private T readMemoryToT <T>(ProcessMemoryReader pmr, IntPtr address, Func <byte[], T> converterFunc)
{
byte[] buffer = pmr.ReadProcessMemory(
address,
Marshal.SizeOf(typeof(T)));
return(converterFunc(buffer));
}
private IMAGE_SECTION_HEADER findSection(ProcessMemoryReader pmr, IntPtr baseAddr, int modSize, string secName)
{
byte[] buffer = pmr.ReadProcessMemory(baseAddr, modSize);
IMAGE_DOS_HEADER idh = buffer.ToStruct <IMAGE_DOS_HEADER>();
IMAGE_NT_HEADERS32 inh = bytesToStruct <IMAGE_NT_HEADERS32>(pmr, baseAddr + idh.e_lfanew);
IMAGE_SECTION_HEADER ish = new IMAGE_SECTION_HEADER();
for (int i = 0; i < inh.FileHeader.NumberOfSections; i++)
{
ish = bytesToStruct <IMAGE_SECTION_HEADER>(
pmr,
baseAddr + idh.e_lfanew + Marshal.SizeOf(typeof(IMAGE_NT_HEADERS32)) + (Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER)) * i)
);
if (new string(ish.Name).ToLower().TrimEnd('\0') == secName.ToLower())
{
break;
}
}
return(ish);
}