Show / Hide Table of Contents

# Class SigScanner

A SigScanner facilitates searching for memory signatures in a given ProcessModule.

##### Inheritance

System.Object
SigScanner

##### Implements

System.IDisposable
IServiceType

##### Inherited Members

System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.ToString()

###### Namespace: Dalamud.Game

###### Assembly: Dalamud.dll

##### Syntax

    public class SigScanner : IDisposable, IServiceType

### Constructors

| Improve this Doc View Source

#### SigScanner(Boolean, FileInfo)

Initializes a new instance of the SigScanner class using the main module of the current process.

##### Declaration

    public SigScanner(bool doCopy = false, FileInfo cacheFile = null)

##### Parameters

Type | Name | Description
--- | --- | ---
System.Boolean | doCopy | Whether or not to copy the module upon initialization for search operations to use, as to not get disturbed by possible hooks.
System.IO.FileInfo | cacheFile | File used to cached signatures.

| Improve this Doc View Source

#### SigScanner(ProcessModule, Boolean, FileInfo)

Initializes a new instance of the SigScanner class.

##### Declaration

    public SigScanner(ProcessModule module, bool doCopy = false, FileInfo cacheFile = null)

##### Parameters

Type | Name | Description
--- | --- | ---
System.Diagnostics.ProcessModule | module | The ProcessModule to be used for scanning.
System.Boolean | doCopy | Whether or not to copy the module upon initialization for search operations to use, as to not get disturbed by possible hooks.
System.IO.FileInfo | cacheFile | File used to cached signatures.

### Properties

| Improve this Doc View Source

#### DataSectionBase

Gets the base address of the .data section search area.

##### Declaration

    public IntPtr DataSectionBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### DataSectionOffset

Gets the offset of the .data section from the base of the module.

##### Declaration

    public long DataSectionOffset { get; }

##### Property Value

Type | Description
--- | ---
System.Int64 |

| Improve this Doc View Source

#### DataSectionSize

Gets the size of the .data section.

##### Declaration

    public int DataSectionSize { get; }

##### Property Value

Type | Description
--- | ---
System.Int32 |

| Improve this Doc View Source

#### Is32BitProcess

Gets a value indicating whether or not the ProcessModule is 32-bit.

##### Declaration

    public bool Is32BitProcess { get; }

##### Property Value

Type | Description
--- | ---
System.Boolean |

| Improve this Doc View Source

#### IsCopy

Gets a value indicating whether or not the search on this module is performed on a copy.

##### Declaration

    public bool IsCopy { get; }

##### Property Value

Type | Description
--- | ---
System.Boolean |

| Improve this Doc View Source

#### Module

Gets the ProcessModule on which the search is performed.

##### Declaration

    public ProcessModule Module { get; }

##### Property Value

Type | Description
--- | ---
System.Diagnostics.ProcessModule |

| Improve this Doc View Source

#### RDataSectionBase

Gets the base address of the .rdata section search area.

##### Declaration

    public IntPtr RDataSectionBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### RDataSectionOffset

Gets the offset of the .rdata section from the base of the module.

##### Declaration

    public long RDataSectionOffset { get; }

##### Property Value

Type | Description
--- | ---
System.Int64 |

| Improve this Doc View Source

#### RDataSectionSize

Gets the size of the .rdata section.

##### Declaration

    public int RDataSectionSize { get; }

##### Property Value

Type | Description
--- | ---
System.Int32 |

| Improve this Doc View Source

#### SearchBase

Gets the base address of the search area. When copied, this will be the address of the copy.

##### Declaration

    public IntPtr SearchBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### TextSectionBase

Gets the base address of the .text section search area.

##### Declaration

    public IntPtr TextSectionBase { get; }

##### Property Value

Type | Description
--- | ---
System.IntPtr |

| Improve this Doc View Source

#### TextSectionOffset

Gets the offset of the .text section from the base of the module.

##### Declaration

    public long TextSectionOffset { get; }

##### Property Value

Type | Description
--- | ---
System.Int64 |

| Improve this Doc View Source

#### TextSectionSize

Gets the size of the text section.

##### Declaration

    public int TextSectionSize { get; }

##### Property Value

Type | Description
--- | ---
System.Int32 |

### Methods

| Improve this Doc View Source

#### Dispose()

Free the memory of the copied module search area on object disposal, if applicable.

