REDCODE/spice2x-r3d
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor/feat: Signature scan improvements

Browse Source 
> use reverse pattern search instead, fixes performance issue for some hooks
> sigscan still requires overhead of module copy for each operation
This commit is contained in:
[ ]
2026-02-18 07:42:11 +09:00
parent 82439962d6
commit 0834646097
4 changed files with 104 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/sigscan.h
+20 -10
View File
@@ -14,21 +14,24 @@ intptr_t find_pattern(
const unsigned char *pattern,
const char *mask,
intptr_t offset,
intptr_t usage);
intptr_t usage,
bool reverse = false);
intptr_t find_pattern(
HMODULE module,
const unsigned char *pattern,
const char *mask,
intptr_t offset,
intptr_t usage);
intptr_t usage,
bool reverse = false);
intptr_t find_pattern(
HMODULE module,
const std::string &pattern,
const char *mask,
intptr_t offset,
intptr_t result_usage);
intptr_t result_usage,
bool reverse = false);
intptr_t find_pattern_from(
std::vector<unsigned char> &data,
@@ -37,7 +40,8 @@ intptr_t find_pattern_from(
const char *mask,
intptr_t offset,
intptr_t usage,
intptr_t start_from);
intptr_t start_from,
bool reverse = false);
intptr_t find_pattern_from(
HMODULE module,
@@ -45,7 +49,8 @@ intptr_t find_pattern_from(
const char *mask,
intptr_t offset,
intptr_t usage,
intptr_t start_from);
intptr_t start_from,
bool reverse = false);
intptr_t find_pattern_from(
HMODULE module,
@@ -53,7 +58,8 @@ intptr_t find_pattern_from(
const char *mask,
intptr_t offset,
intptr_t result_usage,
intptr_t start_from);
intptr_t start_from,
bool reverse = false);
intptr_t replace_pattern(
HMODULE module,
@@ -62,14 +68,16 @@ intptr_t replace_pattern(
intptr_t offset,
intptr_t usage,
const unsigned char *replace_data,
const char *replace_mask);
const char *replace_mask,
bool reverse = false);
intptr_t replace_pattern(
HMODULE module,
const std::string &signature,
const std::string &replacement,
intptr_t offset,
intptr_t usage);
intptr_t usage,
bool reverse = false);
intptr_t replace_pattern_from(
HMODULE module,
@@ -79,7 +87,8 @@ intptr_t replace_pattern_from(
intptr_t usage,
intptr_t start_from,
const unsigned char *replace_data,
const char *replace_mask);
const char *replace_mask,
bool reverse = false);
intptr_t replace_pattern_from(
HMODULE module,
@@ -87,7 +96,8 @@ intptr_t replace_pattern_from(
const std::string &replacement,
intptr_t offset,
intptr_t usage,
intptr_t start_from);
intptr_t start_from,
bool reverse = false);
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point);