static void OverrideNames() { var scanner = new MemoryScan(Process.GetCurrentProcess()); int[] pattern = { 0x40, 0x73, 0x72, 0x63, 0x74, 0x72, 0x20, 0x6E, 0x61, 0x6D, 0x65, 0x40 }; var results = scanner.Scan(pattern); if (results.Length == 0) { return; } foreach (MemoryScan.MemoryScanResult result in results) { for (int i = result.offset; i < result.offset + 0xFFFF; i++) { if (result.buffer[i] == 0x40) //&& result.buffer[i - 1] == 0x65 { result.buffer[i] = 0x65; //result.buffer[i - 1] = 0x61; } } WriteMemory(result.BaseAddress, result.buffer); Console.WriteLine(result.Address.ToString("X")); break; } }
public MemoryScan.MemoryScanResult SingleScan(int[] pattern) { MemoryScan.SYSTEM_INFO sYSTEM_INFO = default(MemoryScan.SYSTEM_INFO); MemoryScan.GetSystemInfo(out sYSTEM_INFO); IntPtr minimumApplicationAddress = sYSTEM_INFO.minimumApplicationAddress; IntPtr maximumApplicationAddress = sYSTEM_INFO.maximumApplicationAddress; long num = (long)minimumApplicationAddress; long num2 = (long)maximumApplicationAddress; IntPtr intPtr = MemoryScan.OpenProcess(1040, false, this.process.Id); MemoryScan.MEMORY_BASIC_INFORMATION mEMORY_BASIC_INFORMATION = default(MemoryScan.MEMORY_BASIC_INFORMATION); int num3 = 0; MemoryScan.MemoryScanResult result; while (num < num2) { MemoryScan.VirtualQueryEx(intPtr, minimumApplicationAddress, out mEMORY_BASIC_INFORMATION, 28u); if (mEMORY_BASIC_INFORMATION.Protect == 4 && mEMORY_BASIC_INFORMATION.State == 4096) { byte[] array = new byte[mEMORY_BASIC_INFORMATION.RegionSize]; MemoryScan.ReadProcessMemory((int)intPtr, mEMORY_BASIC_INFORMATION.BaseAddress, array, mEMORY_BASIC_INFORMATION.RegionSize, ref num3); int num4 = this.SingleSignatureScan(pattern, array); if (num4 >= 0) { result = new MemoryScan.MemoryScanResult(mEMORY_BASIC_INFORMATION.BaseAddress, mEMORY_BASIC_INFORMATION.BaseAddress + num4, num4, array); return(result); } } num += (long)mEMORY_BASIC_INFORMATION.RegionSize; minimumApplicationAddress = new IntPtr(num); } result = null; return(result); }
static void OverrideNames2() { var scanner = new MemoryScan(Process.GetCurrentProcess()); int[] pattern = { 0x3C, 0x74, 0x69, 0x74, 0x6C, 0x65, 0x4C, 0x65, 0x66, 0x74, 0x3E }; var results = scanner.Scan(pattern); foreach (MemoryScan.MemoryScanResult result in results) { Console.WriteLine(result.BaseAddress.ToString("X")); } }
protected override object InternalExecute(Program program, PlanNode planNode) { if (planNode is BaseTableVarNode) { MemoryScan scan = new MemoryScan(program, this, (BaseTableVarNode)planNode); try { scan.NativeTable = EnsureNativeTable(((BaseTableVarNode)planNode).TableVar); scan.Key = scan.NativeTable.ClusteredIndex.Key; scan.Open(); return(scan); } catch { scan.Dispose(); throw; } } else if (planNode is OrderNode) { MemoryScan scan = new MemoryScan(program, this, (BaseTableVarNode)planNode.Nodes[0]); try { scan.NativeTable = EnsureNativeTable(((BaseTableVarNode)planNode.Nodes[0]).TableVar); scan.Key = ((OrderNode)planNode).PhysicalOrder; scan.Direction = ((OrderNode)planNode).ScanDirection; scan.Node.Order = ((OrderNode)planNode).Order; scan.Open(); return(scan); } catch { scan.Dispose(); throw; } } else if (planNode is CreateTableVarBaseNode) { EnsureNativeTable(((CreateTableVarBaseNode)planNode).GetTableVar()); return(null); } else if (planNode is AlterTableNode) { // TODO: Memory device alter table support return(null); } else if (planNode is DropTableNode) { Schema.TableVar tableVar = ((DropTableNode)planNode).Table; NativeTables tables = GetTables(tableVar.Scope); lock (tables) { int tableIndex = tables.IndexOf(tableVar); if (tableIndex >= 0) { NativeTable nativeTable = tables[tableIndex]; #if USEMEMORYDEVICETRANSACTIONS RemoveTransactionReferences(nativeTable.TableVar); #endif nativeTable.Drop(program.ValueManager); tables.RemoveAt(tableIndex); } } return(null); } else { throw new DeviceException(DeviceException.Codes.InvalidExecuteRequest, Device.Name, planNode.ToString()); } }
private static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MemoryScan.MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength);
private static extern void GetSystemInfo(out MemoryScan.SYSTEM_INFO lpSystemInfo);