C# Compact & usefull memory accessing class

**sorpz** · 12-07-2012

Introducing a C# class to access process memory, called 'ProcessMemoryAccessor'...

You could easily create a new 'ProcessMemoryAccessor' object by giving a Process to its constructor..

Code:

ProcessMemoryAccessor testPma = new ProcessMemoryAccessor(ProcessMemoryAccessor.GetProcessByName("iw5mp"));

You could also give 'ProcessAccessTypes' flags to its construtor, but they're default set to read & write..

Code:

[Flags]
public enum ProcessAccessTypes
{
    TERMINATE = (0x0001),
    CREATE_THREAD = (0x0002),
    SET_SESSIONID = (0x0004),
    VM_OPERATION = (0x0008),
    VM_READ = (0x0010),
    VM_WRITE = (0x0020),
    DUP_HANDLE = (0x0040),
    CREATE_PROCESS = (0x0080),
    SET_QUOTA = (0x0100),
    SET_INFORMATION = (0x0200),
    QUERY_INFORMATION = (0x0400)
}

If you successfully created a new 'ProcessMemoryAccessor' object you're able to use a few methods to access its memory content..

Code:

public IntPtr GetModuleBaseByName(); // gets the baseaddress of a module of the current process

public byte[] ReadMemory(); // reads raw memory 
public string ReadString(); // reads raw memory and converts it to string
public int ReadInteger(); // reads raw memory and converts it to int
public float ReadFloat(); // reads raw memory and converts it to float

public void WriteMemory(); // writes raw memory (bytes[])
public void WriteString(); // writes memory (string)
public void WriteInteger(); // writes memory (int)
public void WriteFloat(); // writes memory (float)

public void FreezeMemory(); // freezes a memoryaddress value
public void UnfreezeMemory(); // unfreezes a memoryaddress value, if freezed

public void Close();

So lets check an example..

Code:

using System;
using System.Diagnostics; // required (Process,...)
using System.MemoryAccessing; // required (ProcessMemoryAccessor)

namespace Test{
    class Programm{
        static void Main(string[] args){
            
            Process mw3Proc = null;
            while (true){
                mw3Proc = ProcessMemoryAccessor.GetProcessByName("iw5mp");
                if (mw3Proc != null) break;
            }
            
            ProcessMemoryAccessor pma = ProcessMemoryAccessor(mw3Proc);
            int myPrestige = pma.ReadInteger(0x1DBD448);
            pma.Close();
            
            Console.WriteLine("My prestige lvl: " + myPrestige);
            Console.ReadKey();
        }
    }
}

Hope you'll enjoy it. Questions? pm...

https://virusscan.jotti.org/en/scanre...927172560e09ed
https://www.virustotal.com/file/6e20...is/1355009214/

**Kenshin13** · 12-07-2012

Should add double and character access. Just to simplify work further. :P

**sorpz** · 12-08-2012

Finally fixxed some issues and added the two functions mentioned above.. thanks Kenshin13

...

Giving you the full source code below...

Code:

using System;
using System.Collections.Generic;
using System.Collections;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System****;
using System.Threading;

namespace System.MemoryAccessing
{
    /// <summary>
    /// Class to read & write memory to/from addresses
    /// </summary>
    public class MemoryAccessor
    {
        #region Imports

        [DllImport("kernel32.dll")]
        private static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);

        [DllImport("kernel32.dll")]
        private static extern Int32 CloseHandle(IntPtr hObject);

        [DllImport("kernel32.dll")]
        private static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);

        [DllImport("kernel32.dll")]
        private static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesWritten);

        #endregion

        #region Fields

        private Process _tProcess;
        private IntPtr _tProcessHandle;
        private ProcessAccessTypes _tFlags;

        private Dictionary<IntPtr, Thread> _frozenAddresses;

        #region Public

        /// <summary>
        /// Gets the target process object
        /// </summary>
        public Process TargetProcess
        {
            get { return this._tProcess; }
        }
        /// <summary>
        /// Gets the target process handle pointer
        /// </summary>
        public IntPtr TargetProcessHandle
        {
            get { return this._tProcessHandle; }
        }
        /// <summary>
        /// Gets the target flags (access types)
        /// </summary>
        public ProcessAccessTypes TargetFlags
        {
            get { return this._tFlags; }
        }

        #endregion

        #endregion

        #region Constructor & Destructor

        public MemoryAccessor(Process tProcess, ProcessAccessTypes tFlags = (ProcessAccessTypes.VM_READ | ProcessAccessTypes.VM_WRITE | ProcessAccessTypes.VM_OPERATION))
        {
            this._tProcess = tProcess;
            this._tFlags = tFlags;
            this._tProcessHandle = OpenProcess((uint)this._tFlags, 1, (uint)this._tProces*****);
            this._frozenAddresses = new Dictionary<IntPtr, Thread>();
        }

        ~MemoryAccessor()
        {
            try
            {
                try
                {
                    int error = CloseHandle(this._tProcessHandle);
                    if (error == 0)
                        throw new Exception("Failed to close handle!");
                }
                catch
                {

                }

                foreach (KeyValuePair<IntPtr, Thread> kvp in this._frozenAddresses)
                    kvp.Value.Abort();
            }
            catch
            { }
        }

        #endregion

        #region Methods

        private void FreezeThreadMethod(int mAddress, uint size)
        {
            byte[] data = this.ReadMemory(mAddress, size);

            while (true)
            {
                this.WriteMemory(mAddress, data);
                Thread.Sleep(100);
            }
        }

        #region Public

        public IntPtr GetModuleBaseByName(string mName)
        {
            ProcessModuleCollection pmc = this._tProcess.Modules;
            foreach (ProcessModule pm in pmc)
                if (pm.ModuleName == mName) return pm.BaseAddress;
            return IntPtr.Zero;
        }

        public byte[] ReadMemory(int mAddress, uint size = 5)
        {
            byte[] buffer = new byte[size];
            IntPtr tempPtr;
            ReadProcessMemory(this._tProcessHandle, (IntPtr)mAddress, buffer, (uint)buffer.Length, out tempPtr);
            return buffer;
        }
        public string ReadString(int mAddress, uint lenght = 5)
        {
            return Encoding.ASCII.GetString(this.ReadMemory(mAddress, lenght));
        }
        public int ReadInteger(int mAddress, uint size = 5)
        {
            return BitConverter.ToInt32(this.ReadMemory(mAddress, size), 0);
        }
        public float ReadFloat(int mAddress, uint size = 5)
        {
            return (float)BitConverter.ToDouble(this.ReadMemory(mAddress, size), 0);
        }
        public char ReadCharacter(int mAddress, uint size = 5)
        {
            return BitConverter.ToChar(this.ReadMemory(mAddress, size), 0);
        }
        public double ReadDouble(int mAddress, uint size = 5)
        {
            return BitConverter.ToDouble(this.ReadMemory(mAddress, size), 0);
        }

        public void WriteMemory(int mAddress, byte[] bytes)
        {
            IntPtr tempPtr;
            WriteProcessMemory(this._tProcessHandle, (IntPtr)mAddress, bytes, (uint)bytes.Length, out tempPtr);
        }
        public void WriteString(int mAddress, string str)
        {
            WriteMemory(mAddress, Encoding.ASCII.GetBytes(str));
        }
        public void WriteInteger(int mAddress, int value)
        {
            WriteMemory(mAddress, BitConverter.GetBytes(value));
        }
        public void WriteFloat(int mAddress, float value)
        {
            this.WriteMemory(mAddress, BitConverter.GetBytes(value));
        }
        public void WriteCharacter(int mAddress, char ch)
        {
            this.WriteMemory(mAddress, Encoding.ASCII.GetBytes(new char[]{ ch }));
        }
        public void WriteDouble(int mAddress, double value)
        {
            this.WriteMemory(mAddress, BitConverter.GetBytes(value));
        }

        public void FreezeMemory(int mAddress, uint size = 5)
        {
            ThreadStart ts = delegate { this.FreezeThreadMethod(mAddress, size); };
            this._frozenAddresses.Add((IntPtr)mAddress, new Thread(ts));
            this._frozenAddresses[(IntPtr)mAddress].Start();
        }
        public void UnfreezeMemory(int mAddress)
        {
            try { this._frozenAddresses[(IntPtr)mAddress].Abort(); } catch { }
            this._frozenAddresses.Remove((IntPtr)mAddress);
        }

        public void Close()
        {
            int error = CloseHandle(this._tProcessHandle);
            if (error == 0)
                throw new Exception("Failed to close handle!");

            foreach (KeyValuePair<IntPtr, Thread> kvp in this._frozenAddresses)
                kvp.Value.Abort();
        }

