#pragma once #include #include #include namespace wowee { namespace game { /** * Provides WoW.exe PE memory image for Warden MEM_CHECK responses. * Parses PE headers to build a flat virtual memory image, then serves * readMemory() calls with real bytes. Also mocks KUSER_SHARED_DATA. */ class WardenMemory { public: WardenMemory(); ~WardenMemory(); /** Search standard candidate dirs for WoW.exe and load it. * @param build Client build number (e.g. 5875 for Classic 1.12.1) to select the right exe. */ bool load(uint16_t build = 0); /** Load PE image from a specific file path. */ bool loadFromFile(const std::string& exePath); /** * Read bytes from virtual address space. * Handles PE sections + KUSER_SHARED_DATA mock. */ bool readMemory(uint32_t va, uint8_t length, uint8_t* outBuf) const; bool isLoaded() const { return loaded_; } private: bool loaded_ = false; uint32_t imageBase_ = 0; uint32_t imageSize_ = 0; std::vector image_; // KUSER_SHARED_DATA mock (0x7FFE0000 - 0x7FFE0FFF) static constexpr uint32_t KUSER_BASE = 0x7FFE0000; static constexpr uint32_t KUSER_SIZE = 0x1000; uint8_t kuserData_[KUSER_SIZE] = {}; bool parsePE(const std::vector& fileData); void initKuserSharedData(); void patchRuntimeGlobals(); void writeLE32(uint32_t va, uint32_t value); std::string findWowExe(uint16_t build) const; static uint32_t expectedImageSizeForBuild(uint16_t build); }; } // namespace game } // namespace wowee