-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathProgram.cs
More file actions
62 lines (57 loc) · 2.06 KB
/
Copy pathProgram.cs
File metadata and controls
62 lines (57 loc) · 2.06 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace Unpager
{
class Program
{
[DllImport("kernel32.dll")]
static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int dwSize, out IntPtr lpNumberOfBytesRead);
static void Main(string[] args)
{
if (args.Length != 2)
{
Console.WriteLine("Usage: Unpager <PID or Process Name> <interval>");
return;
}
int pid;
if (!int.TryParse(args[0], out pid))
{
Process[] processes = Process.GetProcessesByName(args[0]);
if (processes.Length == 0)
{
Console.WriteLine("Process not found");
return;
}
pid = processes[0].Id;
}
// int pid = int.Parse(args[0]);
int interval = int.Parse(args[1]);
Process process = Process.GetProcessById(pid);
IntPtr hProcess = process.Handle;
while (true)
{
foreach (ProcessModule module in process.Modules)
{
IntPtr baseAddress = module.BaseAddress;
int size = module.ModuleMemorySize;
byte[] buffer = new byte[size];
IntPtr bytesRead;
if (ReadProcessMemory(hProcess, baseAddress, buffer, size, out bytesRead))
{
Console.WriteLine("Read {0} bytes from {1}", bytesRead, module.ModuleName);
}
else
{
Console.WriteLine("Failed to read from {0}", module.ModuleName);
}
}
System.Threading.Thread.Sleep(interval * 1000);
}
}
}
}