NoLogos.MRWL 0.1.4

MRWL

A simple raw memory reading and writing library for .NET, Windows only.

Install

dotnet add package NoLogos.MRWL

Usage

using MRWL;

RWL rwl = new RWL("target_process");
IntPtr moduleBase = rwl.GetModuleBase("target_process.dll");

int health = rwl.ReadInt(moduleBase + 0x1A2B3C);
rwl.WriteInt(moduleBase + 0x1A2B3C, 100);

IntPtr finalAddress = rwl.ReadPointer(moduleBase, new[] { 0x10, 0x20 });
int value = rwl.ReadInt(finalAddress);

rwl.Close();

Features

• Read/Write all common types: bool, byte, sbyte, short, ushort, int, uint, long, ulong, float, double, decimal, char, string, byte[]
• Numerics support: Vector2/3/4, Quaternion, Matrix4x4, Matrix3x2, Plane, Complex
• Pointer chains: rwl.ReadPointer(baseAddress, new[] { 0x10, 0x20 })
• Pattern scanning: rwl.FindPattern("client.dll", "48 8B 05 ?? ?? ?? ??")

For direct access without the RWL wrapper, use MemoryIO.Read<T> or MemoryIO.Write<T> with a process handle from MemoryIO.OpenTargetProcess(pid).

Functions

• Read/Write Most read functions are just Read{Type}(IntPtr address), returning the value. Write functions are Write{Type}(IntPtr address, {Type} value). ReadString/WriteString are the exception — see below.
• Module addresses GetModuleBase returns an IntPtr, ready to pass straight into a Read/Write call.
• Pattern scanning FindPattern(moduleName, signature, offset = 0) returns an int — cast to IntPtr before passing into a Read/Write call. signature is a space-separated list of hex bytes; use ??, ?, *, or ** as a wildcard byte. offset is added to the match address before it's returned.
• Pointers The pointer function has two forms, chained and single. The chained form takes an array of ints counted as offsets from the base address; the single form takes just one int offset. Both take an IntPtr base address and return an IntPtr.
• Reading/Writing bytes ReadBytes(IntPtr address, int length) reads length bytes starting at the address. WriteBytes(IntPtr address, byte[] buffer) writes the given buffer starting at the address.
• Strings ReadString(IntPtr address, int length) reads length bytes and decodes them as UTF-8. WriteString(IntPtr address, string value) encodes the string as UTF-8 and writes it.
• Close rwl.Close() releases the underlying process handle — call it when you're done with an RWL instance.

License

MIT