RAMvader library's core class. Instances of this class are able to "attach" to processes and execute reading and writing operations in their memory spaces. More...

Inherits RAMvader.NotifyPropertyChangedAdapter.

Public Member Functions
delegate void	AttachedEventHandler (object sender, EventArgs args)
	Delegate used for handling the event which is fired when the Target object is attached to a process. More...

delegate void	DetachedEventHandler (object sender, EventArgs args)
	Delegate used for handling the event which is fired when the Target object is detached from a process. More...

	Target ()
	Constructor. More...

void	SetTargetEndianness (EEndianness endianness)
	Makes the Target instance assume that the target process is using a specific endianness to store its values. The default endianness assumed by a Target instance is the same endianness as the process that is running RAMvader. More...

EEndianness	GetTargetEndianness ()
	Retrieves the endianness that the Target instance is currently assuming that the target process is using. More...

EEndianness	GetActualTargetEndianness ()
	Retrieves the actual endianness that the Target instance is currently assuming that the target process is using. This method converts the EEndianness.evEndiannessDefault value into either EEndianness.evEndiannessBig or EEndianness.evEndiannessLittle. More...

void	SetTargetPointerSize (EPointerSize pointerSize)
	Makes the Target instance assume that the target process is using a specific pointer size (32 or 64 bits) configuration. The default pointer size assumed by a Target instance is the same pointer size as the process that is running RAMvader. More...

EPointerSize	GetTargetPointerSize ()
	Retrieves the pointer size that the Target instance is currently assuming that the target process is using. More...

EPointerSize	GetActualTargetPointerSize ()
	Retrieves the actual pointer size that the Target instance is currently assuming that the target process is using. This method converts the EPointerSize.evPointerSizeDefault value into either EPointerSize.evPointerSize32 or EPointerSize.evPointerSize64. More...

int	GetActualTargetPointerSizeInBytes ()
	Calls the GetActualTargetPointerSize method and converts its returned value into its corresponding number of bytes. More...

void	SetTargetPointerSizeErrorHandling (EDifferentPointerSizeError pointerSizeErrorHandling)
	Defines how to handle errors related to different pointer sizes between the target process and the process which runs the RAMvader library. More...

EDifferentPointerSizeError	GetTargetPointerSizeErrorHandling ()
	Retrieves the pointer size that the Target instance is currently assuming that the target process is using. More...

void	RevertArrayOnEndiannessDifference (byte[] bytesArray)
	Reverts the given array of bytes, if the target process' endianness is different from the endianness used by the process which runs RAMvader. The target process' endianness can be configured through the SetTargetEndianness(EEndianness) method. More...

bool	AttachToProcess (Process targetProcess)
	Sets the target Process to which the instance needs to be attached. More...

bool	DetachFromProcess ()
	Detaches this instance from its target process. More...

Process	GetAttachedProcess ()
	Retrieves the Process to which this instance is attached. More...

bool	IsAttached ()
	Verify if the Target is currently attached to any Process. This is just a shorthand method for checking if GetAttachedProcess returns a null value. More...

void	RefreshTargetProcessModulesBaseAddresses ()
	Refreshes the internal data which keeps the base addresses of each module of the Process this instance is currently attached to. If new modules have been loaded by the target process, this method should be called to update the internal data about these new modules, if you need to use that data. More...

IntPtr	GetTargetProcessModuleBaseAddress (String moduleName)
	Retrieves the base address of the given target process' module (ProcessModule). More...

byte []	GetValueAsBytesArrayInTargetProcess (Object objVal)
	Retrives a byte array representing the given numeric value as it would appear into the target process' memory space (considering its endianness). More...

bool	WriteToTarget (MemoryAddress address, byte[] writeData)
	Writes a Byte Array into the target process' memory. All other writing methods convert their corresponding input data to a byte sequence and then call this method to execute the actual writing operation. More...

bool	WriteToTarget (MemoryAddress address, Object writeData)
	Writes a value into the target process' memory. More...

bool	ReadFromTarget (MemoryAddress address, byte[] outDestiny)
	Reads a sequence of bytes from the target process' memory, filling the given output array with the read bytes. All other reading methods call this method to read the desired data from the target process, and convert the returned bytes into the target data type. More...

bool	ReadFromTarget (MemoryAddress address, Type typeToRead, ref object outDestiny)
	Reads a value from the target process' memory, given the type of the object to be read. More...

bool	ReadFromTarget< T > (MemoryAddress address, ref T outDestiny)
	Reads a value from the target process' memory. More...

Static Public Member Functions
static EPointerSize	GetRAMvaderPointerSize ()
	Retrieves the pointer size for the process which runs RAMvader. More...

static byte []	GetValueAsBytesArray (Object value, EEndianness endianness=EEndianness.evEndiannessDefault, EPointerSize pointerSize=EPointerSize.evPointerSizeDefault, EDifferentPointerSizeError diffPointerSizeError=EDifferentPointerSizeError.evThrowException)
	Utility method for retrieving a given value as an array of bytes, respecting the specified endianness. More...

static void	RevertArrayOnEndiannessDifference (byte[] bytesArray, EEndianness endianness)
	Reverts the given array of bytes, if the specified endianness is different from the endianness used by the process which runs RAMvader. More...

static bool	IsDataTypeSupported (Type type)
	Verifies if a given data type is supported by the RAMvader library. More...

static int	GetSupportedDataTypeSizeInBytes (Type type)

Properties
Process	TargetProcess `[get]`
	The Process object which this RAMvaderTarget instance is attached to. The TargetProcess property can only be changed by calls to AttachToProcess(Process) or DetachFromProcess. Backed by the m_process field. More...

IntPtr	ProcessHandle `[get]`
	The handle to the Process object which this RAMvaderTarget instance is attached to. The ProcessHandle property can only be changed by calls to AttachToProcess(Process) or DetachFromProcess. Backed by the m_targetProcessHandle field. More...

bool	Attached `[get]`
	A flag specifying if this instance is currently attached to a target process. Returns the same result as the IsAttached method. More...

EEndianness	TargetProcessEndianness `[get, set]`
	The endianness configured for the target process. This property can also be accessed through the methods SetTargetEndianness(EEndianness) and GetTargetEndianness. Backed by the m_targetProcessEndianness field. More...

EEndianness	ActualTargetProcessEndianness `[get]`
	The actual endianness that the Target instance is currently assuming that the target process is using. This is the same value returned by the GetActualTargetEndianness method - see its description for more details. More...

EPointerSize	TargetPointerSize `[get, set]`
	The pointer size configured for the target process. This property can also be accessed through the methods SetTargetPointerSize(EPointerSize) and GetTargetPointerSize. Backed by the m_targetPointerSize field. More...

EPointerSize	ActualTargetPointerSize `[get]`
	The actual pointer size that the Target instance is currently assuming that the target process is using. This is the same value returned by the GetActualTargetPointerSize method - see its description for more details. More...

EDifferentPointerSizeError	PointerSizeErrorHandling `[get, set]`
	The type of error handling which is used when the target process runs with a different pointer size configuration, as compared to the process which runs RAMvader. This property can also be accessed through the methods SetTargetPointerSizeErrorHandling(EDifferentPointerSizeError) and GetTargetPointerSizeErrorHandling. Backed by the m_diffPointerSizeError field. More...

Events
AttachedEventHandler	AttachedEvent
	Handles the event that gets fired when the Target gets attached to a process. More...

DetachedEventHandler	DetachedEvent
	Handles the event that gets fired when the Target gets detached from a process. More...

Events inherited from RAMvader.NotifyPropertyChangedAdapter
PropertyChangedEventHandler	PropertyChanged
	Used for implementing the INotifyPropertyChanged interface. More...

Additional Inherited Members
Protected Member Functions inherited from RAMvader.NotifyPropertyChangedAdapter
void	SendPropertyChangedNotification ([CallerMemberName] string propertyName="")
	This method should be called inside PROPERTY SETTER METHODS to notify listeners of the "property changed" event that the property has been updated. More...

Detailed Description

RAMvader library's core class. Instances of this class are able to "attach" to processes and execute reading and writing operations in their memory spaces.

Constructor & Destructor Documentation

◆ Target()

RAMvader.Target.Target ( )

Constructor.

Member Function Documentation

◆ AttachedEventHandler()

delegate void RAMvader.Target.AttachedEventHandler	(	object	sender,
		EventArgs	args
	)

Delegate used for handling the event which is fired when the Target object is attached to a process.

Parameters

sender	The object that sent the event.
args	The arguments (data) of the event.

◆ AttachToProcess()

bool RAMvader.Target.AttachToProcess ( Process targetProcess )

Sets the target Process to which the instance needs to be attached.

Parameters

targetProcess The target process.

Returns: Returns true in case of success, false in case of failure.

Exceptions

InstanceAlreadyAttachedException Indicates there is a Process currently attached to that Target object. You must detach the instance from the Process by calling DetachFromProcess before trying to attach to another Process.

◆ DetachedEventHandler()

delegate void RAMvader.Target.DetachedEventHandler	(	object	sender,
		EventArgs	args
	)

Delegate used for handling the event which is fired when the Target object is detached from a process.

Parameters

sender	The object that sent the event.
args	The arguments (data) of the event.

◆ DetachFromProcess()

bool RAMvader.Target.DetachFromProcess ( )

Detaches this instance from its target process.

Returns: Returns true if the instance detached successfully. Returns false if something went wrong when detaching from the target process.

Exceptions

InstanceNotAttachedException Indicates this instance of the Target class is currently not attached to any Process.

◆ GetActualTargetEndianness()

EEndianness RAMvader.Target.GetActualTargetEndianness ( )

Retrieves the actual endianness that the Target instance is currently assuming that the target process is using. This method converts the EEndianness.evEndiannessDefault value into either EEndianness.evEndiannessBig or EEndianness.evEndiannessLittle.

Returns: Returns the (assumed) target process' endianness.

See also: SetTargetEndianness(EEndianness)

◆ GetActualTargetPointerSize()

EPointerSize RAMvader.Target.GetActualTargetPointerSize ( )

Retrieves the actual pointer size that the Target instance is currently assuming that the target process is using. This method converts the EPointerSize.evPointerSizeDefault value into either EPointerSize.evPointerSize32 or EPointerSize.evPointerSize64.

Returns: Returns the (assumed) target process' pointer size.

See also: SetTargetPointerSize(EPointerSize)

◆ GetActualTargetPointerSizeInBytes()

int RAMvader.Target.GetActualTargetPointerSizeInBytes ( )

Calls the GetActualTargetPointerSize method and converts its returned value into its corresponding number of bytes.

Returns: Returns the number of bytes that represents the return value of GetActualTargetPointerSize.

See also: GetActualTargetPointerSize

◆ GetAttachedProcess()

Process RAMvader.Target.GetAttachedProcess ( )

Retrieves the Process to which this instance is attached.

Returns: Returns a Process object, indicating the process to which this instance is attached. If the instance is not attached to any process, this method returns null.

◆ GetRAMvaderPointerSize()

static EPointerSize RAMvader.Target.GetRAMvaderPointerSize ( )

static

Retrieves the pointer size for the process which runs RAMvader.

Returns: Returns a EPointerSize value, specifying the pointer size of the process.

◆ GetSupportedDataTypeSizeInBytes()

static int RAMvader.Target.GetSupportedDataTypeSizeInBytes ( Type type )

static

Retrieves the size (as considered by the RAMvader library) of a specific data type that is supported by the library, given in bytes.

ATTENTION: this method does NOT support the IntPtr (see remarks).

Parameters

type	The type to be verified.

Returns: Retrieves the size of the type, in bytes, as considered by the RAMvader library.

Exceptions

UnsupportedDataTypeException Thrown when the given data type is IntPtr or when the given type is not supported by the library. To check if a type is supported (except for the IntPtr type), please refer to IsDataTypeSupported(Type).

The IntPtr type is not supported by this method, as it is a type whose size changes might change depending on the process being a 32-bit or 64-bit process. To retrieve the size considered for an IntPtr, you must use the method Target.GetActualTargetPointerSizeInBytes(), which requires an already-configured Target object.

◆ GetTargetEndianness()

EEndianness RAMvader.Target.GetTargetEndianness ( )

Retrieves the endianness that the Target instance is currently assuming that the target process is using.

