Advertisement
Guest User

Untitled

a guest
Feb 6th, 2017
195
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C# 3.17 KB | None | 0 0
  1. using System;
  2. using System.Linq;
  3. using Process.NET.Modules;
  4. using Process.NET.Patterns;
  5.  
  6. namespace re5gir489
  7. {
  8.     class PatternScanner : IPatternScanner
  9.     {
  10.         private readonly IProcessModule _module;
  11.         private int _offsetFromBaseAddress = 0;
  12.  
  13.         public PatternScanner(IProcessModule module)
  14.         {
  15.             _module = module;
  16.             Data = module.Read(0, _module.Size);
  17.         }
  18.  
  19.         public PatternScanner(IProcessModule module, int offset)
  20.         {
  21.             _module = module;
  22.             _offsetFromBaseAddress = offset;
  23.             Data = module.Read(offset, _module.Size - offset);
  24.         }
  25.  
  26.         public byte[] Data { get; set; }
  27.  
  28.         public PatternScanResult Find(IMemoryPattern pattern)
  29.         {
  30.             return pattern.PatternType == MemoryPatternType.Function
  31.                 ? FindFunctionPattern(pattern)
  32.                 : FindDataPattern(pattern);
  33.         }
  34.  
  35.         private PatternScanResult FindFunctionPattern(IMemoryPattern pattern)
  36.         {
  37.             var patternData = Data;
  38.             var patternDataLength = patternData.Length;
  39.  
  40.             for (var offset = 0; offset < patternDataLength; offset++)
  41.             {
  42.                 if (
  43.                     pattern.GetMask()
  44.                         .Where((m, b) => m == 'x' && pattern.GetBytes()[b] != patternData[b + offset])
  45.                         .Any())
  46.                     continue;
  47.  
  48.                 return new PatternScanResult
  49.                 {
  50.                     BaseAddress = _module.BaseAddress + offset + _offsetFromBaseAddress,
  51.                     ReadAddress = _module.BaseAddress + offset + _offsetFromBaseAddress,
  52.                     Offset = offset,
  53.                     Found = true
  54.                 };
  55.             }
  56.             return new PatternScanResult
  57.             {
  58.                 BaseAddress = IntPtr.Zero,
  59.                 ReadAddress = IntPtr.Zero,
  60.                 Offset = 0,
  61.                 Found = false
  62.             };
  63.         }
  64.  
  65.         private PatternScanResult FindDataPattern(IMemoryPattern pattern)
  66.         {
  67.             var patternData = Data;
  68.             var patternBytes = pattern.GetBytes();
  69.             var patternMask = pattern.GetMask();
  70.  
  71.             var result = new PatternScanResult();
  72.  
  73.             for (var offset = 0; offset < patternData.Length; offset++)
  74.             {
  75.                 if (patternMask.Where((m, b) => m == 'x' && patternBytes[b] != patternData[b + offset]).Any())
  76.                     continue;
  77.                 // If this area is reached, the pattern has been found.
  78.                 result.Found = true;
  79.                 result.ReadAddress = _module.Read<IntPtr>(offset + pattern.Offset + _offsetFromBaseAddress);
  80.                 result.BaseAddress = new IntPtr(result.ReadAddress.ToInt64() - _module.BaseAddress.ToInt64());
  81.                 result.Offset = offset;
  82.                 return result;
  83.             }
  84.             // If this is reached, the pattern was not found.
  85.             result.Found = false;
  86.             result.Offset = 0;
  87.             result.ReadAddress = IntPtr.Zero;
  88.             result.BaseAddress = IntPtr.Zero;
  89.             return result;
  90.         }
  91.     }
  92. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement