From 734c762bd62429e4476419016cff3dafbf15c381 Mon Sep 17 00:00:00 2001 From: "[ ]" <[ ]> Date: Tue, 20 Jan 2026 07:56:22 +0900 Subject: [PATCH] code/refactor: Deduplicate sigscan code > cleanup unnecessary code, should break nothing > probably will cause merge issues someday > add missing `replace_pattern_from` --- util/sigscan.cpp | 97 +++++++++++------------------------------------- util/sigscan.h | 18 +++++++++ 2 files changed, 40 insertions(+), 75 deletions(-) diff --git a/util/sigscan.cpp b/util/sigscan.cpp index 7bf09e2..e4abce2 100644 --- a/util/sigscan.cpp +++ b/util/sigscan.cpp @@ -13,85 +13,19 @@ intptr_t find_pattern(std::vector &data, intptr_t base, const uint8_t * const char *mask, intptr_t offset, intptr_t usage) { - // build pattern - std::vector> pattern_vector; - size_t mask_size = strlen(mask); - for (size_t i = 0; i < mask_size; i++) { - pattern_vector.emplace_back(pattern[i], mask[i] == 'X'); - } - - // the scan loop - auto data_begin = data.begin(); - auto cur_usage = 0; - while (true) { - - // search for the pattern - auto search_result = std::search(data_begin, data.end(), pattern_vector.begin(), pattern_vector.end(), - [&](uint8_t c, std::pair pat) { - return (!pat.second) || c == pat.first; - }); - - // check for a match - if (search_result != data.end()) { - - // return the result if we hit the usage count - if (cur_usage == usage) { - return (std::distance(data.begin(), search_result) + base) + offset; - } - - // increment the found count - ++cur_usage; - data_begin = ++search_result; - } else { - break; - } - } - - return 0; + return find_pattern_from(data, base, pattern, mask, offset, usage, 0); } intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset, intptr_t result_usage) { - // get module information - MODULEINFO module_info {}; - if (!GetModuleInformation(GetCurrentProcess(), module, &module_info, sizeof(module_info))) { - return 0; - } - - auto size = static_cast(module_info.SizeOfImage); - - try { - - // copy data - std::vector data(size); - memcpy(data.data(), module_info.lpBaseOfDll, size); - - // find pattern - return find_pattern( - data, - reinterpret_cast(module_info.lpBaseOfDll), - pattern, - mask, - offset, - result_usage); - } catch (const std::bad_alloc &e) { - log_warning("sigscan", "failed to allocate buffer of size {} for image data", size); - return false; - } + return find_pattern_from(module, pattern, mask, offset, result_usage, 0); } intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask, intptr_t offset, intptr_t result_usage) { - std::string pattern_str(pattern); - auto pattern_bin = std::make_unique(pattern.length() / 2); - if (!hex2bin(pattern_str.c_str(), pattern_bin.get())) { - log_warning("sigscan", "hex2bin failed"); - return false; - } - - return find_pattern(module, pattern_bin.get(), mask, offset, result_usage); + return find_pattern_from(module, pattern, mask, offset, result_usage, 0); } /// @@ -184,12 +118,12 @@ intptr_t find_pattern_from(HMODULE module, const std::string &pattern, const cha } -intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset, - intptr_t usage, const uint8_t *replace_data, const char *replace_mask) +intptr_t replace_pattern_from(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset, + intptr_t usage, intptr_t start_from, const uint8_t *replace_data, const char *replace_mask) { // find result - auto result = find_pattern(module, pattern, mask, offset, usage); + auto result = find_pattern_from(module, pattern, mask, offset, usage, start_from); // check result if (!result) { @@ -211,8 +145,8 @@ intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mas return result; } -intptr_t replace_pattern(HMODULE module, const std::string &signature, - const std::string &replacement, intptr_t offset, intptr_t usage) +intptr_t replace_pattern_from(HMODULE module, const std::string &signature, + const std::string &replacement, intptr_t offset, intptr_t usage, intptr_t start_from) { // build pattern std::string pattern_str(signature); @@ -259,17 +193,30 @@ intptr_t replace_pattern(HMODULE module, const std::string &signature, } // do the replacement - return replace_pattern( + return replace_pattern_from( module, pattern_bin.get(), signature_mask.str().c_str(), offset, usage, + start_from, replace_data_bin.get(), replace_mask.str().c_str() ); } +intptr_t replace_pattern(HMODULE module, const std::string &signature, + const std::string &replacement, intptr_t offset, intptr_t usage) +{ + return replace_pattern_from(module, signature, replacement, offset, usage, 0); +} + +intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset, + intptr_t usage, const uint8_t *replace_data, const char *replace_mask) +{ + return replace_pattern_from(module, pattern, mask, offset, usage, 0, replace_data, replace_mask); +} + bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) { std::ifstream file(dll_path, std::ios::binary); if (!file) { diff --git a/util/sigscan.h b/util/sigscan.h index 4d2145e..ba92920 100644 --- a/util/sigscan.h +++ b/util/sigscan.h @@ -71,4 +71,22 @@ intptr_t replace_pattern( intptr_t offset, intptr_t usage); +intptr_t replace_pattern_from( + HMODULE module, + const unsigned char *pattern, + const char *mask, + intptr_t offset, + intptr_t usage, + intptr_t start_from, + const unsigned char *replace_data, + const char *replace_mask); + +intptr_t replace_pattern_from( + HMODULE module, + const std::string &signature, + const std::string &replacement, + intptr_t offset, + intptr_t usage, + intptr_t start_from); + bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point); \ No newline at end of file