Update code

src/analysis/buttons.rs

@@ -2,15 +2,13 @@ use log::debug;
 
 use memflow::prelude::v1::*;
 
-use pelite::pattern;
-use pelite::pe64::{Pe, PeView};
-
 use serde::{Deserialize, Serialize};
 
-use crate::error::{Error, Result};
-use crate::source2::KeyboardKey;
+use skidscan_macros::signature;
+
+use crate::error::{Error, Result};
+use crate::source2::KeyButton;
 
-/// Represents a key button.
 #[derive(Debug, Deserialize, Serialize)]
 pub struct Button {
     pub name: String,
@@ -18,21 +16,15 @@ pub struct Button {
 }
 
 pub fn buttons(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<Vec<Button>> {
-    let module = process.module_by_name("client.dll")?;
+    let module = process.module_by_name("libclient.so")?;
     let buf = process.read_raw(module.base, module.size as _)?;
 
-    let view = PeView::from_bytes(&buf)?;
+    let list_addr = signature!("48 8B 15 ? ? ? ? 48 89 83 ? ? ? ? 48 85 D2")
+        .scan(&buf)
+        .and_then(|result| process.read_addr64_rip(module.base + result).ok())
+        .ok_or_else(|| Error::Other("unable to read button list address"))?;
 
-    let mut save = [0; 2];
-
-    if !view
-        .scanner()
-        .finds_code(pattern!("488b15${'} 4885d2 74? 0f1f40"), &mut save)
-    {
-        return Err(Error::Other("unable to find button list signature"));
-    }
-
-    read_buttons(process, &module, module.base + save[1])
+    read_buttons(process, &module, list_addr)
 }
 
 fn read_buttons(
@@ -42,14 +34,14 @@ fn read_buttons(
 ) -> Result<Vec<Button>> {
     let mut buttons = Vec::new();
 
-    let mut key_ptr = Pointer64::<KeyboardKey>::from(process.read_addr64(list_addr)?);
+    let mut cur_button = Pointer64::<KeyButton>::from(process.read_addr64(list_addr)?);
 
-    while !key_ptr.is_null() {
-        let key = key_ptr.read(process)?;
-        let name = key.name.read_string(process)?.to_string();
+    while !cur_button.is_null() {
+        let button = cur_button.read(process)?;
+        let name = button.name.read_string(process)?.to_string();
 
         let value =
-            ((key_ptr.address() - module.base) + offset_of!(KeyboardKey.state) as i64) as u32;
+            ((cur_button.address() - module.base) + offset_of!(KeyButton.state) as i64) as u32;
 
         debug!(
             "found button: {} at {:#X} ({} + {:#X})",
@@ -61,7 +53,7 @@ fn read_buttons(
 
         buttons.push(Button { name, value });
 
-        key_ptr = key.next;
+        cur_button = button.next;
     }
 
     // Sort buttons by name.

src/analysis/interfaces.rs

@@ -4,17 +4,15 @@ use log::debug;
 
 use memflow::prelude::v1::*;
 
-use pelite::pattern;
-use pelite::pe64::{Pe, PeView};
-
 use serde::{Deserialize, Serialize};
 
+use skidscan_macros::signature;
+
 use crate::error::Result;
 use crate::source2::InterfaceReg;
 
 pub type InterfaceMap = BTreeMap<String, Vec<Interface>>;
 
-/// Represents an exposed interface.
 #[derive(Debug, Deserialize, Serialize)]
 pub struct Interface {
     pub name: String,
@@ -28,18 +26,11 @@ pub fn interfaces(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<Interfa
         .filter_map(|module| {
             let buf = process.read_raw(module.base, module.size as _).ok()?;
 
-            let view = PeView::from_bytes(&buf).ok()?;
+            let list_addr = signature!("48 8B 1D ? ? ? ? 48 85 DB 74 ? 49 89 FC")
+                .scan(&buf)
+                .and_then(|result| process.read_addr64_rip(module.base + result).ok())?;
 
-            let mut save = [0; 2];
-
-            if !view
-                .scanner()
-                .finds_code(pattern!("4c8b0d${'} 4c8bd2 4c8bd9"), &mut save)
-            {
-                return None;
-            }
-
-            read_interfaces(process, module, module.base + save[1])
+            read_interfaces(process, module, list_addr)
                 .ok()
                 .filter(|ifaces| !ifaces.is_empty())
                 .map(|ifaces| Ok((module.name.to_string(), ifaces)))
@@ -54,13 +45,12 @@ fn read_interfaces(
 ) -> Result<Vec<Interface>> {
     let mut ifaces = Vec::new();
 
-    let mut reg_ptr = Pointer64::<InterfaceReg>::from(process.read_addr64(list_addr)?);
+    let mut cur_reg = Pointer64::<InterfaceReg>::from(process.read_addr64(list_addr)?);
 
-    while !reg_ptr.is_null() {
-        let reg = reg_ptr.read(process)?;
+    while !cur_reg.is_null() {
+        let reg = cur_reg.read(process)?;
         let name = reg.name.read_string(process)?.to_string();
-
-        let value = (reg.create_fn - module.base) as u32;
+        let value = (reg.create_fn.address() - module.base) as u32;
 
         debug!(
             "found interface: {} at {:#X} ({} + {:#X})",
@@ -72,7 +62,7 @@ fn read_interfaces(
 
         ifaces.push(Interface { name, value });
 
-        reg_ptr = reg.next;
+        cur_reg = reg.next;
     }
 
     // Sort interfaces by name.

src/analysis/mod.rs

@@ -3,7 +3,33 @@ pub use interfaces::*;
 pub use offsets::*;
 pub use schemas::*;
 
-pub mod buttons;
-pub mod interfaces;
-pub mod offsets;
-pub mod schemas;
+use memflow::prelude::v1::*;
+
+use crate::error::Result;
+
+mod buttons;
+mod interfaces;
+mod offsets;
+mod schemas;
+
+#[derive(Debug)]
+pub struct AnalysisResult {
+    pub buttons: Vec<Button>,
+    pub interfaces: InterfaceMap,
+    pub offsets: OffsetMap,
+    pub schemas: SchemaMap,
+}
+
+pub fn analyze_all(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<AnalysisResult> {
+    let buttons = buttons(process)?;
+    let interfaces = interfaces(process)?;
+    let offsets = offsets(process)?;
+    let schemas = schemas(process)?;
+
+    Ok(AnalysisResult {
+        buttons,
+        interfaces,
+        offsets,
+        schemas,
+    })
+}

src/analysis/offsets.rs

@@ -1,141 +1,95 @@
 use std::collections::BTreeMap;
+use std::mem;
+use std::str::FromStr;
 
-use log::debug;
+use log::{debug, error};
 
 use memflow::prelude::v1::*;
 
-use pelite::pattern;
-use pelite::pattern::{save_len, Atom};
-use pelite::pe64::{Pe, PeView};
+use serde::{Deserialize, Serialize};
 
-use phf::{phf_map, Map};
+use crate::config::{Operation, Signature, CONFIG};
+use crate::error::{Error, Result};
 
-use crate::error::Result;
+pub type OffsetMap = BTreeMap<String, Vec<Offset>>;
 