Returns: Returns the (assumed) target process' endianness.

See also: SetTargetEndianness(EEndianness)

◆ GetTargetPointerSize()

EPointerSize RAMvader.Target.GetTargetPointerSize ( )

Retrieves the pointer size that the Target instance is currently assuming that the target process is using.

Returns: Returns the (assumed) target process' pointer size.

See also: SetTargetPointerSize(EPointerSize)

◆ GetTargetPointerSizeErrorHandling()

EDifferentPointerSizeError RAMvader.Target.GetTargetPointerSizeErrorHandling ( )

Retrieves the pointer size that the Target instance is currently assuming that the target process is using.

Returns: Returns the (assumed) target process' pointer size.

See also: SetTargetPointerSizeErrorHandling(EDifferentPointerSizeError)

◆ GetTargetProcessModuleBaseAddress()

IntPtr RAMvader.Target.GetTargetProcessModuleBaseAddress ( String moduleName )

Retrieves the base address of the given target process' module (ProcessModule).

Parameters

moduleName The name of the module of the target process whose base address is to be retrieved.

Returns: In case of success, returns the base address of the process' module whose name has been specified. Otherwise (e.g., there is no module with the given name in the target process' list of modules, or in case of any error), this method returns IntPtr.Zero.

◆ GetValueAsBytesArray()

static byte [] RAMvader.Target.GetValueAsBytesArray	(	Object	value,
		EEndianness	endianness = `EEndianness.evEndiannessDefault`,
		EPointerSize	pointerSize = `EPointerSize.evPointerSizeDefault`,
		EDifferentPointerSizeError	diffPointerSizeError = `EDifferentPointerSizeError.evThrowException`
	)

static

Utility method for retrieving a given value as an array of bytes, respecting the specified endianness.

Parameters

value	The value to be retrieved as a sequence of bytes.
endianness	The endianness to be used when retrieving the sequence of bytes.
pointerSize	The size of pointer to be used when retrieving the sequence of bytes. That parameter is only used when retrieving the bytes representation of IntPtr values.
diffPointerSizeError	The policy for handling errors regarding different sizes of pointers between RAMvader process' pointers and the pointers size defined by the "pointerSize" parameter. That parameter is only used when retrieving the bytes representation of IntPtr values.

Returns: Returns a sequence of bytes representing the value in the given endianness (and pointer sizes, if applicable).

◆ GetValueAsBytesArrayInTargetProcess()

byte [] RAMvader.Target.GetValueAsBytesArrayInTargetProcess ( Object objVal )

Retrives a byte array representing the given numeric value as it would appear into the target process' memory space (considering its endianness).

Parameters

objVal An Object representing the value to be converted to its (endianness correct) bytes array representation. This object should be one of the basic data types supported by the RAMvader library.

Returns: Returns an array of bytes representing the given value as it would be stored into the target process' memory, considering the target process' endianness configurations.

◆ IsAttached()

bool RAMvader.Target.IsAttached ( )

Verify if the Target is currently attached to any Process. This is just a shorthand method for checking if GetAttachedProcess returns a null value.

Returns: Returns a flag indicating if the Target instance is currently attached to any process.

◆ IsDataTypeSupported()

static bool RAMvader.Target.IsDataTypeSupported ( Type type )

static

Verifies if a given data type is supported by the RAMvader library.

Parameters

type	The type to be verified.

Returns: Returns a flag indicating if the given type is supported by the RAMvader library.

◆ ReadFromTarget() [1/2]

bool RAMvader.Target.ReadFromTarget	(	MemoryAddress	address,
		byte []	outDestiny
	)

Reads a sequence of bytes from the target process' memory, filling the given output array with the read bytes. All other reading methods call this method to read the desired data from the target process, and convert the returned bytes into the target data type.

Parameters

address	The address on the target process' memory where the data will be read from.
outDestiny	The destiny buffer, where the read data will be copied to. The number of elements in the passed array determines the number of bytes that will be read from the target process.

Returns: Returns true in case of success, false in case of failure.

◆ ReadFromTarget() [2/2]

bool RAMvader.Target.ReadFromTarget	(	MemoryAddress	address,
		Type	typeToRead,
		ref object	outDestiny
	)

Reads a value from the target process' memory, given the type of the object to be read.

