1

I am using ReadProcessMemory in C# output is bytes[]. I want to covert this to string. How to do that? My code is below..

!ReadProcessMemory(appProcess.Handle, mbi.BaseAddress, buffer, mbi.RegionSize, ref nRead))
{
    int lastError = Marshal.GetLastWin32Error();

    if (lastError != 0)
        throw new ApplicationException(string.Format("ReadProcessMemory returned Win32 Error {0}", lastError));
}

I am using string szData = Encoding.UTF8.GetString(buffer); and i am getting the below output.. how to get valid string

�#y��Actx Actx �ȶ�+eMZ�Actx Actx Actx ��ؚ~���������������MZ�j��xIlj�u�z�uy�u͙�u�}�u:�u��If�՜��D$f��f�4$��5Q�G"��L[���T_�N�b�l"���aa1wa��[�ۖ+3�����⯚*�e%��m�v�a�����S�+ ��b�r��o���V�G�q�1)v��*��[k<�CP�C�FYYE^i>�o �R��敠{�u�B3�����w�/���E�{U-��v|5�馘���U1�7�ҡ��[�@# P^�J� S4����S�<���� ���cD$�$ډD$$���&,�}�34���e��_��U����V�,I� R��}��=63S�L���M�z[�|�v�{Y^OZ�q<2�#u�c7��dzx����8�.��'h��Jsw���V�J�4)���˧JV@c�z�R��~i� ��c0g�r�| e����e�t2�!. �+�X*m�@�U9�5�������������E ��q �n�'s�Yi�� �������H�����vG�Z�O� �0d��C͕����{D %�@�C���Y�M_E �6�;3�v��c��Ʌ1]�y}�ldu�����@t���A�h�9#�SVG���zfnuy�osKђ�N��q�OD$������E0�v�؃�������������sȶ1+e�����?�������5��h0MZ��D$��M�z�uB|�u�;�ulj�uy�u���'��H[���&��� BEGINTHM�y[������RESCDIRRESCSEG{��"~��������D-x�.MZ���.�z�uB|�u�;�uK�u�E�uy�u�&��__�5����DD�.9���WU����~~�z==G�dd��]]�2+�ss�������OOѣ��D""fT**~;��� ����FF����)k���(<���y�^^�

���v���;d22Vt::N

�II� H$$l�\���]���nC����bb�9���1������7�yy����2���Cn77Y�mm�������d�NN�I����ll��VV�������%�ee��zz�G���o����xx�J%%o..r8$W���s��Ǘ��Q���#���|�tt�>!�KK�a��� �������pp�|>>Bq����ff��HH�����aa�j55_�WW�i���������X:''������8���+���"3�ii����p���3���-���<"������ ���I�UU�P((x���z���Y��� ���

e������1�BB��hh��AA�)���Z--w{��˨TT�m���,:��cc��||��ww��{{ ����kk��ooT���P00��gg}V++���b����M����vvE��ʝ��@��ɇ�}}����YYɎGG ����A��g����_���E���#���S����rr[����u������=��jL&&Zl66A~??���O���\h44�Q��4�������qqs���Sb11?*R���eF##^���(0�7�� �/�� 6$���=���&���iN''�����uu ���tX,,.4-6��nn�ZZ�[����RRMv;;a����}��{R))>���q^//�����SSh���_ValidateTexInfoatToResourceFormat��y��{��"~����{��"~����RESCSEG�\�Ѕȶ1+e����ȶ1+e�������?�������'��P��W��n��W������9$�?������MZ��L$V3��y�t�ы��;T$t��F�Ѓx�u���ID�����ts.r�.��-�������@.MxX� p���O�.rsrc��lp��� �r�aaI��dGS��pOBB�W.�6t��g����MZ�����u��u�v�u���u��u��u�&\w~��u���u���u���u��\w�\w�=�uA\w��u@��u��uئ�u�D�u���uZ�u;��uܔ�u

Saravanan I M
  • 1,115
  • 2
  • 19
  • 29
  • Have you tried changing the P/Invoke declaration of ReadProcessMemory to return a string/fill a StringBuilder? – dtb Jun 28 '10 at 10:58

3 Answers3

2

You are reading raw binary data from a process, that will be a string only by accident. If it is a string at all, it is definitely not going to be encoded in UTF8. That's a format that you'd only ever see in files or data sent across the Internet. The in-memory representation of strings are ASCII or UTF-16.

But start out dumping this data in the same kind of format the debugger uses in the Debug + Windows + Memory 1 window. You can find the code to do so in this post.

Community
  • 1
  • 1
Hans Passant
  • 922,412
  • 146
  • 1,693
  • 2,536
1

It depends on the text encoding. For UTF8, you can do this:

string s = Encoding.UTF8.GetString(buffer);
Philippe Leybaert
  • 168,566
  • 31
  • 210
  • 223
1

You need to specify an encoding and then use that to construct your string.

Example:

byte [] dBytes = ...
string str;
System.Text.ASCIIEncoding enc = new System.Text.ASCIIEncoding();
str = enc.GetString(dBytes);
Mark Rushakoff
  • 249,864
  • 45
  • 407
  • 398