[ ]
0834646097
> use reverse pattern search instead, fixes performance issue for some hooks > sigscan still requires overhead of module copy for each operation
152 lines
3.8 KiB
C++
152 lines
3.8 KiB
C++
#pragma once
|
|
|
|
#include <algorithm>
|
|
#include <string>
|
|
#include <cstdint>
|
|
#include <vector>
|
|
#include <filesystem>
|
|
#include "windows.h"
|
|
#include "psapi.h"
|
|
|
|
intptr_t find_pattern(
|
|
std::vector<unsigned char> &data,
|
|
intptr_t base,
|
|
const unsigned char *pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
bool reverse = false);
|
|
|
|
intptr_t find_pattern(
|
|
HMODULE module,
|
|
const unsigned char *pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
bool reverse = false);
|
|
|
|
intptr_t find_pattern(
|
|
HMODULE module,
|
|
const std::string &pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t result_usage,
|
|
bool reverse = false);
|
|
|
|
intptr_t find_pattern_from(
|
|
std::vector<unsigned char> &data,
|
|
intptr_t base,
|
|
const unsigned char *pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
intptr_t start_from,
|
|
bool reverse = false);
|
|
|
|
intptr_t find_pattern_from(
|
|
HMODULE module,
|
|
const unsigned char *pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
intptr_t start_from,
|
|
bool reverse = false);
|
|
|
|
intptr_t find_pattern_from(
|
|
HMODULE module,
|
|
const std::string &pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t result_usage,
|
|
intptr_t start_from,
|
|
bool reverse = false);
|
|
|
|
intptr_t replace_pattern(
|
|
HMODULE module,
|
|
const unsigned char *pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
const unsigned char *replace_data,
|
|
const char *replace_mask,
|
|
bool reverse = false);
|
|
|
|
intptr_t replace_pattern(
|
|
HMODULE module,
|
|
const std::string &signature,
|
|
const std::string &replacement,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
bool reverse = false);
|
|
|
|
intptr_t replace_pattern_from(
|
|
HMODULE module,
|
|
const unsigned char *pattern,
|
|
const char *mask,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
intptr_t start_from,
|
|
const unsigned char *replace_data,
|
|
const char *replace_mask,
|
|
bool reverse = false);
|
|
|
|
intptr_t replace_pattern_from(
|
|
HMODULE module,
|
|
const std::string &signature,
|
|
const std::string &replacement,
|
|
intptr_t offset,
|
|
intptr_t usage,
|
|
intptr_t start_from,
|
|
bool reverse = false);
|
|
|
|
bool get_pe_identifier(const std::filesystem::path& dll_path, uint32_t* time_date_stamp, uint32_t* address_of_entry_point);
|
|
|
|
union reg_t{
|
|
struct{
|
|
unsigned char t;
|
|
unsigned char v;
|
|
};
|
|
unsigned short s;
|
|
constexpr reg_t(unsigned char t, unsigned char v) : s(v << 8 | t) {}
|
|
constexpr reg_t(unsigned short s) : s(s) {}
|
|
};
|
|
|
|
enum REGTYPE : unsigned char
|
|
{
|
|
GPR_32,
|
|
GPR_64,
|
|
GPR_EXT
|
|
};
|
|
|
|
enum REG : unsigned short
|
|
{
|
|
EAX = reg_t(GPR_32, 0x05).s,
|
|
ECX = reg_t(GPR_32, 0x0D).s,
|
|
EDX = reg_t(GPR_32, 0x15).s,
|
|
EBX = reg_t(GPR_32, 0x1D).s,
|
|
ESP = reg_t(GPR_32, 0x25).s,
|
|
EBP = reg_t(GPR_32, 0x2D).s,
|
|
ESI = reg_t(GPR_32, 0x35).s,
|
|
EDI = reg_t(GPR_32, 0x3D).s,
|
|
RAX = reg_t(GPR_64, 0x05).s,
|
|
RCX = reg_t(GPR_64, 0x0D).s,
|
|
RDX = reg_t(GPR_64, 0x15).s,
|
|
RBX = reg_t(GPR_64, 0x1D).s,
|
|
RSP = reg_t(GPR_64, 0x25).s,
|
|
RBP = reg_t(GPR_64, 0x2D).s,
|
|
RSI = reg_t(GPR_64, 0x35).s,
|
|
RDI = reg_t(GPR_64, 0x3D).s,
|
|
R8 = reg_t(GPR_EXT, 0x05).s,
|
|
R9 = reg_t(GPR_EXT, 0x0D).s,
|
|
R10 = reg_t(GPR_EXT, 0x15).s,
|
|
R11 = reg_t(GPR_EXT, 0x1D).s,
|
|
R12 = reg_t(GPR_EXT, 0x25).s,
|
|
R13 = reg_t(GPR_EXT, 0x2D).s,
|
|
R14 = reg_t(GPR_EXT, 0x35).s,
|
|
R15 = reg_t(GPR_EXT, 0x3D).s
|
|
};
|
|
|
|
intptr_t find_asm_leacstr_from(
|
|
HMODULE module,
|
|
reg_t reg,
|
|
const char *cstr); |