示例#1
0
        private void GetVtable(RemoteProcess remoteProcess, PEImageBuffer peImageBuffer)
        {
            if (DefaultInstance != IntPtr.Zero)
            {
                VTable = remoteProcess.Read <IntPtr>(DefaultInstance);
            }
            //else
            //{
            //    var foundGetType = false;
            //    Int64 start = 0;
            //    Int64 possibleGetType = 0;

            //    while (foundGetType == false)
            //    {
            //        possibleGetType = peImageBuffer.FindPattern(start, "48 8D 05 ? ? ? ? c3");
            //        var deRef = peImageBuffer.DerefOffset(possibleGetType);

            //        if (start >= remoteProcess.ImageSize)
            //        {
            //            break;
            //        }

            //        if (deRef != ThisTypeInfo.ToInt64())
            //        {
            //            start = possibleGetType - remoteProcess.ImageBase.ToInt64() + 8;
            //        }
            //        else
            //        {
            //            foundGetType = true;
            //        }

            //        if ((start >= remoteProcess.ImageSize) || (start < 0))
            //        {
            //            VTable = IntPtr.Zero;
            //            break;
            //        }
            //    }

            //    // look for pointer to the GetType we found
            //    if (foundGetType)
            //    {
            //        GetTypeFunction = (IntPtr)possibleGetType;
            //        VTable = (IntPtr)peImageBuffer.FindPattern(start, peImageBuffer.AddressToSig(possibleGetType));
            //    }
            //}
        }
示例#2
0
        static void Main(string[] args)
        {
            RemoteProcess remoteProcess = new RemoteProcess("starwarsbattlefrontii");

            List <SDKEnumFieldInfo> enumList   = new List <SDKEnumFieldInfo>();
            List <SDKValueTypeInfo> structList = new List <SDKValueTypeInfo>();
            List <SDKClassInfo>     classList  = new List <SDKClassInfo>();

            //bool forIDA = false;    // set true to adjust output for IDA import (Array<> becomes pointer to type)

            remoteProcess.OpenProcessMemory();

            var peImageBuffer = new PEImageBuffer(remoteProcess);

            var firstTypeInfoPtr = peImageBuffer.FindOffset("48 8B 05 ? ? ? ? 48 89 41 08 48 89 0D ? ? ? ?");
            var firstTypeInfo    = remoteProcess.Read <IntPtr>((IntPtr)firstTypeInfoPtr);

            Console.WriteLine($"Image Base : 0x{remoteProcess.ImageBase.ToString("X9")}");
            Console.WriteLine($"Image Size : 0x{remoteProcess.ImageSize.ToString("X9")}");
            Console.WriteLine("");
            Console.WriteLine($"OFFSET_FirstTypeInfo : 0x{firstTypeInfoPtr.ToString("X9")}");

            var next = firstTypeInfo;

            Console.WriteLine("Processing...");
            var count = 1;

            // testing in reclass
            var classcount  = 1;
            var structcount = 1;
            var enumcount   = 1;

            var tasks      = new List <Task>();
            var tasksCount = 0;
            var thisNext   = next;

            while (remoteProcess.IsValidImagePtr(next))
            {
                var typeInfo = new SDKTypeInfo(next, remoteProcess);

                var type = typeInfo.Type;
                if (typeInfo.Name.Contains('('))
                {
                    // some functions apparently defined, skip for now investigate later
                    type = BasicTypesEnum.kTypeCode_Void;
                }
                if ((typeInfo.Name.Contains("Float32")) || (typeInfo.Name.Contains("char")))
                {
                    // uneeded class
                    type = BasicTypesEnum.kTypeCode_Void;
                }

                switch (type)
                {
                case BasicTypesEnum.kTypeCode_Enum:
                {
                    enumList.Add(new SDKEnumFieldInfo(next, remoteProcess));
                    ++enumcount;
                }
                break;

                case BasicTypesEnum.kTypeCode_ValueType:
                {
                    structList.Add(new SDKValueTypeInfo(next, remoteProcess));
                    ++structcount;
                }
                break;

                case BasicTypesEnum.kTypeCode_Class:
                {
                    classList.Add(new SDKClassInfo(next, remoteProcess, peImageBuffer));


