Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using System;
- using System.Linq;
- using Process.NET.Modules;
- using Process.NET.Patterns;
- namespace re7gir489
- {
- class AtomosProcessDotNetScannerImpl : IPatternScanner
- {
- private readonly IProcessModule _module;
- public AtomosProcessDotNetScannerImpl(IProcessModule module)
- {
- _module = module;
- Data = module.Read(0, _module.Size);
- }
- public byte[] Data { get; set; }
- public PatternScanResult Find(IMemoryPattern pattern)
- {
- return pattern.PatternType == MemoryPatternType.Function
- ? FindFunctionPattern(pattern)
- : FindDataPattern(pattern);
- }
- private bool MaskCheck(int nOffset, byte[] btPattern, string strMask)
- {
- // Loop the pattern and compare to the mask and dump.
- for (int x = 0; x < btPattern.Length; x++)
- {
- // If the mask char is a wildcard, just continue.
- if (strMask[x] == '?')
- continue;
- // If the mask char is not a wildcard, ensure a match is made in the pattern.
- if ((strMask[x] == 'x') && (btPattern[x] != this.Data[nOffset + x]))
- return false;
- }
- // The loop was successful so we found the pattern.
- return true;
- }
- private PatternScanResult FindFunctionPattern(IMemoryPattern pattern)
- {
- var patternData = Data;
- var patternDataLength = patternData.Length;
- for (var offset = 0; offset < patternDataLength; offset++)
- {
- if (MaskCheck(offset, pattern.GetBytes().ToArray(), pattern.GetMask()) == false)
- continue;
- return new PatternScanResult
- {
- BaseAddress = _module.BaseAddress + offset,
- ReadAddress = _module.BaseAddress + offset,
- Offset = offset,
- Found = true
- };
- }
- return new PatternScanResult
- {
- BaseAddress = IntPtr.Zero,
- ReadAddress = IntPtr.Zero,
- Offset = 0,
- Found = false
- };
- }
- private PatternScanResult FindDataPattern(IMemoryPattern pattern)
- {
- var patternData = Data;
- var patternBytes = pattern.GetBytes();
- var patternMask = pattern.GetMask();
- var result = new PatternScanResult();
- for (var offset = 0; offset < patternData.Length; offset++)
- {
- if (patternMask.Where((m, b) => m == 'x' && patternBytes[b] != patternData[b + offset]).Any())
- continue;
- // If this area is reached, the pattern has been found.
- result.Found = true;
- result.ReadAddress = _module.Read<IntPtr>(offset + pattern.Offset);
- result.BaseAddress = new IntPtr(result.ReadAddress.ToInt64() - _module.BaseAddress.ToInt64());
- result.Offset = offset;
- return result;
- }
- // If this is reached, the pattern was not found.
- result.Found = false;
- result.Offset = 0;
- result.ReadAddress = IntPtr.Zero;
- result.BaseAddress = IntPtr.Zero;
- return result;
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement