Exemple #1
0
        static void OverrideNames()
        {
            var scanner = new MemoryScan(Process.GetCurrentProcess());

            int[] pattern = { 0x40, 0x73, 0x72, 0x63, 0x74, 0x72, 0x20, 0x6E, 0x61, 0x6D, 0x65, 0x40 };
            var   results = scanner.Scan(pattern);

            if (results.Length == 0)
            {
                return;
            }
            foreach (MemoryScan.MemoryScanResult result in results)
            {
                for (int i = result.offset; i < result.offset + 0xFFFF; i++)
                {
                    if (result.buffer[i] == 0x40) //&& result.buffer[i - 1] == 0x65
                    {
                        result.buffer[i] = 0x65;  //result.buffer[i - 1] = 0x61;
                    }
                }
                WriteMemory(result.BaseAddress, result.buffer);
                Console.WriteLine(result.Address.ToString("X"));
                break;
            }
        }
Exemple #2
0
    public MemoryScan.MemoryScanResult SingleScan(int[] pattern)
    {
        MemoryScan.SYSTEM_INFO sYSTEM_INFO = default(MemoryScan.SYSTEM_INFO);
        MemoryScan.GetSystemInfo(out sYSTEM_INFO);
        IntPtr minimumApplicationAddress = sYSTEM_INFO.minimumApplicationAddress;
        IntPtr maximumApplicationAddress = sYSTEM_INFO.maximumApplicationAddress;
        long   num    = (long)minimumApplicationAddress;
        long   num2   = (long)maximumApplicationAddress;
        IntPtr intPtr = MemoryScan.OpenProcess(1040, false, this.process.Id);

        MemoryScan.MEMORY_BASIC_INFORMATION mEMORY_BASIC_INFORMATION = default(MemoryScan.MEMORY_BASIC_INFORMATION);
        int num3 = 0;

        MemoryScan.MemoryScanResult result;
        while (num < num2)
        {
            MemoryScan.VirtualQueryEx(intPtr, minimumApplicationAddress, out mEMORY_BASIC_INFORMATION, 28u);
            if (mEMORY_BASIC_INFORMATION.Protect == 4 && mEMORY_BASIC_INFORMATION.State == 4096)
            {
                byte[] array = new byte[mEMORY_BASIC_INFORMATION.RegionSize];
                MemoryScan.ReadProcessMemory((int)intPtr, mEMORY_BASIC_INFORMATION.BaseAddress, array, mEMORY_BASIC_INFORMATION.RegionSize, ref num3);
                int num4 = this.SingleSignatureScan(pattern, array);
                if (num4 >= 0)
                {
                    result = new MemoryScan.MemoryScanResult(mEMORY_BASIC_INFORMATION.BaseAddress, mEMORY_BASIC_INFORMATION.BaseAddress + num4, num4, array);
                    return(result);
                }
            }
            num += (long)mEMORY_BASIC_INFORMATION.RegionSize;
            minimumApplicationAddress = new IntPtr(num);
        }
        result = null;
        return(result);
    }
Exemple #3
0
        static void OverrideNames2()
        {
            var scanner = new MemoryScan(Process.GetCurrentProcess());

            int[] pattern = { 0x3C, 0x74, 0x69, 0x74, 0x6C, 0x65, 0x4C, 0x65, 0x66, 0x74, 0x3E };
            var   results = scanner.Scan(pattern);

            foreach (MemoryScan.MemoryScanResult result in results)
            {
                Console.WriteLine(result.BaseAddress.ToString("X"));
            }
        }
Exemple #4
0
 protected override object InternalExecute(Program program, PlanNode planNode)
 {
     if (planNode is BaseTableVarNode)
     {
         MemoryScan scan = new MemoryScan(program, this, (BaseTableVarNode)planNode);
         try
         {
             scan.NativeTable = EnsureNativeTable(((BaseTableVarNode)planNode).TableVar);
             scan.Key         = scan.NativeTable.ClusteredIndex.Key;
             scan.Open();
             return(scan);
         }
         catch
         {
             scan.Dispose();
             throw;
         }
     }
     else if (planNode is OrderNode)
     {
         MemoryScan scan = new MemoryScan(program, this, (BaseTableVarNode)planNode.Nodes[0]);
         try
         {
             scan.NativeTable = EnsureNativeTable(((BaseTableVarNode)planNode.Nodes[0]).TableVar);
             scan.Key         = ((OrderNode)planNode).PhysicalOrder;
             scan.Direction   = ((OrderNode)planNode).ScanDirection;
             scan.Node.Order  = ((OrderNode)planNode).Order;
             scan.Open();
             return(scan);
         }
         catch
         {
             scan.Dispose();
             throw;
         }
     }
     else if (planNode is CreateTableVarBaseNode)
     {
         EnsureNativeTable(((CreateTableVarBaseNode)planNode).GetTableVar());
         return(null);
     }
     else if (planNode is AlterTableNode)
     {
         // TODO: Memory device alter table support
         return(null);
     }
     else if (planNode is DropTableNode)
     {
         Schema.TableVar tableVar = ((DropTableNode)planNode).Table;
         NativeTables    tables   = GetTables(tableVar.Scope);
         lock (tables)
         {
             int tableIndex = tables.IndexOf(tableVar);
             if (tableIndex >= 0)
             {
                 NativeTable nativeTable = tables[tableIndex];
                                         #if USEMEMORYDEVICETRANSACTIONS
                 RemoveTransactionReferences(nativeTable.TableVar);
                                         #endif
                 nativeTable.Drop(program.ValueManager);
                 tables.RemoveAt(tableIndex);
             }
         }
         return(null);
     }
     else
     {
         throw new DeviceException(DeviceException.Codes.InvalidExecuteRequest, Device.Name, planNode.ToString());
     }
 }
Exemple #5
0
 private static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MemoryScan.MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);
Exemple #6
0
 private static extern void GetSystemInfo(out MemoryScan.SYSTEM_INFO lpSystemInfo);