Posted
I'm releasing a internal signature scanner (can be implemented externally, but you'll have to make a few changes) in C++.
(thank you 0x90 for tips, advice and even showing me his impl)
The first parameter is the signature which should have the following format of e.g E8 ? ? ? ? 8B 46 14 8D BD ? ? ? ?
The second parameter takes a relative virtual address which specifies the address to begin scanning for the signature at
The third parameter takes a relative virtual address which specifies the address to end the scanning at.
The last two parameters define the range for the signature scanning.
#include <iostream>
#include <Windows.h>
#include <thread>
#include <vector>
#include <optional>
[[nodiscard]] std::optional<std::uint32_t> scan_pattern(const std::string_view pattern, const std::uint32_t start_address_rva, const std::uint32_t end_address_rva)
{
static const auto module_base_address = reinterpret_cast<std::uint32_t>(GetModuleHandleA(nullptr));
if (end_address_rva < start_address_rva)
return std::nullopt;
const auto end = module_base_address + end_address_rva;
auto start = module_base_address + start_address_rva;
std::vector<std::pair<bool, std::uint8_t>> byte_pattern{};
for(auto iterator_start = pattern.begin(); iterator_start < pattern.end(); ++iterator_start)
{
switch(*iterator_start)
{
case ' ':
continue;
case '?':
byte_pattern.emplace_back(std::make_pair<bool, std::uint8_t>(true, 0x00));
continue;
default:
std::string cached_byte_string(iterator_start - 1, (++iterator_start) + 1);
byte_pattern.emplace_back(std::make_pair<bool, std::uint8_t>(false, static_cast<std::uint8_t>(std::stoul(cached_byte_string, nullptr, 16))));
}
}
while(start < end)
{
auto found_pattern = true;
for(const auto& [wildcard, byte] : byte_pattern)
{
++start;
if (wildcard)
continue;
if (*reinterpret_cast<std::uint8_t*>(start) != byte)
{
found_pattern = false;
break;
}
}
if (found_pattern)
return start - (byte_pattern.size() - 1);
}
return std::nullopt;
}
feel free to suggest anything or make questions in the replies
example usage:
const auto pattern_result = scan_pattern("55 8B EC 68 48 31 C4 00 A1 5C 30 C4 00 50 E8 3D 02 00 00 83 C4 08 5D C3", 0x1000, 0x1040);
std::printf("[exprssnscanner] function found at %x\n", pattern_result.value_or(0));
https://github.com/expressiongz/cpp-internal-signature-scanner
all bugs should be fixed, let me know of any issues!
https://media.discordapp.net/attachments/1044764388546068510/1051935933836050482/Signature_4.png
Replied
vouch express good!
Cancel
Post
https://cdn.discordapp.com/attachments/661621789591470090/1013919752294498314/Untitled_1366_768_px_1546_202_px_2.gif
https://media.discordapp.net/attachments/1044764388546068510/1051935933836050482/Signature_4.png
Users viewing this thread:
( Members: 0, Guests: 1, Total: 1 )
Cancel
Post