private unsafe IList<IntPtr> FindInProcess(IntPtr begin, IntPtr end, int maxMatchCount, IPatternAlgorithm algorithm)
{
byte* b = (byte*)begin + _trimmedWildcardsOffset;
byte* e = (byte*)end;
IList<IntPtr> matches = new List<IntPtr>(maxMatchCount);
while (matches.Count < maxMatchCount && b < e)
{
IntPtr match = algorithm.Apply(_pattern, _mask, b, e);
if (match == IntPtr.Zero)
{
break;
}
match -= _trimmedWildcardsOffset;
matches.Add(match);
b = (byte*)match + 1;
}
return matches;
}
private unsafe IList<IntPtr> FindOutOfProcess(IntPtr begin, IntPtr end, IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm)
{
byte* b = (byte*)begin;
byte* e = (byte*)end;
IList<IntPtr> matches = new List<IntPtr>(maxMatchCount);
int byteCount = (int)(e - b);
byte[] buffer = context.Memory.ReadBytes(begin, byteCount);
fixed (byte* buf = buffer)
{
byte* bufEnd = buf + buffer.Length;
byte* cur = buf;
while (matches.Count < maxMatchCount && cur < bufEnd)
{
IntPtr match = algorithm.Apply(_pattern, _mask, cur, bufEnd);
if (match == IntPtr.Zero)
{
break;
}
int delta = (int)((byte*)match - buf);
matches.Add(begin + delta);
cur = (byte*)match + 1;
}
}
return matches;
}
internal static void ResetInternals()
{
DefaultAlgorithm = BoyerMooreHorspoolAlgorithm.Instance;
}
private unsafe IList<IntPtr> FindImpl(IntPtr begin, IntPtr end, IBotProcessContext context, IPatternAlgorithm algorithm, int maxMatchCount)
{
algorithm = algorithm ?? DefaultAlgorithm;
// if we are injected, simply forward the begin and end addresses.
// otherwise, just copy the whole address range.
if (context.IsInProcess)
{
return FindInProcess(begin, end, maxMatchCount, algorithm);
}
else
{
return FindOutOfProcess(begin, end, context, maxMatchCount, algorithm);
}
}
/// <summary>
/// Find a byte pattern in the ProcessModule <paramref name="module"/>.
/// </summary>
/// <param name="module">The ProcessModule.</param>
/// <param name="context">ProcessContext for the target process.</param>
/// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param>
/// <param name="maxMatchCount">Maximum number of matches to return.</param>
/// <returns>A list of the search results.</returns>
/// <remarks>Does not throw in exception in case of no match is found.</remarks>
public virtual IList<IntPtr> FindMany(ProcessModule module, IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm = null)
{
return FindMany(module.BaseAddress, module.BaseAddress + module.ModuleMemorySize, context, maxMatchCount, algorithm);
}
/// <summary>
/// Find a byte pattern in the memory range from <paramref name="begin"/> to <paramref name="end"/>.
/// </summary>
/// <param name="begin">Start address for searching.</param>
/// <param name="end">One after the last address for searching.</param>
/// <param name="context">ProcessContext for the target process.</param>
/// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param>
/// <param name="maxMatchCount">Maximum number of matches to return.</param>
/// <returns>A list of the search results.</returns>
/// <remarks>Does not throw in exception in case of no match is found.</remarks>
public virtual IList<IntPtr> FindMany(IntPtr begin, IntPtr end, IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm = null)
{
return FindImpl(begin, end, context, algorithm, maxMatchCount);
}
/// <summary>
/// Find a byte pattern in the MainModule of <paramref name="context"/>'s TargetProcess.
/// </summary>
/// <param name="context">ProcessContext for the target process.</param>
/// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param>
/// <param name="maxMatchCount">Maximum number of matches to return.</param>
/// <returns>A list of the search results.</returns>
/// <remarks>Does not throw in exception in case of no match is found.</remarks>
public virtual IList<IntPtr> FindMany(IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm = null)
{
return FindMany(context.TargetProcess.MainModule, context, maxMatchCount, algorithm);
}
/// <summary>
/// Find a byte pattern in the memory range from <paramref name="begin"/> to <paramref name="end"/>.
/// </summary>
/// <param name="begin">Start address for searching.</param>
/// <param name="end">One after the last address for searching.</param>
/// <param name="context">ProcessContext for the target process.</param>
/// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param>
/// <returns>The first pattern match in the specified address range.</returns>
/// <exception cref="PatternException">Pattern could not be matched.</exception>
public virtual IntPtr Find(IntPtr begin, IntPtr end, IBotProcessContext context, IPatternAlgorithm algorithm = null)
{
var list = FindImpl(begin, end, context, algorithm, 1);
if (list.Count == 0)
{
throw new PatternException("Pattern could not be matched.");
}
return list[0];
}
/// <summary>
/// Find a byte pattern in the ProcessModule <paramref name="module"/>.
/// </summary>
/// <param name="module">The ProcessModule.</param>
/// <param name="end">One after the last address for searching.</param>
/// <param name="context">ProcessContext for the target process.</param>
/// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param>
/// <returns>The first pattern match in the specified address range.</returns>
/// <exception cref="PatternException">Pattern could not be matched.</exception>
public virtual IntPtr Find(ProcessModule module, IBotProcessContext context, IPatternAlgorithm algorithm = null)
{
return Find(module.BaseAddress, module.BaseAddress + module.ModuleMemorySize, context, algorithm);
}
/// <summary>
/// Find a byte pattern in the MainModule of <paramref name="context"/>'s TargetProcess.
/// </summary>
/// <param name="context">ProcessContext for the target process.</param>
/// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param>
/// <returns>The first pattern match in the specified address range.</returns>
/// <exception cref="PatternException">Pattern could not be matched.</exception>
public virtual IntPtr Find(IBotProcessContext context, IPatternAlgorithm algorithm = null)
{
return Find(context.TargetProcess.MainModule, context, algorithm);
}
public void Setup()
{
_algorithm = CreateAlgorithm();
}
