public static void GainMemoryAccess(IntPtr address, ulong len)
        {
            SYSTEM_INFO si = new SYSTEM_INFO();
            GetSystemInfo(out si);
            MEMORY_BASIC_INFORMATION mbi;
            ulong currentAddress = RoundUpToPageBoundary((ulong)address, si.pageSize);
            ulong endAddress = currentAddress + len;
            uint ret;
            uint oldProtect = 0;

            while (currentAddress < endAddress)
            {
                mbi = new MEMORY_BASIC_INFORMATION();
                ret = (uint)VirtualQuery((IntPtr)currentAddress, out mbi, (IntPtr)Marshal.SizeOf(mbi));
                if (ret != 0)
                {
                    if (mbi.state == MEM_COMMIT)
                    {
                        VirtualProtect(mbi.baseAddress, mbi.regionSize, PAGE_EXECUTE_READWRITE, out oldProtect);
                    }
                    if ((ulong)mbi.regionSize > 0) currentAddress += (ulong)mbi.regionSize;
                    else currentAddress += si.pageSize;
                }
                else currentAddress += si.pageSize;
            }
        }

        public static Platform GetOperationSystemPlatform()
        {
            var sysInfo = new SYSTEM_INFO();

            // WinXP and older - use GetNativeSystemInfo
            if (Environment.OSVersion.Version.Major > 5 ||
                (Environment.OSVersion.Version.Major == 5 && Environment.OSVersion.Version.Minor >= 1))
            {
                GetNativeSystemInfo(ref sysInfo);
            }
            // else use GetSystemInfo
            else
            {
                GetSystemInfo(ref sysInfo);
            }

            switch (sysInfo.wProcessorArchitecture)
            {
                case PROCESSOR_ARCHITECTURE_IA64:
                case PROCESSOR_ARCHITECTURE_AMD64:
                    return Platform.X64;

                case PROCESSOR_ARCHITECTURE_INTEL:
                    return Platform.X86;

                default:
                    return Platform.Unknown;
            }
        }

            public static string GetProcessorArchitecture()
            {
                try
                {
                    SYSTEM_INFO systemInfo = new SYSTEM_INFO();
                    GetNativeSystemInfo(ref systemInfo);
                    switch (systemInfo.wProcessorArchitecture)
                    {
                        case PROCESSOR_ARCHITECTURE_AMD64:
                        case PROCESSOR_ARCHITECTURE_IA64:
                            return "x64";

                        case PROCESSOR_ARCHITECTURE_ARM:
                            return "ARM";

                        case PROCESSOR_ARCHITECTURE_INTEL:
                            return "x86";

                        default:
                            return "Unknown";
                    }
                }
                catch
                {
                    return "Unknown";
                }
            }

 public Core()
 {
     SYSTEM_INFO info = new SYSTEM_INFO();
     GetSystemInfo(ref info);
     PAGE_SIZE = info.pageSize;
     //dbg //mbd
     //CreateDataTypesXml();
 }

        // finally...
        public static void Main()
        {
            // getting minimum & maximum address

            SYSTEM_INFO sys_info = new SYSTEM_INFO();
            GetSystemInfo(out sys_info);

            IntPtr proc_min_address = sys_info.minimumApplicationAddress;
            IntPtr proc_max_address = sys_info.maximumApplicationAddress;

            // saving the values as long ints so I won't have to do a lot of casts later
            long proc_min_address_l = (long)proc_min_address;
            long proc_max_address_l = (long)proc_max_address;

            // notepad better be runnin'
            Process process = Process.GetProcessesByName("tibia")[0];

            // opening the process with desired access level
            IntPtr processHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_WM_READ, false, process.Id);

            StreamWriter sw = new StreamWriter("dump.txt");

            // this will store any information we get from VirtualQueryEx()
            MEMORY_BASIC_INFORMATION mem_basic_info = new MEMORY_BASIC_INFORMATION();

            int bytesRead = 0;  // number of bytes read with ReadProcessMemory

            while (proc_min_address_l < proc_max_address_l)
            {
                // 28 = sizeof(MEMORY_BASIC_INFORMATION)
                VirtualQueryEx(processHandle, proc_min_address, out mem_basic_info, 28);

                // if this memory chunk is accessible
                if (mem_basic_info.Protect == PAGE_READWRITE && mem_basic_info.State == MEM_COMMIT)
                {
                    byte[] buffer = new byte[mem_basic_info.RegionSize];

                    // read everything in the buffer above
                    ReadProcessMemory((int)processHandle, mem_basic_info.BaseAddress, buffer, mem_basic_info.RegionSize, ref bytesRead);

                    // then output this in the file
                    for (int i = 0; i < mem_basic_info.RegionSize; i++)
                        sw.WriteLine("0x{0} : {1}", (mem_basic_info.BaseAddress + i).ToString("X"), (char)buffer[i]);
                }

                // move to the next memory chunk
                proc_min_address_l += mem_basic_info.RegionSize;
                proc_min_address = new IntPtr(proc_min_address_l);
            }

            sw.Flush();
            sw.Close();

            Console.ReadLine();
        }

 internal static new void GetSystemInfo(ref SYSTEM_INFO lpSystemInfo)
 {
     if (MonoUtility.IsLinux)
     {
         throw new ApplicationException("This method is not supported in mono");
     }
     else
     {
         NativeMethods.GetSystemInfo(ref lpSystemInfo);
     }
 }

 bool VerifyProcessorCount()
 {
     SYSTEM_INFO sysInfo = new SYSTEM_INFO();
     SYSTEM_INFO.GetSystemInfo(ref sysInfo);
     if (Environment.ProcessorCount != sysInfo.dwNumberOfProcessors)
     {
         TestFramework.LogError("001", @"ProcessorCount not as expected. Expected (from Win32): " + sysInfo.dwNumberOfProcessors.ToString() + ", Actual (from CLR): " + Environment.ProcessorCount.ToString());
         return false;
     }
     return true;
 }

 /// <summary>
 /// Abstracts the retrieval of a SYSTEM_INFO structure.
 /// </summary>
 /// <param name="lpSystemInfo">A reference to a SYSTEM_INFO structure that receives the information.</param>
 public static void GetSystemInfoAbstracted(ref SYSTEM_INFO lpSystemInfo)
 {
     if (System.Environment.OSVersion.Version.Major > 5 || 
         (System.Environment.OSVersion.Version.Major == 5 && System.Environment.OSVersion.Version.Minor >= 1))
     {
         GetNativeSystemInfo(ref lpSystemInfo);
     }
     else
     {
         GetSystemInfo(ref lpSystemInfo);
     }
 }

        public void Windows_ProcessorCountTest()
        {
            //arrange
            SYSTEM_INFO sysInfo = new SYSTEM_INFO();
            GetSystemInfo(ref sysInfo);
            int expected = sysInfo.dwNumberOfProcessors;

            //act
            int actual = Environment.ProcessorCount;

            //assert
            Assert.True(actual > 0);
            Assert.Equal(expected, actual);
        }

        public static ProcessorType GetProcessorType()
        {
            SYSTEM_INFO sysInfo = new SYSTEM_INFO();
            GetNativeSystemInfo(ref sysInfo);

            switch (sysInfo.wProcessorArchitecture)
            {
                case PROCESSOR_TYPE_INTEL_AMD64:
                    return ProcessorType.X64;

                case PROCESSOR_TYPE_INTEL:
                    return ProcessorType.X86;

                default:
                    return ProcessorType.Unknown;
            }
        }

        /// <summary>
        /// Try to preload the library.
        /// This is useful when we want to have AnyCPU .NET and CPU-specific native code.
        /// Only available on Windows for now.
        /// </summary>
        /// <param name="libraryName">Name of the library.</param>
        /// <exception cref="System.InvalidOperationException"></exception>
        public static void PreloadLibrary(string libraryName)
        {
#if SILICONSTUDIO_PLATFORM_WINDOWS_DESKTOP
            var systemInfo = new SYSTEM_INFO();
            GetNativeSystemInfo(out systemInfo);

            string cpu;
            if (systemInfo.processorArchitecture == PROCESSOR_ARCHITECTURE.PROCESSOR_ARCHITECTURE_ARM)
                cpu = "ARM";
            else
                cpu = IntPtr.Size == 8 ? "x64" : "x86";
            var libraryFilename = Path.Combine(Path.GetDirectoryName(typeof(NativeLibrary).Assembly.Location), cpu, libraryName);
            var result = LoadLibrary(libraryFilename);

            if (result == IntPtr.Zero)
                throw new InvalidOperationException(string.Format("Could not load native library {0} using CPU architecture {1}.", libraryName, cpu));
#endif
        }

        public static ProcessorArchitecture GetProcessorArchitecture()
        {
            SYSTEM_INFO si = new SYSTEM_INFO();
            GetNativeSystemInfo(ref si);
            switch (si.wProcessorArchitecture)
            {
                case PROCESSOR_ARCHITECTURE_AMD64:
                    return ProcessorArchitecture.Amd64;

                case PROCESSOR_ARCHITECTURE_IA64:
                    return ProcessorArchitecture.IA64;

                case PROCESSOR_ARCHITECTURE_INTEL:
                    return ProcessorArchitecture.X86;

                default:
                    return ProcessorArchitecture.None; // that's weird :-)
            }
        }

