C# Класс BolterV2.SigScan

Показать файл Открыть проект Примеры использования класса

Открытые методы

Метод	Описание
FindPattern ( byte btPattern, string strMask, int nOffset ) : IntPtr	FindPattern Attempts to locate the given pattern inside the dumped memory region compared against the given mask. If the pattern is found, the offset is added to the located address and returned to the user.
ResetRegion ( ) : void	ResetRegion Resets the memory dump array to nothing to allow the class to redump the memory.
SigScan ( ) : System	SigScan Main class constructor that uses no params. Simply initializes the class properties and expects the user to set them later.
SigScan ( Process proc, IntPtr addr, int size ) : System	SigScan Overloaded class constructor that sets the class properties during construction.

Приватные методы

Метод	Описание
DumpMemory ( ) : bool	DumpMemory Internal memory dump function that uses the set class properties to dump a memory region.
MaskCheck ( int nOffset, byte btPattern, string strMask ) : bool	MaskCheck Compares the current pattern byte to the current memory dump byte to check for a match. Uses wildcards to skip bytes that are deemed unneeded in the compares.
ReadProcessMemory ( IntPtr hProcess, IntPtr lpBaseAddress, [ lpBuffer, int dwSize, int &lpNumberOfBytesRead ) : bool
ReadProcessMemory ( IntPtr hProcess, void lpBaseAddress, void lpBuffer, int dwSize, int &lpNumberOfBytesRead ) : bool
WriteProcessMemory ( IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, uint nSize, UIntPtr lpNumberOfBytesWritten ) : bool

Описание методов

FindPattern() публичный Метод

FindPattern Attempts to locate the given pattern inside the dumped memory region compared against the given mask. If the pattern is found, the offset is added to the located address and returned to the user.

public FindPattern ( byte btPattern, string strMask, int nOffset ) : IntPtr
btPattern	byte	Byte pattern to look for in the dumped region.
strMask	string	The mask string to compare against.
nOffset	int	The offset added to the result address.
Результат	System.IntPtr

ResetRegion() публичный Метод

ResetRegion Resets the memory dump array to nothing to allow the class to redump the memory.

public ResetRegion ( ) : void
Результат	void

SigScan() публичный Метод

SigScan Main class constructor that uses no params. Simply initializes the class properties and expects the user to set them later.

public SigScan ( ) : System
Результат	System

SigScan() публичный Метод

SigScan Overloaded class constructor that sets the class properties during construction.

public SigScan ( Process proc, IntPtr addr, int size ) : System
proc	System.Diagnostics.Process	The process to dump the memory from.
addr	System.IntPtr	The started address to begin the dump.
size	int	The size of the dump.
Результат	System