Untitled

                Never    
C#
       
using System;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace AnalPenetration
{
    /// <summary>
    /// Memory Lib v3.1.7 (only for x86 target processes!)
    /// </summary>
    public static unsafe class Memory
    {
        #region IMPORTS

        public const string Ntdll = "ntdll.dll";
        public const string Kernel32 = "kernel32.dll";

        //NtOpenProcess
        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate int OPDelegate(IntPtr pOutProcessHandle, int desiredAccess, IntPtr pObjectAttributes, IntPtr pClientId);
        public static OPDelegate OpenProc = CryptUtils.DecryptDelegate<OPDelegate>(Ntdll, new byte[] { 0x43, 0x74, 0xE8, 0xF7, 0xE7, 0x46, 0x49, 0xC8, 0xD1, 0xB2, 0xBC, 0x6E, 0x9C, 0x55 }, unchecked((int)0xB70BE978), 21); //"NtOpenProcess\0" (0xB70BE978, 21)

        //CloseHandle
        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate bool CHDelegate(IntPtr hObject);
        public static CHDelegate CloseHandle = CryptUtils.DecryptDelegate<CHDelegate>(Kernel32, new byte[] { 0x2A, 0x97, 0xF7, 0xF8, 0x52, 0x46, 0x03, 0xFF, 0xB6, 0xC0, 0xAB, 0xFA }, unchecked((int)0xA4721FBC), 11); //"CloseHandle\0" (0xA4721FBC, 11)


        //NtWriteVirtualMemory
        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate int WMDelegate(IntPtr hProcess, void* address, IntPtr pBuffer, uint size, out uint pNumOfBytesWritten);
        public static WMDelegate WriteMem = CryptUtils.DecryptDelegate<WMDelegate>(Ntdll, new byte[] { 0x60, 0x21, 0x0B, 0xA4, 0x87, 0x5D, 0x84, 0xA9, 0x9F, 0xD4, 0xC1, 0xEA, 0x8D, 0x0C, 0x2B, 0x69, 0xF9, 0x75, 0x18, 0x09, 0xD1 }, unchecked((int)0xDA256C12), 7); //"NtWriteVirtualMemory\0" - (0xDA256C12, 7)

        //NtReadVirtualMemory
        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate int RMDelegate(IntPtr hProcess, void* address, IntPtr pBuffer, uint size, out uint pNumOfBytesReaded);
        public static RMDelegate ReadMem = CryptUtils.DecryptDelegate<RMDelegate>(Ntdll, new byte[] { 0x16, 0x03, 0xFA, 0x82, 0x80, 0xE3, 0x9E, 0x18, 0xCD, 0x04, 0x11, 0xE4, 0xCB, 0x99, 0x0B, 0x7C, 0x63, 0xAD, 0xEF, 0xCE }, 0x0151A295, 3); //"NtReadVirtualMemory\0" (0x0151A295, 3)

        #endregion //IMPORTS



        //Privates
        private static IntPtr _hProcess;
        private static Process _process;
        private static uint _dummyReturnedBytes;


        //Publics
        public static bool IsProcessOpen => (_hProcess != IntPtr.Zero);

        public static IntPtr ProcessHandle => _hProcess;
        public static Process Process => _process;



        /// <summary>
        /// Open process by pid
        /// </summary>
        /// <param name="pid">Process id</param>
        /// <param name="desiredAccess">Access priveleges</param>
        /// <returns>Result of process open operation, returns false when fails</returns>
        public static bool OpenProcess(int pid, int desiredAccess = 0x08 | 0x10 | 0x20)
        {
            try
            {
                //Get process by pid
                _process = Process.GetProcessById(pid);

                //Open handle (genius solution)
                IntPtr procHandle = IntPtr.Zero;
                int objectAttributesLength = (6 * IntPtr.Size);
                byte* objAttr = stackalloc byte[objectAttributesLength];
                *((int*)objAttr) = objectAttributesLength; //Length of OBJECT_ATTRIBUTES
                byte* clientId = stackalloc byte[2 * IntPtr.Size];
                *((IntPtr*)clientId) = (IntPtr)_process.Id; //UniqueProcess
                int result = OpenProc((IntPtr)(&procHandle), desiredAccess, (IntPtr)objAttr, (IntPtr)clientId);
                _hProcess = procHandle;

                return ((result == 0) && (procHandle != IntPtr.Zero));
            }
            catch
            {
                return false;
            }
        }

        /// <summary>
        /// Open process by name
        /// </summary>
        /// <param name="name">Name of process</param>
        /// <param name="desiredAccess">Access priveleges</param>
        /// <returns>Result of process open operation, returns false when fails</returns>
        public static bool OpenProcess(string name, int desiredAccess = 0x08 | 0x10 | 0x20)
        {
            try
            {
                _process = Process.GetProcessesByName(name)[0];
                return OpenProcess(_process.Id, desiredAccess);
            }
            catch
            {
                return false;
            }
        }