        /// <summary>
        /// Try to preload the library.
        /// This is useful when we want to have AnyCPU .NET and CPU-specific native code.
        /// Only available on Windows for now.
        /// </summary>
        /// <param name="libraryName">Name of the library.</param>
        /// <exception cref="System.InvalidOperationException"></exception>
        public static void PreloadLibrary(string libraryName)
        {
#if SILICONSTUDIO_PLATFORM_WINDOWS_DESKTOP
            lock (LoadedLibraries)
            {
                // If already loaded, just exit as we want to load it just once
                var libraryNameNormalized = libraryName.ToLowerInvariant();
                if (LoadedLibraries.ContainsKey(libraryNameNormalized))
                {
                    return;
                }

                var systemInfo = new SYSTEM_INFO();
                GetNativeSystemInfo(out systemInfo);

                string cpu;
                if (systemInfo.processorArchitecture == PROCESSOR_ARCHITECTURE.PROCESSOR_ARCHITECTURE_ARM)
                    cpu = "ARM";
                else
                    cpu = IntPtr.Size == 8 ? "x64" : "x86";

                // We are trying to load the dll from a shadow path if it is already registered, otherwise we use it directly from the folder
                var dllFolder = NativeLibraryInternal.GetShadowPathForNativeDll(libraryName) ?? Path.Combine(AppDomain.CurrentDomain.BaseDirectory, cpu);
                var libraryFilename = Path.Combine(dllFolder, libraryName);
                var result = LoadLibrary(libraryFilename);

                if (result == IntPtr.Zero)
                {
                    throw new InvalidOperationException(string.Format("Could not load native library {0} from path [{1}] using CPU architecture {2}.", libraryName, libraryFilename, cpu));
                }
                else
                {
                    LoadedLibraries.Add(libraryName.ToLowerInvariant(), result);
                }
            }
#endif
        }

 private static extern void GetSystemInfo(out SYSTEM_INFO input);

 internal static extern void GetNativeSystemInfo(out SYSTEM_INFO info);

 internal static extern void GetSystemInfo(ref SYSTEM_INFO lpSystemInfo);

        private void Form1_Load(object sender, EventArgs e)
        {
            SYSTEM_INFO pSI = new SYSTEM_INFO();
            GetSystemInfo(ref pSI);
            int processorNumber = (int)pSI.dwNumberOfProcessors;

            x264ThreadsComboBox.Items.Add("auto");
            for (int i = 1; i <= 16; i++)
            {
                x264ThreadsComboBox.Items.Add(i.ToString());
            }
            //Thread.CurrentThread.CurrentCulture = new System.Globalization.CultureInfo("zh-TW");
            //use YAHEI in VistaOrNewer
            //if (IsWindowsVistaOrNewer)
            //{
            //    FontFamily myFontFamily = new FontFamily("微软雅黑"); //采用哪种字体
            //    Font myFont = new Font(myFontFamily, 9, FontStyle.Regular); //字是那种字体，显示的风格
            //    this.Font = myFont;
            //}

            //define workpath
            startpath = System.Windows.Forms.Application.StartupPath;
            workPath = startpath + "\\tools";
            if (!Directory.Exists(workPath))
            {
                MessageBox.Show("tools文件夹没有解压喔~ 工具箱里没有工具的话运行不起来的喔~", "（这只丸子）",
                    MessageBoxButtons.OK, MessageBoxIcon.Error);
                Environment.Exit(1);
            }
            //Directory.CreateDirectory(workPath);
            //string diskSymbol = startpath.Substring(0, 1);

            //string systemDisk = Environment.GetFolderPath(Environment.SpecialFolder.System).Substring(0, 3);
            //string systemTempPath = systemDisk + @"windows\temp";
            string systemTempPath = Environment.GetEnvironmentVariable("TEMP", EnvironmentVariableTarget.Machine);
            tempavspath = systemTempPath + "\\temp.avs";
            tempPic = systemTempPath + "\\marukotemp.jpg";
            tempfilepath = startpath + "\\temp";

