_WRITE | ProcessMemoryReaderApi.PROCESS_VM_OPERATION, 1, (uint)m_ReadProcess.Id); if (procHandle == IntPtr.Zero)

buffer = new byte[0];
return 0;

buffer = new byte[bytesToRead];
IntPtr ptrBytesReaded;
ProcessMemoryReaderApi.ReadProcessMemory(procHandle, (IntPtr)MemoryAddress, buffer, bytesToRead, out ptrBytesReaded); ProcessMemoryReaderApi.CloseHandle(procHandle);
return ptrBytesReaded.ToInt32();

//We use this to
public int ReadMultiLevelPointer(int MemoryAddress, uint bytesToRead, Int32[] offsetList) {...
Continue Reading

Please join StudyMode to read the full document

Become a StudyMode Member

Sign Up - It's Free