private unsafe IList<IntPtr> FindInProcess(IntPtr begin, IntPtr end, int maxMatchCount, IPatternAlgorithm algorithm) { byte* b = (byte*)begin + _trimmedWildcardsOffset; byte* e = (byte*)end; IList<IntPtr> matches = new List<IntPtr>(maxMatchCount); while (matches.Count < maxMatchCount && b < e) { IntPtr match = algorithm.Apply(_pattern, _mask, b, e); if (match == IntPtr.Zero) { break; } match -= _trimmedWildcardsOffset; matches.Add(match); b = (byte*)match + 1; } return matches; }
private unsafe IList<IntPtr> FindOutOfProcess(IntPtr begin, IntPtr end, IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm) { byte* b = (byte*)begin; byte* e = (byte*)end; IList<IntPtr> matches = new List<IntPtr>(maxMatchCount); int byteCount = (int)(e - b); byte[] buffer = context.Memory.ReadBytes(begin, byteCount); fixed (byte* buf = buffer) { byte* bufEnd = buf + buffer.Length; byte* cur = buf; while (matches.Count < maxMatchCount && cur < bufEnd) { IntPtr match = algorithm.Apply(_pattern, _mask, cur, bufEnd); if (match == IntPtr.Zero) { break; } int delta = (int)((byte*)match - buf); matches.Add(begin + delta); cur = (byte*)match + 1; } } return matches; }
internal static void ResetInternals() { DefaultAlgorithm = BoyerMooreHorspoolAlgorithm.Instance; }
private unsafe IList<IntPtr> FindImpl(IntPtr begin, IntPtr end, IBotProcessContext context, IPatternAlgorithm algorithm, int maxMatchCount) { algorithm = algorithm ?? DefaultAlgorithm; // if we are injected, simply forward the begin and end addresses. // otherwise, just copy the whole address range. if (context.IsInProcess) { return FindInProcess(begin, end, maxMatchCount, algorithm); } else { return FindOutOfProcess(begin, end, context, maxMatchCount, algorithm); } }
/// <summary> /// Find a byte pattern in the ProcessModule <paramref name="module"/>. /// </summary> /// <param name="module">The ProcessModule.</param> /// <param name="context">ProcessContext for the target process.</param> /// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param> /// <param name="maxMatchCount">Maximum number of matches to return.</param> /// <returns>A list of the search results.</returns> /// <remarks>Does not throw in exception in case of no match is found.</remarks> public virtual IList<IntPtr> FindMany(ProcessModule module, IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm = null) { return FindMany(module.BaseAddress, module.BaseAddress + module.ModuleMemorySize, context, maxMatchCount, algorithm); }
/// <summary> /// Find a byte pattern in the memory range from <paramref name="begin"/> to <paramref name="end"/>. /// </summary> /// <param name="begin">Start address for searching.</param> /// <param name="end">One after the last address for searching.</param> /// <param name="context">ProcessContext for the target process.</param> /// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param> /// <param name="maxMatchCount">Maximum number of matches to return.</param> /// <returns>A list of the search results.</returns> /// <remarks>Does not throw in exception in case of no match is found.</remarks> public virtual IList<IntPtr> FindMany(IntPtr begin, IntPtr end, IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm = null) { return FindImpl(begin, end, context, algorithm, maxMatchCount); }
/// <summary> /// Find a byte pattern in the MainModule of <paramref name="context"/>'s TargetProcess. /// </summary> /// <param name="context">ProcessContext for the target process.</param> /// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param> /// <param name="maxMatchCount">Maximum number of matches to return.</param> /// <returns>A list of the search results.</returns> /// <remarks>Does not throw in exception in case of no match is found.</remarks> public virtual IList<IntPtr> FindMany(IBotProcessContext context, int maxMatchCount, IPatternAlgorithm algorithm = null) { return FindMany(context.TargetProcess.MainModule, context, maxMatchCount, algorithm); }
/// <summary> /// Find a byte pattern in the memory range from <paramref name="begin"/> to <paramref name="end"/>. /// </summary> /// <param name="begin">Start address for searching.</param> /// <param name="end">One after the last address for searching.</param> /// <param name="context">ProcessContext for the target process.</param> /// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param> /// <returns>The first pattern match in the specified address range.</returns> /// <exception cref="PatternException">Pattern could not be matched.</exception> public virtual IntPtr Find(IntPtr begin, IntPtr end, IBotProcessContext context, IPatternAlgorithm algorithm = null) { var list = FindImpl(begin, end, context, algorithm, 1); if (list.Count == 0) { throw new PatternException("Pattern could not be matched."); } return list[0]; }
/// <summary> /// Find a byte pattern in the ProcessModule <paramref name="module"/>. /// </summary> /// <param name="module">The ProcessModule.</param> /// <param name="end">One after the last address for searching.</param> /// <param name="context">ProcessContext for the target process.</param> /// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param> /// <returns>The first pattern match in the specified address range.</returns> /// <exception cref="PatternException">Pattern could not be matched.</exception> public virtual IntPtr Find(ProcessModule module, IBotProcessContext context, IPatternAlgorithm algorithm = null) { return Find(module.BaseAddress, module.BaseAddress + module.ModuleMemorySize, context, algorithm); }
/// <summary> /// Find a byte pattern in the MainModule of <paramref name="context"/>'s TargetProcess. /// </summary> /// <param name="context">ProcessContext for the target process.</param> /// <param name="algorithm">An algorithm object which applies the pattern. The default is null, so that the DefaultAlgorithm is used.</param> /// <returns>The first pattern match in the specified address range.</returns> /// <exception cref="PatternException">Pattern could not be matched.</exception> public virtual IntPtr Find(IBotProcessContext context, IPatternAlgorithm algorithm = null) { return Find(context.TargetProcess.MainModule, context, algorithm); }
public void Setup() { _algorithm = CreateAlgorithm(); }