/// <summary>
/// Searches for a given <see cref="Signature"/> inside of a <see cref="ProcessModule"/>.
/// </summary>
/// <param name="remoteMem"><see cref="IRemoteMemory"/> used to read from the process.</param>
/// <param name="signature">The <see cref="Signature"/> to search for.</param>
/// <param name="processModule">The <see cref="ProcessModule"/> to search in.</param>
/// <returns>The address of the <see cref="Signature"/> if it is found; -1 otherwise</returns>
public static long FindSignature(this IRemoteMemory remoteMem, Signature signature, ProcessModule processModule)
{
byte[] dumpedModule;
try
{
dumpedModule = remoteMem.ReadBytes(processModule.BaseAddress, processModule.ModuleMemorySize);
}
catch (ReadMemoryException)
{
return(-1);
}
long found = Scanner.FindSignature(dumpedModule, signature);
if (found == -1)
{
return(-1);
}
return(processModule.BaseAddress.ToInt64() + found);
}
/// <inheritdoc cref="RemoteMemory.Write{T}(IntPtr, T, bool)" />
public static T Write <T>(this IRemoteMemory remoteMemory, int address, bool relative = false) where T : unmanaged => remoteMemory.Read <T>(new IntPtr(address), relative);
/// <inheritdoc cref="ReadPointer{T}(IRemoteMemory, IntPtr, int[], bool)" />
public static T ReadPointer <T>(this IRemoteMemory remoteMemory, long address, int[] offsets, bool relative = false) where T : unmanaged => remoteMemory.Read <T>(remoteMemory.GetAddress(address, offsets, relative));
/// <inheritdoc cref="RemoteMemory.GetAddress(IntPtr, int[], bool)"/> public static IntPtr GetAddress(this IRemoteMemory remoteMemory, long address, int[] offsets, bool relative = false) => remoteMemory.GetAddress(new IntPtr(address), offsets, relative);
/// <summary> /// Searches for a given <see cref="Signature"/> inside of the processes main module. /// </summary> /// <param name="remoteMem"><see cref="IRemoteMemory"/> used to read from the process.</param> /// <param name="signature">The <see cref="Signature"/> to search for.</param> /// <returns>The address of the <see cref="Signature"/> if it is found; -1 otherwise</returns> public static long FindSignature(this IRemoteMemory remoteMem, Signature signature) => FindSignature(remoteMem, signature, remoteMem.MainModule);
/// <summary> /// Searches for a PEiD style string signature inside of the processes main module. /// </summary> /// <param name="remoteMem"><see cref="IRemoteMemory"/> used to read from the process.</param> /// <param name="signature">PEiD style string signature to search for.</param> /// <returns>The address of the <see cref="Signature"/> if it is found; -1 otherwise</returns> public static long FindSignature(this IRemoteMemory remoteMem, string signature) => FindSignature(remoteMem, new Signature(signature), remoteMem.MainModule);