        /// <summary>
        /// Close opened process
        /// </summary>
        /// <returns>Result of process closing operation, if handle is invalid or handle already closed then returns false</returns>
        public static bool CloseProcess()
        {
            try
            {
                return CloseHandle(_hProcess);
            }
            catch
            {
                return false;
            }
        }



        /// <summary>
        /// Get value size.
        /// 5 times faster than calling Marshal.SizeOf()!
        /// At the first request, it calculates it once and then stores it for later use without again recalculation.
        /// </summary>
        /// <typeparam name="T">Type for which you want to get the size</typeparam>
        /// <param name="obj">The object for which you want to get the size</param>
        /// <returns>Object size</returns>
        public static uint SizeOf<T>(T obj)
        {
            return FastSize<T>.Size;
        }



        #region <- READING ->

        public static bool Read(int Address, void* ValueAddress, uint ValueSize)
        {
            void* addressPtr;
            *(uint*)(&addressPtr) = *(uint*)(&Address);
            int result = ReadMem(_hProcess, addressPtr, (IntPtr)ValueAddress, ValueSize, out _dummyReturnedBytes);
            return (result == 0);
        }

        public static bool Read<T>(int Address, ref T Value) where T : struct
        {
            //By dirty hacks gets address of Value
            TypedReference tRef = __makeref(Value);
            IntPtr valuePtr = *(IntPtr*)(&tRef);

            //Get size of type
            uint size = FastSize<T>.Size;

            //Read
            void* addressPtr;
            *(uint*)(&addressPtr) = *(uint*)(&Address);
            int result = ReadMem(_hProcess, addressPtr, valuePtr, size, out _dummyReturnedBytes);
            return (result == 0);
        }

        public static T Read<T>(int Address) where T : struct
        {
            T value = default(T);
            if (Read<T>(Address, ref value))
                return value;
            else
                return default(T);
        }

        public static T ReadOffsets<T>(params int[] Addresses) where T : struct
        {
            int prevPtr = 0;
            for (int i = 0; i < Addresses.Length; i++)
            {
                int NextAddress = Addresses[i];
                int ReadAddress = NextAddress + prevPtr;

                if (i == Addresses.Length - 1)
                    return Read<T>(ReadAddress);
                else
                {
                    prevPtr = Read<int>(ReadAddress);
                    if (prevPtr == 0) //Check that its not died pointer?
                        break;
                }
            }

            return default(T);
        }

        /// <summary>
        /// Read array of 'float', 'double', 'int' and etc.
        /// </summary>
        /// <typeparam name="T">Array type</typeparam>
        /// <param name="Address">Address of array</param>
        /// <param name="Array">Reference to already exist array</param>
        /// <returns>Result of reading operation</returns>
        public static bool ReadArray<T>(int Address, ref T[] Array)
        {
            if (Array == null) //Its not null of course
                throw new NullReferenceException();
            if (Array.Length == 0) //Lol
                return false;

            //By dirty hacks gets address of first element in array
            TypedReference tRef = __makeref(Array[0]);
            IntPtr arrPtr = *(IntPtr*)(&tRef);

            //Get full size of array
            uint size = (uint)(SizeOf(Array[0]) * Array.Length);

            //Read array
            return Read(Address, (void*)arrPtr, size);
        }

        /// <summary>
        /// Read byte array
        /// </summary>
        /// <param name="Address">Address of array</param>
        /// <param name="byteArray">Already initializated array that will be filled</param>
        /// <returns>Result of reading operation</returns>
        public static bool ReadBytes(int Address, ref byte[] byteArray)
        {
            fixed (byte* ptr = byteArray)
                return Read(Address, ptr, (uint)byteArray.Length);
        }

        /// <summary>
        /// Read byte array
        /// </summary>
        /// <param name="Address">Address of array</param>
        /// <param name="bytesSize">Size in bytes to read</param>
        /// <returns>Result of reading operation</returns>
        public static byte[] ReadBytes(int Address, uint bytesSize)
        {
            byte[] byteArray = new byte[bytesSize];
            if (ReadBytes(Address, ref byteArray))
                return byteArray;
            else
                return null;
        }

        /// <summary>
        /// Read string with the specified encoding
        /// </summary>
        /// <param name="Address">Address of string</param>
        /// <param name="Encoding">The encoding from which the string will be converted</param>
        /// <param name="MaxLenght">Maximum reading length in chars</param>
        /// <returns>Readed string. If unsuccessful, returns NULL</returns>
        public static string ReadString(int Address, Encoding Encoding, ushort MaxLenght = 512)
        {
            byte[] Array = new byte[MaxLenght];
            fixed (byte* ptr = Array)
            {
                if (Read(Address, ptr, MaxLenght))
                {
                    if (Encoding.IsSingleByte)
                    {
                        for (int i = 0; i < MaxLenght; i++)
                        {
                            if (*(ptr + i) == '\0') //Search null terminator
                                return Encoding.GetString(Array, 0, i);
                        }
                    }
                    else
                    {
                        for (int i = 0; i < MaxLenght; i += 2)
                        {
                            if (*((ushort*)(ptr) + i) == 0) //Search null terminator
                                return Encoding.GetString(Array, 0, i + 1);
                        }
                    }