                    //if (tasksCount == Environment.ProcessorCount)
                    //{
                    //    Task.WaitAll(tasks.ToArray());
                    //    tasksCount = 0;
                    //}

                    //// experimental multitasking of the classes to speed up finding vtables
                    //thisNext = next;

                    //tasks.Add(
                    //    Task.Run(() =>
                    //    {
                    //        var cInfo = new SDKClassInfo(thisNext, remoteProcess, peImageBuffer);
                    //        classList.Add(cInfo);
                    //    }
                    //    ));

                    //++tasksCount;

                    ++classcount;
                }
                break;

                case BasicTypesEnum.kTypeCode_BasicTypeCount:
                {
                    Console.WriteLine($"{typeInfo.Name}");
                }
                break;

                default:
                    break;
                }

                next = typeInfo.Next;

                ++count;
            }

            Task.WaitAll(tasks.ToArray());

            ProcessHeaders.CreateHeaders(ref enumList, ref structList, ref classList);

//            var enumLines = new List<string>();

//            if (!forIDA)
//            {
//                enumLines.Add("#pragma once");
//                enumLines.Add("");
//                enumLines.Add("namespace fb");
//                enumLines.Add("{");
//            }

//            foreach (SDKEnumFieldInfo enumInfo in enumList)
//            {
//                enumLines.Add("////////////////////////////////////////");
//                enumLines.Add($"// Runtime Id : {enumInfo.RuntimeId}");
//                enumLines.Add($"// TypeInfo : 0x{enumInfo.ThisTypeInfo.ToString("X9")}");

//                enumLines.Add($"enum {enumInfo.Name}");

//                enumLines.Add("{");

//                for (int i = 0; i < enumInfo.FieldCount; i++)
//                {
//                    string end = ",";
//                    if (i == enumInfo.FieldCount - 1)
//                    {
//                        end = "";
//                    }

//                    // fix some small issues related to having all the enums in the same file
//                    var fieldName = enumInfo.Fields.ElementAt(i).fieldName;
//                    if ((enumInfo.Name == "CutsceneActorType") || (enumInfo.Name == "DSJetpackMovementMode") || (enumInfo.Name == "AIPathLinkDirection"))
//                    {
//                        fieldName = $"{fieldName}_";
//                    }

//                    enumLines.Add($"    {fieldName}{end} //0x{i.ToString("X4")}");
//                }

//                enumLines.Add("};");
//                enumLines.Add("");
//            }

//            if (!forIDA)
//            {
//                enumLines.Add("}");
//            }

//            // sort structs for dependencies
//            int infoCount = 0;
//            while (infoCount < structList.Count)
//            {
//                var item = structList.ElementAt(infoCount);

//                foreach (SDKFieldEntry field in item.Fields)
//                {
//                    var fieldIndex = 0;
//                    var fieldTypeName = field.fieldType;

//                    if (fieldTypeName.Contains("-Array"))
//                    {
//                        fieldTypeName = field.fieldType.Substring(0, field.fieldType.Length - 6);
//                    }

//                    if ((field.fieldBasicType == BasicTypesEnum.kTypeCode_ValueType)
//                        || (field.fieldBasicType == BasicTypesEnum.kTypeCode_Array))
//                    {
//                        foreach (SDKValueTypeInfo fieldInfo in structList)
//                        {
//                            if (fieldInfo.Name == fieldTypeName)
//                            {
//                                fieldIndex = structList.IndexOf(fieldInfo);
//                            }
//                        }

//                        if (fieldIndex != 0)
//                        {
//                            var itemIndex = structList.IndexOf(item);

//                            // if we find the field item lower than the owning type, drop the owning type below it
//                            if (fieldIndex > itemIndex)
//                            {
//                                var tempInfo = structList.ElementAt(itemIndex);
//                                structList.RemoveAt(itemIndex);
//                                structList.Insert(fieldIndex, tempInfo);

