private void GetMemoryInfo(IntPtr pHandle)
{
if (memoryInfo != null)
{
return;
}
memoryInfo = new List <MemInfo>();
IntPtr current = (IntPtr)65536;
while (true)
{
MemInfo memInfo = new MemInfo();
int dump = VirtualQueryEx(pHandle, current, out memInfo, Marshal.SizeOf(memInfo));
if (dump == 0)
{
break;
}
long regionSize = (long)memInfo.RegionSize;
if (regionSize <= 0 || regionSize > int.MaxValue)
{
break;
}
if (MemoryFilter(memInfo))
{
memoryInfo.Add(memInfo);
}
current = memInfo.BaseAddress + (int)regionSize;
}
}
private void ScanMemory(List <IntPtr> pointers, MemInfo info, byte[] data, byte[] search, bool[] mask, int[] offsets)
{
int current = 0;
int end = search.Length - 1;
while (current <= data.Length - search.Length)
{
for (int i = end; data[current + i] == search[i] || mask[i]; i--)
{
if (i == 0)
{
pointers.Add(info.BaseAddress + current);
break;
}
}
int offset = offsets[data[current + end]];
current += offset;
}
}
public List <IntPtr> FindSignatures(Process process, string signature)
{
byte[] pattern;
bool[] mask;
GetSignature(signature, out pattern, out mask);
GetMemoryInfo(process.Handle);
int[] offsets = GetCharacterOffsets(pattern, mask);
List <IntPtr> pointers = new List <IntPtr>();
for (int i = 0; i < memoryInfo.Count; i++)
{
MemInfo info = memoryInfo[i];
byte[] buff = new byte[(uint)info.RegionSize];
ReadProcessMemory(process.Handle, info.BaseAddress, buff, (uint)info.RegionSize, 0);
ScanMemory(pointers, info, buff, pattern, mask, offsets);
}
return(pointers);
}
public IntPtr FindSignature(Process process, string signature)
{
byte[] pattern;
bool[] mask;
GetSignature(signature, out pattern, out mask);
GetMemoryInfo(process.Handle);
int[] offsets = GetCharacterOffsets(pattern, mask);
for (int i = 0; i < memoryInfo.Count; i++)
{
MemInfo info = memoryInfo[i];
byte[] buff = new byte[(uint)info.RegionSize];
ReadProcessMemory(process.Handle, info.BaseAddress, buff, (uint)info.RegionSize, 0);
int result = ScanMemory(buff, pattern, mask, offsets);
if (result != int.MinValue)
{
return(info.BaseAddress + result);
}
}
return(IntPtr.Zero);
}
private static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MemInfo lpBuffer, int dwLength);