Show / Hide Table of Contents

# Class SigScanner

A SigScanner facilitates searching for memory signatures in a given ProcessModule.

##### Inheritance

System.Object
SigScanner

##### Implements

System.IDisposable

##### Inherited Members

System.Object.ToString()
System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()

###### Namespace: Dalamud.Game

###### Assembly: Dalamud.dll

##### Syntax

    public sealed class SigScanner : IDisposable

### Constructors

| Improve this Doc View Source

#### SigScanner(ProcessModule, Boolean)

Set up the SigScanner.

##### Declaration

    public SigScanner(ProcessModule module, bool doCopy = false)

##### Parameters

Type | Name | Description
--- | --- | ---
System.Diagnostics.ProcessModule | module | The ProcessModule to be used for scanning
System.Boolean | doCopy | Whether or not to copy the module upon initialization for search operations to use, as to not get disturbed by possible hooks.

### Properties

| Improve this Doc View Source

#### DataSectionBase

The base address of the .data section search area.

##### Declaration

    public IntPtr DataSectionBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### DataSectionOffset

The offset of the .data section from the base of the module.

##### Declaration

    public long DataSectionOffset { get; }

##### Property Value

Type | Description
--- | ---
System.Int64 |

| Improve this Doc View Source

#### DataSectionSize

The size of the .data section.

##### Declaration

    public int DataSectionSize { get; }

##### Property Value

Type | Description
--- | ---
System.Int32 |

| Improve this Doc View Source

#### Is32BitProcess

If the ProcessModule is 32-bit.

##### Declaration

    public bool Is32BitProcess { get; }

##### Property Value

Type | Description
--- | ---
System.Boolean |

| Improve this Doc View Source

#### IsCopy

If the search on this module is performed on a copy.

##### Declaration

    public bool IsCopy { get; }

##### Property Value

Type | Description
--- | ---
System.Boolean |

| Improve this Doc View Source

#### Module

The ProcessModule on which the search is performed.

##### Declaration

    public ProcessModule Module { get; }

##### Property Value

Type | Description
--- | ---
System.Diagnostics.ProcessModule |

| Improve this Doc View Source

#### SearchBase

The base address of the search area. When copied, this will be the address of the copy.

##### Declaration

    public IntPtr SearchBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### TextSectionBase

The base address of the .text section search area.

##### Declaration

    public IntPtr TextSectionBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### TextSectionOffset

The offset of the .text section from the base of the module.

##### Declaration

    public long TextSectionOffset { get; }

##### Property Value

Type | Description
--- | ---
System.Int64 |

| Improve this Doc View Source

#### TextSectionSize

The size of the text section.

##### Declaration

    public int TextSectionSize { get; }

##### Property Value

Type | Description
--- | ---
System.Int32 |

### Methods

| Improve this Doc View Source

#### Dispose()

Free the memory of the copied module search area on object disposal, if applicable.

##### Declaration

    public void Dispose()

| Improve this Doc View Source

#### GetStaticAddressFromSig(String, Int32)

Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

##### Declaration

    public IntPtr GetStaticAddressFromSig(string signature, int offset)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature of the function using the data.
System.Int32 | offset | The offset from function start of the instruction using the data.

##### Returns

Type | Description
--- | ---
System.IntPtr | An IntPtr to the static memory location.

| Improve this Doc View Source

#### ResolveRelativeAddress(IntPtr, Int32)

##### Declaration

    public IntPtr ResolveRelativeAddress(IntPtr nextInstAddr, int relOffset)

##### Parameters

Type | Name | Description
--- | --- | ---
System.IntPtr | nextInstAddr |
System.Int32 | relOffset |

##### Returns

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### Scan(IntPtr, Int32, String)

##### Declaration

    public IntPtr Scan(IntPtr baseAddress, int size, string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.IntPtr | baseAddress |
System.Int32 | size |
System.String | signature |

##### Returns

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### ScanData(String)

Scan for a byte signature in the .data section.

##### Declaration

    public IntPtr ScanData(string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.

##### Returns

Type | Description
--- | ---
System.IntPtr | The real offset of the found signature.

| Improve this Doc View Source

#### ScanModule(String)

Scan for a byte signature in the whole module search area.

##### Declaration

    public IntPtr ScanModule(string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.

##### Returns

Type | Description
--- | ---
System.IntPtr | The real offset of the found signature.

| Improve this Doc View Source

#### ScanText(String)

Scan for a byte signature in the .text section.

##### Declaration

    public IntPtr ScanText(string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.

##### Returns

Type | Description
--- | ---
System.IntPtr | The real offset of the found signature.

### Implements

System.IDisposable