/// <summary> /// Called when the scan updates. /// </summary> /// <param name="cancellationToken">The cancellation token for handling canceled tasks.</param> protected override void OnUpdate(CancellationToken cancellationToken) { cancellationToken.ThrowIfCancellationRequested(); // Collect pointer roots foreach (UInt64 modulePointer in this.LevelPointers.ModulePointerPool.PointerAddresses) { this.DiscoveredPointers.AddPointerRoot(new PointerRoot(modulePointer)); } this.DiscoveredPointers.Sort(); // Build out pointer paths via a DFS foreach (PointerRoot pointerRoot in this.DiscoveredPointers.PointerRoots) { PointerPool nextLevel = this.LevelPointers.NonStaticPointerPools.First(); UInt64 pointerDestination = this.LevelPointers.ModulePointerPool[pointerRoot.BaseAddress]; pointerRoot.AddOffsets(nextLevel.FindOffsets(pointerDestination, this.PointerRadius)); // Recurse on the branches if (this.LevelPointers.NonStaticPointerPools.Count() > 1) { foreach (PointerBranch branch in pointerRoot) { this.BuildPointerPaths(this.ApplyOffset(pointerDestination, branch.Offset), branch, 0); } } } }
private void BuildPointerPaths(UInt64 currentPointer, PointerBranch pointerBranch, Int32 levelIndex) { PointerPool currentLevel = this.LevelPointers.NonStaticPointerPools.ElementAt(levelIndex); PointerPool nextLevel = this.LevelPointers.NonStaticPointerPools.ElementAt(levelIndex + 1); UInt64 pointerDestination = currentLevel[currentPointer]; pointerBranch.AddOffsets(nextLevel.FindOffsets(pointerDestination, this.PointerRadius)); // Stop recursing if no more levels if (levelIndex + 1 >= this.LevelPointers.NonStaticPointerPools.Count() - 1) { return; } foreach (PointerBranch branch in pointerBranch) { this.BuildPointerPaths(this.ApplyOffset(pointerDestination, branch.Offset), branch, levelIndex + 1); } }
/// <summary> /// Called when the scan updates. /// </summary> /// <param name="cancellationToken">The cancellation token for handling canceled tasks.</param> protected override void OnUpdate(CancellationToken cancellationToken) { cancellationToken.ThrowIfCancellationRequested(); Int32 processedPointerRoots = 0; // We start from modules and build paths to the destination. Create the roots from our found module pointers. this.ScannedPointers.CreatePointerRoots(this.LevelPointers.ModulePointerPool.PointerAddresses); // Build out pointer paths via a DFS foreach (PointerRoot pointerRoot in this.ScannedPointers.PointerRoots) { cancellationToken.ThrowIfCancellationRequested(); PointerPool nextLevel = this.LevelPointers.DynamicPointerPools.First(); UInt64 pointerDestination = this.LevelPointers.ModulePointerPool[pointerRoot.BaseAddress]; pointerRoot.AddOffsets(nextLevel.FindOffsets(pointerDestination, this.PointerRadius)); // Recurse on the branches if (this.LevelPointers.IsMultiLevel) { foreach (PointerBranch branch in pointerRoot) { this.BuildPointerPaths(this.ApplyOffset(pointerDestination, branch.Offset), branch); } } // Update scan progress if (Interlocked.Increment(ref processedPointerRoots) % 32 == 0) { this.UpdateProgress(processedPointerRoots, this.ScannedPointers.PointerRoots.Count(), canFinalize: false); } } this.ScannedPointers.BuildCount(); }