HelpWould this works ?

Posts 16–19 of 19 · Page 2 of 2
Quote Originally Posted by rabir007 View Post


I found a way:
-I trashed the C++ FindPattern
-And my my own, with my own logic and hey, it works
Post it up, lets see it.
Quote Originally Posted by Pingo View Post
Post it up, lets see it.
Code:
private static unsafe IntPtr ScanPattern(IntPtr StartAddress, int Length, byte[] Pattern, string Mask)
        {
            IntPtr FinalAddy = (IntPtr)0;
            byte[] Dump = new byte[Length];

            //Create a Dump of the process
            for (int i = 0; i < Length; i++)
            {
                Dump[i] = *(byte*)(StartAddress + i);
            }

            //Scan for the pattern
            for (int i = 0; i < Length - Pattern.Length; i++)
            {
                bool Found = true;
                for (int k = 0; k < Pattern.Length; k++)
                {

                    Found = Found && ((Dump[i + k] == Pattern[k]) && (Mask[k] == 'x')) || (Mask[k] == '?');
                }
                if (Found)
                {
                    Dump = new byte[0]; //Free Up the Dump Memory
                    return (IntPtr)(StartAddress + i); //Return the specified Address
                }
            }
            Dump = new byte[0]; //Free Up the Dump Memory
            return (IntPtr)0; //Pattern not found, return 0
        }

        public static unsafe IntPtr FindPattern(IntPtr StartAddress, int Length, byte[] BytePattern, string Mask, int Plus)
        {
            IntPtr pointer = PatternScanner.ScanPattern(StartAddress, Length, BytePattern, Mask);
            return *(IntPtr*)(pointer + Plus) - (int)MainClass.CShell;
        }

        public static unsafe IntPtr FindPattern2(IntPtr StartAddress, int Length, byte[] BytePattern, string Mask, int Plus)
        {
            IntPtr pointer = PatternScanner.ScanPattern(StartAddress, Length, BytePattern, Mask);
            return *(IntPtr*)(pointer + Plus);
        }

        public static string DecToHex(int Dec)
        {
            return Dec.ToString("X");
        }
It is the full Class...

I know, i don'r really have to Dump the process to a byte array, but i needed fast, and i wanted to finish as soon as i can, so I choosen the fastest way i could create in 10 min...

IDK if it is work 100%
I tested with WeaponMgr (where i was sure about correct pattern), and it found it...

Example of use (WeaponMgr) [Tested with CrossFire Eu]
Code:
PatternScanner.FindPattern(MainClass.CShell, 0xFFFFFF, new byte[] { 0x8B, 0x4F, 0x04, 0xA1, 0x00, 0x00, 0x00, 0x00, 0x85, 0xC0, 0x8B, 0x51, 0x04, 0x8B, 0x6A, 0x04 }, "xxxx????xxxxxxxx" , 4))
Edit:
The " && Mask[k] == 'X' " isn't necessary too...
@rabir007
Heres how i converted mine incase you wanted anything from it.
 
Code
Code:
        unsafe bool Compare(byte* pData, byte* bMaskara, char* szMaskara)
        {
            for (; *szMaskara != '\0'; ++szMaskara, ++pData, ++bMaskara)
                if (*szMaskara == 'x' && *pData != *bMaskara)
                    return false;
            return *szMaskara == '\0';
        }

        unsafe int FindPattern(int dwAddress, int dwLen, string bMask, string szMask)
        {
            if (dwAddress == 0) return 0;

            char* szM = null;
            fixed (char* p = szMask)
                szM = (char*)p;

            byte[] byts = new byte[bMask.Length / 2];
            for (int i = 0; i < byts.Length; i++)
                byts[i] = byte.Parse(bMask.Substring(i * 2, 2), System.Globalization.NumberStyles.HexNumber);

            byte* bM = null;
            fixed (byte* p = byts)
                bM = (byte*)p;

            for (int i = 0; i < dwLen; i++)
                if (Compare((byte*)(dwAddress + i), bM, szM))
                    return (int)(dwAddress + i);

            return 0;
        }


And to use it with your WeaponMgr pattern.
The api i used for the base.
Code:
        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern int GetModuleHandle(string lpModuleName);
Code:
FindPattern(GetModuleHandle("cshell"), 0xFFFFFF, "8B4F04A10000000085C08B51048B6A04", "xxxx????xxxxxxxx");
Both seems working...
Posts 16–19 of 19 · Page 2 of 2

Post a Reply

Similar Threads

Tags for this Thread

None

Talk with us