-pub type OffsetMap = BTreeMap<String, BTreeMap<String, u32>>;
-
-macro_rules! pattern_map {
-    ($($module:ident => {
-        $($name:expr => $pattern:expr $(=> $callback:expr)?),+ $(,)?
-    }),+ $(,)?) => {
-        $(
-            mod $module {
-                use super::*;
-
-                pub(super) const PATTERNS: Map<
-                    &'static str,
-                    (
-                        &'static [Atom],
-                        Option<fn(&PeView, &mut BTreeMap<String, u32>, u32)>,
-                    ),
-                > = phf_map! {
-                    $($name => ($pattern, $($callback)?)),+
-                };
-
-                pub fn offsets(view: PeView<'_>) -> BTreeMap<String, u32> {
-                    let mut map = BTreeMap::new();
-
-                    for (&name, (pat, callback)) in &PATTERNS {
-                        let mut save = vec![0; save_len(pat)];
-
-                        if !view.scanner().finds_code(pat, &mut save) {
-                            continue;
-                        }
-
-                        let rva = save[1];
-
-                        map.insert(name.to_string(), rva);
-
-                        if let Some(callback) = callback {
-                            callback(&view, &mut map, rva);
-                        }
-                    }
-
-                    for (name, value) in &map {
-                        debug!(
-                            "found offset: {} at {:#X} ({}.dll + {:#X})",
-                            name,
-                            *value as u64 + view.optional_header().ImageBase,
-                            stringify!($module),
-                            value
-                        );
-                    }
-
-                    map
-                }
-            }
-        )+
-    };
-}
-
-pattern_map! {
-    client => {
-        "dwCSGOInput" => pattern!("4c8b0d${*{'}} 488d045b") => Some(|view, map, rva| {
-            let mut save = [0; 2];
-
-            if view.scanner().finds_code(pattern!("498d81u4 4803c7"), &mut save) {
-                map.insert("dwViewAngles".to_string(), rva + save[1]);
-            }
-        }),
-        "dwEntityList" => pattern!("488935${'} 4885f6") => None,
-        "dwGameEntitySystem" => pattern!("488b1d${'} 48891d") => None,
-        "dwGameEntitySystem_getHighestEntityIndex" => pattern!("8b81u2?? 8902 488bc2 c3 cccccccc 48895c24? 48896c24") => None,
-        "dwGameRules" => pattern!("48890d${'} 8b0d${} ff15") => None,
-        "dwGlobalVars" => pattern!("48890d${'} 488941") => None,
-        "dwGlowManager" => pattern!("488b05${'} c3 cccccccccccccccc 8b41") => None,
-        "dwLocalPlayerController" => pattern!("488b05${'} 4885c0 74? 8b88") => None,
-        "dwPlantedC4" => pattern!("488b15${'} ffc0 488d4c24") => None,
-        "dwPrediction" => pattern!("488d05${'} c3 cccccccccccccccc 4883ec? 8b0d") => Some(|_view, map, rva| {
-            map.insert("dwLocalPlayerPawn".to_string(), rva + 0x138);
-        }),
-        "dwSensitivity" => pattern!("488b05${'} 488b40? f3410f59f4") => None,
-        "dwSensitivity_sensitivity" => pattern!("ff50u1 4c8bc6 488d55? 488bcf e8${} 84c0 0f85${} 4c8d45? 8bd3 488bcf e8${} e9${} f30f1006") => None,
-        "dwViewMatrix" => pattern!("488d0d${'} 48c1e006") => None,
-        "dwViewRender" => pattern!("488905${'} 488bc8 4885c0") => None,
-    },
-    engine2 => {
-        "dwBuildNumber" => pattern!("8905${'} 488d0d${} ff15${} e9") => None,
-        "dwNetworkGameClient" => pattern!("48893d${'} 488d15") => None,
-        "dwNetworkGameClient_deltaTick" => pattern!("8983u4 40b7") => None,
-        "dwNetworkGameClient_getLocalPlayer" => pattern!("4883c0u1 488d0440 458b04c7") => Some(|_view, map, rva| {
-            // .text 48 83 C0 0A   add rax, 0Ah
-            // .text 48 8D 04 40   lea rax, [rax+rax*2]
-            // .text 45 8B 04 C7   mov r8d, [r15+rax*8]
-            map.insert("dwNetworkGameClient_getLocalPlayer".to_string(), (rva + (rva * 2)) * 8);
-        }),
-        "dwNetworkGameClient_getMaxClients" => pattern!("8b81u2?? c3cccccccccccccccccc 8b81${} ffc0") => None,
-        "dwNetworkGameClient_signOnState" => pattern!("448b81u2?? 488d0d") => None,
-        "dwWindowHeight" => pattern!("8b05${'} 8903") => None,
-        "dwWindowWidth" => pattern!("8b05${'} 8907") => None,
-    },
-    input_system => {
-        "dwInputSystem" => pattern!("488905${'} 488d05") => None,
-    },
-    matchmaking => {
-        "dwGameTypes" => pattern!("488d0d${'} 33d2") => Some(|_view, map, rva| {
-            map.insert("dwGameTypes_mapName".to_string(), rva + 0x120);
-        }),
-    },
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Offset {
+    pub name: String,
+    pub value: u32,
 }
 
 pub fn offsets(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<OffsetMap> {
     let mut map = BTreeMap::new();
 
