public static int GetIndexOf(IAMemoryPattern pattern, byte[] Data, AProcessSharpModule module)
{
var patternData = Data;
var patternDataLength = patternData.Length;
for (var offset = 0; offset < patternDataLength; offset++)
{
if (
pattern.GetMask()
.Where((m, b) => m == 'x' && pattern.GetBytes()[b] != patternData[b + offset])
.Any())
{
continue;
}
return(offset);
}
return(-1);
}
/// <summary>
/// Frees the loaded dynamic-link library (DLL) module and, if necessary, decrements its reference count.
/// </summary>
/// <param name="module">The module to eject.</param>
public void Eject(AProcessSharpModule module)
{
// If the module is valid
if (!module.IsValid)
{
return;
}
// Find if the module is an injected one
var injected = InternalInjectedModules.FirstOrDefault(m => m.Equals(module));
if (injected != null)
{
InternalInjectedModules.Remove(injected);
}
// Eject the module
ARemoteModule.InternalEject(ProcessPlus, module);
}
public APatternScanner(AProcessSharpModule module, int offsetFromBaseAddress)
{
_module = module;
_offsetFromBaseAddress = offsetFromBaseAddress;
Data = module.Read(_offsetFromBaseAddress, _module.Size - _offsetFromBaseAddress);
}
/// <summary>
/// Frees the loaded dynamic-link library (DLL) module and, if necessary, decrements its reference count.
/// </summary>
/// <param name="memorySharp">The reference of the <see cref="MemorySharp" /> object.</param>
/// <param name="module">The module to eject.</param>
internal static void InternalEject(AProcessSharp memorySharp, AProcessSharpModule module)
{
// Call FreeLibrary remotely
memorySharp.ThreadFactory.CreateAndJoin(memorySharp["kernel32"]["FreeLibrary"].BaseAddress,
module.BaseAddress);
}
public APatternScanner(AProcessSharpModule module) : this(module, 0)
{
}
