death function() { ... } help request

[abuckau907]

Just taking a poll of how many ppl are active here (well, the # of active members that would check out a dumb post like mine lol sry)

by reading this, you upped the view count. thank you


^^thnx & sry


----------------------------------------------------------------------------------------------------------------
@devs - sry, if this goes how I think i'll be gone in a week anyway. My post can't hurt any more than the the rest of [some] these silly posts. Plz leave it. sry.

[abuckau907]

appears I was wrong: 14 views / 2 hours. maybe dead is the wrong word. sorry admins. I guess thnx to anyone who checks in regularly.


---------------------------------------------------------------------------------------------------------------------------------------------------

to sort-of save this post..at least I do have a real question, about .Net framework :/

I'm working on my MemoryManager class (Read/Write processmemory) and I'm trying to learn generics..but frankly keep messing up as far as..suing GetType vs. typeof etc etc. I know the differences, but I still mess up because I don't understand it very well yet.

So..I have this function (vb.net)..it works fine. Any comments/suggestions? <-- if you call that a question.

Public Function ReadStructure(Of T)(ByVal addr As IntPtr, ByRef yourVal As T) As Boolean
        Dim _tSizeInBytes As Int32 = Marshal.SizeOf(GetType(T))
        Dim _tBuffer(_tSizeInBytes) As Byte
        Dim _bytesRead As Int32 = 0
        If ReadProcessMemory(_targetProcessHandle, addr, _tBuffer, _tSizeInBytes, _bytesRead) Then
            If _bytesRead <> _tSizeInBytes Then
                'not all bytes read, rpm fail
                modPublic.DoOutput("MemReader::ReadStructure() _bytesRead != size , 0x" & addr.ToString("X"))
                Return False
            Else
                'all success
                Dim _tBuffPtr As IntPtr = Marshal.AllocHGlobal(_tSizeInBytes) 'double memory usage. o well :/
                Marshal.Copy(_tBuffer, 0, _tBuffPtr, _tSizeInBytes)
                yourVal = CType(Marshal.PtrToStructure(_tBuffPtr, GetType(T)), T)
                Marshal.FreeHGlobal(_tBuffPtr)
                Return True
            End If
        Else
            modPublic.DoOutput("MemReader::ReadStructure() ReadProcessMemory() FAIL , 0x" & addr.ToString("X"))

            Return False
        End If
    End Function 'experimental

basically i know it's bad because it allocated too much memory --> i declare the local buffer, andalso, use marshal.alloc() --> this is because in my declarations, rpm() expect a byte array, not a pointer to a byte array. So I can't pass in the IntPtr from Marshal.Alloc To Rpm() ..so instead I, declare the buff, rpm into the buff, marshal.alloc(), copy the buff into the new alloc, then use Marshal.PtrToStructure().
It's wasteful. But the only way I see to fix it is to make RPM expect a byte pointer --> but then that means I have to use marshal.alloc for all of my reads --> I think for "doing a scan for int32" would require thousands of calls to Marshal.Alloc() and that can't be as fast as creating the buffer locally? I guess I could just malloc one big chunk and manage it myself inside my read functions, but that's another level of complexity I didn't want to add. so, any suggestions? I guess it really* doesn't matter..since currently I barely use the function ( I don't really..just a couple debug functions ): so for as often as I call it, it's not really a performance hit, but I'm curious if there is anything obviously wrong with the logic behind it, etc. thnx.

[Cromon]

About your function:
Possibility 1:
Use C# and fixed with pointers, that spares you the second allocation in unmanaged memory.

Result:

        [DllImport("Kernel32.dll", SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        private static extern bool ReadProcessMemory(SafeHandle hProcess, IntPtr lpBaseAddress, [Out] byte[] lpBuffer, uint nSize, out uint lpNumberOfBytesRead);

        public unsafe T ReadMemory<T>(IntPtr address) where T : struct
        {
            int size = Marshal.SizeOf(typeof(T));
            byte[] buffer = new byte[size];
            uint numBytesRead = 0;

            if (!ReadProcessMemory(mProcessHandle, address, buffer, (uint)size, out numBytesRead) || numBytesRead != (uint)size)
                throw new Exception();

            fixed (byte* ptr = buffer)
                return (T)Marshal.PtrToStructure((IntPtr)ptr, typeof(T));
        }

Possibility 2:
Do your own marshalling which can be optimized for your specialized needs instead of beeing generic for all possible cases which usually means beeing restricted by the worst case.

[abuckau907]

Maybe I will switch to C# soon. been reading my book on it for the last week or so, not really motivated to switch tho.

I was thinking there might be something in the marshal class, but as I don't really use the code, i haven't been motivated to look.

Thanks.