C# Find sequence of bytes in memory

Question

Im trying to find out if there is a simple way of searching for a sequence of bytes in a programs memory. More specifically, I want to search through a dll that is loaded into memory and find the VA/RVA of the address where those bytes are. Is this possible?

I know I can read the contents of a dll and then search, but I not sure how I can get the VA/RVA of the location.

Thanks

Answer 1

I don't know exactly how you manage to acces memory but if you know pattern of things you search and have access to memory chunks you can pretty much find everything through ORegex.

var memory_bytes = new byte[] {0, 0, 0, 0, 254, 255, 254, 0, 0, 0, 254};

var oregex = new ORegex<byte>("{0}{1}{0}",x=> x==254, x=> x==255);
var matches = oregex.Matches(memory_bytes);

///OUTPUT: [254,255,254]