Click here to Skip to main content
Click here to Skip to main content
Articles » Languages » C# » Memory Management » Downloads
 
Add your own
alternative version

How to write a Memory Scanner using C#

, 23 Sep 2006
Search a process' memory to find specified 16, 32 or 64 bit data values.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using Sojaner.MemoryScanner;

namespace MemoryScanner
{
    public partial class WholeMemoryScan : Form
    {
        public WholeMemoryScan()
        {
            InitializeComponent();
            #region User Interface
            Bitmap bitmap = new Bitmap(this.Width, this.Height);
            Graphics graphic = Graphics.FromImage(bitmap);
            graphic.SmoothingMode = SmoothingMode.AntiAlias;
            Rectangle rectangle = new Rectangle(0, 0, this.Width, this.Height);
            LinearGradientBrush brush = new LinearGradientBrush(rectangle, Color.LightSteelBlue, Color.SteelBlue, 90, true);
            graphic.FillRectangle(brush, rectangle);
            Bitmap terminalBitmap = global::MemoryScanner.Properties.Resources.EarthGreen;
            int distance = (this.Height - terminalBitmap.Height) / 2;
            Rectangle imageRectangel = new Rectangle((distance / 2), distance, terminalBitmap.Width, terminalBitmap.Height);
            graphic.DrawImage(terminalBitmap, imageRectangel);
            Pen pen = new Pen(Brushes.White, 4);
            graphic.DrawRectangle(pen, rectangle);
            this.BackgroundImage = (Image)bitmap;
            #endregion
        }

        private int[] theArray = new int[0];

        private Process tempProcess;

        public Process process
        {
            set
            {
                tempProcess = value;
            }
        }

        private RegularMemoryScan scan;

        private void startScan_Click(object sender, EventArgs e)
        {
            int firstAddress;
            int lastAddress;
            Int16 value16 = 0;
            Int32 value32 = 0;
            Int64 value64 = 0;
            #region Check the startAddress TextBox for correct address format
            try
            {
                if (startAddress.Text == "")
                {
                    throw new Exception("'Start' address can not be empty.");
                }
                firstAddress = int.Parse(startAddress.Text, System.Globalization.NumberStyles.HexNumber);
                if (firstAddress == -1)
                {
                    throw new Exception("'Start' address most be between '0' to '7FFFFFFF'.");
                }
            }
            catch (FormatException)
            {
                MessageBox.Show("'Start' address most be in hexadecimal format, excluding '0x'.", "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            } 
            #endregion

            #region Check the endAddress TextBox for correct address format
            try
            {
                if (endAddress.Text == "")
                {
                    throw new Exception("'End' address can not be empty.");
                }
                lastAddress = int.Parse(endAddress.Text, System.Globalization.NumberStyles.HexNumber);
                if (lastAddress == -1)
                {
                    throw new Exception("'End' address most be between '0' to '7FFFFFFF'.");
                }
            }
            catch (FormatException)
            {
                MessageBox.Show("'End' address most be in hexadecimal format, excluding '0x'.", "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            } 
            #endregion

            //Check to see if any Data Type is selected or not.
            if (comboBox.SelectedIndex == -1)
            {
                MessageBox.Show("No Data Type is selected.", "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }

            #region Check the valueAddress TextBox for correct digit format
            try
            {
                if (valueTextBox.Text == "")
                {
                    throw new Exception("'Value' can not be empty.");
                }
                switch (comboBox.SelectedIndex)
                {
                    case 0:
                        Int16 temp16;
                        if (Int16.TryParse(valueTextBox.Text, out temp16))
                        {
                            value16 = Int16.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        if (value16 == -1)
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        break;
                    case 1:
                        Int32 temp32;
                        if (Int32.TryParse(valueTextBox.Text, out temp32))
                        {
                            value32 = Int32.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        if (value32 == -1)
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        break;
                    case 2:
                        Int64 temp64;
                        if (Int64.TryParse(valueTextBox.Text, out temp64))
                        {
                            value64 = Int64.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        if (value64 == -1)
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        break;
                }
                
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            #endregion

            #region Get Ready to scan
            scan = new RegularMemoryScan(tempProcess, firstAddress, lastAddress);
            scan.ScanProgressChanged += new RegularMemoryScan.ScanProgressedEventHandler(scan_ScanProgressChanged);
            scan.ScanCompleted += new RegularMemoryScan.ScanCompletedEventHandler(scan_ScanCompleted);
            scan.ScanCanceled += new RegularMemoryScan.ScanCanceledEventHandler(scan_ScanCanceled);

            startAddress.Enabled = false;
            endAddress.Enabled = false;
            startScan.Enabled = false;
            stopScan.Enabled = true;
            valueTextBox.Enabled = false;
            comboBox.Enabled = false;
            listBox.Items.Clear();
            progressBar.Value = 0;
            #endregion

            try
            {
                //Start the scan
                switch (comboBox.SelectedIndex)
                {
                    case 0:
                        scan.StartScanForInt16(value16);
                        break;
                    case 1:
                        scan.StartScanForInt32(value32);
                        break;
                    case 2:
                        scan.StartScanForInt64(value64);
                        break;
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }

        void scan_ScanCanceled(object sender, ScanCanceledEventArgs e)
        {
            MessageBox.Show("Scan canceled by the user.", "Scan canceled", MessageBoxButtons.OK, MessageBoxIcon.Warning);
        }

        delegate void Completed(object sender, ScanCompletedEventArgs e);
        void scan_ScanCompleted(object sender, ScanCompletedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Completed completed = new Completed(scan_ScanCompleted);
                this.Invoke(completed, new object[] { sender, e });
            }
            else
            {
                for (int i = 0; i < e.MemoryAddresses.Length; i++)
                {
                    int[] array = e.MemoryAddresses;
                    Array.Sort(array);
                    listBox.Items.Add("0x" + Convert.ToString((uint)array[i], 16).ToUpper());
                }
                theArray = e.MemoryAddresses;
                nextButton.Enabled = true;
                stopScan.Enabled = false;
            }
        }


        delegate void Progress(object sender, ScanProgressChangedEventArgs e);
        void scan_ScanProgressChanged(object sender, ScanProgressChangedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Progress progress = new Progress(scan_ScanProgressChanged);
                this.Invoke(progress, new object[] { sender, e });
            }
            else
            {
                progressBar.Value = e.Progress;
            }
        }

        private void closeButton_Click(object sender, EventArgs e)
        {
            Application.Exit();
        }

        private void stopScan_Click(object sender, EventArgs e)
        {
            scan.CancelScan();
            startAddress.Enabled = true;
            endAddress.Enabled = true;
            startScan.Enabled = true;
            stopScan.Enabled = false;
            valueTextBox.Enabled = true;
            comboBox.Enabled = true;
            progressBar.Value = 0;
        }

        private void nextButton_Click(object sender, EventArgs e)
        {
            ReScan rescan = new ReScan();
            rescan.intArray = theArray;
            rescan.Type = comboBox.SelectedIndex;
            rescan.process = tempProcess;
            rescan.Show();
            this.Hide();
        }
    }
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

About the Author

Rojan Gh.
CEO Atrin Design Group
Iran (Islamic Republic Of) Iran (Islamic Republic Of)
MVC/SPA designer and programmer.
C# programmer on .net/mono/monomac/monotouch/monodroid frameworks.
jQuery/Knockout/Angular programmer.
And has been working since 2002.
Follow on   Twitter

| Advertise | Privacy | Mobile
Web04 | 2.8.140721.1 | Last Updated 23 Sep 2006
Article Copyright 2006 by Rojan Gh.
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid