Notes

namespace sigScan
{
public class SigScan
{
[System.Runtime.InteropServices.DllImport("kernel32.dll", SetLastError = true)]
private static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
byte[] lpBuffer,
int dwSize,
out int lpNumberOfBytesRead
);

private byte[] m_vDumpedRegion;
private Process m_vProcess;
private IntPtr m_vAddress;
private Int32 m_vSize;

public SigScan()
{
this.m_vProcess = null;
this.m_vAddress = IntPtr.Zero;
this.m_vSize = 0;
this.m_vDumpedRegion = null;
}
public SigScan(Process proc, IntPtr addr, int size)
{
if (proc == null || proc.Id == 0)
{
MessageBox.Show("Boş Process.");
return;
}
this.m_vProcess = proc;
this.m_vAddress = addr;
this.m_vSize = size;
}
private bool DumpMemory()
{
try
{
if (this.m_vProcess == null || this.m_vProcess.HasExited || this.m_vAddress == IntPtr.Zero || this.m_vSize == 0)
return false;

this.m_vDumpedRegion = new byte[this.m_vSize];

bool bReturn = false;
int nBytesRead = 0;

bReturn = ReadProcessMemory(
this.m_vProcess.Handle, this.m_vAddress, this.m_vDumpedRegion, this.m_vSize, out nBytesRead
);

if (bReturn == false || nBytesRead != this.m_vSize)
return false;
return true;
}
catch (Exception ex)
{
return false;
}
}
private bool MaskCheck(int nOffset, byte[] btPattern, string strMask)
{
// Loop the pattern and compare to the mask and dump.
for (int x = 0; x < btPattern.Length; x++)
{
// If the mask char is a wildcard, just continue.
if (strMask[x] == '?')
continue;

// If the mask char is not a wildcard, ensure a match is made in the pattern.
if ((strMask[x] == 'x') && (btPattern[x] != this.m_vDumpedRegion[nOffset + x]))
return false;
}

// The loop was successful so we found the pattern.
return true;
}

public IntPtr FindPattern(byte[] btPattern, string strMask, int nOffset)
{
try
{
// Dump the memory region if we have not dumped it yet.
if (this.m_vDumpedRegion == null || this.m_vDumpedRegion.Length == 0)
{
if (!this.DumpMemory())
return IntPtr.Zero;
}

// Ensure the mask and pattern lengths match.
if (strMask.Length != btPattern.Length)
return IntPtr.Zero;

// Loop the region and look for the pattern.
for (int x = 0; x < this.m_vDumpedRegion.Length; x++)
{
if (this.MaskCheck(x, btPattern, strMask))
{
// The pattern was found, return it.
return new IntPtr((int)this.m_vAddress + (x + nOffset));
}
}

// Pattern was not found.
return IntPtr.Zero;
}
catch (Exception ex)
{
return IntPtr.Zero;
}
}
public void ResetRegion()
{
this.m_vDumpedRegion = null;
}
public Process Process
{
get { return this.m_vProcess; }
set { this.m_vProcess = value; }
}
public IntPtr Address
{
get { return this.m_vAddress; }
set { this.m_vAddress = value; }
}
public Int32 Size
{
get { return this.m_vSize; }
set { this.m_vSize = value; }
}
}
}