public RemoteFunction FindFunction(string functionName)
{
// Create the tuple
var tuple = Tuple.Create(functionName, MemorySharp.Handle);
// Check if the function is already cached
if (CachedFunctions.ContainsKey(tuple))
return CachedFunctions[tuple];
// If the function is not cached
// Check if the local process has this module loaded
var localModule = Process.GetCurrentProcess().Modules.Cast<ProcessModule>().FirstOrDefault(m => m.FileName.ToLower() == Path.ToLower());
var isManuallyLoaded = false;
try
{
// If this is not the case, load the module inside the local process
if (localModule == null)
{
isManuallyLoaded = true;
localModule = ModuleCore.LoadLibrary(Native.FileName);
}
// Get the offset of the function
var offset = ModuleCore.GetProcAddress(localModule, functionName).ToInt64() - localModule.BaseAddress.ToInt64();
// Rebase the function with the remote module
var function = new RemoteFunction(MemorySharp, new IntPtr(Native.BaseAddress.ToInt64() + offset), functionName);
// Store the function in the cache
CachedFunctions.Add(tuple, function);
// Return the function rebased with the remote module
return function;
}
finally
{
// Free the module if it was manually loaded
if(isManuallyLoaded)
ModuleCore.FreeLibrary(localModule);
}
}