Beispiel #1
0
 public MemoryInfo(Native.MemoryBasicInformation32 m)
 {
     BaseAddress = (ulong)m.BaseAddress.ToInt64();
     RegionSize  = (ulong)m.RegionSize.ToInt64();
     State       = m.State;
     Protect     = m.Protect;
     Type        = m.Type;
 }
Beispiel #2
0
 public MemoryInfo(Native.MemoryBasicInformation64 m)
 {
     BaseAddress = m.BaseAddress;
     RegionSize  = m.RegionSize;
     State       = m.State;
     Protect     = m.Protect;
     Type        = m.Type;
 }
        /// <summary>
        /// Scans a memory section for a pattern, only looking in memory regions matching the given
        /// <paramref name="memType"/> and <paramref name="memProtect"/>.
        /// </summary>
        /// <param name="abs">A <see cref="MemoryAbstraction"/> instance of the process to scan</param>
        /// <param name="pattern">The pattern array to scan for</param>
        /// <param name="memType">The memory region type</param>
        /// <param name="memProtect">The memory region protection</param>
        /// <param name="result">The address, or <see cref="IntPtr.Zero"/> on failure</param>
        /// <returns>Whether the scan was successful or not</returns>
        public static bool Scan(MemoryAbstraction abs, PatternByte[] pattern, Native.MemoryType memType, Native.AllocationProtect memProtect, out IntPtr result)
        {
            result = IntPtr.Zero;
            var handle = abs.Handle;

            foreach (var mbi in NativeHelper.EnumerateMemoryRegions(handle, MaxAddress).Where(a =>
                                                                                              a.Type == memType &&
                                                                                              a.Protect == memProtect &&
                                                                                              a.State == Native.MemoryState.MemCommit))
            {
                if (Scan(handle, pattern, new IntPtr((long)mbi.BaseAddress), (int)mbi.RegionSize, out result))
                {
                    return(true);
                }
            }

            return(false);
        }