-    let modules: [(&str, fn(PeView) -> BTreeMap<String, u32>); 4] = [
-        ("client.dll", client::offsets),
-        ("engine2.dll", engine2::offsets),
-        ("inputsystem.dll", input_system::offsets),
-        ("matchmaking.dll", matchmaking::offsets),
-    ];
-
-    for (module_name, callback) in &modules {
+    for (module_name, sigs) in CONFIG.signatures.iter().flatten() {
         let module = process.module_by_name(module_name)?;
-        let buf = process.read_raw(module.base, module.size as _)?;
 
-        let view = PeView::from_bytes(&buf)?;
+        let mut offsets: Vec<_> = sigs
+            .iter()
+            .filter_map(|sig| match read_offset(process, &module, sig) {
+                Ok(offset) => Some(offset),
+                Err(err) => {
+                    error!("{}", err);
 
-        map.insert(module_name.to_string(), callback(view));
+                    None
+                }
+            })
+            .collect();
+
+        if !offsets.is_empty() {
+            offsets.sort_unstable_by(|a, b| a.name.cmp(&b.name));
+
+            map.insert(module_name.to_string(), offsets);
+        }
     }
 
     Ok(map)
 }
+
+fn read_offset(
+    process: &mut IntoProcessInstanceArcBox<'_>,
+    module: &ModuleInfo,
+    signature: &Signature,
+) -> Result<Offset> {
+    let buf = process.read_raw(module.base, module.size as _)?;
+
+    let addr = skidscan::Signature::from_str(&signature.pattern)?
+        .scan(&buf)
+        .ok_or_else(|| Error::SignatureNotFound(signature.name.clone()))?;
+
+    let mut result = module.base + addr;
+
+    for op in &signature.operations {
+        result = match op {
+            Operation::Add { value } => result + *value,
+            Operation::Rip { offset, len } => {
+                let offset: i32 = process.read(result + offset.unwrap_or(3))?;
+
+                (result + offset) + len.unwrap_or(7)
+            }
+            Operation::Read => process.read_addr64(result)?,
+            Operation::Slice { start, end } => {
+                let buf = process.read_raw(result + *start, end - start)?;
+
+                let mut bytes = [0; mem::size_of::<usize>()];
+
+                bytes[..buf.len()].copy_from_slice(&buf);
+
+                usize::from_le_bytes(bytes).into()
+            }
+            Operation::Sub { value } => result - *value,
+        };
+    }
+
+    let value = (result - module.base)
+        .try_into()
+        .map_or_else(|_| result.to_umem() as u32, |v| v);
+
+    debug!("found offset: {} at {:#X}", signature.name, value);
+
+    Ok(Offset {
+        name: signature.name.clone(),
+        value,
+    })
+}

src/analysis/schemas.rs

@@ -1,27 +1,24 @@
 use std::collections::BTreeMap;
 use std::ffi::CStr;
-use std::mem;
-use std::ops::Add;
 
 use log::debug;
 
 use memflow::prelude::v1::*;
 
-use pelite::pattern;
-use pelite::pe64::{Pe, PeView};
-
 use serde::{Deserialize, Serialize};
 
+use skidscan_macros::signature;
+
 use crate::error::{Error, Result};
 use crate::source2::*;
 
 pub type SchemaMap = BTreeMap<String, (Vec<Class>, Vec<Enum>)>;
 
-#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
+#[derive(Clone, Debug, Deserialize, Serialize)]
 pub enum ClassMetadata {
     Unknown { name: String },
     NetworkChangeCallback { name: String },
-    NetworkVarNames { name: String, ty: String },
+    NetworkVarNames { name: String, type_name: String },
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -29,22 +26,22 @@ pub struct Class {
     pub name: String,
     pub module_name: String,
     pub parent: Option<Box<Class>>,
-    pub metadata: Option<Vec<ClassMetadata>>,
+    pub metadata: Vec<ClassMetadata>,
     pub fields: Vec<ClassField>,
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct ClassField {
     pub name: String,
-    pub ty: String,
-    pub offset: u32,
+    pub type_name: String,
+    pub offset: i32,
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct Enum {
     pub name: String,
     pub alignment: u8,
-    pub size: u16,
+    pub size: i16,
     pub members: Vec<EnumMember>,
 }
 
