Maple.Memory

Allocator adapters, primitive read/write facades, and remote x86 call-stub execution for attached Maple process tooling. Windows-only, trimmable and AOT/NativeAOT compatible.

Packages

Package	NuGet	Description
Maple.Memory		Allocator adapters and higher-level process-memory tooling
Maple.Memory.Execution		Remote x86 call-stub generation and execution helpers

Example

// Attach to a process and read/write primitive values
using var processMemory = new NullProcessMemory();
using var accessor = new MemoryAccessor(processMemory, ownsProcessMemory: false);

// Typed reads: byte, int32, uint32, pointer, bool32
accessor.TryReadInt32(0x00AB_0100u, out int hp);
accessor.TryReadPointer(0x00AB_0200u, out uint baseAddr);

// Typed writes
accessor.TryWriteInt32(0x00AB_0100u, 9999);
accessor.TryWriteByte(0x00AB_0300u, 0xFF);

// Stable reads retry until two consecutive snapshots match
Span<byte> snapshot = stackalloc byte[16];
accessor.TryReadStable(0x00AB_0400u, snapshot, maxAttempts: 3);

Example Catalogue

The following examples are available in ReadMeTest.cs.

Example - ShellcodeFactory

// Build x86 call stubs for remote thread execution
byte[] stdcallStub = Execution.ShellcodeFactory.CreateThreadProcCallStub(
    functionAddress: 0x00AB_CDEFu,
    arguments: [100u, 200u]
);

byte[] cdeclStub = Execution.ShellcodeFactory.CreateThreadProcCallStub(
    functionAddress: 0x00AB_CDEFu,
    arguments: [100u, 200u],
    callingConvention: Execution.X86CallingConvention.Cdecl
);

byte[] thiscallStub = Execution.ShellcodeFactory.CreateThreadProcCallStub(
    functionAddress: 0x00AB_CDEFu,
    arguments: [100u],
    callingConvention: Execution.X86CallingConvention.ThisCall,
    thisPointer: 0xDEAD_BEEFu
);

Public API Reference

See docs/PublicApi.md for the complete auto-generated public API reference.

Note: docs/PublicApi.md is auto-updated by the ReadMeTest_PublicApi test on every dotnet test run. Do not edit it manually.