JamesMenetrey / MemorySharp

A C# based memory editing library targeting Windows applications, offering various functions to extract and inject data and codes into remote processes to allow interoperability.
Other
631 stars 134 forks source link

How to find address of a value ? #18

Open ISmileYouCryYouSmileIDie opened 5 years ago

ISmileYouCryYouSmileIDie commented 5 years ago

https://stackoverflow.com/questions/52531996/find-address-of-a-specified-value-in-another-process

Is it possible in memorysharp ?

zcanann commented 5 years ago

This is called an "Array of Byte scan". Just google for how to do that. Not sure if MemorySharp has that.

[deleted my original post, misunderstood the question]

ISmileYouCryYouSmileIDie commented 5 years ago

nothing found dude , it seems it's really hard to do :\

lolp1 commented 5 years ago

https://github.com/lolp1/Process.NET/tree/master/src/Process.NET/Patterns

     public class TestClass
    {
        public readonly IMemoryPattern DataAddressPattern =
            new DwordPattern("48 8B 05 ?? ?? ?? ?? 48 85 C0 48 0F 44 05 ?? ?? ?? ?? C3", 0x40);

        public readonly IMemoryPattern FuncOffsetPattern =
            new DwordPattern("48 8B 05 ?? ?? ?? ?? 48 85 C0 48 0F 44 05 ?? ?? ?? ?? C3");

        public PatternScanResult Find(string moduleName,IMemoryPattern pattern)
        {
            var process = new ProcessSharp(System.Diagnostics.Process.GetCurrentProcess());
            process.Memory = new ExternalProcessMemory(process.Handle);
            var scanner = new PatternScanner(process[moduleName]);
            return scanner.Find(pattern);
        }
    }
lolp1 commented 5 years ago

https://github.com/ZenLulz/MemorySharp/pull/6

If I miss-understand let me know.