Exemplo n.º 1
0
        private IntPtr GetVersionedFunctionPointer(Process program)
        {
            if (signatures != null)
            {
                searcher.memoryInfo = null;
                for (int i = 0; i < signatures.Length; i++)
                {
                    ProgramSignature signature = signatures[i];

                    IntPtr ptr = searcher.FindSignature(program, signature.Signature);
                    if (ptr != IntPtr.Zero)
                    {
                        Version       = signature.Version;
                        lastSignature = signature.Signature;
                        lastPointer   = ptr;
                        return(ptr + signature.Offset);
                    }
                }
                return(IntPtr.Zero);
            }

            if (MemoryReader.is64Bit)
            {
                return((IntPtr)program.Read <ulong>(program.MainModule.BaseAddress, offsets));
            }
            else
            {
                return((IntPtr)program.Read <uint>(program.MainModule.BaseAddress, offsets));
            }
        }
Exemplo n.º 2
0
        private IntPtr GetVersionedFunctionPointer(Process program)
        {
            if (signatures != null)
            {
                MemorySearcher searcher = new MemorySearcher();
                searcher.MemoryFilter = delegate(MemInfo info) {
                    return((info.State & 0x1000) != 0 && (info.Protect & 0x40) != 0 && (info.Protect & 0x100) == 0);
                };
                for (int i = 0; i < signatures.Length; i++)
                {
                    ProgramSignature signature = signatures[i];

                    IntPtr ptr = searcher.FindSignature(program, signature.Signature);
                    if (ptr != IntPtr.Zero)
                    {
                        Version = signature.Version;
                        return(ptr + signature.Offset);
                    }
                }
                return(IntPtr.Zero);
            }

            if (MemoryReader.is64Bit)
            {
                return((IntPtr)program.Read <ulong>(program.MainModule.BaseAddress, offsets));
            }
            else
            {
                return((IntPtr)program.Read <uint>(program.MainModule.BaseAddress, offsets));
            }
        }