From fa6187dec24bb8c75f0cfa7882c8c8b2af4c120a Mon Sep 17 00:00:00 2001 From: Jacob Fliss Date: Wed, 17 Apr 2024 20:26:01 -0400 Subject: [PATCH] better wait to check for "main" and "base" --- Memory/memory.cs | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/Memory/memory.cs b/Memory/memory.cs index 6a8c927..c971b04 100644 --- a/Memory/memory.cs +++ b/Memory/memory.cs @@ -419,9 +419,11 @@ public UIntPtr GetCode(string name, string path = "", int size = 8) } int[] offsets = offsetsList.ToArray(); - if (theCode.ToLower().Equals("base") || theCode.ToLower().Equals("main")) + bool mainBase = (theCode.ToLower().Contains("base") || theCode.ToLower().Contains("main")) && !theCode.ToLower().Contains(".dll") && !theCode.ToLower().Contains(".exe"); + + if (mainBase) ReadProcessMemory(mProc.Handle, (UIntPtr)((int)mProc.MainModule.BaseAddress + offsets[0]), memoryAddress, (UIntPtr)size, IntPtr.Zero); - else if (!theCode.ToLower().Equals("base") && !theCode.ToLower().Equals("main") && theCode.Contains("+")) + else if (!mainBase && theCode.Contains("+")) { string[] moduleName = theCode.Split('+'); IntPtr altModule = IntPtr.Zero; @@ -465,9 +467,11 @@ public UIntPtr GetCode(string name, string path = "", int size = 8) int trueCode = Convert.ToInt32(newOffsets, 16); IntPtr altModule = IntPtr.Zero; //Debug.WriteLine("newOffsets=" + newOffsets); - if (theCode.ToLower().Equals("base") || theCode.ToLower().Equals("main")) + bool mainBase = (theCode.ToLower().Contains("base") || theCode.ToLower().Contains("main")) && !theCode.ToLower().Contains(".dll") && !theCode.ToLower().Contains(".exe"); + + if (mainBase) altModule = mProc.MainModule.BaseAddress; - else if (!theCode.ToLower().Equals("base") && !theCode.ToLower().Equals("main") && theCode.Contains("+")) + else if (!mainBase && theCode.Contains("+")) { string[] moduleName = theCode.Split('+'); if (!moduleName[0].ToLower().Contains(".dll") && !moduleName[0].ToLower().Contains(".exe") && !moduleName[0].ToLower().Contains(".bin")) @@ -567,9 +571,11 @@ public UIntPtr Get64BitCode(string name, string path = "", int size = 16) } Int64[] offsets = offsetsList.ToArray(); - if (theCode.ToLower().Equals("base") || theCode.ToLower().Equals("main")) + bool mainBase = (theCode.ToLower().Contains("base") || theCode.ToLower().Contains("main")) && !theCode.ToLower().Contains(".dll") && !theCode.ToLower().Contains(".exe"); + + if (mainBase) ReadProcessMemory(mProc.Handle, (UIntPtr)((Int64)mProc.MainModule.BaseAddress + offsets[0]), memoryAddress, (UIntPtr)size, IntPtr.Zero); - else if (!theCode.ToLower().Equals("base") && !theCode.ToLower().Equals("main") && theCode.Contains("+")) + else if (!mainBase && theCode.Contains("+")) { string[] moduleName = theCode.Split('+'); IntPtr altModule = IntPtr.Zero; @@ -608,9 +614,12 @@ public UIntPtr Get64BitCode(string name, string path = "", int size = 16) { Int64 trueCode = Convert.ToInt64(newOffsets, 16); IntPtr altModule = IntPtr.Zero; - if (theCode.ToLower().Equals("base") || theCode.ToLower().Equals("main")) + + bool mainBase = (theCode.ToLower().Contains("base") || theCode.ToLower().Contains("main")) && !theCode.ToLower().Contains(".dll") && !theCode.ToLower().Contains(".exe"); + + if (mainBase) altModule = mProc.MainModule.BaseAddress; - else if (!theCode.ToLower().Equals("base") && !theCode.ToLower().Equals("main") && theCode.Contains("+")) + else if (!mainBase && theCode.Contains("+")) { string[] moduleName = theCode.Split('+'); if (!moduleName[0].ToLower().Contains(".dll") && !moduleName[0].ToLower().Contains(".exe") && !moduleName[0].ToLower().Contains(".bin"))