param( [Parameter(Mandatory = $true)] [int]$ProcessId, [Parameter(Mandatory = $true)] [uint64]$Address, [int]$Length = 64 ) $source = @' using System; using System.ComponentModel; using System.Runtime.InteropServices; public static class ProcessMemoryReader { [DllImport("kernel32.dll", SetLastError = true)] private static extern IntPtr OpenProcess(uint access, bool inherit, int processId); [DllImport("kernel32.dll", SetLastError = true)] private static extern bool CloseHandle(IntPtr handle); [DllImport("kernel32.dll", SetLastError = true)] private static extern bool ReadProcessMemory(IntPtr process, IntPtr address, byte[] buffer, UIntPtr size, out UIntPtr bytesRead); public static byte[] Read(int processId, ulong address, int length) { IntPtr process = OpenProcess(0x0010 | 0x0400, false, processId); if (process == IntPtr.Zero) throw new Win32Exception(Marshal.GetLastWin32Error(), "OpenProcess failed"); try { byte[] bytes = new byte[length]; UIntPtr read; if (!ReadProcessMemory(process, new IntPtr(unchecked((long)address)), bytes, new UIntPtr((uint)length), out read) || read.ToUInt64() != (ulong)length) throw new Win32Exception(Marshal.GetLastWin32Error(), "ReadProcessMemory failed"); return bytes; } finally { CloseHandle(process); } } } '@ Add-Type -TypeDefinition $source -Language CSharp $bytes = [ProcessMemoryReader]::Read($ProcessId, $Address, $Length) for ($offset = 0; $offset -lt $bytes.Length; $offset += 16) { $count = [Math]::Min(16, $bytes.Length - $offset) $hex = ($bytes[$offset..($offset + $count - 1)] | ForEach-Object { '{0:x2}' -f $_ }) -join ' ' '0x{0:x16}: {1}' -f ($Address + [uint64]$offset), $hex }