//                                // start the list again
//                                infoCount = 0;
//                                break;
//                            }
//                        }
//                    }
//                }

//                ++infoCount;
//            }

//            var structLines = new List<string>();

//            if (!forIDA)
//            {
//                structLines.Add("#pragma once");
//                structLines.Add("");
//                structLines.Add("namespace fb");
//                structLines.Add("{");
//            }

//            foreach (SDKValueTypeInfo structInfo in structList)
//            {
//                structLines.Add("////////////////////////////////////////");
//                structLines.Add($"// Runtime Id : {structInfo.RuntimeId}");
//                structLines.Add($"// TypeInfo : 0x{structInfo.ThisTypeInfo.ToString("X9")}");

//                structLines.Add($"struct {structInfo.Name}");

//                structLines.Add("{");

//                for (int i = 0; i < structInfo.FieldCount; i++)
//                {
//                    var fieldType = structInfo.Fields.ElementAt(i).fieldType;
//                    var postfix = "";

//                    if (fieldType.Contains("-Array"))
//                    {
//                        fieldType = fieldType.Substring(0, fieldType.Length - 6);
//                    }

//                    fieldType = FixTypeName(fieldType);

//                    if ((structInfo.Fields.ElementAt(i).fieldBasicType == BasicTypesEnum.kTypeCode_Class) && (fieldType != "float"))
//                    {
//                        postfix = "*";
//                    }

//                    if (structInfo.Fields.ElementAt(i).fieldBasicType == BasicTypesEnum.kTypeCode_Array)
//                    {
//                        if (forIDA)
//                        {
//                            postfix = "*";
//                        }
//                        else
//                        {
//                            fieldType = $"Array<{fieldType}>";
//                        }
//                    }

//                    structLines.Add($"    {fieldType}{postfix} {structInfo.Fields.ElementAt(i).fieldName}; //0x{structInfo.Fields.ElementAt(i).fieldOffset.ToString("X4")}");
//                }

//                structLines.Add("};");
//                structLines.Add("");
//            }

//            if (!forIDA)
//            {
//                structLines.Add("}");
//            }

//            // sort by classid
//            classList = classList.OrderBy(x => x.ClassId).ToList();

//            var nameLines = new List<string>
//            {
//                "from idautils import *",
//                "from idc import *",
//                "from idaapi import *",
//                "",
//                "def MakeNames():",
//                "    startEa = SegByBase(SegByName(\"HEADER\"))",
//                "    imageend = 0",
//                "",
//                "    for ea in Segments():",
//                "        imageend = SegEnd(ea)",
//                ""
//            };
//            var classLines = new List<string>();

//            if (!forIDA)
//            {
//                classLines.Add("#pragma once");
//                classLines.Add("");
//                classLines.Add("namespace fb");
//                classLines.Add("{");
//            }

//            var declarationLines = new List<string>();

//            if (!forIDA)
//            {
//                declarationLines.Add("#pragma once");
//                declarationLines.Add("");
//                declarationLines.Add("namespace fb");
//                declarationLines.Add("{");
//            }

//            foreach (SDKClassInfo classInfo in classList)
//            {
//                classLines.Add("////////////////////////////////////////");
//                classLines.Add($"// Class Id : {classInfo.ClassId}");
//                classLines.Add($"// Runtime Id : {classInfo.RuntimeId}");
//                classLines.Add($"// TypeInfo : 0x{classInfo.ThisTypeInfo.ToString("X9")}");
//                classLines.Add($"// Default Instance : 0x{classInfo.DefaultInstance.ToString("X9")}");
//                classLines.Add($"// Vtable : 0x{classInfo.VTable.ToString("X9")}");

//                classLines.Add($"#ifndef _{classInfo.Name}_");
//                classLines.Add($"#define _{classInfo.Name}_");

