这是一个在字节数组中搜索字节模式(在进程内存中)的函数。
其中SearchFor
是要查找的字节数组。 SearchIn
是ReadProcessMemory
外部函数转储的字节数组。这也是使用通配符"?"
完成的。
问题是如果字节模式长度小于或等于32,它将搜索。否则返回intptr.zero。我不知道为什么。
Private Function WildCard(ByVal SearchIn As Byte(), ByVal SearchFor As Byte()) As IntPtr
Dim l As Integer = 0, m = 0
Dim iEnd As Integer = SearchFor.Length
Dim sBytes As Integer() = New Integer(&H100 - 1) {}
Dim i As Integer
For i = 0 To iEnd - 1
If (SearchFor(i) = &H3F) Then
l = (l Or (CInt(1) << ((iEnd - i) - 1)))
End If
Next i
If (l <> 0) Then
Dim j As Integer
For j = 0 To sBytes.Length - 1
sBytes(j) = l
Next j
End If
l = 1
Dim index As Integer = (iEnd - 1)
Do While (index >= 0)
sBytes(SearchFor(index)) = (sBytes(SearchFor(index)) Or l)
index -= 1
l = (l << 1)
Loop
Do While (m <= (SearchIn.Length - SearchFor.Length))
l = (SearchFor.Length - 1)
Dim length As Integer = SearchFor.Length
Dim k As Integer = -1
Do While (k <> 0)
k = (k And sBytes(SearchIn((m + l))))
If (k <> 0) Then
If (l = 0) Then
Return New IntPtr(m)
End If
length = l
End If
l -= 1
k = (k << 1)
Loop
m = (m + length)
Loop
Return IntPtr.Zero
End Function