            //load x264 exe
            DirectoryInfo folder = new DirectoryInfo(workPath);
            List<string> x264exe = new List<string>();
            try
            {
                bool usex265 = bool.Parse(ConfigurationManager.AppSettings["x265Enable"].ToString());
                foreach (FileInfo FileName in folder.GetFiles())
                {
                    if ((FileName.Name.ToLower().Contains("x264") || FileName.Name.ToLower().Contains(usex265 ? "x265" : "xxxx")) && Path.GetExtension(FileName.Name) == ".exe")
                    {
                        x264exe.Add(FileName.Name);
                    }
                }
                x264exe = x264exe.OrderByDescending(i => i.Substring(7)).ToList();
                x264ExeComboBox.Items.AddRange(x264exe.ToArray());
            }
            catch { }

            // avisynth未安装使用本地内置的avs
            if (string.IsNullOrEmpty(Util.CheckAviSynth()))
            {
                string sourceAviSynthdll = Path.Combine(workPath, @"avs\AviSynth.dll");
                string sourceDevILdll = Path.Combine(workPath, @"avs\DevIL.dll");
                if (File.Exists(sourceAviSynthdll) && File.Exists(sourceDevILdll))
                {
                    File.Copy(sourceAviSynthdll, Path.Combine(workPath, "AviSynth.dll"), true);
                    File.Copy(sourceDevILdll, Path.Combine(workPath, "DevIL.dll"), true);
                    LogRecord("未安装avisynth,使用本地内置avs.");
                }
            }
            else
            {
                File.Delete(Path.Combine(workPath, "AviSynth.dll"));
                File.Delete(Path.Combine(workPath, "DevIL.dll"));
            }

            //load AVS filter
            DirectoryInfo avspath = new DirectoryInfo(workPath + @"\avs\plugins");
            List<string> avsfilters = new List<string>();
            if (Directory.Exists(workPath + @"\avs\plugins"))
            {
                foreach (FileInfo FileName in avspath.GetFiles())
                {
                    if (Path.GetExtension(FileName.Name) == ".dll")
                    {
                        avsfilters.Add(FileName.Name);
                    }
                }
                AVSFilterComboBox.Items.AddRange(avsfilters.ToArray());
            }

            //ReleaseDate = System.IO.File.GetLastWriteTime(this.GetType().Assembly.Location); //获得程序编译时间
            ReleaseDatelabel.Text = ReleaseDate.ToString("yyyy-M-d");

            // load Help Text
            if (File.Exists(startpath + "\\help.rtf"))
            {
                HelpTextBox.LoadFile(startpath + "\\help.rtf");
            }

            PresetXml();
//.........这里部分代码省略.........

        public int DumpProcMemory(int pid, string filename)
        {
            //打开进程
            IntPtr handle = OpenProcess(ProcessAccessFlags.QueryInformation
                                        | ProcessAccessFlags.VMOperation
                                        | ProcessAccessFlags.VMRead
                                        | ProcessAccessFlags.VMWrite, false, pid);

            SYSTEM_INFO systeminfo = new SYSTEM_INFO();
            GetSystemInfo(out systeminfo);

            System.IO.FileStream stream = null;

            stream = new System.IO.FileStream(filename, System.IO.FileMode.Append);

            long MaxAddress = (long)systeminfo.lpMaximumApplicationAddress;
            long address = 0;
            int countcount = 0;
            do
            {
                MEMORY_BASIC_INFORMATION memory;
                int result = VirtualQueryEx(handle, (IntPtr)address, out memory, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
                if (address == (long)memory.BaseAddress + (long)memory.RegionSize)
                    break;
                //保存具有读写属性且已提交的虚存
                if (memory.State == (uint)StateEnum.MEM_COMMIT)
                {
                    switch (memory.AllocationProtect)
                    {
                        case (uint)AllocationProtect.PAGE_READWRITE:
                            byte[] buffer = new byte[(int)memory.RegionSize];
                            IntPtr byteread;
                            ReadProcessMemory(handle, memory.BaseAddress, buffer, (int)memory.RegionSize, out byteread);
                            //写入文件
                            stream.Write(buffer, 0, buffer.Length);
                            countcount++;
                            break;
                        default:
                            break;
                    }
                }
                address = (long)memory.BaseAddress + (long)memory.RegionSize;
            }
            while (address <= MaxAddress);

            stream.Close();
            CloseHandle(handle);
            Console.WriteLine("read over!");
            Console.WriteLine(countcount);
            return 0;
        }

