Update to spice2x-25-04-25 (pre-apply)
> broken commit
This commit is contained in:
@@ -1,5 +1,7 @@
|
||||
#include "sigscan.h"
|
||||
|
||||
#include <format>
|
||||
#include <fstream>
|
||||
#include <sstream>
|
||||
#include <vector>
|
||||
|
||||
@@ -79,6 +81,109 @@ intptr_t find_pattern(HMODULE module, const uint8_t *pattern, const char *mask,
|
||||
}
|
||||
}
|
||||
|
||||
intptr_t find_pattern(HMODULE module, const std::string &pattern, const char *mask,
|
||||
intptr_t offset, intptr_t result_usage)
|
||||
{
|
||||
std::string pattern_str(pattern);
|
||||
auto pattern_bin = std::make_unique<uint8_t[]>(pattern.length() / 2);
|
||||
if (!hex2bin(pattern_str.c_str(), pattern_bin.get())) {
|
||||
log_warning("sigscan", "hex2bin failed");
|
||||
return false;
|
||||
}
|
||||
|
||||
return find_pattern(module, pattern_bin.get(), mask, offset, result_usage);
|
||||
}
|
||||
|
||||
///
|
||||
|
||||
intptr_t find_pattern_from(std::vector<uint8_t> &data, intptr_t base, const uint8_t *pattern,
|
||||
const char *mask, intptr_t offset, intptr_t usage, intptr_t start_from)
|
||||
{
|
||||
|
||||
// build pattern
|
||||
std::vector<std::pair<uint8_t, bool>> pattern_vector;
|
||||
size_t mask_size = strlen(mask);
|
||||
for (size_t i = 0; i < mask_size; i++) {
|
||||
pattern_vector.emplace_back(pattern[i], mask[i] == 'X');
|
||||
}
|
||||
|
||||
// the scan loop
|
||||
auto data_begin = data.begin();
|
||||
std::advance(data_begin, start_from);
|
||||
auto cur_usage = 0;
|
||||
while (true) {
|
||||
|
||||
// search for the pattern
|
||||
auto search_result = std::search(data_begin, data.end(), pattern_vector.begin(), pattern_vector.end(),
|
||||
[&](uint8_t c, std::pair<uint8_t, bool> pat) {
|
||||
return (!pat.second) || c == pat.first;
|
||||
});
|
||||
|
||||
// check for a match
|
||||
if (search_result != data.end()) {
|
||||
|
||||
// return the result if we hit the usage count
|
||||
if (cur_usage == usage) {
|
||||
return (std::distance(data.begin(), search_result) + base) + offset;
|
||||
}
|
||||
|
||||
// increment the found count
|
||||
++cur_usage;
|
||||
data_begin = ++search_result;
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
intptr_t find_pattern_from(HMODULE module, const uint8_t *pattern, const char *mask,
|
||||
intptr_t offset, intptr_t result_usage, intptr_t start_from)
|
||||
{
|
||||
// get module information
|
||||
MODULEINFO module_info {};
|
||||
if (!GetModuleInformation(GetCurrentProcess(), module, &module_info, sizeof(module_info))) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
auto size = static_cast<size_t>(module_info.SizeOfImage);
|
||||
|
||||
try {
|
||||
|
||||
// copy data
|
||||
std::vector<uint8_t> data(size);
|
||||
memcpy(data.data(), module_info.lpBaseOfDll, size);
|
||||
|
||||
// find pattern
|
||||
return find_pattern_from(
|
||||
data,
|
||||
reinterpret_cast<intptr_t>(module_info.lpBaseOfDll),
|
||||
pattern,
|
||||
mask,
|
||||
offset,
|
||||
result_usage,
|
||||
start_from);
|
||||
} catch (const std::bad_alloc &e) {
|
||||
log_warning("sigscan", "failed to allocate buffer of size {} for image data", size);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
intptr_t find_pattern_from(HMODULE module, const std::string &pattern, const char *mask,
|
||||
intptr_t offset, intptr_t result_usage, intptr_t start_from)
|
||||
{
|
||||
std::string pattern_str(pattern);
|
||||
auto pattern_bin = std::make_unique<uint8_t[]>(pattern.length() / 2);
|
||||
if (!hex2bin(pattern_str.c_str(), pattern_bin.get())) {
|
||||
log_warning("sigscan", "hex2bin failed");
|
||||
return false;
|
||||
}
|
||||
|
||||
return find_pattern_from(module, pattern_bin.get(), mask, offset, result_usage, start_from);
|
||||
}
|
||||
|
||||
|
||||
intptr_t replace_pattern(HMODULE module, const uint8_t *pattern, const char *mask, intptr_t offset,
|
||||
intptr_t usage, const uint8_t *replace_data, const char *replace_mask)
|
||||
{
|
||||
@@ -164,3 +269,36 @@ intptr_t replace_pattern(HMODULE module, const std::string &signature,
|
||||
replace_mask.str().c_str()
|
||||
);
|
||||
}
|
||||
|
||||
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point) {
|
||||
std::ifstream file(dll_path, std::ios::binary);
|
||||
if (!file) {
|
||||
log_warning("sigscan", "Failed to open file: {}", dll_path.string().c_str());
|
||||
return false;
|
||||
}
|
||||
|
||||
// read the DOS header
|
||||
IMAGE_DOS_HEADER dos_header;
|
||||
file.read(reinterpret_cast<char*>(&dos_header), sizeof(dos_header));
|
||||
if (dos_header.e_magic != IMAGE_DOS_SIGNATURE) {
|
||||
log_warning("sigscan", "Invalid DOS signature: {}", dll_path.string().c_str());
|
||||
return false;
|
||||
}
|
||||
|
||||
// move to the NT headers
|
||||
file.seekg(dos_header.e_lfanew);
|
||||
|
||||
// read the NT headers
|
||||
IMAGE_NT_HEADERS nt_headers;
|
||||
file.read(reinterpret_cast<char*>(&nt_headers), sizeof(nt_headers));
|
||||
if (nt_headers.Signature != IMAGE_NT_SIGNATURE) {
|
||||
log_warning("sigscan", "Invalid NT signature: {}", dll_path.string().c_str());
|
||||
return false;
|
||||
}
|
||||
|
||||
// get the TimeDateStamp and AddressOfEntryPoint from the file header
|
||||
*time_date_stamp = nt_headers.FileHeader.TimeDateStamp;
|
||||
*address_of_entry_point = nt_headers.OptionalHeader.AddressOfEntryPoint;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user