//                if ((classInfo.ParentClassName != classInfo.Name) && (classInfo.ParentClassName != ""))
//                {
//                    classLines.Add($"class {classInfo.Name} : {classInfo.ParentClassName}");
//                }
//                else
//                {
//                    classLines.Add($"class {classInfo.Name}");
//                }

//                classLines.Add("{");

//                if (classInfo.FieldCount > 0)
//                {
//                    classLines.Add("public:");
//                }

//                for (int i = 0; i < classInfo.FieldCount; i++)
//                {
//                    var fieldType = classInfo.Fields.ElementAt(i).fieldType;
//                    var postfix = "";

//                    if (fieldType.Contains("-Array"))
//                    {
//                        fieldType = fieldType.Substring(0, fieldType.Length - 6);
//                    }

//                    fieldType = FixTypeName(fieldType);

//                    if ((classInfo.Fields.ElementAt(i).fieldBasicType == BasicTypesEnum.kTypeCode_Class) && (fieldType != "float"))
//                    {
//                        postfix = "*";
//                    }

//                    if (classInfo.Fields.ElementAt(i).fieldBasicType == BasicTypesEnum.kTypeCode_Array)
//                    {
//                        if (forIDA)
//                        {
//                            postfix = "*";
//                        }
//                        else
//                        {
//                            fieldType = $"Array<{fieldType}>";
//                        }
//                    }

//                    classLines.Add($"    {fieldType}{postfix} {classInfo.Fields.ElementAt(i).fieldName}; //0x{classInfo.Fields.ElementAt(i).fieldOffset.ToString("X4")}");
//                }

//                classLines.Add("};");
//                classLines.Add($"//0x{classInfo.TotalSize.ToString("X4")}");

//                classLines.Add($"#endif");

//                classLines.Add("");

//                declarationLines.Add($"class {classInfo.Name};");

//                // idapython stuff
//                /*
//                 * Python>MakeNames()
//14356C140: can't rename byte as 'PlayerAbilityWeaponInfoEntityData_vtbl' because this byte can't have a name (it is a tail byte).
//14356C178: can't rename byte as 'PlayerAbilityWeaponUpgradeInfoEntityData_vtbl' because this byte can't have a name (it is a tail byte).
//1413481DC: can't rename byte as 'ClientWheelComponent_vtbl' because this byte can't have a name (it is a tail byte).
//141948644: can't rename byte as 'ServerVehicleHealthComponent_vtbl' because this byte can't have a name (it is a tail byte).
//                 */
//                if (classInfo.GetTypeFunction != IntPtr.Zero)
//                {
//                    nameLines.Add($"    MakeName(0x{classInfo.GetTypeFunction.ToString("X9")}, \"{classInfo.Name}_GetType\")");
//                }

//                if (classInfo.VTable != IntPtr.Zero)
//                {
//                    nameLines.Add($"    MakeName(0x{classInfo.VTable.ToString("X9")}, \"{classInfo.Name}_vtbl\")");
//                }
//            }

//            if (!forIDA)
//            {
//                classLines.Add("}");
//            }

//            if (!forIDA)
//            {
//                declarationLines.Add("}");
//            }

//            System.IO.File.WriteAllLines(@".\Enums.h", enumLines);
//            System.IO.File.WriteAllLines(@".\Structs.h", structLines);
//            System.IO.File.WriteAllLines(@".\Declarations.h", declarationLines);
//            System.IO.File.WriteAllLines(@".\Classes.h", classLines);
//            System.IO.File.WriteAllLines(@".\MakeNames.py", nameLines);

