Ciao a tutti ,
stavo cercando di fare un programma per cercare un exe sulla base della sua impronta in memoria :
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
byte[] lpBuffer,
UInt32 nSize,
ref UInt32 lpNumberOfBytesRead
);
private void button1_Click(object sender, EventArgs e)
{
Process[] process = Process.GetProcessesByName("WindowsTerminal");
byte[] memory = new byte[255];
uint bytesRead = 0;
bool success = ReadProcessMemory(
process[0].Handle,
process[0].MainModule.BaseAddress,
memory,
(uint)memory.Length,
ref bytesRead);
bool t = success;
this.FindProcess(memory);
}
private void button2_Click(object sender, EventArgs e)
{
Process[] process = Process.GetProcessesByName("PerfWatson2");
byte[] memory = new byte[255];
uint bytesRead = 0;
bool success = ReadProcessMemory(
process[0].Handle,
process[0].MainModule.BaseAddress,
memory,
(uint)memory.Length,
ref bytesRead);
bool t = success;
Process[] process1 = Process.GetProcessesByName("WindowsTerminal");
byte[] memory1 = new byte[255];
uint bytesRead1 = 0;
bool success1 = ReadProcessMemory(
process1[0].Handle,
process1[0].MainModule.BaseAddress,
memory,
(uint)memory.Length,
ref bytesRead);
bool s = success1;
//this.FindProcess(memory);
}
private void FindProcess(byte[] impronta)
{
Process[] listProcess = Process.GetProcesses();
bool found = false;
int counter = 0;
int counted = listProcess.Count();
while(counter < counted && !found)
{
Process currentProcess = listProcess[counter];
byte[] memory = new byte[255];
uint bytesRead = 0;
try {
bool success = ReadProcessMemory(
currentProcess.Handle,
currentProcess.MainModule.BaseAddress,
memory,
(uint)memory.Length,
ref bytesRead);
if(impronta==memory)
{
found = true;
}
} catch(Exception ex)
{
this.textBox1.AppendText(ex.Message);
}
counter++;
}
}
tutto funziona se analizzo un processo alla volta come in "button2_Click" ,mentre mi ritorna un errore "Accesso Negato" se cerco di analizzare tutti i processi ciclando sulla collezione degli stessi come in FindProcess , come NativeErrorCode ho 5 ,il che dovrebbe corrispondere ad InvalidClass (
https://learn.microsoft.com/en-us/dotnet/api/microsoft.management.infrastructure.nativeerrorcode?view=powershellsdk-7.3.0 ), valore che non mi dice molto, forse è l'av che non gradisce si scanni la memoria? ,