Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import pymem
- class SCMemory(pymem.Pymem):
- pClassLoader = 0
- JavaClassArray = 0
- def GetClassLoaderAndArray(self):
- mov_rax_qword_737FC700 = self.PatternScan("jvm.dll", "48 8B 05 ?? ?? ?? ?? 48 85 C0 74 ?? 48 8B 50 ?? 48 85 D2")
- self.pClassLoader = self.GetAbsoluteAddress(mov_rax_qword_737FC700, 3, 7)
- self.JavaClassArray = self.read_ulonglong(self.pClassLoader + 0x28)
- def GetAbsoluteAddress(self, ptr: int, offset: int, size: int) -> int:
- return ptr + self.read_int(ptr + offset) + size
- def PatternScan(self, module_name, pattern) -> int:
- module = pymem.process.module_from_name(self.process_handle, module_name)
- pattern_bytes_str = ""
- for byte in pattern.split(" "):
- if byte == "?" or byte == "??":
- pattern_bytes_str += "."
- else:
- pattern_bytes_str += "\\x" + byte
- pattern_bytes = bytes(pattern_bytes_str, "utf-8")
- value = pymem.pattern.pattern_scan_module(self.process_handle, module, pattern_bytes)
- if value is None:
- value = 0
- return value
- def FindJavaClassInstance(self, query):
- klass = sc.read_ulonglong(self.JavaClassArray + 0x30) # first klass
- while klass:
- klass_symbol = sc.read_ulonglong(klass + 0x58)
- klass_name = sc.read_string(klass_symbol + 0x6, sc.read_short(klass_symbol)) # short - string len
- if klass_name == query:
- return klass
- klass = sc.read_ulonglong(klass + 0x78) # next class
- def FindClassInstance(self, query):
- klass = sc.read_ulonglong(sc.read_ulonglong(self.pClassLoader) + 0x30) # first klass
- while klass:
- klass_symbol = sc.read_ulonglong(klass + 0x58)
- klass_name = sc.read_string(klass_symbol + 0x6, sc.read_short(klass_symbol)) # short - string len
- if klass_name == query:
- return klass
- klass = sc.read_ulonglong(klass + 0x78) # next class
- sc = SCMemory("stalcraftw.exe")
- sc.GetClassLoaderAndArray()
- fl = open("dmp.txt", "w")
- #Java Classes
- klass = sc.read_ulonglong(sc.JavaClassArray + 0x30) # first klass
- while klass:
- klass_symbol = sc.read_ulonglong(klass + 0x58)
- klass_name = sc.read_string(klass_symbol + 0x6, sc.read_short(klass_symbol)) # short - string len
- print(klass_name)
- fl.write(klass_name + "\n")
- klass = sc.read_ulonglong(klass + 0x78)
- #Other classes
- klass = sc.read_ulonglong(sc.read_ulonglong(sc.pClassLoader) + 0x30)
- while klass:
- klass_symbol = sc.read_ulonglong(klass + 0x58)
- klass_name = sc.read_string(klass_symbol + 0x6, sc.read_short(klass_symbol))
- print(klass_name)
- fl.write(klass_name + "\n")
- klass = sc.read_ulonglong(klass + 0x78)
Advertisement
Advertisement