Initial commit

2026-07-21 22:30:10 +02:00
parent 21d2dd0460
commit 0380705e76
67 changed files with 7356 additions and 0 deletions
@@ -0,0 +1,90 @@
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using WhiteMagic.Native;
+
+namespace WhiteMagic;
+
+/// <summary>
+/// In-process memory reader that accesses the owning process's memory through
+/// <see cref="NativeMethods.ReadProcessMemory"/> and
+/// <see cref="NativeMethods.WriteProcessMemory"/> on a handle to the current
+/// process. Unlike the unsafe-deref approach, this fails softly (returns
+/// empty / zero bytes) on invalid or protected addresses instead of crashing
+/// the host process with an <see cref="AccessViolationException"/>.
+/// </summary>
+public sealed class InProcessReader : MemoryBase
+{
+    private readonly SafeMemoryHandle _handle;
+    private readonly IntPtr _imageBase;
+    private bool _disposed;
+
+    /// <summary>
+    /// Creates an in-process reader for the current process.
+    /// </summary>
+    public InProcessReader()
+    {
+        Process current = Process.GetCurrentProcess();
+        _handle = NativeMethods.OpenProcess(
+            ProcessAccess.VmRead | ProcessAccess.VmWrite | ProcessAccess.VmOperation | ProcessAccess.QueryInformation,
+            false,
+            current.Id);
+        if (_handle.IsInvalid)
+        {
+            int error = Marshal.GetLastPInvokeError();
+            throw new InvalidOperationException(
+                $"OpenProcess failed for PID {current.Id}: error {error}");
+        }
+
+        _imageBase = current.MainModule?.BaseAddress ?? IntPtr.Zero;
+    }
+
+    /// <inheritdoc />
+    public override IntPtr ImageBase => _imageBase;
+
+    /// <inheritdoc />
+    public override SafeMemoryHandle Handle => _handle;
+
+    /// <inheritdoc />
+    public override byte[] ReadBytes(IntPtr address, int count, bool isRelative = false)
+    {
+        if (isRelative)
+            address = GetAbsolute(address);
+
+        byte[] buffer = new byte[count];
+        if (!NativeMethods.ReadProcessMemory(_handle, address, buffer, count, out nint bytesRead))
+        {
+            return [];
+        }
+
+        if ((int)bytesRead != count)
+        {
+            Array.Resize(ref buffer, (int)bytesRead);
+        }
+
+        return buffer;
+    }
+
+    /// <inheritdoc />
+    public override int WriteBytes(IntPtr address, ReadOnlySpan<byte> bytes, bool isRelative = false)
+    {
+        if (isRelative)
+            address = GetAbsolute(address);
+
+        if (!NativeMethods.WriteProcessMemory(_handle, address, bytes, bytes.Length, out nint written))
+        {
+            return 0;
+        }
+
+        return (int)written;
+    }
+
+    /// <inheritdoc />
+    public override void Dispose()
+    {
+        if (!_disposed)
+        {
+            _disposed = true;
+            _handle.Dispose();
+        }
+    }
+}