@@ -56,7 +53,7 @@ pub struct EnumMember {
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct TypeScope {
-    pub name: String,
+    pub module_name: String,
     pub classes: Vec<Class>,
     pub enums: Vec<Enum>,
 }
@@ -65,9 +62,14 @@ pub fn schemas(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<SchemaMap>
     let schema_system = read_schema_system(process)?;
     let type_scopes = read_type_scopes(process, &schema_system)?;
 
-    let map: BTreeMap<_, _> = type_scopes
+    let map = type_scopes
         .into_iter()
-        .map(|type_scope| (type_scope.name, (type_scope.classes, type_scope.enums)))
+        .map(|type_scope| {
+            (
+                type_scope.module_name,
+                (type_scope.classes, type_scope.enums),
+            )
+        })
         .collect();
 
     Ok(map)
@@ -82,20 +84,33 @@ fn read_class_binding(
     let module_name = binding
         .module_name
         .read_string(process)
-        .map(|s| format!("{}.dll", s))?;
+        .map(|s| format!("{}.so", s))?;
 
     let name = binding.name.read_string(process)?.to_string();
 
     let parent = binding.base_classes.non_null().and_then(|ptr| {
         let base_class = ptr.read(process).ok()?;
+        let parent_class = base_class.prev.read(process).ok()?;
 
-        read_class_binding(process, base_class.prev)
-            .ok()
-            .map(Box::new)
+        let module_name = parent_class
+            .module_name
+            .read_string(process)
+            .ok()?
+            .to_string();
+
+        let name = parent_class.name.read_string(process).ok()?.to_string();
+
+        Some(Box::new(Class {
+            name,
+            module_name,
+            parent: None,
+            metadata: Vec::new(),
+            fields: Vec::new(),
+        }))
     });
 
-    let metadata = read_class_binding_metadata(process, &binding).map(Some)?;
     let fields = read_class_binding_fields(process, &binding)?;
+    let metadata = read_class_binding_metadata(process, &binding)?;
 
     debug!(
         "found class: {} at {:#X} (module name: {}) (parent name: {:?}) (metadata count: {}) (fields count: {})",
@@ -103,8 +118,8 @@ fn read_class_binding(
         binding_ptr.to_umem(),
         module_name,
         parent.as_ref().map(|parent| parent.name.clone()),
-        metadata.as_ref().map(|metadata| metadata.len()).unwrap_or(0),
-        fields.len()
+        metadata.len(),
+        fields.len(),
     );
 
     Ok(Class {
@@ -120,33 +135,31 @@ fn read_class_binding_fields(
     process: &mut IntoProcessInstanceArcBox<'_>,
     binding: &SchemaClassBinding,
 ) -> Result<Vec<ClassField>> {
-    (0..binding.fields_count)
-        .map(|i| {
-            let field_ptr: Pointer64<SchemaClassFieldData> = binding
-                .fields
-                .address()
-                .add(i * mem::size_of::<SchemaClassFieldData>() as u16)
-                .into();
+    if binding.fields.is_null() {
+        return Ok(Vec::new());
+    }
 
-            let field = field_ptr.read(process)?;
+    (0..binding.num_fields).try_fold(Vec::new(), |mut acc, i| {
+        let field = binding.fields.at(i as _).read(process)?;
 
-            if field.type_.is_null() {
-                return Err(Error::Other("field schema type is null"));
-            }
+        if field.schema_type.is_null() {
+            return Ok(acc);
+        }
 
-            let name = field.name.read_string(process)?.to_string();
-            let type_ = field.type_.read(process)?;
+        let name = field.name.read_string(process)?.to_string();
+        let schema_type = field.schema_type.read(process)?;
 
-            // TODO: Parse this properly.
-            let ty = type_.name.read_string(process)?.replace(" ", "");
+        // TODO: Parse this properly.
+        let type_name = schema_type.name.read_string(process)?.replace(" ", "");
 