//            // c++ import header
//            var cppImportLines = new List<string>
//            {
//                "#pragma once",
//                "",
//                "namespace fb {",
//                "    struct Guid",
//                "    {",
//                "        unsigned long	m_Data1;	//0x0000",
//                "        unsigned short	m_Data2;	//0x0004",
//                "        unsigned short	m_Data3;	//0x0006",
//                "        unsigned char	m_Data4[8];	//0x0008",
//                "    };",
//                "    //Size=0x0010",
//                "",
//                "    typedef __m128 BoxedValueRef;",
//                "    typedef uint64_t ResourceRef;",
//                "    typedef uint64_t TypeRef;",
//                "    typedef uint64_t FileRef;",
//                "",
//                "    typedef struct",
//                "    {",
//                "     char pad[0x14];",
//                "    } SHA1;",
//                "    //Size=0x0014",
//                "",
//                "    template <typename T>",
//                "    class Array",
//                "    {",
//                "    private:",
//                "      T* m_firstElement;",
//                "",
//                "    public:",
//                "        T At(INT nIndex)",
//                "        {",
//                "            if (m_firstElement == NULL)",
//                "                return *(T*)((UINT64)NULL);",
//                "",
//                "            return *(T*)((UINT64)m_firstElement + (nIndex * sizeof(T)));",
//                "         };",
//                "",
//                "         T operator [](INT index) { return At(index); }",
//                "    };",
//                "",
//                "    #include \"Declarations.h\"",
//                "    #include \"Enums.h\"",
//                "    #include \"Structs.h\"",
//                "    #include \"Classes.h\"",
//                "",
//            };

//            // IDA import header
//            var idaImportLines = new List<string>
//            {
//                "from idautils import *",
//                "from idc import *",
//                "from idaapi import *",
//                "",
//                "def MakeNames():",
//                "    startEa = SegByBase(SegByName(\"HEADER\"))",
//                "    imageend = 0",
//                "",
//                "    for ea in Segments():",
//                "        imageend = SegEnd(ea)",
//                ""
//            };

            Console.WriteLine($"Found {count} TypeInfo entries.");
            Console.WriteLine($"Found {classcount} ClassInfo entries.");
            Console.WriteLine($"Found {structcount} ValueTypeInfo entries.");
            Console.WriteLine($"Found {enumcount} EnumFieldInfo entries.");

            Console.WriteLine("Done. Press a key to quit.");

            remoteProcess.CloseProcessMemory();

            Console.ReadLine();
        }
示例#3
0
        public SDKClassInfo(IntPtr address, RemoteProcess remoteProcess, PEImageBuffer peImageBuffer)
        {
            ClassInfo     typeInfo     = remoteProcess.Read <ClassInfo>(address);
            ClassInfoData typeInfoData = remoteProcess.Read <ClassInfoData>(typeInfo.m_InfoData);

            Name         = $"{remoteProcess.ReadString(typeInfoData.m_Name, 255)}";
            ThisTypeInfo = address;
            Type         = typeInfoData.GetNewEntryType();
            Flags        = typeInfoData.m_Flags;
            Alignment    = typeInfoData.m_Alignment;
            TotalSize    = typeInfoData.m_TotalSize;
            FieldCount   = typeInfoData.m_FieldCount;
            ParentClass  = typeInfoData.m_SuperClass;
            var superClassInfo = new SDKTypeInfo(ParentClass, remoteProcess);

            ParentClassName = $"{superClassInfo.Name}";

            // debug
            if (Name == "PoseTrackKeyframe")
            {
                Name = Name;
            }
            // end debug

            // fill fields list
            if (FieldCount == 0)
            {
                if ((ParentClass != IntPtr.Zero) && (TotalSize > superClassInfo.TotalSize))
                {
                    SDKFieldEntry fieldEntry;

                    fieldEntry.fieldType         = "char";
                    fieldEntry.fieldInternalType = "Uint8";
                    fieldEntry.fieldBasicType    = BasicTypesEnum.kTypeCode_Uint8;
                    fieldEntry.fieldName         = $"_0x{superClassInfo.TotalSize.ToString("X4")}[{TotalSize - superClassInfo.TotalSize}]";
                    fieldEntry.fieldOffset       = superClassInfo.TotalSize;
                    fieldEntry.fieldSize         = TotalSize - superClassInfo.TotalSize;
                    fieldEntry.lastFieldOffset   = 0;
                    fieldEntry.lastFieldSize     = 0;

                    Fields.Add(fieldEntry);

