Click here to Skip to main content
12,405,946 members (67,585 online)
Click here to Skip to main content
Articles » Languages » C# » Memory Management » Downloads

Stats

231.9K views
12.6K downloads
154 bookmarked
Posted

How to write a Memory Scanner using C#

, 23 Sep 2006 CPOL
Search a process' memory to find specified 16, 32 or 64 bit data values.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using Sojaner.MemoryScanner;

namespace MemoryScanner
{
    struct MemoryPass
    {
        int address;

        public int Address
        {
            get { return address; }
            set { address = value; }
        }
        int type;

        public int Type
        {
            get { return type; }
            set { type = value; }
        }
        object value;

        public object Value
        {
            get { return this.value; }
            set { this.value = value; }
        }
    }

    public partial class ReScan : Form
    {
        public ReScan()
        {
            InitializeComponent();
            #region User Interface
            Bitmap bitmap = new Bitmap(this.Width, this.Height);
            Graphics graphic = Graphics.FromImage(bitmap);
            graphic.SmoothingMode = SmoothingMode.AntiAlias;
            Rectangle rectangle = new Rectangle(0, 0, this.Width, this.Height);
            LinearGradientBrush brush = new LinearGradientBrush(rectangle, Color.LightSteelBlue, Color.SteelBlue, 90, true);
            graphic.FillRectangle(brush, rectangle);
            Bitmap terminalBitmap = global::MemoryScanner.Properties.Resources.CubeImage;
            int distance = (this.Height - terminalBitmap.Height) / 2;
            Rectangle imageRectangel = new Rectangle((distance / 2), distance, terminalBitmap.Width, terminalBitmap.Height);
            graphic.DrawImage(terminalBitmap, imageRectangel);
            Pen pen = new Pen(Brushes.White, 4);
            graphic.DrawRectangle(pen, rectangle);
            this.BackgroundImage = (Image)bitmap;
            #endregion
        }

        private Process tempProcess;

        public Process process
        {
            set
            {
                tempProcess = value;
            }
        }

        private int[] tempArray = new int[0];

        public int[] intArray
        {
            set
            {
                tempArray = value;
            }
        }

        private int type = 0;

        public int Type
        {
            set { type = value; }
        }

        IrregularMemoryScan scan;

        object currentValue;

        private void closeButton_Click(object sender, EventArgs e)
        {
            Application.Exit();
        }

        private void startScan_Click(object sender, EventArgs e)
        {
            Int16 value16 = 0;
            Int32 value32 = 0;
            Int64 value64 = 0;

            #region Check the valueAddress TextBox for correct digit format
            try
            {
                if (valueTextBox.Text == "")
                {
                    throw new Exception("'Value' can not be empty.");
                }
                switch (type)
                {
                    case 0:
                        Int16 temp16;
                        if (Int16.TryParse(valueTextBox.Text, out temp16))
                        {
                            value16 = Int16.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        if (value16 == -1)
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        break;
                    case 1:
                        Int32 temp32;
                        if (Int32.TryParse(valueTextBox.Text, out temp32))
                        {
                            value32 = Int32.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        if (value32 == -1)
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        break;
                    case 2:
                        Int64 temp64;
                        if (Int64.TryParse(valueTextBox.Text, out temp64))
                        {
                            value64 = Int64.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        if (value64 == -1)
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        break;
                }

            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            #endregion

            #region Get Ready to scan
            scan = new IrregularMemoryScan(tempProcess, tempArray);
            scan.ScanProgressChanged += new IrregularMemoryScan.ScanProgressedEventHandler(scan_ScanProgressChanged);
            scan.ScanCompleted += new IrregularMemoryScan.ScanCompletedEventHandler(scan_ScanCompleted);
            scan.ScanCanceled += new IrregularMemoryScan.ScanCanceledEventHandler(scan_ScanCanceled);

            startScan.Enabled = false;
            stopScan.Enabled = true;
            valueTextBox.Enabled = false;
            listBox.Items.Clear();
            progressBar.Value = 0;
            #endregion