-            Ok(ClassField {
-                name,
-                ty,
-                offset: field.offset,
-            })
-        })
-        .collect()
+        acc.push(ClassField {
+            name,
+            type_name,
+            offset: field.offset,
+        });
+
+        Ok(acc)
+    })
 }
 
 fn read_class_binding_metadata(
@@ -154,43 +167,40 @@ fn read_class_binding_metadata(
     binding: &SchemaClassBinding,
 ) -> Result<Vec<ClassMetadata>> {
     if binding.static_metadata.is_null() {
-        return Err(Error::Other("class metadata is null"));
+        return Ok(Vec::new());
     }
 
-    (0..binding.static_metadata_count)
-        .map(|i| {
-            let metadata_ptr: Pointer64<SchemaMetadataEntryData> =
-                binding.static_metadata.offset(i as _).into();
+    (0..binding.num_static_metadata).try_fold(Vec::new(), |mut acc, i| {
+        let metadata = binding.static_metadata.at(i as _).read(process)?;
 
-            let metadata = metadata_ptr.read(process)?;
+        if metadata.network_value.is_null() {
+            return Ok(acc);
+        }
 
-            if metadata.network_value.is_null() {
-                return Err(Error::Other("class metadata network value is null"));
-            }
+        let name = metadata.name.read_string(process)?.to_string();
+        let network_value = metadata.network_value.read(process)?;
 
-            let name = metadata.name.read_string(process)?.to_string();
-            let network_value = metadata.network_value.read(process)?;
+        let metadata = match name.as_str() {
+            "MNetworkChangeCallback" => unsafe {
+                let name = network_value.u.name_ptr.read_string(process)?.to_string();
 
-            let metadata = match name.as_str() {
-                "MNetworkChangeCallback" => unsafe {
-                    let name = network_value.u.name_ptr.read_string(process)?.to_string();
+                ClassMetadata::NetworkChangeCallback { name }
+            },
+            "MNetworkVarNames" => unsafe {
+                let var_value = network_value.u.var_value;
 
-                    ClassMetadata::NetworkChangeCallback { name }
-                },
-                "MNetworkVarNames" => unsafe {
-                    let var_value = network_value.u.var_value;
+                let name = var_value.name.read_string(process)?.to_string();
+                let type_name = var_value.type_name.read_string(process)?.replace(" ", "");
 
-                    let name = var_value.name.read_string(process)?.to_string();
-                    let ty = var_value.ty.read_string(process)?.replace(" ", "");
+                ClassMetadata::NetworkVarNames { name, type_name }
+            },
+            _ => ClassMetadata::Unknown { name },
+        };
 
-                    ClassMetadata::NetworkVarNames { name, ty }
-                },
-                _ => ClassMetadata::Unknown { name },
-            };
+        acc.push(metadata);
 
-            Ok(metadata)
-        })
-        .collect()
+        Ok(acc)
+    })
 }
 
 fn read_enum_binding(
@@ -199,6 +209,7 @@ fn read_enum_binding(
 ) -> Result<Enum> {
     let binding = binding_ptr.read(process)?;
     let name = binding.name.read_string(process)?.to_string();
+
     let members = read_enum_binding_members(process, &binding)?;
 
     debug!(
@@ -212,7 +223,7 @@ fn read_enum_binding(
     Ok(Enum {
         name,
         alignment: binding.alignment,
-        size: binding.size,
+        size: binding.num_enumerators,
         members,
     })
 }
@@ -221,48 +232,33 @@ fn read_enum_binding_members(
     process: &mut IntoProcessInstanceArcBox<'_>,
     binding: &SchemaEnumBinding,
 ) -> Result<Vec<EnumMember>> {
-    (0..binding.size)
-        .map(|i| {
-            let enum_info_ptr: Pointer64<SchemaEnumeratorInfoData> = binding
-                .enum_info
-                .address()
-                .add(i * mem::size_of::<SchemaEnumeratorInfoData>() as u16)
-                .into();
+    if binding.enumerators.is_null() {
+        return Ok(Vec::new());
+    }
 
-            let enum_info = enum_info_ptr.read(process)?;
-            let name = enum_info.name.read_string(process)?.to_string();
+    (0..binding.num_enumerators).try_fold(Vec::new(), |mut acc, i| {
+        let enumerator = binding.enumerators.at(i as _).read(process)?;
+        let name = enumerator.name.read_string(process)?.to_string();
 
