1. Нам понадобиться библиотека Jupiter, Nuget
Код сканера:
Рекомендация для скрости: патерн не должен начинаться на ??
Пример вызова:
Код сканера:
Рекомендация для скрости: патерн не должен начинаться на ??
C#:
public List<IntPtr> PatternScan(MemoryModule memoryModule, IntPtr firstAddr, IntPtr SecondAddr, string pattern)
{
var patternAddresses = new List<IntPtr>();
pattern = pattern.Replace("??", "..");
//for regex library "??" replaced with ".."
var range = SecondAddr.ToInt64() - firstAddr.ToInt64();
Console.WriteLine(range);
//length between the second address and the first address
var index = Convert.ToInt32(range / 1000);
//index for "for" loop. Example: range = 46352 -> index=46
//So we will memory read 46x1000 with the for loop.
var carry = Convert.ToInt32(range - (index * 1000));
//46352-46*1000=352 -> We will read the bytes remaining after 46x1000 memory reads.
var sb = new StringBuilder();
//We add the bytes of hex type to the stringbuilder.
if (index > 0)
{
for (int i = 0; i < index; i++)
{
var value = memoryModule.ReadVirtualMemory(firstAddr + (1000 * i), 1000);
//1000 byte memory read single loop
sb.Append(BitConverter.ToString(value).Replace("-", " "));
//converting the incoming bytes to hex code. Example: 01 00 0B....
sb.Append(" ");
}
}
var endvalue = memoryModule.ReadVirtualMemory(firstAddr + (1000 * index), carry + 1);
sb.Append(BitConverter.ToString(endvalue).Replace("-", " "));
//remaining bytes are read
sb.Append(" ");
/////////////////////////////////////////////////////////////////////////////
var m = Regex.Match(sb.ToString(), pattern, RegexOptions.IgnoreCase);
while (m.Success)
{
patternAddresses.Add(firstAddr + (m.Index / 3));
m = m.NextMatch();
}
//find all pattern
return patternAddresses;
}
C#:
List<IntPtr> nicknames = scanner.PatternScan(memoryModule, new IntPtr(0x82000000), new IntPtr(0x95000000), "E9 83 00 20 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 01 00 00 00 00 00 00 00 1C 81 00 20 08 00 00 00 4E 65 6B 69 50 6C 61 79 01 00 00 00 00 00 00 00 E9 83 00 20 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 01 00 00 00 00 00 00 00 1C 81 00 20 04 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 01 00 00 00 00 00 00 00");
Последнее редактирование: