publicinterfaceIProcess:IDisposable{System.Diagnostics.ProcessNative{get;}SafeMemoryHandleHandle{get;}IMemoryMemory{get;}IThreadFactoryThreadFactory{get;}IModuleFactoryModuleFactory{get;}IMemoryFactoryMemoryFactory{get;}IWindowFactoryWindowFactory{get;}IProcessModulethis[stringmoduleName]{get;}IPointerthis[IntPtraddr]{get;}}

publicabstractclassProcessMemory:IMemory{protectedreadonlySafeMemoryHandleHandle;protectedProcessMemory(SafeMemoryHandlehandle){Handle=handle;}publicabstractbyte[]Read(IntPtrintPtr,intlength);publicstringRead(IntPtrintPtr,Encodingencoding,intmaxLength){varbuffer=Read(intPtr,maxLength);varret=encoding.GetString(buffer);if(ret.IndexOf('\0')!=-1)ret=ret.Remove(ret.IndexOf('\0'));returnret;}publicabstractTRead<T>(IntPtrintPtr);publicT[]Read<T>(IntPtrintPtr,intlength){varbuffer=newT[length];for(vari=0;i<buffer.Length;i++)buffer[i]=Read<T>(intPtr);returnbuffer;}publicabstractintWrite(IntPtrintPtr,byte[]bytesToWrite);publicvoidWrite(IntPtrintPtr,stringstringToWrite,Encodingencoding){if(stringToWrite[stringToWrite.Length-1]!='\0')stringToWrite+='\0';varbytes=encoding.GetBytes(stringToWrite);Write(intPtr,bytes);}publicvoidWrite<T>(IntPtrintPtr,T[]values){foreach(varvalueinvalues)Write(intPtr,value);}publicabstractvoidWrite<T>(IntPtrintPtr,Tvalue);}

publicclassTestClass{publicreadonlyIMemoryPatternDataAddressPattern=newDwordPattern("48 8B 05 ?? ?? ?? ?? 48 85 C0 48 0F 44 05 ?? ?? ?? ?? C3",0x40);publicreadonlyIMemoryPatternFuncOffsetPattern=newDwordPattern("48 8B 05 ?? ?? ?? ?? 48 85 C0 48 0F 44 05 ?? ?? ?? ?? C3");publicPatternScanResultFind(stringmoduleName,IMemoryPatternpattern){varprocess=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());process.Memory=newExternalProcessMemory(process.Handle);varscanner=newPatternScanner(process[moduleName]);returnscanner.Find(pattern);}}

publicclassWindowHook:WndProcHook{publicenumUserMessage{SayHi,SayBye}publicWindowHook(IntPtrhandle):base(handle,"ExampleWndProc"){}publicboolHandleUserMessage(IntPtrwpparam){// ReSharper disable once SwitchStatementMissingSomeCasesswitch((UserMessage)wpparam){caseUserMessage.SayHi:MessageBox.Show("Hi");returntrue;caseUserMessage.SayBye:MessageBox.Show("Bye");returntrue;}returnfalse;}publicvoidInvoke(UserMessagemsg){SendMessage((int)WindowsMessages.User,(IntPtr)msg);}protectedoverrideIntPtrWndProc(IntPtrhWnd,intmsg,IntPtrwParam,IntPtrlParam){if(msg==(int)WindowsMessages.User&&HandleUserMessage(wParam))returnIntPtr.Zero;returnbase.WndProc(hWnd,msg,wParam,lParam);}}

publicclassTestClass{privateWindowHook_window;publicvoidInstall(IntPtrhandle){_window=newWindowHook(handle);_window.Enable();_window.Invoke(UserMessage.SayHi);}publicvoidUninstall(){_window.Invoke(WindowHook.UserMessage.SayBye);_window.Disable();}}

publicclassTestClass{privateKeyboardHook_keyboardHook;publicvoidInstall(stringname){_keyboardHook=newKeyboardHook(name);_keyboardHook.KeyDownEvent+= args =>{if(args.IsAltPressed&&args.Key==Keys.A)Console.WriteLine("The A and alt keys were pressed together.");};}}

publicclassTestClass{privateMouseHook_mouseHook;publicvoidInstall(){_mouseHook=newMouseHook();_mouseHook.LeftButtonDown+=(sender,args)=>Console.WriteLine($"The mouse was at the position: {args.Position} when left clicked.");_mouseHook.Enable();}}

