Click here to Skip to main content
15,891,431 members
Articles / Programming Languages / C#

How to write a Memory Scanner using C#

Rate me:
Please Sign up or sign in to vote.
4.86/5 (67 votes)
23 Sep 2006CPOL8 min read 352.1K   16K   164  
Search a process' memory to find specified 16, 32 or 64 bit data values.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using Sojaner.MemoryScanner;

namespace MemoryScanner
{
    struct MemoryPass
    {
        int address;

        public int Address
        {
            get { return address; }
            set { address = value; }
        }
        int type;

        public int Type
        {
            get { return type; }
            set { type = value; }
        }
        object value;

        public object Value
        {
            get { return this.value; }
            set { this.value = value; }
        }
    }

    public partial class ReScan : Form
    {
        public ReScan()
        {
            InitializeComponent();
            #region User Interface
            Bitmap bitmap = new Bitmap(this.Width, this.Height);
            Graphics graphic = Graphics.FromImage(bitmap);
            graphic.SmoothingMode = SmoothingMode.AntiAlias;
            Rectangle rectangle = new Rectangle(0, 0, this.Width, this.Height);
            LinearGradientBrush brush = new LinearGradientBrush(rectangle, Color.LightSteelBlue, Color.SteelBlue, 90, true);
            graphic.FillRectangle(brush, rectangle);
            Bitmap terminalBitmap = global::MemoryScanner.Properties.Resources.CubeImage;
            int distance = (this.Height - terminalBitmap.Height) / 2;
            Rectangle imageRectangel = new Rectangle((distance / 2), distance, terminalBitmap.Width, terminalBitmap.Height);
            graphic.DrawImage(terminalBitmap, imageRectangel);
            Pen pen = new Pen(Brushes.White, 4);
            graphic.DrawRectangle(pen, rectangle);
            this.BackgroundImage = (Image)bitmap;
            #endregion
        }

        private Process tempProcess;

        public Process process
        {
            set
            {
                tempProcess = value;
            }
        }

        private int[] tempArray = new int[0];

        public int[] intArray
        {
            set
            {
                tempArray = value;
            }
        }

        private int type = 0;

        public int Type
        {
            set { type = value; }
        }

        IrregularMemoryScan scan;

        object currentValue;

        private void closeButton_Click(object sender, EventArgs e)
        {
            Application.Exit();
        }

        private void startScan_Click(object sender, EventArgs e)
        {
            Int16 value16 = 0;
            Int32 value32 = 0;
            Int64 value64 = 0;

            #region Check the valueAddress TextBox for correct digit format
            try
            {
                if (valueTextBox.Text == "")
                {
                    throw new Exception("'Value' can not be empty.");
                }
                switch (type)
                {
                    case 0:
                        Int16 temp16;
                        if (Int16.TryParse(valueTextBox.Text, out temp16))
                        {
                            value16 = Int16.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        if (value16 == -1)
                        {
                            throw new Exception("'Value' most be a 16 bit value.");
                        }
                        break;
                    case 1:
                        Int32 temp32;
                        if (Int32.TryParse(valueTextBox.Text, out temp32))
                        {
                            value32 = Int32.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        if (value32 == -1)
                        {
                            throw new Exception("'Value' most be a 32 bit value.");
                        }
                        break;
                    case 2:
                        Int64 temp64;
                        if (Int64.TryParse(valueTextBox.Text, out temp64))
                        {
                            value64 = Int64.Parse(valueTextBox.Text, System.Globalization.NumberStyles.Integer);
                        }
                        else
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        if (value64 == -1)
                        {
                            throw new Exception("'Value' most be a 64 bit value.");
                        }
                        break;
                }

            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                return;
            }
            #endregion

