code/refactor: Deduplicate sigscan code
> cleanup unnecessary code, should break nothing > probably will cause merge issues someday > add missing `replace_pattern_from`
This commit is contained in:
+22
-75
@@ -13,85 +13,19 @@ intptr_t find_pattern(std::vector<uint8_t> &data, intptr_t base, const uint8_t *
|
||||
const char *mask, intptr_t offset, intptr_t usage)
|
||||
{
|
||||
|
||||
// build pattern
|
||||
std::vector<std::pair<uint8_t, bool>> pattern_vector;
|
||||
size_t mask_size = strlen(mask);
|
||||
for (size_t i = 0; i < mask_size; i++) {
|
||||
pattern_vector.emplace_back(pattern[i], mask[i] == 'X');
|
||||
}
|
||||
|
||||
// the scan loop
|
||||
auto data_begin = data.begin();
|
||||
auto cur_usage = 0;
|
||||
while (true) {
|
||||
|
||||
// search for the pattern
|
||||
auto search_result = std::search(data_begin, data.end(), pattern_vector.begin(), pattern_vector.end(),
|
||||
[&](uint8_t c, std::pair<uint8_t, bool> pat) {
|
||||
return (!pat.second) || c == pat.first;
|
||||
});
|
||||
|
||||
// check for a match
|
||||
if (search_result != data.end()) {
|
||||
|
||||
// return the result if we hit the usage count
|
||||
if (cur_usage == usage) {
|
||||
return (std::distance(data.begin(), search_result) + base) + offset;
|
||||
}
|
||||
|
||||
// increment the found count
|
||||
++cur_usage;
|
||||
data_begin = ++search_result;
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
return find_pattern_from(data, base, pattern, mask, offset, usage, 0);
|
||||
}
|
||||
|
||||
intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask,
|
||||
intptr_t offset, intptr_t result_usage)
|
||||
{
|
||||
// get module information
|
||||
MODULEINFO module_info {};
|
||||
if (!GetModuleInformation(GetCurrentProcess(), module, &module_info, sizeof(module_info))) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
auto size = static_cast<size_t>(module_info.SizeOfImage);
|
||||
|
||||
try {
|
||||
|
||||
// copy data
|
||||
std::vector<uint8_t> data(size);
|
||||
memcpy(data.data(), module_info.lpBaseOfDll, size);
|
||||
|
||||
// find pattern
|
||||
return find_pattern(
|
||||
data,
|
||||
reinterpret_cast<intptr_t>(module_info.lpBaseOfDll),
|
||||
pattern,
|
||||
mask,
|
||||
offset,
|
||||
result_usage);
|
||||
} catch (const std::bad_alloc &e) {
|
||||
log_warning("sigscan", "failed to allocate buffer of size {} for image data", size);
|
||||
return false;
|
||||
}
|
||||
return find_pattern_from(module, pattern, mask, offset, result_usage, 0);
|
||||
}
|
||||
|
||||
intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask,
|
||||
intptr_t offset, intptr_t result_usage)
|
||||
{
|
||||
std::string pattern_str(pattern);
|
||||
auto pattern_bin = std::make_unique<uint8_t[]>(pattern.length() / 2);
|
||||
if (!hex2bin(pattern_str.c_str(), pattern_bin.get())) {
|
||||
log_warning("sigscan", "hex2bin failed");
|
||||
return false;
|
||||
}
|
||||
|
||||
return find_pattern(module, pattern_bin.get(), mask, offset, result_usage);
|
||||
return find_pattern_from(module, pattern, mask, offset, result_usage, 0);
|
||||
}
|
||||
|
||||
///
|
||||
@@ -184,12 +118,12 @@ intptr_t find_pattern_from(HMODULE module, const std::string &pattern, const cha
|
||||
}
|
||||
|
||||
|
||||
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
||||
intptr_t usage, const uint8_t *replace_data, const char *replace_mask)
|
||||
intptr_t replace_pattern_from(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
||||
intptr_t usage, intptr_t start_from, const uint8_t *replace_data, const char *replace_mask)
|
||||
{
|
||||
|
||||
// find result
|
||||
auto result = find_pattern(module, pattern, mask, offset, usage);
|
||||
auto result = find_pattern_from(module, pattern, mask, offset, usage, start_from);
|
||||
|
||||
// check result
|
||||
if (!result) {
|
||||
@@ -211,8 +145,8 @@ intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mas
|
||||
return result;
|
||||
}
|
||||
|
||||
intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
||||
const std::string &replacement, intptr_t offset, intptr_t usage)
|
||||
intptr_t replace_pattern_from(HMODULE module, const std::string &signature,
|
||||
const std::string &replacement, intptr_t offset, intptr_t usage, intptr_t start_from)
|
||||
{
|
||||
// build pattern
|
||||
std::string pattern_str(signature);
|
||||
@@ -259,17 +193,30 @@ intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
||||
}
|
||||
|
||||
// do the replacement
|
||||
return replace_pattern(
|
||||
return replace_pattern_from(
|
||||
module,
|
||||
pattern_bin.get(),
|
||||
signature_mask.str().c_str(),
|
||||
offset,
|
||||
usage,
|
||||
start_from,
|
||||
replace_data_bin.get(),
|
||||
replace_mask.str().c_str()
|
||||
);
|
||||
}
|
||||
|
||||
intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
||||
const std::string &replacement, intptr_t offset, intptr_t usage)
|
||||
{
|
||||
return replace_pattern_from(module, signature, replacement, offset, usage, 0);
|
||||
}
|
||||
|
||||
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
||||
intptr_t usage, const uint8_t *replace_data, const char *replace_mask)
|
||||
{
|
||||
return replace_pattern_from(module, pattern, mask, offset, usage, 0, replace_data, replace_mask);
|
||||
}
|
||||
|
||||
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) {
|
||||
std::ifstream file(dll_path, std::ios::binary);
|
||||
if (!file) {
|
||||
|
||||
@@ -71,4 +71,22 @@ intptr_t replace_pattern(
|
||||
intptr_t offset,
|
||||
intptr_t usage);
|
||||
|
||||
intptr_t replace_pattern_from(
|
||||
HMODULE module,
|
||||
const unsigned char *pattern,
|
||||
const char *mask,
|
||||
intptr_t offset,
|
||||
intptr_t usage,
|
||||
intptr_t start_from,
|
||||
const unsigned char *replace_data,
|
||||
const char *replace_mask);
|
||||
|
||||
intptr_t replace_pattern_from(
|
||||
HMODULE module,
|
||||
const std::string &signature,
|
||||
const std::string &replacement,
|
||||
intptr_t offset,
|
||||
intptr_t usage,
|
||||
intptr_t start_from);
|
||||
|
||||
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point);
|
||||
Reference in New Issue
Block a user