Parameters

address	The address on the target process' memory where the data will be read from.
typeToRead	The type to be read from the target process' memory space.
outDestiny	The result of the reading will be stored in this variable. The output data will be one of the basic data types supported by the RAMvader library.

Returns: Returns true in case of success, false in case of failure.

◆ ReadFromTarget< T >()

bool RAMvader.Target.ReadFromTarget< T >	(	MemoryAddress	address,
		ref T	outDestiny
	)

Reads a value from the target process' memory.

Template Parameters

T	The data type expected to be read from the target process' memory space.

Parameters

address	The address on the target process' memory where the data will be read from.
outDestiny	The result of the reading will be stored in this variable. The referenced variable's data must be one of the basic data types supported by the RAMvader library.

Returns: Returns true in case of success, false in case of failure.

◆ RefreshTargetProcessModulesBaseAddresses()

void RAMvader.Target.RefreshTargetProcessModulesBaseAddresses ( )

Refreshes the internal data which keeps the base addresses of each module of the Process this instance is currently attached to. If new modules have been loaded by the target process, this method should be called to update the internal data about these new modules, if you need to use that data.

◆ RevertArrayOnEndiannessDifference() [1/2]

static void RAMvader.Target.RevertArrayOnEndiannessDifference	(	byte []	bytesArray,
		EEndianness	endianness
	)

static

Reverts the given array of bytes, if the specified endianness is different from the endianness used by the process which runs RAMvader.

Parameters

bytesArray	The array to be set to the target process' endianness.
endianness	The endianness to compare agains the RAMvader process' endianness.

◆ RevertArrayOnEndiannessDifference() [2/2]

void RAMvader.Target.RevertArrayOnEndiannessDifference ( byte [] bytesArray )

Reverts the given array of bytes, if the target process' endianness is different from the endianness used by the process which runs RAMvader. The target process' endianness can be configured through the SetTargetEndianness(EEndianness) method.

Parameters

bytesArray The array to be set to the target process' endianness.

◆ SetTargetEndianness()

void RAMvader.Target.SetTargetEndianness ( EEndianness endianness )

Makes the Target instance assume that the target process is using a specific endianness to store its values. The default endianness assumed by a Target instance is the same endianness as the process that is running RAMvader.

Parameters

endianness The new endianness to be assumed as the target process' endianness.

See also: GetTargetEndianness

◆ SetTargetPointerSize()

void RAMvader.Target.SetTargetPointerSize ( EPointerSize pointerSize )

Makes the Target instance assume that the target process is using a specific pointer size (32 or 64 bits) configuration. The default pointer size assumed by a Target instance is the same pointer size as the process that is running RAMvader.

Parameters

pointerSize The new pointer size to be assumed for the target process.

See also: GetTargetPointerSize

◆ SetTargetPointerSizeErrorHandling()

void RAMvader.Target.SetTargetPointerSizeErrorHandling ( EDifferentPointerSizeError pointerSizeErrorHandling )

Defines how to handle errors related to different pointer sizes between the target process and the process which runs the RAMvader library.

Parameters

pointerSizeErrorHandling How different pointer-size-related errors are to be handled.

See also: GetTargetPointerSizeErrorHandling

◆ WriteToTarget() [1/2]

bool RAMvader.Target.WriteToTarget	(	MemoryAddress	address,
		byte []	writeData
	)

Writes a Byte Array into the target process' memory. All other writing methods convert their corresponding input data to a byte sequence and then call this method to execute the actual writing operation.

Parameters

address	The address on the target process' memory where the data is to be written.
writeData	The data to be written to the target process.

Returns: Returns true in case of success, false in case of failure.

◆ WriteToTarget() [2/2]

bool RAMvader.Target.WriteToTarget	(	MemoryAddress	address,
		Object	writeData
	)

Writes a value into the target process' memory.

Parameters

address	The address on the target process' memory where the data is to be written.
writeData	The data to be written to the target process. This data must be one of the basic data types supported by the RAMvader library.

Returns: Returns true in case of success, false in case of failure.