##### Declaration

    public void Dispose()

| Improve this Doc View Source

#### GetStaticAddressFromSig(String, Int32)

Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

##### Declaration

    public IntPtr GetStaticAddressFromSig(string signature, int offset = 0)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature of the function using the data.
System.Int32 | offset | The offset from function start of the instruction using the data.

##### Returns

Type | Description
--- | ---
System.IntPtr | An IntPtr to the static memory location.

| Improve this Doc View Source

#### ResolveRelativeAddress(IntPtr, Int32)

Resolve a RVA address.

##### Declaration

    public IntPtr ResolveRelativeAddress(IntPtr nextInstAddr, int relOffset)

##### Parameters

Type | Name | Description
--- | --- | ---
System.IntPtr | nextInstAddr | The address of the next instruction.
System.Int32 | relOffset | The relative offset.

##### Returns

Type | Description
--- | ---
System.IntPtr | The calculated offset.

| Improve this Doc View Source

#### Scan(IntPtr, Int32, String)

Scan memory for a signature.

##### Declaration

    public static IntPtr Scan(IntPtr baseAddress, int size, string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.IntPtr | baseAddress | The base address to scan from.
System.Int32 | size | The amount of bytes to scan.
System.String | signature | The signature to search for.

##### Returns

Type | Description
--- | ---
System.IntPtr | The found offset.

| Improve this Doc View Source

#### ScanData(String)

Scan for a byte signature in the .data section.

##### Declaration

    public IntPtr ScanData(string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.

##### Returns

Type | Description
--- | ---
System.IntPtr | The real offset of the found signature.

| Improve this Doc View Source

#### ScanModule(String)

Scan for a byte signature in the whole module search area.

##### Declaration

    public IntPtr ScanModule(string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.

##### Returns

Type | Description
--- | ---
System.IntPtr | The real offset of the found signature.

| Improve this Doc View Source

#### ScanText(String)

Scan for a byte signature in the .text section.

##### Declaration

    public IntPtr ScanText(string signature)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.

##### Returns

Type | Description
--- | ---
System.IntPtr | The real offset of the found signature.

| Improve this Doc View Source

#### TryGetStaticAddressFromSig(String, out IntPtr, Int32)

Try scanning for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

##### Declaration

    public bool TryGetStaticAddressFromSig(string signature, out IntPtr result, int offset = 0)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature of the function using the data.
System.IntPtr | result | An IntPtr to the static memory location, if found.
System.Int32 | offset | The offset from function start of the instruction using the data.

##### Returns

Type | Description
--- | ---
System.Boolean | true if the signature was found.

| Improve this Doc View Source

#### TryScan(IntPtr, Int32, String, out IntPtr)

Try scanning memory for a signature.

##### Declaration

    public static bool TryScan(IntPtr baseAddress, int size, string signature, out IntPtr result)

##### Parameters

Type | Name | Description
--- | --- | ---
System.IntPtr | baseAddress | The base address to scan from.
System.Int32 | size | The amount of bytes to scan.
System.String | signature | The signature to search for.
System.IntPtr | result | The offset, if found.

##### Returns

Type | Description
--- | ---
System.Boolean | true if the signature was found.

| Improve this Doc View Source

#### TryScanData(String, out IntPtr)

Try scanning for a byte signature in the .data section.

##### Declaration

    public bool TryScanData(string signature, out IntPtr result)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.
System.IntPtr | result | The real offset of the signature, if found.

##### Returns

Type | Description
--- | ---
System.Boolean | true if the signature was found.

| Improve this Doc View Source

#### TryScanModule(String, out IntPtr)

Try scanning for a byte signature in the whole module search area.

##### Declaration

    public bool TryScanModule(string signature, out IntPtr result)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.
System.IntPtr | result | The real offset of the signature, if found.

##### Returns

Type | Description
--- | ---
System.Boolean | true if the signature was found.

| Improve this Doc View Source

#### TryScanText(String, out IntPtr)

Try scanning for a byte signature in the .text section.

##### Declaration

    public bool TryScanText(string signature, out IntPtr result)

##### Parameters

Type | Name | Description
--- | --- | ---
System.String | signature | The signature.
System.IntPtr | result | The real offset of the signature, if found.

##### Returns

Type | Description
--- | ---
System.Boolean | true if the signature was found.

### Implements

System.IDisposable
IServiceType