            #region Get Ready to scan
            scan = new IrregularMemoryScan(tempProcess, tempArray);
            scan.ScanProgressChanged += new IrregularMemoryScan.ScanProgressedEventHandler(scan_ScanProgressChanged);
            scan.ScanCompleted += new IrregularMemoryScan.ScanCompletedEventHandler(scan_ScanCompleted);
            scan.ScanCanceled += new IrregularMemoryScan.ScanCanceledEventHandler(scan_ScanCanceled);

            startScan.Enabled = false;
            stopScan.Enabled = true;
            valueTextBox.Enabled = false;
            listBox.Items.Clear();
            progressBar.Value = 0;
            #endregion

            try
            {
                //Start the scan
                switch (type)
                {
                    case 0:
                        scan.StartScanForInt16(value16);
                        currentValue = value16;
                        break;
                    case 1:
                        scan.StartScanForInt32(value32);
                        currentValue = value32;
                        break;
                    case 2:
                        scan.StartScanForInt64(value64);
                        currentValue = value64;
                        break;
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }

        void scan_ScanCanceled(object sender, ScanCanceledEventArgs e)
        {
            MessageBox.Show("Scan canceled by the user.", "Scan canceled", MessageBoxButtons.OK, MessageBoxIcon.Warning);
        }

        delegate void Completed(object sender, ScanCompletedEventArgs e);
        void scan_ScanCompleted(object sender, ScanCompletedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Completed completed = new Completed(scan_ScanCompleted);
                this.Invoke(completed, new object[] { sender, e });
            }
            else
            {
                listBox.Items.Clear();
                for (int i = 0; i < e.MemoryAddresses.Length; i++)
                {
                    int[] array = e.MemoryAddresses;
                    Array.Sort(array);
                    listBox.Items.Add("0x" + Convert.ToString((uint)array[i], 16).ToUpper());
                }
                tempArray = e.MemoryAddresses;
                startScan.Enabled = true;
                stopScan.Enabled = false;
                valueTextBox.Enabled = true;
                nextButton.Enabled = true;
            }
        }


        delegate void Progress(object sender, ScanProgressChangedEventArgs e);
        void scan_ScanProgressChanged(object sender, ScanProgressChangedEventArgs e)
        {
            if (this.InvokeRequired)
            {
                Progress progress = new Progress(scan_ScanProgressChanged);
                this.Invoke(progress, new object[] { sender, e });
            }
            else
            {
                progressBar.Value = e.Progress;
            }
        }

        private void stopScan_Click(object sender, EventArgs e)
        {
            scan.CancelScan();
            startScan.Enabled = true;
            stopScan.Enabled = false;
            valueTextBox.Enabled = true;
            progressBar.Value = 0;
        }

        private void ReScan_Load(object sender, EventArgs e)
        {
            for (int i = 0; i < tempArray.Length; i++)
            {
                listBox.Items.Add("0x" + Convert.ToString((uint)tempArray[i], 16).ToUpper());
            }
        }

        private void nextButton_Click(object sender, EventArgs e)
        {
            if (listBox.SelectedItems.Count > 0)
            {
                MemoryPass[] pass = new MemoryPass[listBox.SelectedItems.Count];
                FreezeValues freeze;
                for (int i = 0; i < listBox.SelectedItems.Count; i++)
                {
                    string address = listBox.SelectedItems[i].ToString();
                    address = address.Substring(2);
                    freeze = new FreezeValues(int.Parse(address, System.Globalization.NumberStyles.HexNumber), type, currentValue);
                    freeze.StartPosition = FormStartPosition.CenterScreen;
                    freeze.ShowDialog();
                    if (freeze.DialogResult == DialogResult.OK)
                    {
                        pass[i].Address = int.Parse(address, System.Globalization.NumberStyles.HexNumber);
                        pass[i].Type = type;
                        pass[i].Value = freeze.NewValue;
                    }
                    else
                    {
                        return;
                    }
                }
                FreezeWindow freezeWindow = new FreezeWindow();
                freezeWindow.Process = tempProcess;
                freezeWindow.Pass = pass;
                freezeWindow.Show();
                this.Hide();
            }
            else
            {
                MessageBox.Show("No memory addresses are selected from the list.", "Seletion error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }
    }
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Founder Sojaner AB
Sweden Sweden
UX designer and full stack developer mainly focused on .NET technologies.
Currently loving .NET Core 2.0.

Comments and Discussions