static unsafe bool bCompare(byte* pData, byte bMask, char szMask)
{
for (; szMask != 0; ++szMask, ++pData, ++bMask)
if ((szMask != '?') && (szMask == 'x' && *pData != bMask))
return false;
return true;
}
static unsafe IntPtr FindPattern(IntPtr dwAddress, IntPtr dwLen, byte[] bMask, char[] szMask)
{
bool Return = false;
for (int i = 0; i < (int)dwLen; i++)
{
for (int j = 0; j < bMask.Length; j++)
{
Return = Return && bCompare((byte*)(dwAddress + i), bMask[j], szMask[j]);
}
if (Return)
return (IntPtr)(dwAddress + i);
}
return (IntPtr)0;
}

public static unsafe IntPtr FindPattern(IntPtr StartAddress, int Length, byte[] Pattern, string Mask)
{
MenuForm.Console.Items.Add("Create Allocated Array");
byte[] Dump = new byte[Length];
//Create a Dump of the process
MenuForm.Console.Items.Add("Dumping Process");
for (int i = 0; i < Length; i++)
{
Dump[i] = *(byte*)(StartAddress + i);
}
MenuForm.Console.Items.Add("Scanning Pattern");
//Scan for the pattern
for (int i = 0; i < Length - Pattern.Length; i++)
{
bool Found = true;
for (int k = 0; k < Pattern.Length; k++)
{
Found = Found & (Dump[i + k] == Pattern[k]) && (Mask[k] == 'x');
}
if (Found)
{
Dump = new byte[0]; //Free Up the Dump Memory
return (IntPtr)i; //Return the specified Address
}
}
Dump = new byte[0]; //Free Up the Dump Memory
return (IntPtr)0; //Pattern not found, return 0
MenuForm.Console.Items.Add("Done");
}
PatternScanner.FindPattern(MainClass.CShell, 0xFFFFFF, new byte[] { 0x8B, 0x4F, 0x04, 0xA1, 0x00, 0x00, 0x00, 0x00, 0x85, 0xC0, 0x8B, 0x51, 0x04, 0x8B, 0x6A, 0x04 }, "xxxx????xxxxxxxx");
FindPattern(StartingAddress, SearchLength, "0000000000000000000000", "xx????xxxxx");