Help with read-memory-64-bit.exe

Hey mates,

so I found this interesting tool ‘read-memory-64-bit’ and wanted to see how it performs and if I can get any infos out of the eve client. Unfortuantly I get an error and cannot solve it:

C:\read-memory-64>read-memory-64-bit.exe save-process-sample --pid=13724
Unhandled exception. System.ArgumentException: Parameter is not valid.
at System.Drawing.SafeNativeMethods.Gdip.CheckStatus(Int32 status)
at System.Drawing.Bitmap…ctor(Int32 width, Int32 height, PixelFormat format)
at read_memory_64_bit.Program.GetScreenshotOfWindowClientAreaAsBitmap(IntPtr windowHandle) in K:\Source\Repos\Sanderling\implement\read-memory-64-bit\Program.cs:line 337
at read_memory_64_bit.Program.GetProcessSampleFileFromProcessId(Int32 processId) in K:\Source\Repos\Sanderling\implement\read-memory-64-bit\Program.cs:line 237
at read_memory_64_bit.Program.<>c__DisplayClass2_1.b__3() in K:\Source\Repos\Sanderling\implement\read-memory-64-bit\Program.cs:line 38
at McMaster.Extensions.CommandLineUtils.CommandLineApplicationExtensions.<>c__DisplayClass10_0.b__0()
at McMaster.Extensions.CommandLineUtils.CommandLineApplication.<>c__DisplayClass148_0.b__0(CancellationToken _)
at McMaster.Extensions.CommandLineUtils.CommandLineApplication.ExecuteAsync(String[] args, CancellationToken cancellationToken)
at McMaster.Extensions.CommandLineUtils.CommandLineApplication.Execute(String[] args)
at read_memory_64_bit.Program.Main(String[] args) in K:\Source\Repos\Sanderling\implement\read-memory-64-bit\Program.cs:line 230

Can somebody help me out? I dont understand why the parameter should be wrong?

Best,
Mark

In the quoted text I see the error System.ArgumentException: Parameter is not valid. is coming out of System.Drawing.Bitmap…ctor(Int32 width, Int32 height, PixelFormat format)

This is the part where it usually takes the screenshots.

This error happens when the main window of the chosen process is minimized.

To avoid the error, ensure the game client window is visible and not minimized.

Thx mate, it worked. Now I was able to create a memory dump, how can I press the data now? I got many files named like: ‘0xE80EDD8000’ or ‘0x7FF87AAC1000’. I f I open the files in Notepad++ for example I see no structure or whatsoever?

To get the structures for the case of EVE Online, the fastest way is to use the read-memory-eve-online command. This command saves the structure to a JSON file.

With the --source-file option, you can let it read the process sample that you earlier saved to a file using the save-process-sample command:

read-memory-64-bit.exe  read-memory-eve-online  --source-file=process-sample.zip  --output-file=structure.json

Besides the output file with the structures, this command also writes a report with an overview of what it found in the process sample:

Reading from process sample ECCDCD901A86DDFDAC8016024938F47DC31ADD65FC83ADAEA0245D4E3E81A0EE.
Found 12 candidates for UIRoot in 93 seconds: 0x2788601CDB8,0x2788758A7D8,0x2788775A398,0x278891B9B90,0x278899B2788,0x278899ECFB8,0x27891CEBC50,0x278B05CC270,0x278FE3E0820,0x278FE3EA580,0x278FEFAC368,0x278FF1350C0
Read 2 UI trees in 25608 milliseconds:
0x27891CEBC50: 918 nodes.
0x278891B9B90: 1 nodes.
I saved memory reading 433C47197879A16CC32505DD3875DF6D911AE734E93781A40ACDA9F4DA3CF8DA from address 0x27891CEBC50 to file 'structure.json'.

If you only want these structures, you can skip the step of creating a process sample entirely and instead use the --pid option with read-memory-eve-online to let it read from a live game client process.

Also, there are two other options to get the JSON file:

Thanks for the explanation. When i used reading the “live” and “saved” information is there’s quite a big difference in reading / processing the information. The realtime-reading seems to take a lot longer. The process of finding candidates for UIRoot takes sometimes up to 2 minutes the processing of the UI-tree was done in a few seconds up to half a minute. I was wondering how you can use this information real-time with delays rangeing between 5-20seconds, like the alternative-ui does.
I guess once the UI tree(s) have been determined you don’t need to repeat that initial process again and you only have to deal with that UI processing delay of several seconds.

Good point about the timing. There is more to this: There different ways to use the read-memory-eve-online command, and there is a huge difference in the time needed.
If you use the command in the simplest way, it must search for the root of the UI tree first. To quote the help text from the tools user interface:

If the address is not specified, the program searches the whole process memory for UI roots.

If you want it to complete in less than a second, tell it the UI tree’s root address, so it does not have to search it first. Use the --root-address option like this: --root-address=0x27891CEBC50.
If you let it search the whole process, it will tell you the UI tree root addresses it has found so that you can reuse them later.

AFAIR, when you read from a sample file, it still takes longer than a second. That route is not as optimized as reading from a live process.

For the specific goal of getting memory readings for EVE Online, there is an easier way than using read-memory-64-bit.exe

When you run a bot or any other app that uses EVE Online memory reading, the engine saves the readings to files by default. Since version 2020-07-17, the engine also has tooling to make it easy to export a memory reading into a file.

You can use the botengine devtools command to open the session recording, as explained in the guide at https://to.botengine.org/guide/observing-and-inspecting-an-app

After selecting the app event in the timeline, you see a visualization of the memory reading in the app event details view.

EVE Online memory reading visualization

Above the visualization is the button “Download reading as JSON file”. Here is how it looks in the DevTools user interface:

button to download a memory reading from a session

This file has the same format as the output from read-memory-64-bit.exe read-memory-eve-online. You can use the file downloaded from the DevTools the same way.

If you want to further inspect the memory reading, for example exploring the nodes in the tree, you can load it into the tool here: FrontendWeb.Main

Most of all, i’m surprised how fast you parse the json and build a few views for ease of reading.
I haven’t been very successful with elm so I’m trying to figure out how the structure of that json is put together to use that information without using elm. The sheer number of objects in objects makes it hard to wrap your head around it and instruct a json decode to process it.