diff --git a/Memory/Methods/AoB.cs b/Memory/Methods/AoB.cs index c811c09..238e8f9 100644 --- a/Memory/Methods/AoB.cs +++ b/Memory/Methods/AoB.cs @@ -22,7 +22,7 @@ public partial class Mem /// IEnumerable of all addresses found. public Task> AoBScan(string search, bool writable = false, bool executable = true, string file = "") { - return AoBScan(0, long.MaxValue, search, writable, executable, file); + return AoBScan(0, long.MaxValue, search, writable, executable, false, file); } /// @@ -36,7 +36,7 @@ public Task> AoBScan(string search, bool writable = false, boo /// IEnumerable of all addresses found. public Task> AoBScan(string search, bool readable, bool writable, bool executable, string file = "") { - return AoBScan(0, long.MaxValue, search, readable, writable, executable, file); + return AoBScan(0, long.MaxValue, search, readable, writable, executable, false, file); } @@ -49,11 +49,12 @@ public Task> AoBScan(string search, bool readable, bool writab /// ini file (OPTIONAL) /// Include writable addresses in scan /// Include executable addresses in scan + /// Include mapped addresses in scan /// IEnumerable of all addresses found. - public Task> AoBScan(long start, long end, string search, bool writable = false, bool executable = true, string file = "") + public Task> AoBScan(long start, long end, string search, bool writable = false, bool executable = true, bool mapped = false, string file = "") { // Not including read only memory was scan behavior prior. - return AoBScan(start, end, search, false, writable, executable, file); + return AoBScan(start, end, search, false, writable, executable, mapped, file); } /// @@ -66,8 +67,9 @@ public Task> AoBScan(long start, long end, string search, bool /// Include readable addresses in scan /// Include writable addresses in scan /// Include executable addresses in scan + /// Include mapped addresses in scan /// IEnumerable of all addresses found. - public Task> AoBScan(long start, long end, string search, bool readable, bool writable, bool executable, string file = "") + public Task> AoBScan(long start, long end, string search, bool readable, bool writable, bool executable, bool mapped, string file = "") { return Task.Run(() => { @@ -136,6 +138,8 @@ public Task> AoBScan(long start, long end, string search, bool isValid &= ((memInfo.Protect & PAGE_GUARD) == 0); isValid &= ((memInfo.Protect & PAGE_NOACCESS) == 0); isValid &= (memInfo.Type == MEM_PRIVATE) || (memInfo.Type == MEM_IMAGE); + if (mapped) + isValid &= (memInfo.Type == MEM_MAPPED); if (isValid) { @@ -224,7 +228,7 @@ public async Task AoBScan(string code, long end, string search, string fil { long start = (long)GetCode(code, file).ToUInt64(); - return (await AoBScan(start, end, search, true, true, true, file)).FirstOrDefault(); + return (await AoBScan(start, end, search, true, true, true, false, file)).FirstOrDefault(); } private long[] CompareScan(MemoryRegionResult item, byte[] aobPattern, byte[] mask) diff --git a/Memory/Structures/Imports.cs b/Memory/Structures/Imports.cs index e23731e..695db22 100644 --- a/Memory/Structures/Imports.cs +++ b/Memory/Structures/Imports.cs @@ -221,6 +221,7 @@ OUT LPVOID lpBytesBuffer public const uint MEM_PRIVATE = 0x20000; public const uint MEM_IMAGE = 0x1000000; + public const uint MEM_MAPPED = 0x40000; internal enum NTSTATUS {