Skip to content

Commit

Permalink
Fixed .bin executables, and case insensitive module checks
Browse files Browse the repository at this point in the history
  • Loading branch information
erfg12 committed Mar 16, 2020
1 parent 6a5c85e commit 9cc58e7
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions Memory/memory.cs
Original file line number Diff line number Diff line change
Expand Up @@ -452,6 +452,8 @@ public int GetProcIdFromName(string name) //new 1.0.2 function

if (name.Contains(".exe"))
name = name.Replace(".exe", "");
if (name.Contains(".bin")) // test
name = name.Replace(".bin", "");

foreach (Process theprocess in processlist)
{
Expand Down Expand Up @@ -1164,7 +1166,7 @@ public UIntPtr GetCode(string name, string path = "", int size = 8)
{
string[] moduleName = theCode.Split('+');
IntPtr altModule = IntPtr.Zero;
if (!moduleName[0].Contains(".dll") && !moduleName[0].Contains(".exe"))
if (!moduleName[0].ToLower().Contains(".dll") && !moduleName[0].ToLower().Contains(".exe") && !moduleName[0].ToLower().Contains(".bin"))
{
string theAddr = moduleName[0];
if (theAddr.Contains("0x")) theAddr = theAddr.Replace("0x", "");
Expand Down Expand Up @@ -1204,12 +1206,12 @@ public UIntPtr GetCode(string name, string path = "", int size = 8)
int trueCode = Convert.ToInt32(newOffsets, 16);
IntPtr altModule = IntPtr.Zero;
//Debug.WriteLine("newOffsets=" + newOffsets);
if (theCode.Contains("base") || theCode.Contains("main"))
if (theCode.ToLower().Contains("base") || theCode.ToLower().Contains("main"))
altModule = mainModule.BaseAddress;
else if (!theCode.Contains("base") && !theCode.Contains("main") && theCode.Contains("+"))
else if (!theCode.ToLower().Contains("base") && !theCode.ToLower().Contains("main") && theCode.Contains("+"))
{
string[] moduleName = theCode.Split('+');
if (!moduleName[0].Contains(".dll") && !moduleName[0].Contains(".exe"))
if (!moduleName[0].ToLower().Contains(".dll") && !moduleName[0].ToLower().Contains(".exe") && !moduleName[0].ToLower().Contains(".bin"))
{
string theAddr = moduleName[0];
if (theAddr.Contains("0x")) theAddr = theAddr.Replace("0x", "");
Expand Down Expand Up @@ -1292,7 +1294,7 @@ public UIntPtr Get64BitCode(string name, string path = "", int size = 16)
{
string[] moduleName = theCode.Split('+');
IntPtr altModule = IntPtr.Zero;
if (!moduleName[0].Contains(".dll") && !moduleName[0].Contains(".exe"))
if (!moduleName[0].ToLower().Contains(".dll") && !moduleName[0].ToLower().Contains(".exe") && !moduleName[0].ToLower().Contains(".bin"))
altModule = (IntPtr)Int64.Parse(moduleName[0], System.Globalization.NumberStyles.HexNumber);
else
{
Expand Down Expand Up @@ -1332,7 +1334,7 @@ public UIntPtr Get64BitCode(string name, string path = "", int size = 16)
else if (!theCode.Contains("base") && !theCode.Contains("main") && theCode.Contains("+"))
{
string[] moduleName = theCode.Split('+');
if (!moduleName[0].Contains(".dll") && !moduleName[0].Contains(".exe"))
if (!moduleName[0].ToLower().Contains(".dll") && !moduleName[0].ToLower().Contains(".exe") && !moduleName[0].ToLower().Contains(".bin"))
{
string theAddr = moduleName[0];
if (theAddr.Contains("0x")) theAddr = theAddr.Replace("0x", "");
Expand Down

0 comments on commit 9cc58e7

Please sign in to comment.