MemorySharp - C# based memory editing library targeting Windows applications !

[redcatH]

super!!!!thk @ZenLulz

[RivaLfr]

Very nice library. Only one problem, get relative address is very slow, why do not save MainModule when you initialize MemorySharp

For 100 000 int reads:
array = sharp.Read<int>((IntPtr)(i * 0x4), true); // 30 810 ms
array = sharp.Read<int>((IntPtr)(i * 0x4 + mainModuleAddress), false); // 156 ms

[ZenLulz]

Hey RivaLfr !

Nice to see you here and thanks for your report.
I will look after this bottleneck and more generally enhance the library by adding a caching system to avoid these cases.

Cheers

[Shenlok]

This is fantastic, great work ZenLulz! I'll certainly give this a try, I've been meaning to start playing with WoW memory editing again for a while now and this is the perfect excuse. Judging from a quick browse of your example code, plus the comments from the bigwigs here, I think it's safe to say this could become the de facto memory editing library for C# once you iron out the performance details Thanks very much for the contribution to the community!

[ZenLulz]

Hi Shenlok,

Thanks for your sweet comment !

I'm currently working on a lightweight .NET library for benchmarking performance of a set of functions. My first motivation by doing that is to enhance the speed of MemorySharp. The project is only on Github (here) for the moment, but I plan to bring it up on my website once it's done.

To answer to your question sent by PM, the library does not support injection of .NET libraries directly within a remote process unfortunately, you have to make your own native dll that set up the .NET environment. Nevertheless, it can be a good idea as improvement for it. I started to list the people's ideas on my website here.

cheers,
ZenLulz

[vmv]

Hello,
I have a function to open a process and retrieve the base address from a specified .dll inside that process but i think is doing something wrong when i use CloseHandle.
How would be my function using this library ?
Here is the code:

[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId); 
 
        public static IntPtr myProcess; 
 
        public static void OpenProcess() 
        { 
            Process[] procs = Process.GetProcessesByName("game.exe"); 
 
            if (procs.Length == 0) 
            { 
                MessageBox.Show("game not found..."); 
                return; 
            } 
            else 
            { 
                int dwPid = procs[0].Id;  
                 
                myProcess = OpenProcess( 0x1F0FFF, false, dwPid ); 
 
                ProcessModuleCollection modules = procs[0].Modules; 
  
                foreach (ProcessModule module in modules) 
                { 
                    if (module.ModuleName == "this.dll") 
                    { 
                        int gameBase = module.BaseAddress.ToInt32() + 0x00000000; 
                    } 
                } 
            } 
        }  

Thank you,

[ZenLulz]

Hi, Vmv,

Thanks for your interest about MemorySharp.
Here is the code written with the library that performs the same actions than yours.

using (var memory = new MemorySharp(ApplicationFinder.FromProcessName("notepad++").First()))
{
    var baseAddress = memory.Modules.RemoteModules.First(m => m.Name == "this.dll").BaseAddress;
}

A bit more straightforward.

Cheers,
ZenLulz

[Corthezz]

I am thinking about switching to your library over Blackmagic which I use currently.
Is there any benchmark comparing all current libraries?

+Rape for the good work

[vmv]

Hi, Vmv,

Thanks for your interest about MemorySharp.
Here is the code written with the library that performs the same actions than yours.

using (var memory = new MemorySharp(ApplicationFinder.FromProcessName("notepad++").First()))
{
    var baseAddress = memory.Modules.RemoteModules.First(m => m.Name == "this.dll").BaseAddress;
}

A bit more straightforward.

Cheers,
ZenLulz

An unhandled exception of type 'System.ApplicationException' occurred in MemorySharp.dll

Additional information: Couldn't get the information from the process, error code '-1073741820'.

I'm newbie...don't shoot me

using System.Linq;
using Binarysharp.MemoryManagement;
using Binarysharp.MemoryManagement.Helpers;


namespace tester
{
    public class rwMem
    {
        public static void Open()
        {
            using (var memory = new MemorySharp(ApplicationFinder.FromProcessName("game.exe").First()))
            {
                var baseAddress = memory.Modules.RemoteModules.First(m => m.Name == "game.dll").BaseAddress;
            }
        }
    }
}  

Hmmm...it's my mistake..i was on 64bit...but i need this for 64bit .

It is working fine on 32bit ...just awesome.

Now...let's go further ....

[vmv]

Well...i tripped again ...how about Allocation/Dealoc :

public static void allocate(out int vMemory, int nSize) 
        { 
            vMemory = VirtualAllocEx(m_hProcess, IntPtr.Zero, nSize, AllocType.Commit, Protect.ExecuteReadWrite); 
        }  

More then 2 hours trying to understand what's there...

Thank you,

[ZenLulz]

Hi there,

@Corthezz, Thanks ! There is actually no official benchmarking numbers. Nevertheless, I'm definitively interested in having some figures to show and optimize the performance of my library. For that purpose, I just released a lightweight tool to measure predefined functions in .NET applications. This library is called BenchShark and basically benchmarks the functions with a given number of iterations to measure their speed. I plan to integrate a new project within the MemorySharp solution in order to extract some interesting numbers and make sure some key features aren't and won't become a bottleneck.

@Vmv: I answered to your questions in the official forum.

Cheers,
ZenLulz

[xbec]

cannn't run on x64.