C# Signature:
[DllImport("kernel32.dll", SetLastError=true)]
static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
[Out()] byte[] lpBuffer,
int dwSize,
out int lpNumberOfBytesRead
);
[DllImport("kernel32.dll", SetLastError=true)]
static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
[Out(),MarshalAs(UnmanagedType.AsAny)] object lpBuffer,
int dwSize,
out int lpNumberOfBytesRead
);
[DllImport("kernel32.dll", SetLastError=true)]
static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
IntPtr lpBuffer,
int dwSize,
out int lpNumberOfBytesRead
);
[DllImport("kernel32.dll", SetLastError=true)]
static unsafe extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
void* lpBuffer,
int dwSize,
out int lpNumberOfBytesRead
);
VB.Net Signature:
<DllImport("kernel32.dll", SetLastError=true)> _
Public Shared Function ReadProcessMemory( _
ByVal hProcess As IntPtr, _
ByVal lpBaseAddress As IntPtr, _
<Out()>ByVal lpBuffer() As Byte, _
ByVal dwSize as Integer, _
ByRef lpNumberOfBytesRead as Integer
) As Boolean
End Function
<DllImport("kernel32.dll", SetLastError=true)> _
Public Shared Function ReadProcessMemory( _
ByVal hProcess As IntPtr, _
ByVal lpBaseAddress As IntPtr, _
<Out(),MarshalAs(UnmanagedType.AsAny)>ByVal lpBuffer As object, _
ByVal dwSize as Integer, _
ByRef lpNumberOfBytesRead as Integer _
) As Boolean
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function ReadProcessMemory( _
ByVal hProcess As IntPtr, _
ByVal lpBaseAddress As IntPtr, _
ByVal lpBuffer As IntPtr, _
ByVal iSize As Integer, _
ByRef lpNumberOfBytesRead As Integer) As Boolean
End Function
User-Defined Types:
None.
Notes:
Tips & Tricks:
To read primitive values without boxing pass in a byte array to read the content. Use methods in the BitConverter class to convert the data.
You can also make aliases of the signatures above to pass the variable recieving the data by reference. e.g
<DllImport("kernel32.dll", SetLastError=true, EntryPoint="ReadProcessMemory")> _
Public Shared Function ReadVMInteger(ByVal hProcess As IntPtr,ByVal lpBaseAddress As IntPtr,
ByRef lpBuffer As Integer,ByVal dwSize as Integer, ByRef lpNumberOfBytesRead as Integer);
Sample Code:
Please add some!
Alternative Managed API:
Do you know one? Please contribute it!