        #region Static

        public static Process GetProcessByName(string pName)
        {
            Process[] procs = Process.GetProcessesByName(pName);
            if (procs.Length != 0)
            {
                if (procs.Length > 1) throw new Exception("Multiple processes detected. Sorry, but it cannot be handled more than one process per session..");
                return procs[0];
            }
            else
                return null;
        }
        public static Process[] GetProcesses()
        {
            return Process.GetProcesses();
        }

        #endregion

        #endregion

        #endregion
    }

    /// <summary>
    /// Enumeration of flags to handle accessed processes
    /// </summary>
    [Flags]
    public enum ProcessAccessTypes
    {
        TERMINATE = (0x0001),
        CREATE_THREAD = (0x0002),
        SET_SESSIONID = (0x0004),
        VM_OPERATION = (0x0008),
        VM_READ = (0x0010),
        VM_WRITE = (0x0020),
        DUP_HANDLE = (0x0040),
        CREATE_PROCESS = (0x0080),
        SET_QUOTA = (0x0100),
        SET_INFORMATION = (0x0200),
        QUERY_INFORMATION = (0x0400)
    }
}

Enjoy,.. and thank, if it helped..

**Kenshin13** · 12-08-2012

You could edit your origional post

**OzeTheDude** · 12-08-2012

i cant get the code to work, it gives me an error when defining pma variable

Code:

MemoryAccessor pma = MemoryAccessor(mw3Proc);

Error that it gives:

Code:

Error	1	'System.MemoryAccessing.MemoryAccessor' is a 'type' but is used like a 'variable'	C:\Users\Ozelinho\AppData\Local\Temporary Projects\Try\Form1.cs	28	34	Try

someone help please

**Kenshin13** · 12-08-2012

Originally Posted by OzeTheDude

i cant get the code to work, it gives me an error when defining pma variable

Code:

MemoryAccessor pma = MemoryAccessor(mw3Proc);

Error that it gives:

Code:

Error	1	'System.MemoryAccessing.MemoryAccessor' is a 'type' but is used like a 'variable'	C:\Users\Ozelinho\AppData\Local\Temporary Projects\Try\Form1.cs	28	34	Try

someone help please

Here try this:

Code:

MemoryAccessor pma = new MemoryAccessor();

**OzeTheDude** · 12-08-2012

Originally Posted by Kenshin13

Here try this:

Code:

MemoryAccessor pma = new MemoryAccessor();

worked, ty kenshin, ur a boss

**Kenshin13** · 12-08-2012

:S Thanks...

**OzeTheDude** · 12-08-2012

great, now when i try to read the memory it stops responding, no error is given, it just stops responding

Code:

        private void button1_Click(object sender, EventArgs e)
        {
            Process mw3Proc = null;
            while (true)
            {
                mw3Proc = MemoryAccessor.GetProcessByName("iw5m");
                if (mw3Proc != null) break;
            }


            MemoryAccessor pma = new MemoryAccessor(mw3Proc);
            currXP = pma.ReadInteger(0x1DBD448);
            pma.Close();
        }

**Kenshin13** · 12-08-2012

Code:

        private void button1_Click(object sender, EventArgs e)
        {
            Process mw3Proc = null;
            while (true)
            {
                mw3Proc = ProcessMemoryAccessor.GetProcessByName("iw5m.dat");
                if (mw3Proc != null) break;
            }


            ProcessMemoryAccessor pma = new ProcessMemoryAccessor(mw3Proc);
            var currXP = pma.ReadInteger(0x1DBD448);
            Log("Current XP: "+currXP.ToString()+"\n");
            pma.Close();
        }

"iw5m.dat" as I assume ur using :iw5m: as 4D1

You sure u know how to code bro? Such simple errors...

**OzeTheDude** · 12-08-2012

Originally Posted by Kenshin13

Code:

        private void button1_Click(object sender, EventArgs e)
        {
            Process mw3Proc = null;
            while (true)
            {
                mw3Proc = ProcessMemoryAccessor.GetProcessByName("iw5m.dat");
                if (mw3Proc != null) break;
            }


            ProcessMemoryAccessor pma = new ProcessMemoryAccessor(mw3Proc);
            var currXP = pma.ReadInteger(0x1DBD448);
            Log("Current XP: "+currXP.ToString()+"\n");
            pma.Close();
        }

"iw5m.dat" as I assume ur using :iw5m: as 4D1

You sure u know how to code bro? Such simple errors...

Code:

Error	2	The name 'Log' does not exist in the current context
Error	1	The type or namespace name 'ProcessMemoryAccessor' could not be found (are you missing a using directive or an assembly reference?)

after i did your coding, i got these errors, and yea i know how to code some stuff, but not that memory accessing hydra

**Kenshin13** · 12-08-2012

Memory Accessing ... what?
Dude, look at Jorndel's tutorials if you need help.

**Nachos** · 12-08-2012

Added virusscans and approved.

---------- Post added at 01:41 AM ---------- Previous post was at 01:32 AM ----------

Originally Posted by sorpz

Finally fixxed some issues and added the two functions mentioned above.. thanks Kenshin13

...

Giving you the full source code below...

Code:

using System;
using System.Collections.Generic;
using System.Collections;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System****;
using System.Threading;

namespace System.MemoryAccessing
{
    /// <summary>
    /// Class to read & write memory to/from addresses
    /// </summary>
    public class MemoryAccessor
    {
        #region Imports

        [DllImport("kernel32.dll")]
        private static extern IntPtr OpenProcess(UInt32 dwDesiredAccess, Int32 bInheritHandle, UInt32 dwProcessId);

        [DllImport("kernel32.dll")]
        private static extern Int32 CloseHandle(IntPtr hObject);

        [DllImport("kernel32.dll")]
        private static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);

        [DllImport("kernel32.dll")]
        private static extern Int32 WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesWritten);

        #endregion

        #region Fields

        private Process _tProcess;
        private IntPtr _tProcessHandle;
        private ProcessAccessTypes _tFlags;

        private Dictionary<IntPtr, Thread> _frozenAddresses;

        #region Public

        /// <summary>
        /// Gets the target process object
        /// </summary>
        public Process TargetProcess
        {
            get { return this._tProcess; }
        }
        /// <summary>
        /// Gets the target process handle pointer
        /// </summary>
        public IntPtr TargetProcessHandle
        {
            get { return this._tProcessHandle; }
        }
        /// <summary>
        /// Gets the target flags (access types)
        /// </summary>
        public ProcessAccessTypes TargetFlags
        {
            get { return this._tFlags; }
        }

        #endregion

        #endregion

        #region Constructor & Destructor

        public MemoryAccessor(Process tProcess, ProcessAccessTypes tFlags = (ProcessAccessTypes.VM_READ | ProcessAccessTypes.VM_WRITE | ProcessAccessTypes.VM_OPERATION))
        {
            this._tProcess = tProcess;
            this._tFlags = tFlags;
            this._tProcessHandle = OpenProcess((uint)this._tFlags, 1, (uint)this._tProces*****);
            this._frozenAddresses = new Dictionary<IntPtr, Thread>();
        }

        ~MemoryAccessor()
        {
            try
            {
                try
                {
                    int error = CloseHandle(this._tProcessHandle);
                    if (error == 0)
                        throw new Exception("Failed to close handle!");
                }
                catch
                {

                }

                foreach (KeyValuePair<IntPtr, Thread> kvp in this._frozenAddresses)
                    kvp.Value.Abort();
            }
            catch
            { }
        }

        #endregion

        #region Methods

        private void FreezeThreadMethod(int mAddress, uint size)
        {
            byte[] data = this.ReadMemory(mAddress, size);

            while (true)
            {
                this.WriteMemory(mAddress, data);
                Thread.Sleep(100);
            }
        }

        #region Public

        public IntPtr GetModuleBaseByName(string mName)
        {
            ProcessModuleCollection pmc = this._tProcess.Modules;
            foreach (ProcessModule pm in pmc)
                if (pm.ModuleName == mName) return pm.BaseAddress;
            return IntPtr.Zero;
        }

