Repository navigation
Expand file tree
/
Copy pathPatternScanner.cs
More file actions
91 lines (80 loc) · 3.26 KB
/
Copy pathPatternScanner.cs
File metadata and controls
91 lines (80 loc) · 3.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
using System;
using System.Linq;
using Process.NET.Modules;
using Process.NET.Utilities;
namespace Process.NET.Patterns
{
public class PatternScanner : IPatternScanner
{
private readonly IProcessModule _module;
private readonly int _offsetFromBaseAddress;
private static readonly PatternScanResult EmptyPatternScanResult = new PatternScanResult
{
BaseAddress = IntPtr.Zero,
ReadAddress = IntPtr.Zero,
Offset = 0,
Found = false
};
public PatternScanner(IProcessModule module) : this(module, 0) { }
public PatternScanner(IProcessModule module, int offsetFromBaseAddress)
{
_module = module;
_offsetFromBaseAddress = offsetFromBaseAddress;
Data = module.Read(_offsetFromBaseAddress, _module.Size - _offsetFromBaseAddress);
}
public byte[] Data { get; }
public PatternScanResult Find(IMemoryPattern pattern)
{
switch(pattern.PatternType)
{
case MemoryPatternType.Function:
return FindFunctionPattern(pattern);
case MemoryPatternType.Data:
return FindDataPattern(pattern);
}
throw new NotImplementedException("PatternScanner encountered an unknown MemoryPatternType: " + pattern.PatternType + ".");
}
private int GetOffset(IMemoryPattern pattern)
{
switch(pattern.Algorithm)
{
case PatternScannerAlgorithm.BoyerMooreHorspool:
return Utilities.BoyerMooreHorspool.IndexOf(Data, pattern.GetBytes().ToArray());
case PatternScannerAlgorithm.Naive:
return Utilities.Naive.GetIndexOf(pattern, Data, _module);
}
throw new NotImplementedException("GetOffset encountered an unknown PatternScannerAlgorithm: " + pattern.Algorithm + ".");
}
private PatternScanResult FindFunctionPattern(IMemoryPattern pattern)
{
var offset = GetOffset(pattern);
if (offset != -1)
{
return new PatternScanResult
{
BaseAddress = _module.BaseAddress + offset + _offsetFromBaseAddress,
ReadAddress = _module.BaseAddress + offset + _offsetFromBaseAddress,
Offset = offset + _offsetFromBaseAddress,
Found = true
};
}
return EmptyPatternScanResult;
}
private PatternScanResult FindDataPattern(IMemoryPattern pattern)
{
var result = new PatternScanResult();
var offset = GetOffset(pattern);
if ( offset != -1)
{
// If this area is reached, the pattern has been found.
result.Found = true;
result.ReadAddress = _module.Read<IntPtr>(offset + pattern.Offset);
result.BaseAddress = new IntPtr(result.ReadAddress.ToInt64() - _module.BaseAddress.ToInt64());
result.Offset = offset;
return result;
}
// If this is reached, the pattern was not found.
return EmptyPatternScanResult;
}
}
}