Class SigScanner
A SigScanner facilitates searching for memory signatures in a given ProcessModule.
Assembly: Dalamud.dll
View Source
public class SigScanner : IDisposable, ISigScanner
Implements:
System.IDisposable, Dalamud.Game.ISigScanner
Properties
IsCopy
Gets a value indicating whether or not the search on this module is performed on a copy.
View Source
public bool IsCopy { get; }
Is32BitProcess
Gets a value indicating whether or not the ProcessModule is 32-bit.
View Source
public bool Is32BitProcess { get; }
SearchBase
Gets the base address of the search area. When copied, this will be the address of the copy.
View Source
public nint SearchBase { get; }
TextSectionBase
Gets the base address of the .text section search area.
View Source
public nint TextSectionBase { get; }
TextSectionOffset
Gets the offset of the .text section from the base of the module.
View Source
public long TextSectionOffset { get; }
TextSectionSize
Gets the size of the text section.
View Source
public int TextSectionSize { get; }
DataSectionBase
Gets the base address of the .data section search area.
View Source
public nint DataSectionBase { get; }
DataSectionOffset
Gets the offset of the .data section from the base of the module.
View Source
public long DataSectionOffset { get; }
DataSectionSize
Gets the size of the .data section.
View Source
public int DataSectionSize { get; }
RDataSectionBase
Gets the base address of the .rdata section search area.
View Source
public nint RDataSectionBase { get; }
RDataSectionOffset
Gets the offset of the .rdata section from the base of the module.
View Source
public long RDataSectionOffset { get; }
RDataSectionSize
Gets the size of the .rdata section.
View Source
public int RDataSectionSize { get; }
Module
Gets the ProcessModule on which the search is performed.
View Source
public ProcessModule Module { get; }
Methods
Scan(nint, int, string)
Scan memory for a signature.
View Source
public static nint Scan(nint baseAddress, int size, string signature)
Returns
System.IntPtr: The found offset.
Parameters
| Type | Name | Description |
|---|---|---|
System.IntPtr | baseAddress | The base address to scan from. |
System.Int32 | size | The amount of bytes to scan. |
System.String | signature | The signature to search for. |
TryScan(nint, int, string, out nint)
Try scanning memory for a signature.
View Source
public static bool TryScan(nint baseAddress, int size, string signature, out nint result)
Returns
System.Boolean: true if the signature was found.
Parameters
| Type | Name | Description |
|---|---|---|
System.IntPtr | baseAddress | The base address to scan from. |
System.Int32 | size | The amount of bytes to scan. |
System.String | signature | The signature to search for. |
System.IntPtr | result | The offset, if found. |
GetStaticAddressFromSig(string, int)
Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig. The signature and offset should not break through instruction boundaries.
View Source
public nint GetStaticAddressFromSig(string signature, int offset = 0)
Returns
System.IntPtr: An IntPtr to the static memory location.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature of the function using the data. |
System.Int32 | offset | The offset from function start of the instruction using the data. |
TryGetStaticAddressFromSig(string, out nint, int)
Try scanning for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.
View Source
public bool TryGetStaticAddressFromSig(string signature, out nint result, int offset = 0)
Returns
System.Boolean: true if the signature was found.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature of the function using the data. |
System.IntPtr | result | An IntPtr to the static memory location, if found. |
System.Int32 | offset | The offset from function start of the instruction using the data. |
ScanData(string)
Scan for a byte signature in the .data section.
View Source
public nint ScanData(string signature)
Returns
System.IntPtr: The real offset of the found signature.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature. |
TryScanData(string, out nint)
Try scanning for a byte signature in the .data section.
View Source
public bool TryScanData(string signature, out nint result)
Returns
System.Boolean: true if the signature was found.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature. |
System.IntPtr | result | The real offset of the signature, if found. |
ScanModule(string)
Scan for a byte signature in the whole module search area.
View Source
public nint ScanModule(string signature)
Returns
System.IntPtr: The real offset of the found signature.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature. |
TryScanModule(string, out nint)
Try scanning for a byte signature in the whole module search area.
View Source
public bool TryScanModule(string signature, out nint result)
Returns
System.Boolean: true if the signature was found.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature. |
System.IntPtr | result | The real offset of the signature, if found. |
ResolveRelativeAddress(nint, int)
Resolve a RVA address.
View Source
public nint ResolveRelativeAddress(nint nextInstAddr, int relOffset)
Returns
System.IntPtr: The calculated offset.
Parameters
| Type | Name | Description |
|---|---|---|
System.IntPtr | nextInstAddr | The address of the next instruction. |
System.Int32 | relOffset | The relative offset. |
ScanText(string)
Scan for a byte signature in the .text section.
View Source
public nint ScanText(string signature)
Returns
System.IntPtr: The real offset of the found signature.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature. |
TryScanText(string, out nint)
Try scanning for a byte signature in the .text section.
View Source
public bool TryScanText(string signature, out nint result)
Returns
System.Boolean: true if the signature was found.
Parameters
| Type | Name | Description |
|---|---|---|
System.String | signature | The signature. |
System.IntPtr | result | The real offset of the signature, if found. |
ScanAllText(string)
View Source
public nint[] ScanAllText(string signature)
Returns
System.IntPtr[]
Parameters
| Type | Name |
|---|---|
System.String | signature |
Dispose()
Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.
View Source
public void Dispose()
Implements
System.IDisposable- Dalamud.Game.ISigScanner