DWORD cExMemory::FindSignature(DWORD base, DWORD size, byte* sign, char* mask)
{
MEMORY_BASIC_INFORMATION mbi = { 0 };
DWORD offset = 0;
while (offset < size)
{
VirtualQueryEx(this->pHandle, (LPCVOID)(base + offset), &mbi, sizeof(MEMORY_BASIC_INFORMATION));
if (mbi.State != MEM_FREE)
{
byte* buffer = new byte[mbi.RegionSize];
ReadProcessMemory(this->pHandle, mbi.BaseAddress, buffer, mbi.RegionSize, NULL);
for (size_t i = 0; i < mbi.RegionSize; i++)
{
if (DataCompare(buffer + i, sign, mask))
{
delete[] buffer;
return (DWORD)mbi.BaseAddress + i;
}
}
delete[] buffer;
}
offset += mbi.RegionSize;
}
return 0;
}
bool cExMemory::DataCompare(byte* data, byte* sign, char* mask)
{
for (; *mask; mask++, sign++, data++)
{
if (*mask == 'x' && *data != *sign)
return false;
}
return true;
}
this->pHandle - передаешь хендл нужного процесса