Example #1
0
    public MemoryScan.MemoryScanResult SingleScan(int[] pattern)
    {
        MemoryScan.SYSTEM_INFO sYSTEM_INFO = default(MemoryScan.SYSTEM_INFO);
        MemoryScan.GetSystemInfo(out sYSTEM_INFO);
        IntPtr minimumApplicationAddress = sYSTEM_INFO.minimumApplicationAddress;
        IntPtr maximumApplicationAddress = sYSTEM_INFO.maximumApplicationAddress;
        long   num    = (long)minimumApplicationAddress;
        long   num2   = (long)maximumApplicationAddress;
        IntPtr intPtr = MemoryScan.OpenProcess(1040, false, this.process.Id);

        MemoryScan.MEMORY_BASIC_INFORMATION mEMORY_BASIC_INFORMATION = default(MemoryScan.MEMORY_BASIC_INFORMATION);
        int num3 = 0;

        MemoryScan.MemoryScanResult result;
        while (num < num2)
        {
            MemoryScan.VirtualQueryEx(intPtr, minimumApplicationAddress, out mEMORY_BASIC_INFORMATION, 28u);
            if (mEMORY_BASIC_INFORMATION.Protect == 4 && mEMORY_BASIC_INFORMATION.State == 4096)
            {
                byte[] array = new byte[mEMORY_BASIC_INFORMATION.RegionSize];
                MemoryScan.ReadProcessMemory((int)intPtr, mEMORY_BASIC_INFORMATION.BaseAddress, array, mEMORY_BASIC_INFORMATION.RegionSize, ref num3);
                int num4 = this.SingleSignatureScan(pattern, array);
                if (num4 >= 0)
                {
                    result = new MemoryScan.MemoryScanResult(mEMORY_BASIC_INFORMATION.BaseAddress, mEMORY_BASIC_INFORMATION.BaseAddress + num4, num4, array);
                    return(result);
                }
            }
            num += (long)mEMORY_BASIC_INFORMATION.RegionSize;
            minimumApplicationAddress = new IntPtr(num);
        }
        result = null;
        return(result);
    }
Example #2
0
 public MemoryScan.MemoryScanResult SingleScan(int[] pattern)
 {
     MemoryScan.SYSTEM_INFO sYSTEM_INFO = default(MemoryScan.SYSTEM_INFO);
     MemoryScan.GetSystemInfo(out sYSTEM_INFO);
     IntPtr minimumApplicationAddress = sYSTEM_INFO.minimumApplicationAddress;
     IntPtr maximumApplicationAddress = sYSTEM_INFO.maximumApplicationAddress;
     long num = (long)minimumApplicationAddress;
     long num2 = (long)maximumApplicationAddress;
     IntPtr intPtr = MemoryScan.OpenProcess(1040, false, this.process.Id);
     MemoryScan.MEMORY_BASIC_INFORMATION mEMORY_BASIC_INFORMATION = default(MemoryScan.MEMORY_BASIC_INFORMATION);
     int num3 = 0;
     MemoryScan.MemoryScanResult result;
     while (num < num2)
     {
         MemoryScan.VirtualQueryEx(intPtr, minimumApplicationAddress, out mEMORY_BASIC_INFORMATION, 28u);
         if (mEMORY_BASIC_INFORMATION.Protect == 4 && mEMORY_BASIC_INFORMATION.State == 4096)
         {
             byte[] array = new byte[mEMORY_BASIC_INFORMATION.RegionSize];
             MemoryScan.ReadProcessMemory((int)intPtr, mEMORY_BASIC_INFORMATION.BaseAddress, array, mEMORY_BASIC_INFORMATION.RegionSize, ref num3);
             int num4 = this.SingleSignatureScan(pattern, array);
             if (num4 >= 0)
             {
                 result = new MemoryScan.MemoryScanResult(mEMORY_BASIC_INFORMATION.BaseAddress, mEMORY_BASIC_INFORMATION.BaseAddress + num4, num4, array);
                 return result;
             }
         }
         num += (long)mEMORY_BASIC_INFORMATION.RegionSize;
         minimumApplicationAddress = new IntPtr(num);
     }
     result = null;
     return result;
 }