Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using System;
- using System.Linq;
- using Process.NET.Modules;
- using Process.NET.Patterns;
- namespace re5gir489
- {
- class PatternScanner : IPatternScanner
- {
- private readonly IProcessModule _module;
- private int _offsetFromBaseAddress = 0;
- public PatternScanner(IProcessModule module)
- {
- _module = module;
- Data = module.Read(0, _module.Size);
- }
- public PatternScanner(IProcessModule module, int offset)
- {
- _module = module;
- _offsetFromBaseAddress = offset;
- Data = module.Read(offset, _module.Size - offset);
- }
- public byte[] Data { get; set; }
- public PatternScanResult Find(IMemoryPattern pattern)
- {
- return pattern.PatternType == MemoryPatternType.Function
- ? FindFunctionPattern(pattern)
- : FindDataPattern(pattern);
- }
- private PatternScanResult FindFunctionPattern(IMemoryPattern pattern)
- {
- var patternData = Data;
- var patternDataLength = patternData.Length;
- for (var offset = 0; offset < patternDataLength; offset++)
- {
- if (
- pattern.GetMask()
- .Where((m, b) => m == 'x' && pattern.GetBytes()[b] != patternData[b + offset])
- .Any())
- continue;
- return new PatternScanResult
- {
- BaseAddress = _module.BaseAddress + offset + _offsetFromBaseAddress,
- ReadAddress = _module.BaseAddress + offset + _offsetFromBaseAddress,
- Offset = offset,
- Found = true
- };
- }
- return new PatternScanResult
- {
- BaseAddress = IntPtr.Zero,
- ReadAddress = IntPtr.Zero,
- Offset = 0,
- Found = false
- };
- }
- private PatternScanResult FindDataPattern(IMemoryPattern pattern)
- {
- var patternData = Data;
- var patternBytes = pattern.GetBytes();
- var patternMask = pattern.GetMask();
- var result = new PatternScanResult();
- for (var offset = 0; offset < patternData.Length; offset++)
- {
- if (patternMask.Where((m, b) => m == 'x' && patternBytes[b] != patternData[b + offset]).Any())
- continue;
- // If this area is reached, the pattern has been found.
- result.Found = true;
- result.ReadAddress = _module.Read<IntPtr>(offset + pattern.Offset + _offsetFromBaseAddress);
- result.BaseAddress = new IntPtr(result.ReadAddress.ToInt64() - _module.BaseAddress.ToInt64());
- result.Offset = offset;
- return result;
- }
- // If this is reached, the pattern was not found.
- result.Found = false;
- result.Offset = 0;
- result.ReadAddress = IntPtr.Zero;
- result.BaseAddress = IntPtr.Zero;
- return result;
- }
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement