code/refactor: Deduplicate sigscan code
> cleanup unnecessary code, should break nothing > probably will cause merge issues someday > add missing `replace_pattern_from`
This commit is contained in:
+22
-75
@@ -13,85 +13,19 @@ intptr_t find_pattern(std::vector<uint8_t> &data, intptr_t base, const uint8_t *
|
|||||||
const char *mask, intptr_t offset, intptr_t usage)
|
const char *mask, intptr_t offset, intptr_t usage)
|
||||||
{
|
{
|
||||||
|
|
||||||
// build pattern
|
return find_pattern_from(data, base, pattern, mask, offset, usage, 0);
|
||||||
std::vector<std::pair<uint8_t, bool>> pattern_vector;
|
|
||||||
size_t mask_size = strlen(mask);
|
|
||||||
for (size_t i = 0; i < mask_size; i++) {
|
|
||||||
pattern_vector.emplace_back(pattern[i], mask[i] == 'X');
|
|
||||||
}
|
|
||||||
|
|
||||||
// the scan loop
|
|
||||||
auto data_begin = data.begin();
|
|
||||||
auto cur_usage = 0;
|
|
||||||
while (true) {
|
|
||||||
|
|
||||||
// search for the pattern
|
|
||||||
auto search_result = std::search(data_begin, data.end(), pattern_vector.begin(), pattern_vector.end(),
|
|
||||||
[&](uint8_t c, std::pair<uint8_t, bool> pat) {
|
|
||||||
return (!pat.second) || c == pat.first;
|
|
||||||
});
|
|
||||||
|
|
||||||
// check for a match
|
|
||||||
if (search_result != data.end()) {
|
|
||||||
|
|
||||||
// return the result if we hit the usage count
|
|
||||||
if (cur_usage == usage) {
|
|
||||||
return (std::distance(data.begin(), search_result) + base) + offset;
|
|
||||||
}
|
|
||||||
|
|
||||||
// increment the found count
|
|
||||||
++cur_usage;
|
|
||||||
data_begin = ++search_result;
|
|
||||||
} else {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask,
|
intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask,
|
||||||
intptr_t offset, intptr_t result_usage)
|
intptr_t offset, intptr_t result_usage)
|
||||||
{
|
{
|
||||||
// get module information
|
return find_pattern_from(module, pattern, mask, offset, result_usage, 0);
|
||||||
MODULEINFO module_info {};
|
|
||||||
if (!GetModuleInformation(GetCurrentProcess(), module, &module_info, sizeof(module_info))) {
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
auto size = static_cast<size_t>(module_info.SizeOfImage);
|
|
||||||
|
|
||||||
try {
|
|
||||||
|
|
||||||
// copy data
|
|
||||||
std::vector<uint8_t> data(size);
|
|
||||||
memcpy(data.data(), module_info.lpBaseOfDll, size);
|
|
||||||
|
|
||||||
// find pattern
|
|
||||||
return find_pattern(
|
|
||||||
data,
|
|
||||||
reinterpret_cast<intptr_t>(module_info.lpBaseOfDll),
|
|
||||||
pattern,
|
|
||||||
mask,
|
|
||||||
offset,
|
|
||||||
result_usage);
|
|
||||||
} catch (const std::bad_alloc &e) {
|
|
||||||
log_warning("sigscan", "failed to allocate buffer of size {} for image data", size);
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask,
|
intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask,
|
||||||
intptr_t offset, intptr_t result_usage)
|
intptr_t offset, intptr_t result_usage)
|
||||||
{
|
{
|
||||||
std::string pattern_str(pattern);
|
return find_pattern_from(module, pattern, mask, offset, result_usage, 0);
|
||||||
auto pattern_bin = std::make_unique<uint8_t[]>(pattern.length() / 2);
|
|
||||||
if (!hex2bin(pattern_str.c_str(), pattern_bin.get())) {
|
|
||||||
log_warning("sigscan", "hex2bin failed");
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
return find_pattern(module, pattern_bin.get(), mask, offset, result_usage);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
///
|
///
|
||||||
@@ -184,12 +118,12 @@ intptr_t find_pattern_from(HMODULE module, const std::string &pattern, const cha
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
intptr_t replace_pattern_from(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
||||||
intptr_t usage, const uint8_t *replace_data, const char *replace_mask)
|
intptr_t usage, intptr_t start_from, const uint8_t *replace_data, const char *replace_mask)
|
||||||
{
|
{
|
||||||
|
|
||||||
// find result
|
// find result
|
||||||
auto result = find_pattern(module, pattern, mask, offset, usage);
|
auto result = find_pattern_from(module, pattern, mask, offset, usage, start_from);
|
||||||
|
|
||||||
// check result
|
// check result
|
||||||
if (!result) {
|
if (!result) {
|
||||||
@@ -211,8 +145,8 @@ intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mas
|
|||||||
return result;
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
intptr_t replace_pattern_from(HMODULE module, const std::string &signature,
|
||||||
const std::string &replacement, intptr_t offset, intptr_t usage)
|
const std::string &replacement, intptr_t offset, intptr_t usage, intptr_t start_from)
|
||||||
{
|
{
|
||||||
// build pattern
|
// build pattern
|
||||||
std::string pattern_str(signature);
|
std::string pattern_str(signature);
|
||||||
@@ -259,17 +193,30 @@ intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
|||||||
}
|
}
|
||||||
|
|
||||||
// do the replacement
|
// do the replacement
|
||||||
return replace_pattern(
|
return replace_pattern_from(
|
||||||
module,
|
module,
|
||||||
pattern_bin.get(),
|
pattern_bin.get(),
|
||||||
signature_mask.str().c_str(),
|
signature_mask.str().c_str(),
|
||||||
offset,
|
offset,
|
||||||
usage,
|
usage,
|
||||||
|
start_from,
|
||||||
replace_data_bin.get(),
|
replace_data_bin.get(),
|
||||||
replace_mask.str().c_str()
|
replace_mask.str().c_str()
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
||||||
|
const std::string &replacement, intptr_t offset, intptr_t usage)
|
||||||
|
{
|
||||||
|
return replace_pattern_from(module, signature, replacement, offset, usage, 0);
|
||||||
|
}
|
||||||
|
|
||||||
|
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
||||||
|
intptr_t usage, const uint8_t *replace_data, const char *replace_mask)
|
||||||
|
{
|
||||||
|
return replace_pattern_from(module, pattern, mask, offset, usage, 0, replace_data, replace_mask);
|
||||||
|
}
|
||||||
|
|
||||||
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) {
|
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) {
|
||||||
std::ifstream file(dll_path, std::ios::binary);
|
std::ifstream file(dll_path, std::ios::binary);
|
||||||
if (!file) {
|
if (!file) {
|
||||||
|
|||||||
@@ -71,4 +71,22 @@ intptr_t replace_pattern(
|
|||||||
intptr_t offset,
|
intptr_t offset,
|
||||||
intptr_t usage);
|
intptr_t usage);
|
||||||
|
|
||||||
|
intptr_t replace_pattern_from(
|
||||||
|
HMODULE module,
|
||||||
|
const unsigned char *pattern,
|
||||||
|
const char *mask,
|
||||||
|
intptr_t offset,
|
||||||
|
intptr_t usage,
|
||||||
|
intptr_t start_from,
|
||||||
|
const unsigned char *replace_data,
|
||||||
|
const char *replace_mask);
|
||||||
|
|
||||||
|
intptr_t replace_pattern_from(
|
||||||
|
HMODULE module,
|
||||||
|
const std::string &signature,
|
||||||
|
const std::string &replacement,
|
||||||
|
intptr_t offset,
|
||||||
|
intptr_t usage,
|
||||||
|
intptr_t start_from);
|
||||||
|
|
||||||
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point);
|
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point);
|
||||||
Reference in New Issue
Block a user