Forum > Coding >

[REL] C++ Internal Signature Scanner

Posts: 224

Threads: 43

Joined: May, 2022

Reputation: -5

Posted

I'm releasing a internal signature scanner (can be implemented externally, but you'll have to make a few changes) in C++.

 

(thank you 0x90 for tips, advice and even showing me his impl)

 

The first parameter is the signature which should have the following format of e.g E8 ? ? ? ? 8B 46 14 8D BD ? ? ? ?

The second parameter takes a relative virtual address which specifies the address to begin scanning for the signature at

The third parameter takes a relative virtual address which specifies the address to end the scanning at.

 

The last two parameters define the range for the signature scanning.

 

#include <iostream>
#include <Windows.h>
#include <thread>
#include <vector>
#include <optional>

[[nodiscard]] std::optional<std::uint32_t> scan_pattern(const std::string_view pattern, const std::uint32_t start_address_rva, const std::uint32_t end_address_rva)
{
	static const auto module_base_address = reinterpret_cast<std::uint32_t>(GetModuleHandleA(nullptr));

	if (end_address_rva < start_address_rva)
		return std::nullopt;

	const auto end = module_base_address + end_address_rva;
	auto start = module_base_address + start_address_rva;

	std::vector<std::pair<bool, std::uint8_t>> byte_pattern{};
	for(auto iterator_start = pattern.begin(); iterator_start < pattern.end(); ++iterator_start)
	{
		switch(*iterator_start)
		{
		case ' ':
			continue;
		case '?':
			byte_pattern.emplace_back(std::make_pair<bool, std::uint8_t>(true, 0x00));
			continue;
		default:
				std::string cached_byte_string(iterator_start - 1, (++iterator_start) + 1);
				byte_pattern.emplace_back(std::make_pair<bool, std::uint8_t>(false, static_cast<std::uint8_t>(std::stoul(cached_byte_string, nullptr, 16))));
		}
	}
	
	while(start < end)
	{
		auto found_pattern = true;

		for(const auto& [wildcard, byte] : byte_pattern)
		{
			++start;
			if (wildcard)
				continue;
			
			if (*reinterpret_cast<std::uint8_t*>(start) != byte)
			{
				found_pattern = false;
				break;
			}
		}
		if (found_pattern)
			return start - (byte_pattern.size() - 1);
	}
	return std::nullopt;
}

 

 

feel free to suggest anything or make questions in the replies

 

example usage:

	const auto pattern_result = scan_pattern("55 8B EC 68 48 31 C4 00 A1 5C 30 C4 00 50 E8 3D 02 00 00 83 C4 08 5D C3", 0x1000, 0x1040);
	std::printf("[exprssnscanner] function found at %x\n", pattern_result.value_or(0));

 

https://github.com/expressiongz/cpp-internal-signature-scanner

 

all bugs should be fixed, let me know of any issues!

  • 1

https://media.discordapp.net/attachments/1044764388546068510/1051935933836050482/Signature_4.png

pepsi

PePsIDeveloper

vip

Posts: 259

Threads: 4

Joined: Apr, 2021

Reputation: 13

Replied

vouch express good!

  • 0

https://cdn.discordapp.com/attachments/661621789591470090/1013919752294498314/Untitled_1366_768_px_1546_202_px_2.gif

Posts: 224

Threads: 43

Joined: May, 2022

Reputation: -5

Replied

@_realnickk

 

yeah it's quite useful. 

  • 0

https://media.discordapp.net/attachments/1044764388546068510/1051935933836050482/Signature_4.png

Users viewing this thread:

( Members: 0, Guests: 1, Total: 1 )