/// <summary> /// Starts the characterbuilder and modifies the in-memory representation of LOADED_FILE to /// support unencrypted data. /// </summary> /// <param name="patchFile"></param> public static void StartProcessAndPatchMemory() { Log.Debug("About to start loading character builder."); //// start character builder NativePipeline np = new NativePipeline(); Log.Debug("Creating process and attaching debugger"); NativeDbgProcess proc = np.CreateProcessDebug(EXECUTABLE, EXECUTABLE_ARGS); while (true) { Log.Debug("Waiting for next event"); NativeEvent ne = np.WaitForDebugEventInfinite(); Log.Debug(ne.ToString()); ne.Process.HandleIfLoaderBreakpoint(ne); if (ne.EventCode == NativeDebugEventCode.LOAD_DLL_DEBUG_EVENT) { DllBaseNativeEvent ev = (DllBaseNativeEvent)ne; if (ev.Module.Name.Contains(LOADED_FILE)) { patchMemory(ev, (uint)proc.Id); np.ContinueEvent(ne); np.Detach(proc); break; } } np.ContinueEvent(ne); } }