                    FieldCount++;
                }
                else if ((ParentClass == IntPtr.Zero) || (Name == ParentClassName))
                {
                    // reference oddity for (Name == ParentClassName) fb::IglooSubsystem : has itself as parent, 0 fields
                    SDKFieldEntry fieldEntry;

                    fieldEntry.fieldType         = "char";
                    fieldEntry.fieldInternalType = "Uint8";
                    fieldEntry.fieldBasicType    = BasicTypesEnum.kTypeCode_Uint8;
                    fieldEntry.fieldName         = $"_0x000[{TotalSize}]";
                    fieldEntry.fieldOffset       = 0;
                    fieldEntry.fieldSize         = TotalSize;
                    fieldEntry.lastFieldOffset   = 0;
                    fieldEntry.lastFieldSize     = 0;

                    Fields.Add(fieldEntry);

                    FieldCount++;
                }
            }
            else //if (FieldCount > 0)
            {
                for (int i = 0; i < FieldCount; i++)
                {
                    var fieldInfoData = remoteProcess.Read <FieldInfoData>((IntPtr)((Int64)typeInfoData.m_Fields + (i * 0x18)));

                    SDKFieldEntry fieldEntry;
                    var           fieldTypeInfo = new SDKTypeInfo(fieldInfoData.m_FieldTypePtr, remoteProcess);

                    // fix the odd field type with flags as 0x0000 or 0x2000
                    if ((fieldInfoData.m_Flags == 0) || (fieldInfoData.m_Flags == 0x2000))
                    {
                        fieldEntry.fieldType = fieldTypeInfo.FixTypeName(fieldTypeInfo.Name);
                    }
                    else
                    {
                        fieldEntry.fieldType = fieldTypeInfo.GetCppType(); //fieldTypeInfo.Name;
                    }
                    fieldEntry.fieldInternalType = fieldTypeInfo.Name;
                    fieldEntry.fieldBasicType    = fieldTypeInfo.Type;//fieldInfoData.GetEntryType();

                    fieldEntry.fieldName       = remoteProcess.ReadString(fieldInfoData.m_Name, 255);
                    fieldEntry.fieldOffset     = fieldInfoData.m_FieldOffset;
                    fieldEntry.fieldSize       = fieldTypeInfo.TotalSize;
                    fieldEntry.lastFieldOffset = lastFieldOffset;
                    fieldEntry.lastFieldSize   = lastFieldSize;

                    // fix error with some bools being flagged as int16_t
                    if ((fieldEntry.fieldType == "int16_t") && (fieldEntry.fieldSize == 1))
                    {
                        fieldEntry.fieldType         = "bool";
                        fieldEntry.fieldInternalType = "Boolean";
                        fieldEntry.fieldBasicType    = BasicTypesEnum.kTypeCode_Boolean;
                    }


                    Fields.Add(fieldEntry);

                    lastFieldOffset = fieldEntry.fieldOffset;
                    lastFieldSize   = fieldTypeInfo.TotalSize;
                }

                // the field array isn't sorted in offset order so fix that
                Fields = Fields.OrderBy(x => x.fieldOffset).ToList();

                // check if pads needed
                for (int i = 1; i < FieldCount; i++)
                {
                    lastFieldOffset = Fields.ElementAt(i - 1).fieldOffset;
                    lastFieldSize   = Fields.ElementAt(i - 1).fieldSize;

                    SDKFieldEntry fieldEntry;
                    fieldEntry = Fields.ElementAt(i);

                    fieldEntry.lastFieldOffset = lastFieldOffset;
                    fieldEntry.lastFieldSize   = lastFieldSize;

