private IntPtr GetVersionedFunctionPointer(Process program)
{
if (signatures != null)
{
MemorySearcher searcher = new MemorySearcher();
searcher.MemoryFilter = delegate(MemInfo info) {
return((info.State & 0x1000) != 0 && (info.Protect & 0x40) != 0 && (info.Protect & 0x100) == 0);
};
for (int i = 0; i < signatures.Length; i++)
{
ProgramSignature signature = signatures[i];
IntPtr ptr = searcher.FindSignature(program, signature.Signature);
if (ptr != IntPtr.Zero)
{
Version = signature.Version;
return(ptr + signature.Offset);
}
}
}
else
{
IntPtr ptr = (IntPtr)program.Read <uint>(program.MainModule.BaseAddress, offsets);
if (ptr != IntPtr.Zero)
{
return(ptr);
}
}
return(IntPtr.Zero);
}
private IntPtr GetPointer(Process program, string asmName)
{
if (string.IsNullOrEmpty(asmName))
{
Searcher.MemoryFilter = delegate(MemInfo info) {
return((info.State & 0x1000) != 0 && (info.Protect & 0x40) != 0 && (info.Protect & 0x100) == 0);
};
}
else
{
Tuple <IntPtr, IntPtr> range = ProgramPointer.GetAddressRange(program, asmName);
Searcher.MemoryFilter = delegate(MemInfo info) {
return((ulong)info.BaseAddress >= (ulong)range.Item1 && (ulong)info.BaseAddress <= (ulong)range.Item2 && (info.State & 0x1000) != 0 && (info.Protect & 0x20) != 0 && (info.Protect & 0x100) == 0);
};
}
BasePtr = Searcher.FindSignature(program, Signature);
if (BasePtr != IntPtr.Zero)
{
LastVerified = DateTime.Now.AddSeconds(5);
int offset = CalculateRelative(program);
return(BasePtr + offset);
}
return(BasePtr);
}