Interface ISigScanner

A SigScanner facilitates searching for memory signatures in a given ProcessModule.

Assembly: Dalamud.dll

View Source

Declaration

public interface ISigScanner

Properties

IsCopy

Gets a value indicating whether or not the search on this module is performed on a copy.

View Source

Declaration

bool IsCopy { get; }

Is32BitProcess

Gets a value indicating whether or not the ProcessModule is 32-bit.

View Source

Declaration

bool Is32BitProcess { get; }

SearchBase

Gets the base address of the search area. When copied, this will be the address of the copy.

View Source

Declaration

nint SearchBase { get; }

TextSectionBase

Gets the base address of the .text section search area.

View Source

Declaration

nint TextSectionBase { get; }

TextSectionOffset

Gets the offset of the .text section from the base of the module.

View Source

Declaration

long TextSectionOffset { get; }

TextSectionSize

Gets the size of the text section.

View Source

Declaration

int TextSectionSize { get; }

DataSectionBase

Gets the base address of the .data section search area.

View Source

Declaration

nint DataSectionBase { get; }

DataSectionOffset

Gets the offset of the .data section from the base of the module.

View Source

Declaration

long DataSectionOffset { get; }

DataSectionSize

Gets the size of the .data section.

View Source

Declaration

int DataSectionSize { get; }

RDataSectionBase

Gets the base address of the .rdata section search area.

View Source

Declaration

nint RDataSectionBase { get; }

RDataSectionOffset

Gets the offset of the .rdata section from the base of the module.

View Source

Declaration

long RDataSectionOffset { get; }

RDataSectionSize

Gets the size of the .rdata section.

View Source

Declaration

int RDataSectionSize { get; }

Module

Gets the ProcessModule on which the search is performed.

View Source

Declaration

ProcessModule Module { get; }

Methods

GetStaticAddressFromSig(string, int)

Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig. The signature and offset should not break through instruction boundaries.

View Source

Declaration

nint GetStaticAddressFromSig(string signature, int offset = 0)

Returns

System.IntPtr: An IntPtr to the static memory location.

Parameters

Type	Name	Description
System.String	signature	The signature of the function using the data.
System.Int32	offset	The offset from function start of the instruction using the data.

TryGetStaticAddressFromSig(string, out nint, int)

Try scanning for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

View Source

Declaration

bool TryGetStaticAddressFromSig(string signature, out nint result, int offset = 0)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature of the function using the data.
System.IntPtr	result	An IntPtr to the static memory location, if found.
System.Int32	offset	The offset from function start of the instruction using the data.

ScanData(string)

Scan for a byte signature in the .data section.

View Source

Declaration

nint ScanData(string signature)

Returns

System.IntPtr: The real offset of the found signature.

Parameters

Type	Name	Description
System.String	signature	The signature.

TryScanData(string, out nint)

Try scanning for a byte signature in the .data section.

View Source

Declaration

bool TryScanData(string signature, out nint result)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature.
System.IntPtr	result	The real offset of the signature, if found.

ScanModule(string)

Scan for a byte signature in the whole module search area.

View Source

Declaration

nint ScanModule(string signature)

Returns

System.IntPtr: The real offset of the found signature.

Parameters

Type	Name	Description
System.String	signature	The signature.

TryScanModule(string, out nint)

Try scanning for a byte signature in the whole module search area.

View Source

Declaration

bool TryScanModule(string signature, out nint result)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature.
System.IntPtr	result	The real offset of the signature, if found.

ResolveRelativeAddress(nint, int)

Resolve a RVA address.

View Source

Declaration

nint ResolveRelativeAddress(nint nextInstAddr, int relOffset)

Returns

System.IntPtr: The calculated offset.

Parameters

Type	Name	Description
System.IntPtr	nextInstAddr	The address of the next instruction.
System.Int32	relOffset	The relative offset.

ScanText(string)

Scan for a byte signature in the .text section.

View Source

Declaration

nint ScanText(string signature)

Returns

System.IntPtr: The real offset of the found signature.

Parameters

Type	Name	Description
System.String	signature	The signature.

TryScanText(string, out nint)

Try scanning for a byte signature in the .text section.

View Source

Declaration

bool TryScanText(string signature, out nint result)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature.
System.IntPtr	result	The real offset of the signature, if found.

ScanAllText(string)

Scan for all matching byte signatures in the .text section.

View Source

Declaration

nint[] ScanAllText(string signature)

Returns

System.IntPtr[]: The list of real offsets of the found elements based on signature.

Parameters

Type	Name	Description
System.String	signature	The Signature.