Interface ISigScanner

A SigScanner facilitates searching for memory signatures in a given ProcessModule.

Assembly: Dalamud.dll

Declaration

public interface ISigScanner : IDalamudService

Properties

IsCopy

Gets a value indicating whether the search on this module is performed on a copy.

Declaration

bool IsCopy { get; }

Is32BitProcess

Gets a value indicating whether the ProcessModule is 32-bit.

Declaration

bool Is32BitProcess { get; }

SearchBase

Gets the base address of the search area. When copied, this will be the address of the copy.

Declaration

nint SearchBase { get; }

TextSectionBase

Gets the base address of the .text section search area.

Declaration

nint TextSectionBase { get; }

TextSectionOffset

Gets the offset of the .text section from the base of the module.

Declaration

long TextSectionOffset { get; }

TextSectionSize

Gets the size of the text section.

Declaration

int TextSectionSize { get; }

DataSectionBase

Gets the base address of the .data section search area.

Declaration

nint DataSectionBase { get; }

DataSectionOffset

Gets the offset of the .data section from the base of the module.

Declaration

long DataSectionOffset { get; }

DataSectionSize

Gets the size of the .data section.

Declaration

int DataSectionSize { get; }

RDataSectionBase

Gets the base address of the .rdata section search area.

Declaration

nint RDataSectionBase { get; }

RDataSectionOffset

Gets the offset of the .rdata section from the base of the module.

Declaration

long RDataSectionOffset { get; }

RDataSectionSize

Gets the size of the .rdata section.

Declaration

int RDataSectionSize { get; }

Module

Gets the ProcessModule on which the search is performed.

Declaration

ProcessModule Module { get; }

Methods

GetStaticAddressFromSig(string, int)

Scan for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig. The signature and offset should not break through instruction boundaries.

Declaration

nint GetStaticAddressFromSig(string signature, int offset = 0)

Returns

System.IntPtr: An IntPtr to the static memory location.

Parameters

Type	Name	Description
System.String	signature	The signature of the function using the data.
System.Int32	offset	The offset from function start of the instruction using the data.

TryGetStaticAddressFromSig(string, out nint, int)

Try scanning for a .data address using a .text function. This is intended to be used with IDA sigs. Place your cursor on the line calling a static address, and create and IDA sig.

Declaration

bool TryGetStaticAddressFromSig(string signature, out nint result, int offset = 0)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature of the function using the data.
System.IntPtr	result	An IntPtr to the static memory location, if found.
System.Int32	offset	The offset from function start of the instruction using the data.

ScanData(string)

Scan for a byte signature in the .data section.

Declaration

nint ScanData(string signature)

Returns

System.IntPtr: The real offset of the found signature.

Parameters

Type	Name	Description
System.String	signature	The signature.

TryScanData(string, out nint)

Try scanning for a byte signature in the .data section.

Declaration

bool TryScanData(string signature, out nint result)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature.
System.IntPtr	result	The real offset of the signature, if found.

ScanModule(string)

Scan for a byte signature in the whole module search area.

Declaration

nint ScanModule(string signature)

Returns

System.IntPtr: The real offset of the found signature.

Parameters

Type	Name	Description
System.String	signature	The signature.

TryScanModule(string, out nint)

Try scanning for a byte signature in the whole module search area.

Declaration

bool TryScanModule(string signature, out nint result)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature.
System.IntPtr	result	The real offset of the signature, if found.

ResolveRelativeAddress(nint, int)

Resolve a RVA address.

Declaration

nint ResolveRelativeAddress(nint nextInstAddr, int relOffset)

Returns

System.IntPtr: The calculated offset.

Parameters

Type	Name	Description
System.IntPtr	nextInstAddr	The address of the next instruction.
System.Int32	relOffset	The relative offset.

ScanText(string)

Scan for a byte signature in the .text section.

Declaration

nint ScanText(string signature)

Returns

System.IntPtr: The real offset of the found signature.

Parameters

Type	Name	Description
System.String	signature	The signature.

TryScanText(string, out nint)

Try scanning for a byte signature in the .text section.

Declaration

bool TryScanText(string signature, out nint result)

Returns

System.Boolean: true if the signature was found.

Parameters

Type	Name	Description
System.String	signature	The signature.
System.IntPtr	result	The real offset of the signature, if found.

ScanAllText(string)

Scan for all matching byte signatures in the .text section.

Declaration

nint[] ScanAllText(string signature)

Returns

System.IntPtr[]: The list of real offsets of the found elements based on signature.

Parameters

Type	Name	Description
System.String	signature	The Signature.

ScanAllText(string, CancellationToken)

Scan for all matching byte signatures in the .text section.

Declaration

IEnumerable<nint> ScanAllText(string signature, CancellationToken cancellationToken)

Returns

System.Collections.Generic.IEnumerable<System.IntPtr>: Enumerable yielding the real offsets of the found elements based on signature.

Parameters

Type	Name	Description
System.String	signature	The Signature.
System.Threading.CancellationToken	cancellationToken	Cancellation token.