public ScanResult PerformSignatureScan(byte[] pattern, string mask, ProcessModule module, bool codeOnly = true) { MemoryModule mmod = MemoryModule.FromMemory(this, module); byte[] buffer = new byte[4096]; int idx = 0; bool found = false; long start = mmod.ImageBase;// codeOnly ? mmod.BaseOfCode : mmod.ImageBase; long size = codeOnly ? mmod.SizeOfCode : mmod.MemorySize; while (true) { this.Position = start + idx; this.Position -= this.Position % 4; int length = this.Read(buffer, 0, (int)Math.Min(buffer.Length, size - idx)); for (int b = 0; b < buffer.Length - mask.Length; b++) { found = true; for (int i = 0; i < mask.Length; i++) { if (mask[i] != '?' && buffer[b + i] != pattern[i]) { found = false; break; } } if (found) { byte[] data = new byte[mask.Length]; Array.Copy(buffer, b, data, 0, mask.Length); return(ScanResult.Succeeded(start + idx + b, data)); } } if (length - mask.Length == 0) { break; } idx += length - mask.Length; if (this.Position >= start + size) { break; } } return(ScanResult.Failed()); }