Class SigScanner

A SigScanner facilitates searching for memory signatures in a given ProcessModule.

Inheritance

System.Object

SigScanner

Implements

System.IDisposable

Inherited Members

System.Object.ToString()

System.Object.Equals(System.Object)

System.Object.Equals(System.Object, System.Object)

System.Object.ReferenceEquals(System.Object, System.Object)

System.Object.GetHashCode()

System.Object.GetType()

System.Object.MemberwiseClone()

Namespace: Dalamud.Game

Assembly: Dalamud.dll

Syntax

public sealed class SigScanner : IDisposable

Constructors

SigScanner(ProcessModule, Boolean)

Initializes a new instance of the SigScanner class.

Declaration

public SigScanner(ProcessModule module, bool doCopy = false)

Parameters

Type	Name	Description
System.Diagnostics.ProcessModule	module	The ProcessModule to be used for scanning.
System.Boolean	doCopy	Whether or not to copy the module upon initialization for search operations to use, as to not get disturbed by possible hooks.

Properties

DataSectionBase

Gets the base address of the .data section search area.

Declaration

public IntPtr DataSectionBase { get; }

Property Value

Type	Description
System.IntPtr

DataSectionOffset

Gets the offset of the .data section from the base of the module.

Declaration

public long DataSectionOffset { get; }

Property Value

Type	Description
System.Int64

DataSectionSize

Gets the size of the .data section.

Declaration

public int DataSectionSize { get; }

Property Value

Type	Description
System.Int32

Is32BitProcess

Gets a value indicating whether or not the ProcessModule is 32-bit.

Declaration

public bool Is32BitProcess { get; }

Property Value

Type	Description
System.Boolean

IsCopy

Gets a value indicating whether or not the search on this module is performed on a copy.

Declaration

public bool IsCopy { get; }

Property Value

Type	Description
System.Boolean

Module

Gets the ProcessModule on which the search is performed.

Declaration

public ProcessModule Module { get; }

Property Value

Type	Description
System.Diagnostics.ProcessModule

RDataSectionBase

Gets the base address of the .rdata section search area.

Declaration

public IntPtr RDataSectionBase { get; }

Property Value

Type	Description
System.IntPtr

RDataSectionOffset

Gets the offset of the .rdata section from the base of the module.

Declaration

public long RDataSectionOffset { get; }

Property Value

Type	Description
System.Int64

RDataSectionSize

Gets the size of the .rdata section.

Declaration

public int RDataSectionSize { get; }

Property Value

Type	Description
System.Int32

SearchBase

Gets the base address of the search area. When copied, this will be the address of the copy.

Declaration

public IntPtr SearchBase { get; }

Property Value

Type	Description
System.IntPtr

TextSectionBase

Gets the base address of the .text section search area.

Declaration

public IntPtr TextSectionBase { get; }

Property Value

Type	Description
System.IntPtr

TextSectionOffset

Gets the offset of the .text section from the base of the module.

Declaration

public long TextSectionOffset { get; }

Property Value

Type	Description
System.Int64

TextSectionSize

Gets the size of the text section.

Declaration

public int TextSectionSize { get; }

Property Value

Type	Description
System.Int32

Methods

Dispose()

Free the memory of the copied module search area on object disposal, if applicable.

Declaration

public void Dispose()

GetStaticAddressFromSig(String, Int32)

Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

Declaration

public IntPtr GetStaticAddressFromSig(string signature, int offset = 0)

Parameters

Type	Name	Description
System.String	signature	The signature of the function using the data.
System.Int32	offset	The offset from function start of the instruction using the data.

Returns

Type	Description
System.IntPtr	An IntPtr to the static memory location.

ResolveRelativeAddress(IntPtr, Int32)

Resolve a RVA address.

Declaration

public IntPtr ResolveRelativeAddress(IntPtr nextInstAddr, int relOffset)

Parameters

Type	Name	Description
System.IntPtr	nextInstAddr	The address of the next instruction.
System.Int32	relOffset	The relative offset.

Returns

Type	Description
System.IntPtr	The calculated offset.

Scan(IntPtr, Int32, String)

Scan memory for a signature.

Declaration

public static IntPtr Scan(IntPtr baseAddress, int size, string signature)

Parameters

Type	Name	Description
System.IntPtr	baseAddress	The base address to scan from.
System.Int32	size	The amount of bytes to scan.
System.String	signature	The signature to search for.

Returns

Type	Description
System.IntPtr	The found offset.

ScanData(String)

Scan for a byte signature in the .data section.

Declaration

public IntPtr ScanData(string signature)

Parameters

Type	Name	Description
System.String	signature	The signature.

Returns

Type	Description
System.IntPtr	The real offset of the found signature.

ScanModule(String)

Scan for a byte signature in the whole module search area.

Declaration

public IntPtr ScanModule(string signature)

Parameters

Type	Name	Description
System.String	signature	The signature.

Returns

Type	Description
System.IntPtr	The real offset of the found signature.

ScanText(String)

Scan for a byte signature in the .text section.

Declaration

public IntPtr ScanText(string signature)

Parameters

Type	Name	Description
System.String	signature	The signature.

Returns

Type	Description
System.IntPtr	The real offset of the found signature.

Implements

System.IDisposable