            try
            {
                //Start the scan
                switch (type)
                {
                    case 0:
                        scan.StartScanForInt16(value16);
                        currentValue = value16;
                        break;
                    case 1:
                        scan.StartScanForInt32(value32);
                        currentValue = value32;
                        break;
                    case 2:
                        scan.StartScanForInt64(value64);
                        currentValue = value64;
                        break;
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }

        void scan_ScanCanceled(object sender, ScanCanceledEventArgs e)
        {
            MessageBox.Show("Scan canceled by the user.", "Scan canceled", MessageBoxButtons.OK, MessageBoxIcon.Warning);
        }

        delegate void Completed(object sender, ScanCompletedEventArgs e);
        void scan_ScanCompleted(object sender, ScanCompletedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Completed completed = new Completed(scan_ScanCompleted);
                this.Invoke(completed, new object[] { sender, e });
            }
            else
            {
                listBox.Items.Clear();
                for (int i = 0; i < e.MemoryAddresses.Length; i++)
                {
                    int[] array = e.MemoryAddresses;
                    Array.Sort(array);
                    listBox.Items.Add("0x" + Convert.ToString((uint)array[i], 16).ToUpper());
                }
                tempArray = e.MemoryAddresses;
                startScan.Enabled = true;
                stopScan.Enabled = false;
                valueTextBox.Enabled = true;
                nextButton.Enabled = true;
            }
        }


        delegate void Progress(object sender, ScanProgressChangedEventArgs e);
        void scan_ScanProgressChanged(object sender, ScanProgressChangedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Progress progress = new Progress(scan_ScanProgressChanged);
                this.Invoke(progress, new object[] { sender, e });
            }
            else
            {
                progressBar.Value = e.Progress;
            }
        }

        private void stopScan_Click(object sender, EventArgs e)
        {
            scan.CancelScan();
            startScan.Enabled = true;
            stopScan.Enabled = false;
            valueTextBox.Enabled = true;
            progressBar.Value = 0;
        }

        private void ReScan_Load(object sender, EventArgs e)
        {
            for (int i = 0; i < tempArray.Length; i++)
            {
                listBox.Items.Add("0x" + Convert.ToString((uint)tempArray[i], 16).ToUpper());
            }
        }

        private void nextButton_Click(object sender, EventArgs e)
        {
            if (listBox.SelectedItems.Count > 0)
            {
                MemoryPass[] pass = new MemoryPass[listBox.SelectedItems.Count];
                FreezeValues freeze;
                for (int i = 0; i < listBox.SelectedItems.Count; i++)
                {
                    string address = listBox.SelectedItems[i].ToString();
                    address = address.Substring(2);
                    freeze = new FreezeValues(int.Parse(address, System.Globalization.NumberStyles.HexNumber), type, currentValue);
                    freeze.StartPosition = FormStartPosition.CenterScreen;
                    freeze.ShowDialog();
                    if (freeze.DialogResult == DialogResult.OK)
                    {
                        pass[i].Address = int.Parse(address, System.Globalization.NumberStyles.HexNumber);
                        pass[i].Type = type;
                        pass[i].Value = freeze.NewValue;
                    }
                    else
                    {
                        return;
                    }
                }
                FreezeWindow freezeWindow = new FreezeWindow();
                freezeWindow.Process = tempProcess;
                freezeWindow.Pass = pass;
                freezeWindow.Show();
                this.Hide();
            }
            else
            {
                MessageBox.Show("No memory addresses are selected from the list.", "Seletion error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }
    }
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Rojan Gh.
CEO
Sweden Sweden
MVC/SPA designer and programmer.
C# programmer on .net/mono/monomac/monotouch/monodroid frameworks.
jQuery/Knockout/Angular programmer.
And has been working since 2002.

You may also be interested in...

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.160721.1 | Last Updated 23 Sep 2006
Article Copyright 2006 by Rojan Gh.
Everything else Copyright © CodeProject, 1999-2016
Layout: fixed | fluid