diff --git a/Memory/Methods/AoB.cs b/Memory/Methods/AoB.cs
index c811c09..238e8f9 100644
--- a/Memory/Methods/AoB.cs
+++ b/Memory/Methods/AoB.cs
@@ -22,7 +22,7 @@ public partial class Mem
/// IEnumerable of all addresses found.
public Task> AoBScan(string search, bool writable = false, bool executable = true, string file = "")
{
- return AoBScan(0, long.MaxValue, search, writable, executable, file);
+ return AoBScan(0, long.MaxValue, search, writable, executable, false, file);
}
///
@@ -36,7 +36,7 @@ public Task> AoBScan(string search, bool writable = false, boo
/// IEnumerable of all addresses found.
public Task> AoBScan(string search, bool readable, bool writable, bool executable, string file = "")
{
- return AoBScan(0, long.MaxValue, search, readable, writable, executable, file);
+ return AoBScan(0, long.MaxValue, search, readable, writable, executable, false, file);
}
@@ -49,11 +49,12 @@ public Task> AoBScan(string search, bool readable, bool writab
/// ini file (OPTIONAL)
/// Include writable addresses in scan
/// Include executable addresses in scan
+ /// Include mapped addresses in scan
/// IEnumerable of all addresses found.
- public Task> AoBScan(long start, long end, string search, bool writable = false, bool executable = true, string file = "")
+ public Task> AoBScan(long start, long end, string search, bool writable = false, bool executable = true, bool mapped = false, string file = "")
{
// Not including read only memory was scan behavior prior.
- return AoBScan(start, end, search, false, writable, executable, file);
+ return AoBScan(start, end, search, false, writable, executable, mapped, file);
}
///
@@ -66,8 +67,9 @@ public Task> AoBScan(long start, long end, string search, bool
/// Include readable addresses in scan
/// Include writable addresses in scan
/// Include executable addresses in scan
+ /// Include mapped addresses in scan
/// IEnumerable of all addresses found.
- public Task> AoBScan(long start, long end, string search, bool readable, bool writable, bool executable, string file = "")
+ public Task> AoBScan(long start, long end, string search, bool readable, bool writable, bool executable, bool mapped, string file = "")
{
return Task.Run(() =>
{
@@ -136,6 +138,8 @@ public Task> AoBScan(long start, long end, string search, bool
isValid &= ((memInfo.Protect & PAGE_GUARD) == 0);
isValid &= ((memInfo.Protect & PAGE_NOACCESS) == 0);
isValid &= (memInfo.Type == MEM_PRIVATE) || (memInfo.Type == MEM_IMAGE);
+ if (mapped)
+ isValid &= (memInfo.Type == MEM_MAPPED);
if (isValid)
{
@@ -224,7 +228,7 @@ public async Task AoBScan(string code, long end, string search, string fil
{
long start = (long)GetCode(code, file).ToUInt64();
- return (await AoBScan(start, end, search, true, true, true, file)).FirstOrDefault();
+ return (await AoBScan(start, end, search, true, true, true, false, file)).FirstOrDefault();
}
private long[] CompareScan(MemoryRegionResult item, byte[] aobPattern, byte[] mask)
diff --git a/Memory/Structures/Imports.cs b/Memory/Structures/Imports.cs
index e23731e..695db22 100644
--- a/Memory/Structures/Imports.cs
+++ b/Memory/Structures/Imports.cs
@@ -221,6 +221,7 @@ OUT LPVOID lpBytesBuffer
public const uint MEM_PRIVATE = 0x20000;
public const uint MEM_IMAGE = 0x1000000;
+ public const uint MEM_MAPPED = 0x40000;
internal enum NTSTATUS
{