Ejemplo n.º 1
0
        public void FindModulePtr(ProcessMemoryReader mReader)
        {
            string           Movepattern      = "f30f105b40488d5424304C8b4318488d0d";
            string           Mappattern2      = "f30f1043044c8d836cffffff0fb705";
            SignatureScanner signatureScanner = new SignatureScanner(mReader);

            Actual_Base_Offset = (long)signatureScanner.ScanMovePtr(Movepattern)[0];
            ZoneIDPtr          = (long)signatureScanner.ScanPtrBySig(Mappattern2)[0];
            if (Base_Offset != Actual_Base_Offset)
            {
                DialogResult dialogResult = MessageBox.Show("基址不一致,是否使用增强扫描?", "沙沙沙沙……时空狭缝不需要能量吗?", MessageBoxButtons.YesNo);
                if (dialogResult == DialogResult.Yes)
                {
                    pModule = BitConverter.ToInt64(mReader.ReadByteArray((IntPtr)((long)mReader.process.Modules[0].BaseAddress + Actual_Base_Offset), 8u), 0);
                }
                else
                {
                    pModule = BitConverter.ToInt64(mReader.ReadByteArray((IntPtr)((long)mReader.process.Modules[0].BaseAddress + Base_Offset), 8u), 0);
                }
            }
            else
            {
                pModule = BitConverter.ToInt64(mReader.ReadByteArray((IntPtr)((long)mReader.process.Modules[0].BaseAddress + Actual_Base_Offset), 8u), 0);
            }

            string FlyingSig = "40534883EC20488BD9488B89********4885C9741BF605********04751233D2E8********84C0488D05";
            long   F_Offset  = (long)mReader.ScanPtrBySig(FlyingSig).FirstOrDefault();

            pFlyModule = (long)mReader.process.Modules[0].BaseAddress + F_Offset;
        }
Ejemplo n.º 2
0
        public void FindPtr()
        {
            Process process = Process.GetProcessesByName("ffxiv_dx11").ToList().FirstOrDefault();

            mReader.process = process;
            mReader.OpenProcess();
            BaseOffset = (long)mReader.ScanPtrBySig("48833D********007411488B0D********4885C97405E8********488D0D")[0];
            pModule    = mReader.ReadInt64((IntPtr)((long)process.Modules[0].BaseAddress + BaseOffset));
        }