https://github.com/notnite/magia
Code modding with flair - a set of C# libraries for helping interact with native code
https://github.com/notnite/magia
Last synced: 5 months ago
JSON representation
Code modding with flair - a set of C# libraries for helping interact with native code
- Host: GitHub
- URL: https://github.com/notnite/magia
- Owner: NotNite
- License: mit
- Created: 2024-04-22T19:21:29.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-04-23T02:46:29.000Z (about 2 years ago)
- Last Synced: 2024-12-31T11:16:48.143Z (over 1 year ago)
- Language: C#
- Size: 9.77 KB
- Stars: 3
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Magia
Code modding with flair. A set of C# libraries for helping interact with native code.
## Magia.Signatures
A signature scanning library, based off of [pelite's pattern format](https://docs.rs/pelite/latest/pelite/pattern/fn.parse.html).
Assumes you are injected into the target process and the target process is a x64 Windows application. Some features assume compiler quirks (e.g. MSVC function padding with `0xCC`). Signatures can be assembled from their class forms, or parsed from a string. The following commands are available:
- Whitespace is ignored. Comments (`#`) ignore the rest of the line.
- Match a literal byte by typing its two-letter hex representation (e.g. `E8`).
- Match displacements/offsets using the characters `%` (1 byte), `&` (2 byte), and `$` (4 byte).
- A `call` instruction can be represented as `E8 $`.
- Match 8-byte absolute pointers with the `*` character.
- Follow displacements with the `{ }` operator.
- For example, `E8 $ { more stuff here }` will match a function that calls the function matched inside of the braces.
- Execute multiple possible subpatterns with the `( )` operator.
- Separate subpatterns with `|`.
- Skip a byte with `??`, or skip multiple with `[ ]`.
- `??` for one byte, `[number]` for multiple (e.g. `[4]`).
- Square brackets support ranges (e.g. `[4-8]`).
- Skip an unknown number of bytes with `@`.
- This will repeat a search until it encounters a `CC`, which MSVC uses to pad functions.
- Save to the return array with `\`.
- Loads are currently unimplemented, but the `startOverride` argument can be passed to `SignatureScanner#Scan` to start the search at a specific address.
- Match UTF-8 string literals with quotes (e.g. `"Hello, world!"`).