Property Documentation

◆ ActualTargetPointerSize

EPointerSize RAMvader.Target.ActualTargetPointerSize

get

The actual pointer size that the Target instance is currently assuming that the target process is using. This is the same value returned by the GetActualTargetPointerSize method - see its description for more details.

◆ ActualTargetProcessEndianness

EEndianness RAMvader.Target.ActualTargetProcessEndianness

get

The actual endianness that the Target instance is currently assuming that the target process is using. This is the same value returned by the GetActualTargetEndianness method - see its description for more details.

◆ Attached

bool RAMvader.Target.Attached

get

A flag specifying if this instance is currently attached to a target process. Returns the same result as the IsAttached method.

◆ PointerSizeErrorHandling

EDifferentPointerSizeError RAMvader.Target.PointerSizeErrorHandling

getset

The type of error handling which is used when the target process runs with a different pointer size configuration, as compared to the process which runs RAMvader. This property can also be accessed through the methods SetTargetPointerSizeErrorHandling(EDifferentPointerSizeError) and GetTargetPointerSizeErrorHandling. Backed by the m_diffPointerSizeError field.

◆ ProcessHandle

IntPtr RAMvader.Target.ProcessHandle

get

The handle to the Process object which this RAMvaderTarget instance is attached to. The ProcessHandle property can only be changed by calls to AttachToProcess(Process) or DetachFromProcess. Backed by the m_targetProcessHandle field.

◆ TargetPointerSize

EPointerSize RAMvader.Target.TargetPointerSize

getset

The pointer size configured for the target process. This property can also be accessed through the methods SetTargetPointerSize(EPointerSize) and GetTargetPointerSize. Backed by the m_targetPointerSize field.

◆ TargetProcess

Process RAMvader.Target.TargetProcess

get

The Process object which this RAMvaderTarget instance is attached to. The TargetProcess property can only be changed by calls to AttachToProcess(Process) or DetachFromProcess. Backed by the m_process field.

◆ TargetProcessEndianness

EEndianness RAMvader.Target.TargetProcessEndianness

getset

The endianness configured for the target process. This property can also be accessed through the methods SetTargetEndianness(EEndianness) and GetTargetEndianness. Backed by the m_targetProcessEndianness field.

Event Documentation

◆ AttachedEvent

AttachedEventHandler RAMvader.Target.AttachedEvent

Handles the event that gets fired when the Target gets attached to a process.

◆ DetachedEvent

DetachedEventHandler RAMvader.Target.DetachedEvent

Handles the event that gets fired when the Target gets detached from a process.

Public Member Functions

Static Public Member Functions

Properties

Events

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ Target()

Member Function Documentation

◆ AttachedEventHandler()

◆ AttachToProcess()

◆ DetachedEventHandler()

◆ DetachFromProcess()

◆ GetActualTargetEndianness()

◆ GetActualTargetPointerSize()

◆ GetActualTargetPointerSizeInBytes()

◆ GetAttachedProcess()

◆ GetRAMvaderPointerSize()

◆ GetSupportedDataTypeSizeInBytes()

◆ GetTargetEndianness()

◆ GetTargetPointerSize()

◆ GetTargetPointerSizeErrorHandling()

◆ GetTargetProcessModuleBaseAddress()

◆ GetValueAsBytesArray()

◆ GetValueAsBytesArrayInTargetProcess()

◆ IsAttached()

◆ IsDataTypeSupported()

◆ ReadFromTarget() [1/2]

◆ ReadFromTarget() [2/2]

◆ ReadFromTarget< T >()

◆ RefreshTargetProcessModulesBaseAddresses()

◆ RevertArrayOnEndiannessDifference() [1/2]

◆ RevertArrayOnEndiannessDifference() [2/2]

◆ SetTargetEndianness()

◆ SetTargetPointerSize()

◆ SetTargetPointerSizeErrorHandling()

◆ WriteToTarget() [1/2]

◆ WriteToTarget() [2/2]

Property Documentation

◆ ActualTargetPointerSize

◆ ActualTargetProcessEndianness

◆ Attached

◆ PointerSizeErrorHandling

◆ ProcessHandle

◆ TargetPointerSize

◆ TargetProcess

◆ TargetProcessEndianness

Event Documentation

◆ AttachedEvent

◆ DetachedEvent