        public byte[] ReadMemory(int mAddress, uint size = 5)
        {
            byte[] buffer = new byte[size];
            IntPtr tempPtr;
            ReadProcessMemory(this._tProcessHandle, (IntPtr)mAddress, buffer, (uint)buffer.Length, out tempPtr);
            return buffer;
        }
        public string ReadString(int mAddress, uint lenght = 5)
        {
            return Encoding.ASCII.GetString(this.ReadMemory(mAddress, lenght));
        }
        public int ReadInteger(int mAddress, uint size = 5)
        {
            return BitConverter.ToInt32(this.ReadMemory(mAddress, size), 0);
        }
        public float ReadFloat(int mAddress, uint size = 5)
        {
            return (float)BitConverter.ToDouble(this.ReadMemory(mAddress, size), 0);
        }
        public char ReadCharacter(int mAddress, uint size = 5)
        {
            return BitConverter.ToChar(this.ReadMemory(mAddress, size), 0);
        }
        public double ReadDouble(int mAddress, uint size = 5)
        {
            return BitConverter.ToDouble(this.ReadMemory(mAddress, size), 0);
        }

        public void WriteMemory(int mAddress, byte[] bytes)
        {
            IntPtr tempPtr;
            WriteProcessMemory(this._tProcessHandle, (IntPtr)mAddress, bytes, (uint)bytes.Length, out tempPtr);
        }
        public void WriteString(int mAddress, string str)
        {
            WriteMemory(mAddress, Encoding.ASCII.GetBytes(str));
        }
        public void WriteInteger(int mAddress, int value)
        {
            WriteMemory(mAddress, BitConverter.GetBytes(value));
        }
        public void WriteFloat(int mAddress, float value)
        {
            this.WriteMemory(mAddress, BitConverter.GetBytes(value));
        }
        public void WriteCharacter(int mAddress, char ch)
        {
            this.WriteMemory(mAddress, Encoding.ASCII.GetBytes(new char[]{ ch }));
        }
        public void WriteDouble(int mAddress, double value)
        {
            this.WriteMemory(mAddress, BitConverter.GetBytes(value));
        }

        public void FreezeMemory(int mAddress, uint size = 5)
        {
            ThreadStart ts = delegate { this.FreezeThreadMethod(mAddress, size); };
            this._frozenAddresses.Add((IntPtr)mAddress, new Thread(ts));
            this._frozenAddresses[(IntPtr)mAddress].Start();
        }
        public void UnfreezeMemory(int mAddress)
        {
            try { this._frozenAddresses[(IntPtr)mAddress].Abort(); } catch { }
            this._frozenAddresses.Remove((IntPtr)mAddress);
        }

        public void Close()
        {
            int error = CloseHandle(this._tProcessHandle);
            if (error == 0)
                throw new Exception("Failed to close handle!");

            foreach (KeyValuePair<IntPtr, Thread> kvp in this._frozenAddresses)
                kvp.Value.Abort();
        }

        #region Static

        public static Process GetProcessByName(string pName)
        {
            Process[] procs = Process.GetProcessesByName(pName);
            if (procs.Length != 0)
            {
                if (procs.Length > 1) throw new Exception("Multiple processes detected. Sorry, but it cannot be handled more than one process per session..");
                return procs[0];
            }
            else
                return null;
        }
        public static Process[] GetProcesses()
        {
            return Process.GetProcesses();
        }

        #endregion

        #endregion

        #endregion
    }

    /// <summary>
    /// Enumeration of flags to handle accessed processes
    /// </summary>
    [Flags]
    public enum ProcessAccessTypes
    {
        TERMINATE = (0x0001),
        CREATE_THREAD = (0x0002),
        SET_SESSIONID = (0x0004),
        VM_OPERATION = (0x0008),
        VM_READ = (0x0010),
        VM_WRITE = (0x0020),
        DUP_HANDLE = (0x0040),
        CREATE_PROCESS = (0x0080),
        SET_QUOTA = (0x0100),
        SET_INFORMATION = (0x0200),
        QUERY_INFORMATION = (0x0400)
    }
}

Enjoy,.. and thank, if it helped..

You need two virusscans, I added to the other one because it was more than 24 hours ago.

Thread: C# Compact & usefull memory accessing class

Thread Tools

Display

C# Compact & usefull memory accessing class

The Following 3 Users Say Thank You to sorpz For This Useful Post:

The Following User Says Thank You to Kenshin13 For This Useful Post:

The Following 3 Users Say Thank You to sorpz For This Useful Post:

help again

Similar Threads

[Solved] Abnormal Memory access from a dll by Xtrap

[Help] Abnormal memory access

[Help] The game execute file is not normal or abnormal memory access has been detected HELP?

Tutorial Replies - Direct Memory Access (DMA) to Static Memory Addresses

Direct Memory Access (DMA) to Static Memory Addresses