-
Notifications
You must be signed in to change notification settings - Fork 6
Expand file tree
/
Copy pathMemoryOperation.cpp
More file actions
112 lines (89 loc) · 2.72 KB
/
Copy pathMemoryOperation.cpp
File metadata and controls
112 lines (89 loc) · 2.72 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
#include "MemoryOperation.h"
// --- Read ---
float MemoryOperation::Read_flaot(void* addr) {
if (!addr) return 0.0f;
return *(float*)addr;
}
int MemoryOperation::Read_int(void* addr) {
if (!addr) return 0;
return *(int*)addr;
}
bool MemoryOperation::Read_bool(void* addr) {
if (!addr) return false;
return *(bool*)addr;
}
double MemoryOperation::Read_double(void* addr) {
if (!addr) return 0.0;
return *(double*)addr;
}
uint8_t MemoryOperation::Read_byte(void* addr) {
if (!addr) return 0;
return *(uint8_t*)addr;
}
string MemoryOperation::Read_il2cppString(void* il2cppStringAddr) {
if (!il2cppStringAddr) return {};
return Engine::il2cppStringToStdString((Il2CppString*)il2cppStringAddr);
}
// --- Write ---
bool MemoryOperation::write_float(void* addr, float value) {
if (!addr) return false;
*(float*)addr = value;
return true;
}
bool MemoryOperation::write_double(void* addr, double value) {
if (!addr) return false;
*(double*)addr = value;
return true;
}
bool MemoryOperation::write_int(void* addr, int value) {
if (!addr) return false;
*(int*)addr = value;
return true;
}
bool MemoryOperation::write_bool(void* addr, bool value) {
if (!addr) return false;
*(bool*)addr = value;
return true;
}
bool MemoryOperation::write_byte(void* addr, uint8_t value) {
if (!addr) return false;
*(uint8_t*)addr = value;
return true;
}
bool MemoryOperation::write_il2cppString(void* addr, string value) {
if (!addr) return false;
wstring wval(value.begin(), value.end());
Il2CppString* newStr = Engine::create_il2cpp_string(wval.c_str());
*(Il2CppString**)addr = newStr;
return true;
}
int MemoryOperation::ScanFeature(const char* moduleName, const unsigned char* pattern, size_t patternLen,vector<uintptr_t>& results) {
HMODULE hMod = GetModuleHandleA(moduleName);
if (!hMod) return 0;
// 获取模块大小（简化版，实际应使用 Module32First 或 GetModuleInformation）
PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)hMod;
PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)((BYTE*)hMod + dos->e_lfanew);
size_t modSize = nt->OptionalHeader.SizeOfImage;
results.clear();
uintptr_t base = (uintptr_t)hMod;
for (uintptr_t i = 0; i < modSize - patternLen; i++) {
if (memcmp((void*)(base + i), pattern, patternLen) == 0) {
results.push_back(base + i);
}
}
return (int)results.size();
}
uintptr_t MemoryOperation::ReadRipRelativeValue(uintptr_t movAddr) {
// 验证指令
if (*(unsigned char*)movAddr != 0x48 ||
*(unsigned char*)(movAddr + 1) != 0x8B ||
*(unsigned char*)(movAddr + 2) != 0x05) {
return 0;
}
// 读取偏移
int32_t offset = *(int32_t*)(movAddr + 3);
uintptr_t nextInsn = movAddr + 7;
uintptr_t targetAddr = nextInsn + offset;
// 读取目标地址中的 qword 值
return *(uintptr_t*)targetAddr;
}