| 4 | |
| 5 | |
| 6 | BOOL FindLargestSection(HANDLE hProcess, uintptr_t moduleAddr, uintptr_t& resultAddress) { |
| 7 | |
| 8 | MEMORY_BASIC_INFORMATION memoryInfo; |
| 9 | uintptr_t offset = moduleAddr; |
| 10 | |
| 11 | SIZE_T largestRegion = 0; |
| 12 | |
| 13 | while (VirtualQueryEx(hProcess, reinterpret_cast<LPVOID>(offset), &memoryInfo, sizeof(memoryInfo))) |
| 14 | { |
| 15 | if (memoryInfo.State == MEM_COMMIT && (memoryInfo.Protect & PAGE_READONLY) != 0 && memoryInfo.Type == MEM_IMAGE) |
| 16 | { |
| 17 | if (memoryInfo.RegionSize > largestRegion) { |
| 18 | largestRegion = memoryInfo.RegionSize; |
| 19 | resultAddress = reinterpret_cast<uintptr_t>(memoryInfo.BaseAddress); |
| 20 | } |
| 21 | } |
| 22 | offset += memoryInfo.RegionSize; |
| 23 | } |
| 24 | if (largestRegion > 0) |
| 25 | return TRUE; |
| 26 | |
| 27 | return FALSE; |
| 28 | } |
| 29 | |
| 30 | void PatchPattern(BYTE* pattern, BYTE baseAddrPattern[], size_t offset) { |
| 31 | size_t szAddr = sizeof(uintptr_t) - 1; |