-
Notifications
You must be signed in to change notification settings - Fork 14
/
08-CheckProcessMemory.cs
48 lines (46 loc) · 1.51 KB
/
08-CheckProcessMemory.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Runtime.InteropServices;
using System.Net;
namespace EvasionPractice
{
class Program
{
[DllImport("kernel32.dll")]
private static extern IntPtr GetCurrentProcess();
[StructLayout(LayoutKind.Sequential, Size = 40)]
private struct PROCESS_MEMORY_COUNTERS
{
public uint cb;
public uint PageFaultCount;
public uint PeakWorkingSetSize;
public uint WorkingSetSize;
public uint QuotaPeakPagedPoolUsage;
public uint QuotaPagedPoolUsage;
public uint QuotaPeakNonPagedPoolUsage;
public uint QuotaNonPagedPoolUsage;
public uint PagefileUsage;
public uint PeakPagefileUsage;
}
[DllImport("psapi.dll", SetLastError = true)]
static extern bool GetProcessMemoryInfo(IntPtr hProcess, out PROCESS_MEMORY_COUNTERS counters, uint size);
static void Main(string[] args)
{
PROCESS_MEMORY_COUNTERS pmc;
pmc.cb = (uint)Marshal.SizeOf(typeof(PROCESS_MEMORY_COUNTERS));
GetProcessMemoryInfo(GetCurrentProcess(), out pmc, pmc.cb);
if (pmc.WorkingSetSize <= 3500000)
{
runner();
}
return;
}
static void runner()
{
Console.WriteLine("Hello World!");
}
}
}