Skip to content

Instantly share code, notes, and snippets.

@hackf5
Last active May 19, 2023 23:44
Show Gist options
  • Save hackf5/3aa3b0bd3d019d2116bab8f9264d7906 to your computer and use it in GitHub Desktop.
Save hackf5/3aa3b0bd3d019d2116bab8f9264d7906 to your computer and use it in GitHub Desktop.
[DllImport("kernel32", SetLastError = true)]
static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
IntPtr lpBuffer,
int nSize,
out IntPtr lpNumberOfBytesRead);
void ReadProcessMemory(Process process, byte[] buffer, IntPtr processAddress)
{
var bufferHandle = GCHandle.Alloc(buffer, GCHandleType.Pinned);
try
{
var bufferPointer = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);
ReadProcessMemory(
process.Handle,
processAddress,
bufferPointer,
buffer.Length,
out _);
}
finally
{
bufferHandle.Free();
}
}
var moduleDump = new byte[monoModule.ModuleMemorySize];
ReadProcessMemory(process, moduleDump, monoModule.BaseAddress);
// moduleDump now contains the contents of the monoModule
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment