-
Notifications
You must be signed in to change notification settings - Fork 1
/
memory.h
62 lines (51 loc) · 1.5 KB
/
memory.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#pragma once
#include "stdafx.h"
#include "lazyimporter.h"
#include <type_traits>
#define in_range(x, a, b) (x >= a && x <= b)
#define get_bits(x) (in_range((x & (~0x20)), 'A', 'F') ? ((x & (~0x20)) - 'A' + 0xA): (in_range(x, '0', '9') ? x - '0': 0))
#define get_byte(x) (get_bits(x[0]) << 4 | get_bits(x[1]))
struct EnumData
{
DWORD dwProcessId;
HWND hWnd;
};
namespace memory
{
uintptr_t occurence(const char* module, const char* pattern)
{
MODULEINFO mod;
iat(K32GetModuleInformation).get()(iat(GetCurrentProcess).get()(), iat(GetModuleHandleA).get()(module), &mod, sizeof(MODULEINFO));
uintptr_t start = (uintptr_t)mod.lpBaseOfDll;
uintptr_t end = (uintptr_t)mod.lpBaseOfDll + (uintptr_t)mod.SizeOfImage;
uintptr_t match = (uintptr_t)nullptr;
const char* current = pattern;
for (uintptr_t pCur = start; pCur < end; pCur++) {
if (!*current)
return match;
if (*(PBYTE)current == ('\?') || *(BYTE*)pCur == get_byte(current)) {
if (!match)
match = pCur;
if (!current[2])
return match;
if (*(PWORD)current == ('\?\?') || *(PBYTE)current != ('\?'))
current += 3;
else
current += 2;
}
else {
current = pattern;
match = 0;
}
}
return (uintptr_t)nullptr;
}
inline uintptr_t dereference(uintptr_t address, unsigned int offset)
{
if (address == 0)
return (uintptr_t)nullptr;
if (sizeof(uintptr_t) == 8)
return address + (int)((*(int*)(address + offset) + offset) + sizeof(int));
return *(uintptr_t*)(address + offset);
}
}