using System; using System.Diagnostics.Contracts; using System.IO; namespace ReClassNET.Memory { public static class Dumper { /// Dumps a chunk of memory to the given stream. /// The memory reader to use. /// The begin of the chunk. /// The size of the chunk. /// The stream to dump to. public static void DumpRaw(IRemoteMemoryReader reader, IntPtr address, int size, Stream stream) { Contract.Requires(size >= 0); Contract.Requires(stream != null); var data = reader.ReadRemoteMemory(address, size); stream.Write(data, 0, data.Length); } /// Dumps a section to the given stream. /// The memory reader to use. /// The section to dump. /// The stream to dump to. public static void DumpSection(IRemoteMemoryReader reader, Section section, Stream stream) { Contract.Requires(section != null); Contract.Requires(stream != null); DumpRaw(reader, section.Start, section.Size.ToInt32(), stream); } /// Dumps a module to the given stream. The section headers of the pe header get fixed to build a valid pe file. /// The memory reader to use. /// The module to dump. /// The stream to dump to. public static void DumpModule(IRemoteMemoryReader reader, Module module, Stream stream) { Contract.Requires(module != null); Contract.Requires(stream != null); var data = reader.ReadRemoteMemory(module.Start, module.Size.ToInt32()); SimplePeHeader.FixSectionHeaders(data); stream.Write(data, 0, data.Length); } } }