C# MEMORY_BASIC_INFORMATION类代码示例

 private static MEMORY_BASIC_INFORMATION VirtualQueryEx(Process proc, long address)
 {
     var info = new MEMORY_BASIC_INFORMATION();
     var ptr = new IntPtr(address);
     VirtualQueryEx(proc.Handle, ptr, out info, Marshal.SizeOf(info));
     return info;
 }

        public static void GainMemoryAccess(IntPtr address, ulong len)
        {
            SYSTEM_INFO si = new SYSTEM_INFO();
            GetSystemInfo(out si);
            MEMORY_BASIC_INFORMATION mbi;
            ulong currentAddress = RoundUpToPageBoundary((ulong)address, si.pageSize);
            ulong endAddress = currentAddress + len;
            uint ret;
            uint oldProtect = 0;

            while (currentAddress < endAddress)
            {
                mbi = new MEMORY_BASIC_INFORMATION();
                ret = (uint)VirtualQuery((IntPtr)currentAddress, out mbi, (IntPtr)Marshal.SizeOf(mbi));
                if (ret != 0)
                {
                    if (mbi.state == MEM_COMMIT)
                    {
                        VirtualProtect(mbi.baseAddress, mbi.regionSize, PAGE_EXECUTE_READWRITE, out oldProtect);
                    }
                    if ((ulong)mbi.regionSize > 0) currentAddress += (ulong)mbi.regionSize;
                    else currentAddress += si.pageSize;
                }
                else currentAddress += si.pageSize;
            }
        }

        public int readNextMemoryRegion(byte[] buffer, uint maxSize)
        {
            MEMORY_BASIC_INFORMATION mbi = new MEMORY_BASIC_INFORMATION();
            int amtRead;
            while (true)
            {
                if (nextAddr_ <= pSize_ + baseAddr_)
                {
                    if (0 == VirtualQueryEx(pHandle_, new IntPtr(nextAddr_), out mbi, (uint)Marshal.SizeOf(mbi)))
                    {
                        Console.WriteLine("VirtualQueryEx failure");
                    }
                    int rgnSize = mbi.RegionSize.ToInt32();
                    if (rgnSize > maxSize)
                    {
                        nextAddr_ += rgnSize;
                        continue;
                    }

                    ReadProcessMemory(pHandle_, new IntPtr(nextAddr_), buffer, rgnSize, out amtRead);
                    nextAddr_ += rgnSize;

                    if (0 != amtRead)
                    {
                        return amtRead;
                    }
                }
                else
                {
                    return 0;
                }
            }
        }

        /// <summary>
        /// Gets managed heap address
        /// </summary>
        private static unsafe void GetManagedHeap(IntPtr offset, out IntPtr heapsOffset, out IntPtr lastHeapByte)
        {
            var somePtr = EntityPtr.ToPointer("sample");
            var memoryBasicInformation = new MEMORY_BASIC_INFORMATION();

            heapsOffset = IntPtr.Zero;
            lastHeapByte = IntPtr.Zero;
            unsafe
            {
                while (VirtualQuery(offset, ref memoryBasicInformation, (IntPtr)Marshal.SizeOf(memoryBasicInformation)) !=
                       IntPtr.Zero)
                {
                    var isManagedHeap = (long)memoryBasicInformation.BaseAddress < (long)somePtr &&
                                        (long)somePtr <
                                        ((long)memoryBasicInformation.BaseAddress + (long)memoryBasicInformation.RegionSize);

                    if (isManagedHeap)
                    {
                        heapsOffset = offset;
                        lastHeapByte = (IntPtr)((long)offset + (long)memoryBasicInformation.RegionSize);
                    }

                    offset = (IntPtr)((long)offset + (long)memoryBasicInformation.RegionSize);
                }
            }
        }

 public static extern UIntPtr VirtualQueryEx(
     IntPtr hProcess,                    // Дескриптора процесса
     IntPtr pvAddress,                   // адрес виртуальной памяти
     out MEMORY_BASIC_INFORMATION pmbi,  // это адрес структуры MEMORY_BASIC_INFORMATION,
     // которую надо создать перед вызовом функции
     int dwLength                        // задает размер структуры MEMORY_BASIC_INFORMATION
     );

        // finally...
        public static void Main()
        {
            // getting minimum & maximum address

