Advertisement
Guest User

Untitled

a guest
Feb 5th, 2017
152
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 3.45 KB | None | 0 0
  1. using System;
  2. using System.Linq;
  3. using Process.NET.Modules;
  4. using Process.NET.Patterns;
  5.  
  6. namespace re7gir489
  7. {
  8.     class AtomosProcessDotNetScannerImpl  : IPatternScanner
  9.     {
  10.         private readonly IProcessModule _module;
  11.  
  12.         public AtomosProcessDotNetScannerImpl(IProcessModule module)
  13.         {
  14.             _module = module;
  15.             Data = module.Read(0, _module.Size);
  16.         }
  17.  
  18.         public byte[] Data { get; set; }
  19.  
  20.         public PatternScanResult Find(IMemoryPattern pattern)
  21.         {
  22.             return pattern.PatternType == MemoryPatternType.Function
  23.                 ? FindFunctionPattern(pattern)
  24.                 : FindDataPattern(pattern);
  25.         }
  26.         private bool MaskCheck(int nOffset, byte[] btPattern, string strMask)
  27.         {
  28.             // Loop the pattern and compare to the mask and dump.
  29.             for (int x = 0; x < btPattern.Length; x++)
  30.             {
  31.                 // If the mask char is a wildcard, just continue.
  32.                 if (strMask[x] == '?')
  33.                     continue;
  34.  
  35.                 // If the mask char is not a wildcard, ensure a match is made in the pattern.
  36.                 if ((strMask[x] == 'x') && (btPattern[x] != this.Data[nOffset + x]))
  37.                     return false;
  38.             }
  39.  
  40.             // The loop was successful so we found the pattern.
  41.             return true;
  42.         }
  43.  
  44.         private PatternScanResult FindFunctionPattern(IMemoryPattern pattern)
  45.         {
  46.             var patternData = Data;
  47.             var patternDataLength = patternData.Length;
  48.  
  49.             for (var offset = 0; offset < patternDataLength; offset++)
  50.             {
  51.                 if (MaskCheck(offset, pattern.GetBytes().ToArray(), pattern.GetMask()) == false)
  52.                     continue;
  53.  
  54.                 return new PatternScanResult
  55.                 {
  56.                     BaseAddress = _module.BaseAddress + offset,
  57.                     ReadAddress = _module.BaseAddress + offset,
  58.                     Offset = offset,
  59.                     Found = true
  60.                 };
  61.             }
  62.             return new PatternScanResult
  63.             {
  64.                 BaseAddress = IntPtr.Zero,
  65.                 ReadAddress = IntPtr.Zero,
  66.                 Offset = 0,
  67.                 Found = false
  68.             };
  69.         }
  70.  
  71.         private PatternScanResult FindDataPattern(IMemoryPattern pattern)
  72.         {
  73.             var patternData = Data;
  74.             var patternBytes = pattern.GetBytes();
  75.             var patternMask = pattern.GetMask();
  76.  
  77.             var result = new PatternScanResult();
  78.  
  79.             for (var offset = 0; offset < patternData.Length; offset++)
  80.             {
  81.                 if (patternMask.Where((m, b) => m == 'x' && patternBytes[b] != patternData[b + offset]).Any())
  82.                     continue;
  83.                 // If this area is reached, the pattern has been found.
  84.                 result.Found = true;
  85.                 result.ReadAddress = _module.Read<IntPtr>(offset + pattern.Offset);
  86.                 result.BaseAddress = new IntPtr(result.ReadAddress.ToInt64() - _module.BaseAddress.ToInt64());
  87.                 result.Offset = offset;
  88.                 return result;
  89.             }
  90.             // If this is reached, the pattern was not found.
  91.             result.Found = false;
  92.             result.Offset = 0;
  93.             result.ReadAddress = IntPtr.Zero;
  94.             result.BaseAddress = IntPtr.Zero;
  95.             return result;
  96.         }
  97.     }
  98. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement