Пример #1
0
        public byte[] ReadMemory(Process process, int index)
        {
            MemInfo info = memoryInfo[index];

            byte[] buff = new byte[(uint)info.RegionSize];
            ReadProcessMemory(process.Handle, info.BaseAddress, buff, (uint)info.RegionSize, 0);
            return(buff);
        }
Пример #2
0
        private void ScanMemory(List <IntPtr> pointers, MemInfo info, byte[] data, byte[] search, bool[] mask, int[] offsets)
        {
            int current = 0;
            int end     = search.Length - 1;

            while (current <= data.Length - search.Length)
            {
                for (int i = end; data[current + i] == search[i] || mask[i]; i--)
                {
                    if (i == 0)
                    {
                        pointers.Add(info.BaseAddress + current);
                        break;
                    }
                }
                int offset = offsets[data[current + end]];
                current += offset;
            }
        }
Пример #3
0
        public List <IntPtr> FindSignatures(Process process, string signature)
        {
            byte[] pattern;
            bool[] mask;
            GetSignature(signature, out pattern, out mask);
            GetMemoryInfo(process.Handle);
            int[] offsets = GetCharacterOffsets(pattern, mask);

            List <IntPtr> pointers = new List <IntPtr>();

            for (int i = 0; i < memoryInfo.Count; i++)
            {
                byte[]  buff = ReadMemory(process, i);
                MemInfo info = memoryInfo[i];

                ScanMemory(pointers, info, buff, pattern, mask, offsets);
            }
            return(pointers);
        }
Пример #4
0
        public IntPtr FindSignature(Process process, string signature)
        {
            byte[] pattern;
            bool[] mask;
            GetSignature(signature, out pattern, out mask);
            GetMemoryInfo(process.Handle);
            int[] offsets = GetCharacterOffsets(pattern, mask);

            for (int i = 0; i < memoryInfo.Count; i++)
            {
                byte[]  buff = ReadMemory(process, i);
                MemInfo info = memoryInfo[i];

                int result = ScanMemory(buff, pattern, mask, offsets);
                if (result != int.MinValue)
                {
                    return(info.BaseAddress + result);
                }
            }
            return(IntPtr.Zero);
        }
Пример #5
0
        public void GetMemoryInfo(IntPtr pHandle)
        {
            if (memoryInfo != null)
            {
                return;
            }

            memoryInfo = new List <MemInfo>();
            IntPtr current = (IntPtr)65536;

            while (true)
            {
                MemInfo memInfo = new MemInfo();
                int     dump    = VirtualQueryEx(pHandle, current, out memInfo, Marshal.SizeOf(memInfo));
                if (dump == 0)
                {
                    break;
                }

                long regionSize = (long)memInfo.RegionSize;
                if (regionSize <= 0 || (int)regionSize != regionSize)
                {
                    if (MemoryReader.is64Bit)
                    {
                        current = (IntPtr)((ulong)memInfo.BaseAddress + (ulong)memInfo.RegionSize);
                        continue;
                    }
                    break;
                }

                if (MemoryFilter(memInfo))
                {
                    memoryInfo.Add(memInfo);
                }

                current = memInfo.BaseAddress + (int)regionSize;
            }
        }
Пример #6
0
 private static extern int VirtualQueryEx(IntPtr hProcess, IntPtr lpAddress, out MemInfo lpBuffer, int dwLength);