Question

I’m trying to monitor a process for memory changes with a timer. So I saw that the GetWriteWatch API gives me the changed pages. But I can’t find an example in .NET. Can someone help

Answer 1

You can always make the call through the Platform Invoke (P/Invoke) layer which allows you to make calls to COM components, as well as functions exported from DLLs, such as GetWriteWatch.

pinvoke.net contains listings of Windows API P/Invoke signatures pre-defined in C# so you don’t have to figure it out yourself. It provides the following for the GetWriteWatch function:

[DllImport("kernel32.dll")]
static extern uint GetWriteWatch(uint dwFlags, IntPtr lpBaseAddress,
   UIntPtr dwRegionSize, out IntPtr lpAddresses, ref UIntPtr lpdwCount,
   out uint lpdwGranularity);