publicstaticclassProgram{publicstaticProcessSharpProcessSharp{get;set;}publicdelegatevoidMessageBox(IntPtrhWnd,stringtext,stringcaption,uinttype);publicstaticvoidMain(string[]args){ProcessSharp=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());ProcessSharp.Memory=newExternalProcessMemory(process.Handle);// get a process function instance for MessageBox function in user32.dllvarprocessFunction=ProcessSharp.ModuleFactory["user32"]["MessageBoxA"];// create a delegate for it.var@delegate=processFunction.GetDelegate<MessageBox>();// show a message box using the user32.dll MessageBox api.@delegate.Invoke(IntPtr.Zero,"Hello world!","title",0);}}

publicclassFasm32Assembler:IAssembler{publicbyte[]Assemble(stringasm){returnAssemble(asm,IntPtr.Zero);}publicbyte[]Assemble(stringasm,IntPtrbaseAddress){asm=$"use32\norg 0x{baseAddress.ToInt64():X8}\n"+asm;returnFasmNet.Assemble(asm);}}publicstaticclassProgram{publicstaticProcessSharpProcessSharp{get;set;}publicstaticAssemblyFactoryFactory{get;set;}publicstaticvoidMain(string[]args){ProcessSharp=newProcessSharp(System.Diagnostics.Process.GetProcessesByName("ProcessName").FirstOrDefault());ProcessSharp.Memory=newExternalProcessMemory(ProcessSharp.Handle);Factory=newAssemblyFactory(ProcessSharp,newFasm32Assembler());// int(int input) => input * 2;varprocessFunction=ProcessSharp.ModuleFactory["SomeLib.dll"]["SomeFunc"];vara=Factory.Execute<int>(processFunction.BaseAddress,5);// out put would be 10.Console.WriteLine(a);// All the classic examples from the MemorySharp lib are applicable.varaddress=IntPtr.Zero;// Execute code and get the return value as booleanvarret=Factory.Execute<bool>(address);Console.WriteLine(ret.ToString());varparameterA=newIntPtr(0x500);varpoint=Factory.Execute<Point>(address,CallingConventions.Stdcall,parameterA,"parameterB");Console.WriteLine(point.ToString());// Inject mnemonicsFactory.Inject(new[]{"push 0","add esp, 4","retn"},address);// Inject and execute code lazily.using(vart=Factory.BeginTransaction()){t.AddLine("mov eax,{0}",address);t.AddLine("call eax");t.AddLine("retn");}}}

varprocess=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());process.Memory=newExternalProcessMemory(process.Handle);// Find Scintillavarscintilla=ProcessSharp.WindowFactory.GetWindowsByClassName("Scintilla").FirstOrDefault();// If scintilla was found, write somethingscintilla?.Keyboard.Write("Hello, World!");varprocess=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());process.Memory=newExternalProcessMemory(process.Handle);// Get the windowvarwindow=process.WindowFactory.MainWindow;// Activate it to be in foregroundwindow.Activate();// Move the cursorwindow.Mouse.MoveTo(0,0);// Perform a left clickwindow.Mouse.ClickLeft();varprocess=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());process.Memory=newExternalProcessMemory(process.Handle);// Get the windowvarwindow=process.WindowFactory.MainWindow;// Press the bottom arrow down and repeat the message every 20mswindow.Keyboard.Press(Keys.Down,TimeSpan.FromMilliseconds(20));// Wait 3 secondsThread.Sleep(3000);// Release the keywindow.Keyboard.Release(Keys.Down);

varprocess=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());process.Memory=newExternalProcessMemory(process.Handle);varaddress=IntPtr.Zero;// Read an array of 3 integers varintegers=process.Memory.Read<int>(address,3);foreach(varintegerinintegers)Console.WriteLine(integer);// Write a stringprocess.Memory.Write(address,"I love managed languages.");varprocess=newProcessSharp(System.Diagnostics.Process.GetCurrentProcess());process.Memory=newExternalProcessMemory(process.Handle);varaddress=IntPtr.Zero;varoffset=0x500;// Read an array of 3 integers at address + offset.varintegersA=process[address].Read<int>(offset,3);foreach(varintegerinintegersA)Console.WriteLine(integer);// You can also do it from a module instance.varmoduleName="SomeModule.dll";varintegersB=process[moduleName].Read<int>(offset,3);foreach(varintegerinintegersB)Console.WriteLine(integer);// Write a string.process[address].Write(offset,"I love managed languages.");process[moduleName].Write(offset,"I love managed languages.");