public string GetName() { var radarAddress = MemUtils.ReadInt32(LittleOverlay.Client + Signatures.dwRadarBase); radarAddress = MemUtils.ReadInt32((IntPtr)(radarAddress + 0x74)); return(MemUtils.ReadString((IntPtr)(radarAddress + 0x168 * (Id + 1) + 0x180), 32, Encoding.ASCII)); }
public string GetName(MemUtils memUtils) { int clientClass = GetClientClass(memUtils); if (clientClass != -1) { int ptr = memUtils.Read<int>((IntPtr)(GetClassID(memUtils) + 8)); return memUtils.ReadString((IntPtr)(ptr + 8), 32, Encoding.ASCII); } return "none"; }
/// <summary> /// Reads the Export Address Table (EAT) of this module from live memory /// </summary> /// <param name="memUtils">MemUtils-instance that is used to read data</param> /// <param name="imageBase">Base-address pf this module in memory</param> /// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param> /// <returns></returns> public Tuple <string, int>[] ReadExportedFunctions(MemUtils memUtils, IntPtr imageBase, _IMAGE_EXPORT_DIRECTORY ied) { List <Tuple <string, int> > functions = new List <Tuple <string, int> >(); IntPtr lpFunctions = (IntPtr)(imageBase.ToInt64() + ied.AddressOfFunctions); IntPtr lpNames = (IntPtr)(imageBase.ToInt64() + ied.AddressOfNames); for (int i = 0; i < ied.NumberOfFunctions; i++) { int address = memUtils.Read <int>((IntPtr)(lpFunctions.ToInt64() + i * 4)); string name = "?"; if (lpFunctions != lpNames) { int nameAddress = memUtils.Read <int>((IntPtr)(lpNames.ToInt64() + i * 4)); name = memUtils.ReadString((IntPtr)(imageBase.ToInt64() + nameAddress), 64, Encoding.ASCII); } functions.Add(new Tuple <string, int>(name, address)); } return(functions.ToArray()); }
/// <summary> /// Reads the name of this module from live-memory /// </summary> /// <param name="memUtils">MemUtils-instance that is used to read data</param> /// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param> /// <param name="imageBase">Base-address pf this module in memory</param> /// <returns></returns> public string ReadName(MemUtils memUtils, _IMAGE_EXPORT_DIRECTORY ied, IntPtr imageBase) { return(memUtils.ReadString((IntPtr)(imageBase.ToInt64() + ied.Name), 32, Encoding.ASCII)); }
/// <summary> /// Reads the name of this module from live-memory /// </summary> /// <param name="memUtils">MemUtils-instance that is used to read data</param> /// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param> /// <param name="imageBase">Base-address pf this module in memory</param> /// <returns></returns> public string ReadName(MemUtils memUtils, _IMAGE_EXPORT_DIRECTORY ied, IntPtr imageBase) { return memUtils.ReadString((IntPtr)(imageBase.ToInt64() + ied.Name), 32, Encoding.ASCII); }
/// <summary> /// Reads the Export Address Table (EAT) of this module from live memory /// </summary> /// <param name="memUtils">MemUtils-instance that is used to read data</param> /// <param name="imageBase">Base-address pf this module in memory</param> /// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param> /// <returns></returns> public Tuple<string, int>[] ReadExportedFunctions(MemUtils memUtils, IntPtr imageBase, _IMAGE_EXPORT_DIRECTORY ied) { List<Tuple<string, int>> functions = new List<Tuple<string, int>>(); IntPtr lpFunctions = (IntPtr)(imageBase.ToInt64() + ied.AddressOfFunctions); IntPtr lpNames = (IntPtr)(imageBase.ToInt64() + ied.AddressOfNames); for (int i = 0; i < ied.NumberOfFunctions; i++) { int address = memUtils.Read<int>((IntPtr)(lpFunctions.ToInt64() + i * 4)); string name = "?"; if (lpFunctions != lpNames) { int nameAddress = memUtils.Read<int>((IntPtr)(lpNames.ToInt64() + i * 4)); name = memUtils.ReadString((IntPtr)(imageBase.ToInt64() + nameAddress), 64, Encoding.ASCII); } functions.Add(new Tuple<string, int>(name, address)); } return functions.ToArray(); }