/// <summary>
/// Creates an <see cref="IAssemblyImage"/> that provides access into a Unity application's managed memory.
/// </summary>
/// <param name="processId">
/// The id of the Unity process to be inspected.
/// </param>
/// <param name="assemblyName">
/// The name of the assembly to be inspected. The default setting of 'Assembly-CSharp' is probably what you want.
/// </param>
/// <returns>
/// An <see cref="IAssemblyImage"/> that provides access into a Unity application's managed memory.
/// </returns>
public static IAssemblyImage Create(int processId, string assemblyName = "Assembly-CSharp")
{
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
{
throw new InvalidOperationException(
"This library reads data directly from a process's memory, so is platform specific "
+ "and only runs under Windows. It might be possible to get it running under macOS, but...");
}
var process = new ProcessFacade(processId);
var monoModule = AssemblyImageFactory.GetMonoModule(process);
var moduleDump = process.ReadModule(monoModule);
var rootDomainFunctionAddress = AssemblyImageFactory.GetRootDomainFunctionAddress(moduleDump, monoModule);
return(AssemblyImageFactory.GetAssemblyImage(process, assemblyName, rootDomainFunctionAddress));
}
public static IAssemblyImage Create([NotNull] UnityProcessFacade process, string assemblyName = "Assembly-CSharp")
{
if (process == null)
{
throw new ArgumentNullException("process parameter cannot be null");
}
var monoModule = process.GetMonoModule();
IntPtr rootDomainFunctionAddress;
if (RuntimeInformation.IsOSPlatform(OSPlatform.OSX))
{
rootDomainFunctionAddress = GetRootDomainFunctionAddressMachOFormat(monoModule);
}
else
{
var moduleDump = process.ReadModule(monoModule);
rootDomainFunctionAddress = AssemblyImageFactory.GetRootDomainFunctionAddressPEFormat(moduleDump, monoModule, process.Is64Bits);
}
return(AssemblyImageFactory.GetAssemblyImage(process, assemblyName, rootDomainFunctionAddress));
}
