code/refactor: Deduplicate sigscan code

> cleanup unnecessary code, should break nothing
> probably will cause merge issues someday
> add missing `replace_pattern_from`
This commit is contained in:
[ ]
2026-01-20 07:56:22 +09:00
parent 1cb5b7b52a
commit 734c762bd6
2 changed files with 40 additions and 75 deletions
+22 -75
View File
@@ -13,85 +13,19 @@ intptr_t find_pattern(std::vector<uint8_t> &data, intptr_t base, const uint8_t *
const char *mask, intptr_t offset, intptr_t usage) const char *mask, intptr_t offset, intptr_t usage)
{ {
// build pattern return find_pattern_from(data, base, pattern, mask, offset, usage, 0);
std::vector<std::pair<uint8_t, bool>> pattern_vector;
size_t mask_size = strlen(mask);
for (size_t i = 0; i < mask_size; i++) {
pattern_vector.emplace_back(pattern[i], mask[i] == 'X');
}
// the scan loop
auto data_begin = data.begin();
auto cur_usage = 0;
while (true) {
// search for the pattern
auto search_result = std::search(data_begin, data.end(), pattern_vector.begin(), pattern_vector.end(),
[&](uint8_t c, std::pair<uint8_t, bool> pat) {
return (!pat.second) || c == pat.first;
});
// check for a match
if (search_result != data.end()) {
// return the result if we hit the usage count
if (cur_usage == usage) {
return (std::distance(data.begin(), search_result) + base) + offset;
}
// increment the found count
++cur_usage;
data_begin = ++search_result;
} else {
break;
}
}
return 0;
} }
intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask,
intptr_t offset, intptr_t result_usage) intptr_t offset, intptr_t result_usage)
{ {
// get module information return find_pattern_from(module, pattern, mask, offset, result_usage, 0);
MODULEINFO module_info {};
if (!GetModuleInformation(GetCurrentProcess(), module, &module_info, sizeof(module_info))) {
return 0;
}
auto size = static_cast<size_t>(module_info.SizeOfImage);
try {
// copy data
std::vector<uint8_t> data(size);
memcpy(data.data(), module_info.lpBaseOfDll, size);
// find pattern
return find_pattern(
data,
reinterpret_cast<intptr_t>(module_info.lpBaseOfDll),
pattern,
mask,
offset,
result_usage);
} catch (const std::bad_alloc &e) {
log_warning("sigscan", "failed to allocate buffer of size {} for image data", size);
return false;
}
} }
intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask, intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask,
intptr_t offset, intptr_t result_usage) intptr_t offset, intptr_t result_usage)
{ {
std::string pattern_str(pattern); return find_pattern_from(module, pattern, mask, offset, result_usage, 0);
auto pattern_bin = std::make_unique<uint8_t[]>(pattern.length() / 2);
if (!hex2bin(pattern_str.c_str(), pattern_bin.get())) {
log_warning("sigscan", "hex2bin failed");
return false;
}
return find_pattern(module, pattern_bin.get(), mask, offset, result_usage);
} }
/// ///
@@ -184,12 +118,12 @@ intptr_t find_pattern_from(HMODULE module, const std::string &pattern, const cha
} }
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset, intptr_t replace_pattern_from(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
intptr_t usage, const uint8_t *replace_data, const char *replace_mask) intptr_t usage, intptr_t start_from, const uint8_t *replace_data, const char *replace_mask)
{ {
// find result // find result
auto result = find_pattern(module, pattern, mask, offset, usage); auto result = find_pattern_from(module, pattern, mask, offset, usage, start_from);
// check result // check result
if (!result) { if (!result) {
@@ -211,8 +145,8 @@ intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mas
return result; return result;
} }
intptr_t replace_pattern(HMODULE module, const std::string &signature, intptr_t replace_pattern_from(HMODULE module, const std::string &signature,
const std::string &replacement, intptr_t offset, intptr_t usage) const std::string &replacement, intptr_t offset, intptr_t usage, intptr_t start_from)
{ {
// build pattern // build pattern
std::string pattern_str(signature); std::string pattern_str(signature);
@@ -259,17 +193,30 @@ intptr_t replace_pattern(HMODULE module, const std::string &signature,
} }
// do the replacement // do the replacement
return replace_pattern( return replace_pattern_from(
module, module,
pattern_bin.get(), pattern_bin.get(),
signature_mask.str().c_str(), signature_mask.str().c_str(),
offset, offset,
usage, usage,
start_from,
replace_data_bin.get(), replace_data_bin.get(),
replace_mask.str().c_str() replace_mask.str().c_str()
); );
} }
intptr_t replace_pattern(HMODULE module, const std::string &signature,
const std::string &replacement, intptr_t offset, intptr_t usage)
{
return replace_pattern_from(module, signature, replacement, offset, usage, 0);
}
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
intptr_t usage, const uint8_t *replace_data, const char *replace_mask)
{
return replace_pattern_from(module, pattern, mask, offset, usage, 0, replace_data, replace_mask);
}
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) { bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) {
std::ifstream file(dll_path, std::ios::binary); std::ifstream file(dll_path, std::ios::binary);
if (!file) { if (!file) {
+18
View File
@@ -71,4 +71,22 @@ intptr_t replace_pattern(
intptr_t offset, intptr_t offset,
intptr_t usage); intptr_t usage);
intptr_t replace_pattern_from(
HMODULE module,
const unsigned char *pattern,
const char *mask,
intptr_t offset,
intptr_t usage,
intptr_t start_from,
const unsigned char *replace_data,
const char *replace_mask);
intptr_t replace_pattern_from(
HMODULE module,
const std::string &signature,
const std::string &replacement,
intptr_t offset,
intptr_t usage,
intptr_t start_from);
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point); bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point);