            SYSTEM_INFO sys_info = new SYSTEM_INFO();
            GetSystemInfo(out sys_info);

            IntPtr proc_min_address = sys_info.minimumApplicationAddress;
            IntPtr proc_max_address = sys_info.maximumApplicationAddress;

            // saving the values as long ints so I won't have to do a lot of casts later
            long proc_min_address_l = (long)proc_min_address;
            long proc_max_address_l = (long)proc_max_address;

            // notepad better be runnin'
            Process process = Process.GetProcessesByName("tibia")[0];

            // opening the process with desired access level
            IntPtr processHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_WM_READ, false, process.Id);

            StreamWriter sw = new StreamWriter("dump.txt");

            // this will store any information we get from VirtualQueryEx()
            MEMORY_BASIC_INFORMATION mem_basic_info = new MEMORY_BASIC_INFORMATION();

            int bytesRead = 0;  // number of bytes read with ReadProcessMemory

            while (proc_min_address_l < proc_max_address_l)
            {
                // 28 = sizeof(MEMORY_BASIC_INFORMATION)
                VirtualQueryEx(processHandle, proc_min_address, out mem_basic_info, 28);

                // if this memory chunk is accessible
                if (mem_basic_info.Protect == PAGE_READWRITE && mem_basic_info.State == MEM_COMMIT)
                {
                    byte[] buffer = new byte[mem_basic_info.RegionSize];

                    // read everything in the buffer above
                    ReadProcessMemory((int)processHandle, mem_basic_info.BaseAddress, buffer, mem_basic_info.RegionSize, ref bytesRead);

                    // then output this in the file
                    for (int i = 0; i < mem_basic_info.RegionSize; i++)
                        sw.WriteLine("0x{0} : {1}", (mem_basic_info.BaseAddress + i).ToString("X"), (char)buffer[i]);
                }

                // move to the next memory chunk
                proc_min_address_l += mem_basic_info.RegionSize;
                proc_min_address = new IntPtr(proc_min_address_l);
            }

            sw.Flush();
            sw.Close();

            Console.ReadLine();
        }

 protected void MemInfo(IntPtr pHandle)
 {
     IntPtr Addy = new IntPtr();
     while (true)
     {
         MEMORY_BASIC_INFORMATION MemInfo = new MEMORY_BASIC_INFORMATION();
         int MemDump = VirtualQueryEx(pHandle, Addy, out  MemInfo, Marshal.SizeOf(MemInfo));
         if (MemDump == 0) break;
         if ((MemInfo.State & 0x1000) != 0 && (MemInfo.Protect & 0x100) == 0)
             MemoryRegion.Add(MemInfo);
         Addy = new IntPtr(MemInfo.BaseAddress.ToInt32() + (int)MemInfo.RegionSize);
     }
 }

        public static bool scanJava(Process p)
        {
            p.Refresh();
            try
            {
                if (p.HasExited)
                {
                    return false;
                }
            }
            catch (Exception)
            {
                return false;
            }
            //Console.WriteLine("Scanning " + p.ProcessName);
            IntPtr Addy = new IntPtr();
            List<MEMORY_BASIC_INFORMATION> MemReg = new List<MEMORY_BASIC_INFORMATION>();
            while (true)
            {
                MEMORY_BASIC_INFORMATION MemInfo = new MEMORY_BASIC_INFORMATION();
                int MemDump = VirtualQueryEx(p.Handle, Addy, out  MemInfo, Marshal.SizeOf(MemInfo));
                if (MemDump == 0) break;
                if (0 != (MemInfo.State & MEM_COMMIT) && 0 != (MemInfo.Protect & WRITABLE) && 0 == (MemInfo.Protect & PAGE_GUARD))
                {
                    MemReg.Add(MemInfo);
                }
                Addy = new IntPtr(MemInfo.BaseAddress.ToInt64() + MemInfo.RegionSize.ToInt64());
            }

            for (int i = 0; i < MemReg.Count; i++)
            {
                byte[] buff = new byte[MemReg[i].RegionSize.ToInt32()];
                ReadProcessMemory(p.Handle, MemReg[i].BaseAddress, buff, MemReg[i].RegionSize.ToInt32(), IntPtr.Zero);

                long Result = IndexOf(buff, javameter);
                if (Result > 0)
                {
                    buff = null;
                    GC.Collect();
                    return true;
                }
                buff = null;
            }
            GC.Collect();
            return false;
        }

        public static unsafe bool HasSufficientStack(long bytes)
        {
            var stackInfo = new MEMORY_BASIC_INFORMATION();

