public string GetName()
{
var radarAddress = MemUtils.ReadInt32(LittleOverlay.Client + Signatures.dwRadarBase);
radarAddress = MemUtils.ReadInt32((IntPtr)(radarAddress + 0x74));
return(MemUtils.ReadString((IntPtr)(radarAddress + 0x168 * (Id + 1) + 0x180), 32,
Encoding.ASCII));
}
public string GetName(MemUtils memUtils)
{
int clientClass = GetClientClass(memUtils);
if (clientClass != -1)
{
int ptr = memUtils.Read<int>((IntPtr)(GetClassID(memUtils) + 8));
return memUtils.ReadString((IntPtr)(ptr + 8), 32, Encoding.ASCII);
}
return "none";
}
/// <summary>
/// Reads the Export Address Table (EAT) of this module from live memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <returns></returns>
public Tuple <string, int>[] ReadExportedFunctions(MemUtils memUtils, IntPtr imageBase, _IMAGE_EXPORT_DIRECTORY ied)
{
List <Tuple <string, int> > functions = new List <Tuple <string, int> >();
IntPtr lpFunctions = (IntPtr)(imageBase.ToInt64() + ied.AddressOfFunctions);
IntPtr lpNames = (IntPtr)(imageBase.ToInt64() + ied.AddressOfNames);
for (int i = 0; i < ied.NumberOfFunctions; i++)
{
int address = memUtils.Read <int>((IntPtr)(lpFunctions.ToInt64() + i * 4));
string name = "?";
if (lpFunctions != lpNames)
{
int nameAddress = memUtils.Read <int>((IntPtr)(lpNames.ToInt64() + i * 4));
name = memUtils.ReadString((IntPtr)(imageBase.ToInt64() + nameAddress), 64, Encoding.ASCII);
}
functions.Add(new Tuple <string, int>(name, address));
}
return(functions.ToArray());
}
/// <summary>
/// Reads the name of this module from live-memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <returns></returns>
public string ReadName(MemUtils memUtils, _IMAGE_EXPORT_DIRECTORY ied, IntPtr imageBase)
{
return(memUtils.ReadString((IntPtr)(imageBase.ToInt64() + ied.Name), 32, Encoding.ASCII));
}
/// <summary>
/// Reads the name of this module from live-memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <returns></returns>
public string ReadName(MemUtils memUtils, _IMAGE_EXPORT_DIRECTORY ied, IntPtr imageBase)
{
return memUtils.ReadString((IntPtr)(imageBase.ToInt64() + ied.Name), 32, Encoding.ASCII);
}
/// <summary>
/// Reads the Export Address Table (EAT) of this module from live memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <returns></returns>
public Tuple<string, int>[] ReadExportedFunctions(MemUtils memUtils, IntPtr imageBase, _IMAGE_EXPORT_DIRECTORY ied)
{
List<Tuple<string, int>> functions = new List<Tuple<string, int>>();
IntPtr lpFunctions = (IntPtr)(imageBase.ToInt64() + ied.AddressOfFunctions);
IntPtr lpNames = (IntPtr)(imageBase.ToInt64() + ied.AddressOfNames);
for (int i = 0; i < ied.NumberOfFunctions; i++)
{
int address = memUtils.Read<int>((IntPtr)(lpFunctions.ToInt64() + i * 4));
string name = "?";
if (lpFunctions != lpNames)
{
int nameAddress = memUtils.Read<int>((IntPtr)(lpNames.ToInt64() + i * 4));
name = memUtils.ReadString((IntPtr)(imageBase.ToInt64() + nameAddress), 64, Encoding.ASCII);
}
functions.Add(new Tuple<string, int>(name, address));
}
return functions.ToArray();
}
