[DllImport("kernel32.dll",SetLastError = true)]
static extern bool WriteProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
byte[] lpBuffer,
int nSize,
out IntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool WriteProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
IntPtr lpBuffer,
int nSize,
out IntPtr lpNumberOfBytesWritten);
<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function WriteProcessMemory(
ByVal hProcess As IntPtr,
ByVal lpBaseAddress As IntPtr,
ByVal lpBuffer As Byte(),
ByVal nSize As Int32,
<Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function WriteProcessMemory(
ByVal hProcess As IntPtr,
ByVal lpBaseAddress As IntPtr,
ByVal lpBuffer As IntPtr,
ByVal nSize As Int32,
<Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean
End Function
None.
Use the Signature with the IntPtr as lpBuffer for passing Structures, which got copied to the unmanaged Heap with Marshal.AllocHGlobal and Marshal.StructureToPtr.
public int WriteByteArray(IntPtr BaseAddress, byte[] NewVal)
{
// Return Value
int ReturnVal;
// Write Memory Byte Array
ReturnVal = WriteProcessMemory(this.hProcess, BaseAddress, NewVal, NewVal.Length, out this.BytesWritten);
return this.BytesWritten;
}
// Sample with IntPtr as lpBuffer for passing structs
public class SomeClass
{
// Some Win32 Struct in CSharp
[StructLayout(LayoutKind.Sequential)]
private struct LVITEM
{
public UInt32 mask;
public Int32 iItem;
public Int32 iSubItem;
public UInt32 state;
public UInt32 stateMask;
public IntPtr pszText;
public Int32 cchTextMax;
public Int32 iImage;
public IntPtr lParam;
public Int32 iIndent;
public Int32 iGroupId;
public UInt32 cColumns;
public UIntPtr puColumns;
public IntPtr piColFmt;
public Int32 iGroup;
}
public void WriteStructureToProcessMemory(IntPtr processHandle, IntPtr BaseAddress)
{
UInt32 sizeOfLVITEM = (UInt32)Marshal.SizeOf(typeof(LVITEM));
IntPtr ptrToLvItem = Marshal.AllocHGlobal((int)sizeOfLVITEM);
Marshal.StructureToPtr(lvItem, ptrToLvItem, true);
WriteProcessMemory(processHandle, BaseAddress, ptrToLvItem, sizeOfLVITEM, UIntPtr.Zero);
}
}
The ManagedWindowsApi project (http://mwinapi.sourceforge.net) provides a ProcessMemoryChunk class to allocate and access memory of a different process.