CODEWITHSUNDEEP
c#winforms
Doron Muzar
Doron Muzar

Reputation: 443

I'm trying to read memory of a process but for some reason I'm not getting the right size of the process memory - what's wrong?

This is the code in Form1:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace MemoryScanner
{
    public partial class Form1 : Form
    {


        [DllImport("kernel32.dll")]
        public static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress,
            [In, Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);

        public static byte[] ReadBytes(IntPtr Handle, Int64 Address, uint BytesToRead)
        {
            IntPtr ptrBytesRead;
         //   ptrBytesRead = (IntPtr)30;
            byte[] buffer = new byte[BytesToRead];
            ReadProcessMemory(Handle, new IntPtr(Address), buffer, BytesToRead, out ptrBytesRead);

            Array.Resize<byte>(ref buffer, ptrBytesRead.ToInt32());
            return buffer;
        }

        public static int ReadInt32(long Address, uint length = 4, IntPtr? Handle = null)
        {
            return BitConverter.ToInt32(ReadBytes((IntPtr)Handle, Address, length), 0);
        }

        public static string ReadString(long Address, uint length = 32, IntPtr? Handle = null)
        {
            string temp3 = ASCIIEncoding.Default.GetString(ReadBytes((IntPtr)Handle, Address, length));
            string[] temp3str = temp3.Split('\0');
            return temp3str[0];
        }


        public Form1()
        {
            InitializeComponent();

            Process p = null;
            UInt32 Address = 00002688;
            // get process
            Process[] Processes = Process.GetProcesses();
            List<Process> flash_processes = new List<Process>();
            for (int i = 0; i < Processes.Length; i++)
            {
                //IntPtr f = Test[i].MainModule.BaseAddress;// Are you sure you want the flag  process ? 
                p = Processes[i];
                if (p.ProcessName.StartsWith("FlashPlugin") == true)
                    flash_processes.Add(p);
            }
            Process Test = flash_processes[1]; // take the second flash process .. are you sure about that? we need the second process ?


            p = Candy;




            UInt32 proc_base_addr = (UInt32)p.MainModule.BaseAddress.ToInt32();//+00000+1835008+100000;
            uint proc_mem_sz = (uint)p.MainModule.ModuleMemorySize;

//            byte[] arr = ReadBytes(p.Handle, proc_base_addr, proc_mem_sz);

            byte[] arr = ReadBytes(p.Handle, proc_base_addr, proc_mem_sz);//5 * 1024 * 1024);

The project is under Admin. The size i'm getting arr is: 1888256 also the variable proc_mem_sz contain: 1888256

When i'm using the windows Task Manager i see two processes one it's memory size: 78.1MB The second one is: 3.1MB

The problem is that i can't get the specific process memory size. I need it to read all the memory of a specific process.

Upvotes: 1

Views: 416

Answers (1)

Marius Bancila
Marius Bancila

Reputation: 16318

ModuleMemorySize indicates the amount of memory that is required to load the module. It includes only the size of the static code and data in the module file, but no additional allocations made from the module after it's been loaded.

To get detailed information about the memory usage of a process you should look at GetProcessMemoryInfo. You can find an example here.

You can retrieve information about the current working set (the amount of memory physically mapped to its process context) with QueryWorkingSet \ QueryWorkingSetEx. More info here.

Upvotes: 1

Related Questions