Click here to Skip to main content
15,894,646 members
Articles / Programming Languages / C#

How to write a Memory Scanner using C#

Rate me:
Please Sign up or sign in to vote.
4.86/5 (67 votes)
23 Sep 2006CPOL8 min read 354.9K   16K   164  
Search a process' memory to find specified 16, 32 or 64 bit data values.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using System.Drawing.Drawing2D;
using Sojaner.MemoryScanner;

namespace MemoryScanner
{
    public partial class FreezeWindow : Form
    {
        public FreezeWindow()
        {
            InitializeComponent();
            #region User Interface
            Bitmap bitmap = new Bitmap(this.Width, this.Height);
            Graphics graphic = Graphics.FromImage(bitmap);
            graphic.SmoothingMode = SmoothingMode.AntiAlias;
            Rectangle rectangle = new Rectangle(0, 0, this.Width, this.Height);
            LinearGradientBrush brush = new LinearGradientBrush(rectangle, Color.LightSteelBlue, Color.SteelBlue, 90, true);
            graphic.FillRectangle(brush, rectangle);
            Bitmap terminalBitmap = global::MemoryScanner.Properties.Resources.Hat;
            int distance = (this.Height - terminalBitmap.Height) / 2;
            Rectangle imageRectangel = new Rectangle((distance / 2), distance, terminalBitmap.Width, terminalBitmap.Height);
            graphic.DrawImage(terminalBitmap, imageRectangel);
            Pen pen = new Pen(Brushes.White, 4);
            graphic.DrawRectangle(pen, rectangle);
            this.BackgroundImage = (Image)bitmap;
            #endregion
        }

        MemoryPass[] pass;

        Process process;

        MemoryFreeze freeze;

        public Process Process
        {
            set { process = value; }
        }

        internal MemoryPass[] Pass
        {
            set { pass = value; }
        }

        private void FreezeWindow_Load(object sender, EventArgs e)
        {
            freeze = new MemoryFreeze(process);
            for (int i = 0; i < pass.Length; i++)
            {
                switch (pass[i].Type)
                {
                    case 0:
                        freeze.AddMemoryAddress(pass[i].Address, (Int16)pass[i].Value);
                        break;
                    case 1:
                        freeze.AddMemoryAddress(pass[i].Address, (Int32)pass[i].Value);
                        break;
                    case 2:
                        freeze.AddMemoryAddress(pass[i].Address, (Int64)pass[i].Value);
                        break;
                }
                listBox.Items.Add("0x" + Convert.ToString(pass[i].Address, 16).ToUpper() + "-> (" + pass[i].Value.ToString() + ")");
            }
            try
            {
                freeze.StartFreezing(10);
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }

        private void closeButton_Click(object sender, EventArgs e)
        {
            try
            {
            freeze.StopFreezing();
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "error", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
            Application.Exit();
        }

    }
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Founder Sojaner AB
Sweden Sweden
UX designer and full stack developer mainly focused on .NET technologies.
Currently loving .NET Core 2.0.

Comments and Discussions