//.........这里部分代码省略.........
                    Console.WriteLine("Ecx     : {0}", context[i].Ecx);
                    Console.WriteLine("Eax     : {0}", context[i].Eax);

                    context[i].ContextFlags = (uint)CONTEXT_FLAGS.CONTEXT_ALL;
                    IntPtr Nowhandle = OpenThread(ThreadAccess.SET_CONTEXT, false, (uint)threadid);
                   // Console.WriteLine(Nowhandle);
                   // context[i] = HandleToHandle(Agohandle, Nowhandle, context[i]);

                    tt.Eax = context[i].Eax;
                    tt.Ebx = context[i].Ebx;
                    tt.Ecx = context[i].Ecx;
                    tt.Edx = context[i].Edx;

                    //tt.Ebp = context[i].Ebp;
                    //tt.Esp = context[i].Esp;
                    //tt.Esi = context[i].Esi;

                    //SetThreadContext(Agohandle, ref tt);
                    CloseHandle(Nowhandle);
                    //建立新线程
                    if (i + 1 < count)
                    {
                        IntPtr lpThreadID = (IntPtr)0;
                        StartThread threadfunc = null;
                        ThreadStartDelegate threadFunc = null;
                        unsafe
                        {
                            thrhandle = CreateRemoteThread(prohandle, (IntPtr)null, 0, threadFunc, (IntPtr)null,
                                (uint)CreateProcessFlags.CREATE_SUSPENDED, lpThreadID);
                        }
                        threadid = (int)lpThreadID;
                    }
                }

               // ResumeThread(thrhandle);

               //读入内存状态
                SYSTEM_INFO systeminfo = new SYSTEM_INFO();
                GetSystemInfo(out systeminfo);

                long MaxAddress = (long)systeminfo.lpMaximumApplicationAddress;
                long address = 0;
                int countcount = 0;
                do
                {
                    MEMORY_BASIC_INFORMATION memory;
                    int result = VirtualQueryEx(prohandle, (IntPtr)address, out memory, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));
                    if (address == (long)memory.BaseAddress + (long)memory.RegionSize)
                        break;
                    if (memory.State == (uint)StateEnum.MEM_COMMIT)
                    {
                        switch (memory.AllocationProtect)
                        {
                            case (uint)AllocationProtect.PAGE_READWRITE:
                                byte[] buffer = new byte[(int)memory.RegionSize];
                                Console.WriteLine("now");
                                Console.WriteLine(memory.BaseAddress);
                                Console.WriteLine(memory.AllocationBase);
                                Console.WriteLine(memory.RegionSize);
                                Console.WriteLine(memory.Type);
                                Console.WriteLine(memory.Protect);
                                stream.Read(buffer, 0, buffer.Length);
                                UIntPtr byteread;
                                WriteProcessMemory(prohandle, memory.BaseAddress, buffer, (uint)memory.RegionSize, out byteread);
                                Console.WriteLine("ago");
                                Console.WriteLine(memory.BaseAddress);
                                Console.WriteLine(memory.AllocationBase);
                                Console.WriteLine(memory.RegionSize);
                                Console.WriteLine(memory.Type);
                                Console.WriteLine(memory.Protect);
                                countcount++;
                                break;
                            default:
                                break;
                        }
                    }
                    address = (long)memory.BaseAddress + (long)memory.RegionSize;
                }
                while (address <= MaxAddress);

                stream.Close();
                CloseHandle(prohandle);
                Console.WriteLine("write over!");
                Console.WriteLine(countcount);

            }

            //恢复线程运行
            System.Diagnostics.Process proc = System.Diagnostics.Process.GetProcessById(proinfo.dwProcessId);
            System.Diagnostics.ProcessThread[] processthread = new System.Diagnostics.ProcessThread[500];
            System.Diagnostics.ProcessThreadCollection threadcollection = new System.Diagnostics.ProcessThreadCollection(processthread);
            threadcollection = proc.Threads;
            for (int k = 0; k < threadcollection.Count; k++)
            {
                IntPtr ptrr = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)threadcollection[k].Id);
                ResumeThread(ptrr);
                CloseHandle(ptrr);
            }
                return 0;
        }

 private static extern void GetSystemInfo(out SYSTEM_INFO lpSystemInfo);