                    Fields[i] = fieldEntry;
                }

                for (int i = 0; i < FieldCount; i++)
                {
                    SDKFieldEntry fieldEntry;

                    if (i == (FieldCount - 1))
                    {
                        // last class member so check against total size
                        if (TotalSize > (Fields.ElementAt(i).fieldOffset + Fields.ElementAt(i).fieldSize))
                        {
                            fieldEntry.fieldType         = "char";
                            fieldEntry.fieldInternalType = "Uint8";
                            fieldEntry.fieldBasicType    = BasicTypesEnum.kTypeCode_Uint8;
                            fieldEntry.fieldName         = $"_0x{(Fields.ElementAt(i).fieldOffset + Fields.ElementAt(i).fieldSize).ToString("X4")}[{TotalSize - (Fields.ElementAt(i).fieldOffset + Fields.ElementAt(i).fieldSize)}]";
                            fieldEntry.fieldOffset       = Fields.ElementAt(i).fieldOffset + Fields.ElementAt(i).fieldSize;
                            fieldEntry.fieldSize         = TotalSize - (Fields.ElementAt(i).fieldOffset + Fields.ElementAt(i).fieldSize);
                            fieldEntry.lastFieldOffset   = Fields.ElementAt(i).fieldOffset;
                            fieldEntry.lastFieldSize     = Fields.ElementAt(i).fieldSize;

                            Fields.Add(fieldEntry);

                            FieldCount++;
                        }
                    }

                    if ((i == 0) && (ParentClass != IntPtr.Zero))
                    {
                        // first class member so check against parent size
                        if (superClassInfo.TotalSize < Fields.ElementAt(i).fieldOffset)
                        {
                            var debug = Fields.ElementAt(i).fieldOffset;
                            fieldEntry.fieldType         = "char";
                            fieldEntry.fieldInternalType = "Uint8";
                            fieldEntry.fieldBasicType    = BasicTypesEnum.kTypeCode_Uint8;
                            fieldEntry.fieldName         = $"_0x{superClassInfo.TotalSize.ToString("X4")}[{Fields.ElementAt(i).fieldOffset - superClassInfo.TotalSize}]";
                            fieldEntry.fieldOffset       = superClassInfo.TotalSize;
                            fieldEntry.fieldSize         = Fields.ElementAt(i).fieldOffset - superClassInfo.TotalSize;
                            fieldEntry.lastFieldOffset   = 0; // superClassInfo.TotalSize;
                            fieldEntry.lastFieldSize     = superClassInfo.TotalSize;

                            Fields.Insert(0, fieldEntry);

                            i++;
                            FieldCount++;
                        }
                    }
                    else
                    {
                        // inter-field pads. seems to be correct now :)
                        if (Fields.ElementAt(i).fieldOffset > (Fields.ElementAt(i).lastFieldOffset + Fields.ElementAt(i).lastFieldSize))
                        {
                            fieldEntry.fieldType         = "char";
                            fieldEntry.fieldInternalType = "Uint8";
                            fieldEntry.fieldBasicType    = BasicTypesEnum.kTypeCode_Uint8;
                            fieldEntry.fieldName         = $"_0x{(Fields.ElementAt(i).lastFieldOffset + Fields.ElementAt(i).lastFieldSize).ToString("X4")}[{Fields.ElementAt(i).fieldOffset - (Fields.ElementAt(i).lastFieldOffset + Fields.ElementAt(i).lastFieldSize)}]";
                            fieldEntry.fieldOffset       = Fields.ElementAt(i).lastFieldOffset + Fields.ElementAt(i).lastFieldSize;
                            fieldEntry.fieldSize         = Fields.ElementAt(i).fieldOffset - (Fields.ElementAt(i).lastFieldOffset + Fields.ElementAt(i).lastFieldSize);
                            fieldEntry.lastFieldOffset   = Fields.ElementAt(i).fieldOffset;
                            fieldEntry.lastFieldSize     = Fields.ElementAt(i).fieldSize;

                            Fields.Insert(i, fieldEntry);

                            i++;
                            FieldCount++;
                        }
                    }
                }
            }

            RuntimeId       = typeInfo.m_RuntimeId;
            Next            = typeInfo.m_Next;
            DefaultInstance = typeInfo.m_DefaultInstance;
            ClassId         = typeInfo.m_ClassId;
            GetVtable(remoteProcess, peImageBuffer);
        }