using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Globalization;
using System.Linq;
using System.Runtime.InteropServices;
namespace aobscan
{
internal class Program
{
[DllImport("kernel32.dll")]
static extern bool ReadProcessMemory(IntPtr handle, IntPtr addy, byte[] buffer, int size, ref int bytesread);
static void Main(string[] args)
{
Process proc = Process.GetProcessesByName("craftrise-x64")[0];
byte[] buffer = new byte[proc.MainModule.ModuleMemorySize];
int bytesread = 0;
ReadProcessMemory(proc.Handle, proc.MainModule.BaseAddress, buffer, buffer.Length, ref bytesread);
string sigscan = "C5 F9 2E ?? 24 ?? ?? ?? ?? 7A";
var addy = SigScan(sigscan, buffer, proc);
Console.WriteLine(addy[0].ToString("X"));
Console.ReadLine();
}
static int[] TransformArray(string sig)
{
var bytes = sig.Split(' ');
int[] inlist = new int[bytes.Length];
for (int i = 0; i < bytes.Length; i++)
{
if (bytes[i] == "??")
inlist[i] = -1;
else
inlist[i] = int.Parse(bytes[i], NumberStyles.HexNumber);
}
return inlist;
}
static List<IntPtr> SigScan(string sig, byte[] buffer, Process proc)
{
var intlist = TransformArray(sig);
var results = new List<IntPtr>();
for (int a = 0; a < buffer.Length; a++)
{
for (int b = 0; b < intlist.Length; b++)
{
if (intlist[b] != -1 && intlist[b] != buffer[a + b])
break;
if (b + 1 == intlist.Length)
{
var result = new IntPtr(a + (int)proc.MainModule.BaseAddress);
results.Add(result);
}
}
}
return results;
}
}
}