/// <summary>
/// Parses a SignatureDefinition element.
/// </summary>
SignatureDefinition ParseSignatureDefinition()
{
Debug.Assert(reader.Name == "");
bool isEmptyElement = reader.IsEmptyElement;
SignatureDefinition signatureDefinition = new SignatureDefinition();
while (MoveToNextAttribute())
{
switch (reader.Name)
{
case "SpotID":
signatureDefinition.SpotID = reader.Value;
break;
case "SignerName":
signatureDefinition.SignerName = reader.Value;
break;
case "xml:lang":
signatureDefinition.lang = reader.Value;
break;
default:
UnexpectedAttribute(reader.Name);
break;
}
}
MoveToNextElement();
return(signatureDefinition);
}
public static unsafe nint FindSignatureInModule(ProcessModule module, SignatureDefinition sigDef)
{
nint ptr = FindSignatureInBlock(
module.BaseAddress,
module.ModuleMemorySize,
sigDef.pattern,
sigDef.mask,
sigDef.offset
);
if (ptr != 0 && sigDef.xref)
{
ptr = XrefScannerLowLevel.JumpTargets(ptr).FirstOrDefault();
}
return(ptr);
}
