Class SigScanner

A SigScanner facilitates searching for memory signatures in a given ProcessModule.

Inheritance

System.Object

SigScanner

Implements

System.IDisposable

Inherited Members

System.Object.ToString()

System.Object.Equals(System.Object)

System.Object.Equals(System.Object, System.Object)

System.Object.ReferenceEquals(System.Object, System.Object)

System.Object.GetHashCode()

System.Object.GetType()

System.Object.MemberwiseClone()

Namespace: Dalamud.Game

Assembly: Dalamud.dll

Syntax

public sealed class SigScanner : IDisposable

Constructors

| Improve this Doc View Source

SigScanner(ProcessModule, Boolean)

Set up the SigScanner.

Declaration

public SigScanner(ProcessModule module, bool doCopy = false)

Parameters

Type	Name	Description
System.Diagnostics.ProcessModule	module	The ProcessModule to be used for scanning
System.Boolean	doCopy	Whether or not to copy the module upon initialization for search operations to use, as to not get disturbed by possible hooks.

Properties

| Improve this Doc View Source

DataSectionBase

The base address of the .data section search area.

Declaration

public IntPtr DataSectionBase { get; }

Property Value

Type	Description
System.IntPtr

| Improve this Doc View Source

DataSectionOffset

The offset of the .data section from the base of the module.

Declaration

public long DataSectionOffset { get; }

Property Value

Type	Description
System.Int64

| Improve this Doc View Source

DataSectionSize

The size of the .data section.

Declaration

public int DataSectionSize { get; }

Property Value

Type	Description
System.Int32

| Improve this Doc View Source

Is32BitProcess

If the ProcessModule is 32-bit.

Declaration

public bool Is32BitProcess { get; }

Property Value

Type	Description
System.Boolean

| Improve this Doc View Source

IsCopy

If the search on this module is performed on a copy.

Declaration

public bool IsCopy { get; }

Property Value

Type	Description
System.Boolean

| Improve this Doc View Source

Module

The ProcessModule on which the search is performed.

Declaration

public ProcessModule Module { get; }

Property Value

Type	Description
System.Diagnostics.ProcessModule

| Improve this Doc View Source

SearchBase

The base address of the search area. When copied, this will be the address of the copy.

Declaration

public IntPtr SearchBase { get; }

Property Value

Type	Description
System.IntPtr

| Improve this Doc View Source

TextSectionBase

The base address of the .text section search area.

Declaration

public IntPtr TextSectionBase { get; }

Property Value

Type	Description
System.IntPtr

| Improve this Doc View Source

TextSectionOffset

The offset of the .text section from the base of the module.

Declaration

public long TextSectionOffset { get; }

Property Value

Type	Description
System.Int64

| Improve this Doc View Source

TextSectionSize

The size of the text section.

Declaration

public int TextSectionSize { get; }

Property Value

Type	Description
System.Int32

Methods

| Improve this Doc View Source

Dispose()

Free the memory of the copied module search area on object disposal, if applicable.

Declaration

public void Dispose()

| Improve this Doc View Source

GetStaticAddressFromSig(String, Int32)

Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

Declaration

public IntPtr GetStaticAddressFromSig(string signature, int offset = 0)

Parameters

Type	Name	Description
System.String	signature	The signature of the function using the data.
System.Int32	offset	The offset from function start of the instruction using the data.

Returns

Type	Description
System.IntPtr	An IntPtr to the static memory location.

| Improve this Doc View Source

ResolveRelativeAddress(IntPtr, Int32)

Declaration

public IntPtr ResolveRelativeAddress(IntPtr nextInstAddr, int relOffset)

Parameters

Type	Name	Description
System.IntPtr	nextInstAddr
System.Int32	relOffset

Returns

Type	Description
System.IntPtr

| Improve this Doc View Source

Scan(IntPtr, Int32, String)

Declaration

public IntPtr Scan(IntPtr baseAddress, int size, string signature)

Parameters

Type	Name	Description
System.IntPtr	baseAddress
System.Int32	size
System.String	signature

Returns

Type	Description
System.IntPtr

| Improve this Doc View Source

ScanData(String)

Scan for a byte signature in the .data section.

Declaration

public IntPtr ScanData(string signature)

Parameters

Type	Name	Description
System.String	signature	The signature.

Returns

Type	Description
System.IntPtr	The real offset of the found signature.

| Improve this Doc View Source

ScanModule(String)

Scan for a byte signature in the whole module search area.

Declaration

public IntPtr ScanModule(string signature)

Parameters

Type	Name	Description
System.String	signature	The signature.

Returns

Type	Description
System.IntPtr	The real offset of the found signature.

| Improve this Doc View Source

ScanText(String)

Scan for a byte signature in the .text section.

Declaration

public IntPtr ScanText(string signature)

Parameters

Type	Name	Description
System.String	signature	The signature.

Returns

Type	Description
System.IntPtr	The real offset of the found signature.

Implements

System.IDisposable