Overview
The resolver:- Scans the
.textsection of native modules for byte patterns - Supports wildcard patterns (
??for unknown bytes) - Follows relative jumps/calls to locate final addresses
- Caches results for fast subsequent launches
- Registers all
Addressobjects generated by InteropGenerator
Core API
Resolver.GetInstance
Access the singleton resolver instance:ResolverThread-safety: Singleton is thread-safe, but setup/resolve should be called once
Setup Methods
Setup (Auto-detect)
Automatically detects the current process’s main module:moduleCopyPointer- Optional pointer to a copy of the module in memory (for scanning without touching live memory)version- Version string for cache validation (e.g., game version)cacheFile- Optional file path for caching resolved addresses
Setup (Manual Module)
Manually specify the module to scan:modulePointer- Base address of the native modulemoduleSize- Size of the module in bytesmoduleCopyPointer- Optional pointer to a memory copy for scanningversion- Version string for cache validationcacheFile- Optional cache file path
Setup (Manual Text Section)
Directly specify the.text section for maximum control:
memoryPointer- Base address of the memory regionmemorySize- Total size of the memory regiontextSectionOffset- Offset to the.textsectiontextSectionSize- Size of the.textsectionversion- Version string for cache validationcacheFile- Optional cache file path
- You’ve already parsed PE headers
- Working with non-standard module layouts
- Need precise control over scan regions
Address Registration
RegisterAddress
Register anAddress object for resolution:
UnregisterAddress
Remove an address from the resolver:- Dynamically unloading code
- Cleaning up temporary addresses
- Managing address lifetime manually
Resolution
Resolve
Scan memory and resolve all registered addresses:- Check cache for previously resolved addresses
- Scan
.textsection for remaining signatures - Follow relative offsets to final addresses
- Update cache with new results
- Save cache to disk (if configured)
- First run: Full scan (typically 50-500ms depending on module size)
- Cached runs: Near-instant (1-10ms)
- Incremental: Only scans for missing addresses
Address Object
Address Structure
Represents a signature pattern and its resolved address:RelativeFollowOffsets
Array of offsets to follow relative addresses (common in x64 code): Example pattern:- Find pattern in memory
- Read 4-byte relative offset at position + 3
- Calculate final address:
position + 3 + 4 + relative_offset - Set
Valueto final address
Caching
Cache File Format
The cache is stored as JSON:- Simple signatures:
{signature} - With relative follow:
{signature}+relfollow[{offset1},{offset2}]
- Cache is invalidated if version string doesn’t match
- Prevents using stale addresses after game updates
Cache Performance
Benefits:- 100x+ faster startup after first launch
- Reduces memory scanning overhead
- Persists across application restarts
- Version mismatch
- Cache file corruption
- Manual deletion
Complete Workflow
Basic Setup
Manual Module Scanning
With Module Copy
Error Handling
Common Issues
Unresolved addresses:Performance Optimization
Minimize Signatures
Use unique, short signatures:Cache Everything
Always use cache files in production:Reduce Address Count
Only register addresses you actually use:Advanced Usage
Custom Address Registration
Partial Resolution
See Also
- Interop Attributes - Signature attribute reference
- Source Generators - How Address objects are generated
- Signature Patterns - Writing effective signatures