            // We subtract one page for our request. VirtualQuery rounds UP to the next page.
            // Unfortunately, the stack grows down. If we're on the first page (last page in the
            // VirtualAlloc), we'll be moved to the next page, which is off the stack! Note this
            // doesn't work right for IA64 due to bigger pages.
            IntPtr currentAddr = new IntPtr((uint)&stackInfo - 4096);

            // Query for the current stack allocation information.
            VirtualQuery(currentAddr, ref stackInfo, sizeof(MEMORY_BASIC_INFORMATION));

            // If the current address minus the base (remember: the stack grows downward in the
            // address space) is greater than the number of bytes requested plus the reserved
            // space at the end, the request has succeeded.
            return ((uint)currentAddr.ToInt64() - stackInfo.AllocationBase) >
                   (bytes + STACK_RESERVED_SPACE);
        }

 public static extern IntPtr VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, ref MEMORY_BASIC_INFORMATION lpBuffer, IntPtr dwLength);

		public MEMORY_BASIC_INFORMATION VirtualQuery(Int32 address)
		{
			var info = new MEMORY_BASIC_INFORMATION();
			var ret = VirtualQueryEx(Handle, address, ref info, Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
			if (ret == 0)
				throw new Win32Exception();
			return info;
		}

        public bool VirtualQuery(ulong addr, out VirtualQueryData vq)
        {
            vq = new VirtualQueryData();

            MEMORY_BASIC_INFORMATION mem = new MEMORY_BASIC_INFORMATION();
            IntPtr ptr = new IntPtr((long)addr);

            int res = VirtualQueryEx(_process, ptr, ref mem, new IntPtr(Marshal.SizeOf(mem)));
            if (res == 0)
                return false;

            vq.BaseAddress = mem.BaseAddress;
            vq.Size = mem.Size;
            return true;
        }

        /// <summary>
        /// Maps the view.
        /// </summary>
        private void MapView()
        {
            IntPtr ptr = MapViewOfFile(_sharedMemoryHandle.GetHandle(),
                                    FileMapAccess.FileMapRead | FileMapAccess.FileMapWrite,
                                    (uint)0,
                                    0,
                                    Size);
            if (ptr == IntPtr.Zero)
            {
                throw new InvalidOperationException("Invalid Handle. Filed to map view");
            }
            if (Size == 0)
            {
                MEMORY_BASIC_INFORMATION info = new MEMORY_BASIC_INFORMATION();

                VirtualQuery(ref ptr, ref info, (int)System.Runtime.InteropServices.Marshal.SizeOf(info));
                Size = info.RegionSize;
            }

            _stream = new SharedMemoryStream(ptr, Size);
        }

		static extern Int32 VirtualQueryEx(IntPtr handle, Int32 address, ref MEMORY_BASIC_INFORMATION buffer, Int32 sizeOfBuffer);

        public IEnumerable<MEMORY_BASIC_INFORMATION> MemoryRegions()
        {
            // getting minimum & maximum address

            SYSTEM_INFO sys_info = new SYSTEM_INFO();
            GetSystemInfo(out sys_info);

            IntPtr proc_min_address = sys_info.minimumApplicationAddress;
            IntPtr proc_max_address = sys_info.maximumApplicationAddress;

            // saving the values as long ints so I won't have to do a lot of casts later
            long proc_min_address_l = (long)proc_min_address;
            long proc_max_address_l = (long)proc_max_address;

            MEMORY_BASIC_INFORMATION mem_basic_info = new MEMORY_BASIC_INFORMATION();

            long current = proc_min_address_l;
            while (current < proc_max_address_l)
            {
                var informationSize = VirtualQueryEx(processHandle, (IntPtr)current, out mem_basic_info, (uint)Marshal.SizeOf(mem_basic_info));
                if (informationSize == 0)
                    throw new Win32Exception();

                yield return mem_basic_info;

                // move to the next memory chunk
                current += mem_basic_info.RegionSize;
            }
        }