-            let value = {
-                let value = unsafe { enum_info.u.ulong } as i64;
+        acc.push(EnumMember {
+            name,
+            value: unsafe { enumerator.u.ulong } as i64,
+        });
 
-                if value == i64::MAX {
-                    -1
-                } else {
-                    value
-                }
-            };
-
-            Ok(EnumMember { name, value })
-        })
-        .collect()
+        Ok(acc)
+    })
 }
 
 fn read_schema_system(process: &mut IntoProcessInstanceArcBox<'_>) -> Result<SchemaSystem> {
-    let module = process.module_by_name("schemasystem.dll")?;
+    let module = process.module_by_name("libschemasystem.so")?;
     let buf = process.read_raw(module.base, module.size as _)?;
 
-    let view = PeView::from_bytes(&buf)?;
+    let schema_system_addr = signature!("48 8D 3D ? ? ? ? 48 8D 35 ? ? ? ? E9")
+        .scan(&buf)
+        .and_then(|result| process.read_addr64_rip(module.base + result).ok())
+        .ok_or_else(|| Error::Other("unable to read schema system address"))?;
 
-    let mut save = [0; 2];
-
-    if !view
-        .scanner()
-        .finds_code(pattern!("488905${'} 4c8d45"), &mut save)
-    {
-        return Err(Error::Other("unable to find schema system signature"));
-    }
-
-    let schema_system: SchemaSystem = process.read(module.base + save[1]).data_part()?;
+    let schema_system: SchemaSystem = process.read(schema_system_addr)?;
 
     if schema_system.num_registrations == 0 {
         return Err(Error::Other("no schema system registrations found"));
@@ -277,40 +273,46 @@ fn read_type_scopes(
 ) -> Result<Vec<TypeScope>> {
     let type_scopes = &schema_system.type_scopes;
 
-    (0..type_scopes.size)
-        .map(|i| {
-            let type_scope = type_scopes.get(process, i as _)?.read(process)?;
+    (0..type_scopes.size).try_fold(Vec::new(), |mut acc, i| {
+        let type_scope_ptr = type_scopes.element(process, i as _)?;
+        let type_scope = type_scope_ptr.read(process)?;
 
-            let name = unsafe { CStr::from_ptr(type_scope.name.as_ptr()) }
-                .to_string_lossy()
-                .to_string();
+        let module_name = unsafe { CStr::from_ptr(type_scope.name.as_ptr()) }
+            .to_string_lossy()
+            .to_string();
 
-            let classes: Vec<_> = type_scope
-                .class_bindings
-                .elements(process)?
-                .iter()
-                .filter_map(|ptr| read_class_binding(process, *ptr).ok())
-                .collect();
+        let classes: Vec<_> = type_scope
+            .class_bindings
+            .elements(process)?
+            .iter()
+            .filter_map(|ptr| read_class_binding(process, *ptr).ok())
+            .collect();
 
-            let enums: Vec<_> = type_scope
-                .enum_bindings
-                .elements(process)?
-                .iter()
-                .filter_map(|ptr| read_enum_binding(process, *ptr).ok())
-                .collect();
+        let enums: Vec<_> = type_scope
+            .enum_bindings
+            .elements(process)?
+            .iter()
+            .filter_map(|ptr| read_enum_binding(process, *ptr).ok())
+            .collect();
 
-            debug!(
-                "found type scope: {} (classes: {}) (enums: {})",
-                name,
-                classes.len(),
-                enums.len()
-            );
+        if classes.is_empty() && enums.is_empty() {
+            return Ok(acc);
+        }
 
-            Ok(TypeScope {
-                name,
-                classes,
-                enums,
-            })
-        })
-        .collect()
+        debug!(
+            "found type scope: {} at {:#X} (classes count: {}) (enums count: {})",
+            module_name,
+            type_scope_ptr.to_umem(),
+            classes.len(),
+            enums.len(),
+        );
+
+        acc.push(TypeScope {
+            module_name,
+            classes,
+            enums,
+        });
+
+        Ok(acc)
+    })
 }