forked from IY/apex-internal
/
memory.h
55 lines (41 loc) · 1.42 KB
/
memory.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
#pragma once
#include "global.h"
namespace memory {
inline uintptr_t occurence(const char* module, const char* pattern) {
#define in_range(x, a, b) (x >= a && x <= b)
#define get_bits(x) (in_range((x & (~0x20)), 'A', 'F') ? ((x & (~0x20)) - 'A' + 0xA): (in_range(x, '0', '9') ? x - '0': 0))
#define get_byte(x) (get_bits(x[0]) << 4 | get_bits(x[1]))
MODULEINFO mod;
iat(K32GetModuleInformation).get()(iat(GetCurrentProcess).get()(), iat(GetModuleHandleA).get()(module), &mod, sizeof(MODULEINFO));
uintptr_t start = (uintptr_t)mod.lpBaseOfDll;
uintptr_t end = (uintptr_t)mod.lpBaseOfDll + (uintptr_t)mod.SizeOfImage;
uintptr_t match = 0;
const char* current = pattern;
for (uintptr_t pCur = start; pCur < end; pCur++) {
if (!*current)
return match;
if (*(PBYTE)current == ('\?') || *(BYTE*)pCur == get_byte(current)) {
if (!match)
match = pCur;
if (!current[2])
return match;
if (*(PWORD)current == ('\?\?') || *(PBYTE)current != ('\?'))
current += 3;
else
current += 2;
} else {
current = pattern;
match = 0;
}
}
return 0;
}
inline uintptr_t dereference(uintptr_t address, unsigned int offset)
{
if (address == 0)
return 0;
if (sizeof(uintptr_t) == 8)
return address + (int)((*(int*)(address + offset) + offset) + sizeof(int));
return (uintptr_t)*(unsigned long*)(address + offset);
}
}