RAMvader 1.4.6840.192

dotnet add package RAMvader --version 1.4.6840.192
NuGet\Install-Package RAMvader -Version 1.4.6840.192
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="RAMvader" Version="1.4.6840.192" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add RAMvader --version 1.4.6840.192
#r "nuget: RAMvader, 1.4.6840.192"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install RAMvader as a Cake Addin
#addin nuget:?package=RAMvader&version=1.4.6840.192

// Install RAMvader as a Cake Tool
#tool nuget:?package=RAMvader&version=1.4.6840.192

Description

RAMvader is a lightweight and powerful library which allows a process running on Windows-based systems to access (read/write) another processes' memory spaces.

It uses p/Invoke to perform low-level operations, while still allowing an application to leverage the full power of the high-level .NET libraries for using more complex resources (such as UI development through WPF, UWP, etc). The main, initial purpose of RAMvader is to provide a library that can be used in the development of game trainers ("hack tools"), but it might also fit other purposes, such as antivirus/security software, machine learning, benchmarking, and others.

RAMvader currently supports .NET Framework 4.5 and superior, being able to run on both 32-bit and 64-bit modes.

Quickstart

After installing the library (steps are described in this page of our wiki), first thing you have to do is find the target process, whose memory will be the target for your read/write operations. There are several ways to do that. Two snippets that might help you finding the target process are shown below:

// NOTE: "Process" class is part of the "System.Diagnostics" namespace
// Print a list of all running processes (their names and PIDs)
foreach (Process p in Process.GetProcesses())
    Console.WriteLine($"{p.ProcessName} (PID = {p.Id})");

// Retrieve a reference to a process, given its PID
Process p = Process.GetProcessById(12345);

Having a reference to the Process you want to operate on, you can attach a Target to that process. Target is the class which provides methods for performing the reading/writing operations in the target process. Here's how you attach it:

// NOTE: "Target" class is part of the "RAMvader" namespace

// Use some method to retrieve a reference to the process you want to operate on
Process p = ...;

// Instantiate a Target object and attach it to the process
Target targ = new Target();
targ.AttachToProcess(p);

After attaching, you can begin performing I/O operations in the target process' memory space.

Writing operations can be performed simply by calling the Target.WriteToTarget() method, passing the memory address where you want to perform the write operation, and the data which should be written (data type is used for determining what kind of data should be written to the target process' memory). Examples:

// Write a DWORD (32-bit signed integer value) to the target process' memory address 0xAABBCCDD
targ.WriteToTarget(new AbsoluteMemoryAddress(0xAABBCCDD), (Int32)123);

// Write a Single (32-bit float value) to the target process' memory address 0x11223344
targ.WriteToTarget(new AbsoluteMemoryAddress(0x11223344), (Single)321.5f);

Reading operations work in a similar fashion, by calling the Target.ReadFromTarget() method, passing the memory address where you want to perform the read operation, and a reference to the variable which should be read (variable type determines what kind of data should be read from the target process' memory). Examples:

// Read a QWORD (64-bit signed integer) from the target process' memory address 0x12345678
Int64 myVar = 0;
targ.ReadFromTarget(new AbsoluteMemoryAddress(0x12345678), ref myVar);

// Read a Double (64-bit double precision floating-point number) from the target process' memory address 0x00FACADA
Double myVar = 0;
targ.ReadFromTarget(new AbsoluteMemoryAddress(0x00FACADA), ref myVar);

User Guide and API Reference

For more details on how to use this library, please read our Wiki pages.

These pages provide a comprehensive and more detailed explanation on both the library's architecture and usage, which includes some more advanced features such as injection of code and data on the target process' memory space.

You can also check the API Reference to find descriptions of the library's classes, methods, and other components.

Product Compatible and additional computed target framework versions.
.NET Framework net45 is compatible.  net451 was computed.  net452 was computed.  net46 was computed.  net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

This package has no dependencies.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
1.4.6840.192 935 9/23/2018
1.4.0 736 9/1/2018

Fixed a bug which prevented the library from correctly honoring the target instruction size while generating x86 branching instructions.