Click here to Skip to main content
15,885,891 members
Articles / Programming Languages / C#

How to write a Memory Scanner using C#

Rate me:
Please Sign up or sign in to vote.
4.86/5 (67 votes)
23 Sep 2006CPOL8 min read 348K   16K   164  
Search a process' memory to find specified 16, 32 or 64 bit data values.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using Sojaner.MemoryScanner;

namespace MemoryScanner
{
    public partial class WholeMemoryScan : Form
    {
        public WholeMemoryScan()
        {
            InitializeComponent();
            #region User Interface
            Bitmap bitmap = new Bitmap(this.Width, this.Height);
            Graphics graphic = Graphics.FromImage(bitmap);
            graphic.SmoothingMode = SmoothingMode.AntiAlias;
            Rectangle rectangle = new Rectangle(0, 0, this.Width, this.Height);
            LinearGradientBrush brush = new LinearGradientBrush(rectangle, Color.LightSteelBlue, Color.SteelBlue, 90, true);
            graphic.FillRectangle(brush, rectangle);
            Bitmap terminalBitmap = global::MemoryScanner.Properties.Resources.EarthGreen;
            int distance = (this.Height - terminalBitmap.Height) / 2;
            Rectangle imageRectangel = new Rectangle((distance / 2), distance, terminalBitmap.Width, terminalBitmap.Height);
            graphic.DrawImage(terminalBitmap, imageRectangel);
            Pen pen = new Pen(Brushes.White, 4);
            graphic.DrawRectangle(pen, rectangle);
            this.BackgroundImage = (Image)bitmap;
            #endregion
        }

        private int[] theArray = new int[0];

        private Process tempProcess;

        public Process process
        {
            set
            {
                tempProcess = value;
            }
        }

        private RegularMemoryScan scan;

        private void startScan_Click(object sender, EventArgs e)
        {
            int firstAddress;
            int lastAddress;
            Int16 value16 = 0;
            Int32 value32 = 0;
            Int64 value64 = 0;
            #region Check the startAddress TextBox for correct address format
            try
            {
                if (startAddress.Text == "")
                {
                    throw new Exception("'Start' address can not be empty.");
                }
                firstAddress = int.Parse(startAddress.Text, System.Globalization.NumberStyles.HexNumber);
                if (firstAddress == -1)
                {
                    throw new Exception("'Start' address most be between '0' to '7FFFFFFF'.");
                }
            }
            catch (FormatException)
            {
                MessageBox.Show("'Start' address most be in hexadecimal format, excluding '0x'.", "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            } 
            #endregion

            #region Check the endAddress TextBox for correct address format
            try
            {
                if (endAddress.Text == "")
                {
                    throw new Exception("'End' address can not be empty.");
                }
                lastAddress = int.Parse(endAddress.Text, System.Globalization.NumberStyles.HexNumber);
                if (lastAddress == -1)
                {
                    throw new Exception("'End' address most be between '0' to '7FFFFFFF'.");
                }
            }
            catch (FormatException)
            {
                MessageBox.Show("'End' address most be in hexadecimal format, excluding '0x'.", "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            } 
            #endregion

            //Check to see if any Data Type is selected or not.
            if (comboBox.SelectedIndex == -1)
            {
                MessageBox.Show("No Data Type is selected.", "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }

            #region Check the valueAddress TextBox for correct digit format
            try
            {
                if (valueTextBox.Text == "")
                {
                    throw new Exception("'Value' can not be empty.");
                }
                switch (comboBox.SelectedIndex)
                {
                    case 0:
                        Int16 temp16;
                        if (Int16.TryParse(valueTextBox.Text, out temp16))
                        {
                            value16 = Int16.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        if (value16 == -1)
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        break;
                    case 1:
                        Int32 temp32;
                        if (Int32.TryParse(valueTextBox.Text, out temp32))
                        {
                            value32 = Int32.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        if (value32 == -1)
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        break;
                    case 2:
                        Int64 temp64;
                        if (Int64.TryParse(valueTextBox.Text, out temp64))
                        {
                            value64 = Int64.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        if (value64 == -1)
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        break;
                }
                
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            #endregion

            #region Get Ready to scan
            scan = new RegularMemoryScan(tempProcess, firstAddress, lastAddress);
            scan.ScanProgressChanged += new RegularMemoryScan.ScanProgressedEventHandler(scan_ScanProgressChanged);
            scan.ScanCompleted += new RegularMemoryScan.ScanCompletedEventHandler(scan_ScanCompleted);
            scan.ScanCanceled += new RegularMemoryScan.ScanCanceledEventHandler(scan_ScanCanceled);

            startAddress.Enabled = false;
            endAddress.Enabled = false;
            startScan.Enabled = false;
            stopScan.Enabled = true;
            valueTextBox.Enabled = false;
            comboBox.Enabled = false;
            listBox.Items.Clear();
            progressBar.Value = 0;
            #endregion

            try
            {
                //Start the scan
                switch (comboBox.SelectedIndex)
                {
                    case 0:
                        scan.StartScanForInt16(value16);
                        break;
                    case 1:
                        scan.StartScanForInt32(value32);
                        break;
                    case 2:
                        scan.StartScanForInt64(value64);
                        break;
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }

        void scan_ScanCanceled(object sender, ScanCanceledEventArgs e)
        {
            MessageBox.Show("Scan canceled by the user.", "Scan canceled", MessageBoxButtons.OK, MessageBoxIcon.Warning);
        }

        delegate void Completed(object sender, ScanCompletedEventArgs e);
        void scan_ScanCompleted(object sender, ScanCompletedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Completed completed = new Completed(scan_ScanCompleted);
                this.Invoke(completed, new object[] { sender, e });
            }
            else
            {
                for (int i = 0; i < e.MemoryAddresses.Length; i++)
                {
                    int[] array = e.MemoryAddresses;
                    Array.Sort(array);
                    listBox.Items.Add("0x" + Convert.ToString((uint)array[i], 16).ToUpper());
                }
                theArray = e.MemoryAddresses;
                nextButton.Enabled = true;
                stopScan.Enabled = false;
            }
        }


        delegate void Progress(object sender, ScanProgressChangedEventArgs e);
        void scan_ScanProgressChanged(object sender, ScanProgressChangedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Progress progress = new Progress(scan_ScanProgressChanged);
                this.Invoke(progress, new object[] { sender, e });
            }
            else
            {
                progressBar.Value = e.Progress;
            }
        }

        private void closeButton_Click(object sender, EventArgs e)
        {
            Application.Exit();
        }

        private void stopScan_Click(object sender, EventArgs e)
        {
            scan.CancelScan();
            startAddress.Enabled = true;
            endAddress.Enabled = true;
            startScan.Enabled = true;
            stopScan.Enabled = false;
            valueTextBox.Enabled = true;
            comboBox.Enabled = true;
            progressBar.Value = 0;
        }

        private void nextButton_Click(object sender, EventArgs e)
        {
            ReScan rescan = new ReScan();
            rescan.intArray = theArray;
            rescan.Type = comboBox.SelectedIndex;
            rescan.process = tempProcess;
            rescan.Show();
            this.Hide();
        }
    }
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Founder Sojaner AB
Sweden Sweden
UX designer and full stack developer mainly focused on .NET technologies.
Currently loving .NET Core 2.0.

Comments and Discussions