Память процесса

using System;
using System.Linq;
using System.Runtime.InteropServices;
using System.Diagnostics;
 
namespace ConsoleApp1 {
    class Program {
 
        [DllImport("ntdll.dll")]
        static unsafe extern uint NtWow64QueryInformationProcess64(IntPtr handle, int infoClass, void* info, int infoLength, out int returnLength);
        [DllImport("ntdll.dll")]
        static unsafe extern uint NtWow64ReadVirtualMemory64(IntPtr handle, long baseAddress, void* buffer, long size, out long readed);
 
        [StructLayout(LayoutKind.Sequential, Pack = 8)]
        struct PROCESS_BASIC_INFORMATION64 {
            public uint ExitStatus;
            public uint Reserved0;
            public long PebBaseAddress;
            public long AffinityMask;
            public int BasePriority;
            public uint Reserved1;
            public long UniqueProcessId;
            public long InheritedFromUniqueProcessId;
        }
 
        [StructLayout(LayoutKind.Sequential, Pack = 8)]
        struct LIST_ENTRY64 {
            public long Flink;
            public long Blink;
        }
 
        [StructLayout(LayoutKind.Sequential, Pack = 8)]
        unsafe struct PEB64 {
            fixed byte pad[24];
            public long Ldr;
        }
 
        [StructLayout(LayoutKind.Sequential, Pack = 8)]
        unsafe struct LDR_DATA64 {
            fixed byte pad[16];
            public LIST_ENTRY64 InLoadOrderModuleList;
        }
 
        [StructLayout(LayoutKind.Sequential, Pack = 8)]
        struct UNICODE_STRING64 {
            public short Length;
            public short MaximumLength;
            public long Buffer;
        }
 
        [StructLayout(LayoutKind.Sequential, Pack = 8)]
        struct LDR_DATA_TABLE_ENTRY_BASE_64 {
            public LIST_ENTRY64 InLoadOrderLinks;
            public LIST_ENTRY64 InMemoryOrderLinks;
            public LIST_ENTRY64 InInitializationOrderLinks;
            public long DllBase;
            public long EntryPoint;
            public int SizeOfImage;
            public UNICODE_STRING64 FullDllName;
            public UNICODE_STRING64 BaseDllName;
        }
 
        static unsafe void Main(string[] args) {
            var pbi = new PROCESS_BASIC_INFORMATION64();
            var peb = new PEB64();
            
            var proc = Process.GetProcessesByName("taskmgr").First();
            var status = NtWow64QueryInformationProcess64(proc.Handle, 0, &pbi, sizeof(PROCESS_BASIC_INFORMATION64), out int ret);
            
            var readed = 0L;
            status = NtWow64ReadVirtualMemory64(proc.Handle, pbi.PebBaseAddress, &peb, sizeof(PEB64), out readed);
 
            var firstEntry = new LIST_ENTRY64();
            var pFirstEntry = peb.Ldr + 16;
            status = NtWow64ReadVirtualMemory64(proc.Handle, pFirstEntry, &firstEntry, sizeof(LIST_ENTRY64), out readed);
 
            for (long pEntry = firstEntry.Flink; pEntry != pFirstEntry; ) {
                var entry = new LIST_ENTRY64();
                status = NtWow64ReadVirtualMemory64(proc.Handle, pEntry, &entry, sizeof(LIST_ENTRY64), out readed);
                if (status != 0) {
                    break;
                }
 
                var imageEntry = new LDR_DATA_TABLE_ENTRY_BASE_64();
                status = NtWow64ReadVirtualMemory64(proc.Handle, pEntry, &imageEntry, sizeof(LDR_DATA_TABLE_ENTRY_BASE_64), out readed);
                if (status != 0) {
                    break;
                }
 
                var buffer = new char[imageEntry.BaseDllName.Length / 2];
                fixed (char* pBuffer = buffer)
                    status = NtWow64ReadVirtualMemory64(proc.Handle, imageEntry.BaseDllName.Buffer, pBuffer, buffer.Length * 2, out readed);
 
                var dllName = new string(buffer);
                Console.WriteLine($"name {dllName} base {imageEntry.DllBase:X} size {imageEntry.SizeOfImage:X} ");
 
                pEntry = entry.Flink;
            }
 
            Console.ReadKey();
        }
    }
}