private T readMemoryToT <T>(ProcessMemoryReader pmr, IntPtr address, Func <byte[], T> converterFunc) { byte[] buffer = pmr.ReadProcessMemory( address, Marshal.SizeOf(typeof(T))); return(converterFunc(buffer)); }
private IMAGE_SECTION_HEADER findSection(ProcessMemoryReader pmr, IntPtr baseAddr, int modSize, string secName) { byte[] buffer = pmr.ReadProcessMemory(baseAddr, modSize); IMAGE_DOS_HEADER idh = buffer.ToStruct <IMAGE_DOS_HEADER>(); IMAGE_NT_HEADERS32 inh = bytesToStruct <IMAGE_NT_HEADERS32>(pmr, baseAddr + idh.e_lfanew); IMAGE_SECTION_HEADER ish = new IMAGE_SECTION_HEADER(); for (int i = 0; i < inh.FileHeader.NumberOfSections; i++) { ish = bytesToStruct <IMAGE_SECTION_HEADER>( pmr, baseAddr + idh.e_lfanew + Marshal.SizeOf(typeof(IMAGE_NT_HEADERS32)) + (Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER)) * i) ); if (new string(ish.Name).ToLower().TrimEnd('\0') == secName.ToLower()) { break; } } return(ish); }