C# - Reading process memory menu

Shout-Out

User Tag List

Results 1 to 4 of 4
  1. #1
    Trixiap's Avatar Contributor
    Reputation
    218
    Join Date
    Nov 2010
    Posts
    349
    Thanks G/R
    22/18
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    C# - Reading process memory

    Hi,
    I'm trying to read whole memory of single process and after many trials and errors I ended with this solution
    Code:
    SYTEM_INFO info = systemInfo(); //GetSystemInfo
                Int64 min_address = (Int64)info.minimumApplicationAddress;
                Int64 max_address = (Int64)info.maximumApplicationAddress;
                IntPtr procHandle = ProcToolbox.openProcess(id);
                MEMORY_BASIC_INFORMATION memInfo = new MEMORY_BASIC_INFORMATION();
                while (min_address < max_address)
                {
                    int memDump = VirtualQueryEx(procHandle, info.minimumApplicationAddress, out memInfo, Marshal.SizeOf(memInfo));
                    if (memDump == 0)
                    {
                        int error = Marshal.GetLastWin32Error();
                    }
                    if (memInfo.Protect == PAGE_READWRITE && memInfo.State == MEM_COMMIT)
                    {
                        byte[] buffer = ReadProcessMemory(procHandle, memInfo.BaseAddress, memInfo.RegionSize.ToInt64());
                    }
                    min_address += memInfo.RegionSize.ToInt64();
                    info.minimumApplicationAddress = (IntPtr)min_address;
                }
    But problem is, that on 64bit machine is maximumAppliactionAddress 8TB so this solution takes very long time to execute. My question is, isn't there some more better solution that don't read whole memory, but only pages that belong to targeted process? Or is there anyway how to obtain list of pages that belong to that process and their addresses?

    C# - Reading process memory
  2. #2
    Torpedoes's Avatar ★ Elder ★ Doomsayer
    Authenticator enabled
    Reputation
    1147
    Join Date
    Sep 2013
    Posts
    956
    Thanks G/R
    148/415
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Wouldn't VirtualQueryEx fail when there are no more pages to read? That or VirtualQueryEx will just return a size spanning the rest of the 8TB, unreadable of course.

    I'm implementing a similar function right now but haven't gotten around to testing it yet.
    Last edited by Torpedoes; 04-02-2015 at 07:08 PM.

  3. #3
    Trixiap's Avatar Contributor
    Reputation
    218
    Join Date
    Nov 2010
    Posts
    349
    Thanks G/R
    22/18
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    How could I miss that!

    So if I'm correct, simple break inside that error IF solve problem, right?

    EDIT: It is probably working (at least for small testing app that I made). VirtualQuaryEx will fail and return error code 84 (I don“t know what it is, but based on error at address 2147418112 it is probably some kind of "out of memory space for 32bit app" error)
    Last edited by Trixiap; 04-02-2015 at 07:43 PM.

  4. #4
    Torpedoes's Avatar ★ Elder ★ Doomsayer
    Authenticator enabled
    Reputation
    1147
    Join Date
    Sep 2013
    Posts
    956
    Thanks G/R
    148/415
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Try calling GetLastError and see what error it gives you. But yeah that's what I've seen other's do, so I'm assuming it works.

Similar Threads

  1. In process memory reading/writing
    By unbekannt1 in forum WoW Memory Editing
    Replies: 7
    Last Post: 06-08-2010, 06:52 PM
  2. PyMem - Python process memory editing
    By nopz in forum Programming
    Replies: 5
    Last Post: 03-25-2010, 03:47 AM
  3. noob question about reading WOW memory
    By frostfiretulsa in forum WoW Memory Editing
    Replies: 7
    Last Post: 10-11-2009, 05:48 PM
  4. Knowing process' memory range
    By devouredelysium in forum WoW Memory Editing
    Replies: 15
    Last Post: 06-10-2009, 04:31 AM
  5. a little bit of c++ and reading process memory..
    By arynock in forum WoW Memory Editing
    Replies: 10
    Last Post: 05-22-2008, 04:12 AM
All times are GMT -5. The time now is 02:17 AM. Powered by vBulletin® Version 4.2.3
Copyright © 2025 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Google Authenticator verification provided by Two-Factor Authentication (Free) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search