private static bool GuessPointerNode(IntPtr address, IProcessReader process, out BaseNode node) { Contract.Requires(process != null); node = null; if (address.IsNull()) { return(false); } var section = process.GetSectionToPointer(address); if (section == null) { return(false); } if (section.Category == SectionCategory.CODE) // If the section contains code, it should be a function pointer. { node = new FunctionPtrNode(); return(true); } if (section.Category == SectionCategory.DATA || section.Category == SectionCategory.HEAP) // If the section contains data, it is at least a pointer to a class or something. { // Check if it is a vtable. Check if the first 3 values are pointers to a code section. var possibleVmt = process.ReadRemoteObject <ThreePointersData>(address); if (process.GetSectionToPointer(possibleVmt.Pointer1)?.Category == SectionCategory.CODE && process.GetSectionToPointer(possibleVmt.Pointer2)?.Category == SectionCategory.CODE && process.GetSectionToPointer(possibleVmt.Pointer3)?.Category == SectionCategory.CODE) { node = new VirtualMethodTableNode(); return(true); } // Check if it is a string. var data = process.ReadRemoteMemory(address, IntPtr.Size * 2); if (data.Take(IntPtr.Size).InterpretAsSingleByteCharacter().IsLikelyPrintableData()) { node = new Utf8TextPtrNode(); return(true); } if (data.InterpretAsDoubleByteCharacter().IsLikelyPrintableData()) { node = new Utf16TextPtrNode(); return(true); } // Now it could be a pointer to something else but we can't tell. :( node = new PointerNode(); return(true); } return(false); }