I would like some of guide line or some help about this setting code.
private MemoryInformation[][] GetRegions()
{
var addy = new IntPtr();
IList<MemoryInformation> regions
= new List<MemoryInformation>();
while (true)
{
var memInf = new MemoryInformation();
int memDump = Pinvoke.VirtualQueryEx(_access.Handle, addy,
out memInf, Marshal.SizeOf(memInf));
if (memDump == 0)
return DivideRegions(regions);
var memProps = MemoryProperties.Parse(memInf);
if (!memProps.State.IsCommited &&
!memProps.Protect.IsGuard &&
memProps.Protect.IsReadOnly)
goto ADDY;
if (!Settings.MemPrivate)
{
if (memProps.Type.IsPrivate)
goto ADDY;
}
if (!Settings.MemImage)
{
if (memProps.Type.IsImageMapped)
goto ADDY;
}
if (!Settings.MemMapped)
{
if (memProps.Type.IsMapped)
goto ADDY;
}
if (Settings.Writable != ScanType.BOTH)
{
if (Settings.Writable == ScanType.ONLY)
{
if (!memProps.Protect.IsWritable)
goto ADDY;
}
else if (memProps.Protect.IsWritable)
goto ADDY;
}
if (Settings.CopyOnWrite != ScanType.BOTH)
{
if (Settings.CopyOnWrite == ScanType.ONLY)
{
if (!memProps.Protect.IsCopyOnWrite)
goto ADDY;
}
else if (memProps.Protect.IsCopyOnWrite)
goto ADDY;
}
if (Settings.Executable != ScanType.BOTH)
{
if (Settings.Executable == ScanType.ONLY)
{
if (!memProps.Protect.IsExecutable)
goto ADDY;
}
else if (memProps.Protect.IsExecutable)
goto ADDY;
}
regions.Add(memInf);
ADDY:
addy = new IntPtr(memInf.BaseAddress.ToInt32()
+ (int)memInf.RegionSize);
}
}
private MemoryInformation[][] DivideRegions(IEnumerable<MemoryInformation> regions)
{
var regionsArray = regions.ToArray();
var result = regionsArray.Length / _tasksAmount;
var rest = regionsArray.Length - (result * _tasksAmount);
var count = 0;
IList<MemoryInformation> subList
= new List<MemoryInformation>();
IList<MemoryInformation[]> list
= new List<MemoryInformation[]>();
for (int i = 0; i < _tasksAmount; i++)
{
subList = new List<MemoryInformation>();
for (int x = 0; x < result; x++)
subList.Add(regionsArray[count++]);
list.Add(subList.ToArray());
}
if (rest != 0)
{
subList = new List<MemoryInformation>();
for (int i = 0; i < rest; i++)
subList.Add(regionsArray[count++]);
list.Add(subList.ToArray());
}
return list.ToArray();
}
I have read and do some reserch about this code and know that I can modified the start address at var addy = new IntPtr(); (ln 3)
by using like this var addy = new IntPtr(0x10000000); (ln 3)
But I have stuck in the place that I don't know how to modified the Maximum value.
By the way, I am using a nutdeep memory scanner from this link NuGet , Nutdeep . In the manual of the Package didn't say how to modified the minimum address and maximum address. So that is my question.
How can I modified the Maximum address?
Thank you.
PS. The code may longer from this page. But I choose the important code to paste on this(means I think it can answer my question).
User contributions licensed under CC BY-SA 3.0