                    //Okay, we dont find end of string, return all!
                    return Encoding.GetString(Array);
                }
                return null; //Error!
            }
        }

        /// <summary>
        /// Reading string in UTF8 encoding
        /// </summary>
        /// <param name="Address">Address of string</param>
        /// <param name="MaxLenght">Maximum reading length in chars</param>
        /// <returns>Readed string. If unsuccessful, returns NULL</returns>
        public static string ReadString(int Address, ushort MaxLenght = 512)
        {
            return ReadString(Address, Encoding.UTF8, MaxLenght);
        }

        #endregion /* END OF READING */



        #region <- WRITING ->

        /// <summary>
        /// Write something at address with specified size (Faster that any another function)
        /// </summary>
        /// <param name="Address">Address where value will be written</param>
        /// <param name="ValueAddress">Value address inside application</param>
        /// <param name="ValueSize">Size of value (Absolute maximum size is 65535)</param>
        /// <returns>Result of write operation</returns>
        public static bool Write(int Address, void* ValueAddress, uint ValueSize)
        {
            void* addressPtr;
            *(uint*)(&addressPtr) = *(uint*)(&Address);
            int result = WriteMem(_hProcess, addressPtr, (IntPtr)ValueAddress, ValueSize, out _dummyReturnedBytes);
            return (result == 0);
        }

        /// <summary>
        /// Write a value
        /// </summary>
        /// <param name="Address">Address where value will be written</param>
        /// <param name="Value">Value</param>
        /// <returns>Result of write operation</returns>
        public static bool Write<T>(int Address, T Value)
        {
            //By dirty hacks gets address of Value
            TypedReference tRef = __makeref(Value);
            IntPtr valPtr = *(IntPtr*)(&tRef);

            //Get size of type
            uint size = FastSize<T>.Size;

            //Write
            void* addressPtr;
            *(uint*)(&addressPtr) = *(uint*)(&Address);
            int result = WriteMem(_hProcess, addressPtr, valPtr, size, out _dummyReturnedBytes);
            return (result == 0);
        }

        /// <summary>
        /// Write a array of 'float', 'double', 'int' and etc.
        /// </summary>>
        /// <param name="Address">Address where array will be written</param>
        /// <param name="Array">Array</param>
        /// <returns>Result of write operation</returns>
        public static bool WriteArray<T>(int Address, T[] Array)
        {
            if (Array == null) //Its not null of course
                throw new NullReferenceException();
            if (Array.Length == 0) //wtf?
                return false;

            //By dirty hacks gets address of first element in array
            TypedReference tRef = __makeref(Array[0]);
            IntPtr arrPtr = *(IntPtr*)(&tRef);

            //Get full size of array in bytes
            uint arrSize = (uint)(SizeOf(Array[0]) * Array.Length);

            //Write
            return Write(Address, (void*)arrPtr, arrSize);
        }

        /// <summary>
        /// Write byte array
        /// </summary>
        /// <param name="Address">Address where byte array will be writen</param>
        /// <param name="Bytes">Byte array</param>
        /// <returns>Result of writing operation</returns>
        public static bool WriteBytes(int Address, byte[] Bytes)
        {
            if (Bytes == null) //null!
                throw new NullReferenceException();

            fixed (byte* ptr = Bytes)
                return Write(Address, ptr, (uint)(Bytes.Length));
        }


        /// <summary>
        /// Write a string with the specified encoding
        /// </summary>
        /// <param name="Address">Address of writing</param>
        /// <param name="Text">The string to be written</param>
        /// <param name="encoding">The encoding with which the string will be converted to bytes</param>
        public static bool WriteString(int Address, string Text, Encoding encoding)
        {
            byte[] bytes = encoding.GetBytes(Text);
            fixed (byte* ptr = bytes)
                return Write(Address, (void*)(ptr), (uint)(bytes.Length));
        }

        /// <summary>
        /// Write a string with the specified encoding and with a length limit
        /// </summary>
        /// <param name="Address">Address of writing</param>
        /// <param name="Text">The string to be written</param>
        /// <param name="MaxTextLength">Limit string length (in bytes!)</param>
        /// <param name="encoding">The encoding with which the string will be converted to bytes</param>
        public static bool WriteString(int Address, string Text, uint MaxWriteLength, Encoding encoding)
        {
            byte[] bytes = encoding.GetBytes(Text);
            fixed (byte* ptr = bytes)
                return Write(Address, (void*)(ptr), (uint)(Math.Min(MaxWriteLength, bytes.Length)));
        }

        #endregion /* END OF WRITING*/
    }
}

Raw Text