Exetools - [C++] Pattern Scanner

Exetools (https://forum.exetools.com/index.php)

- Source Code (https://forum.exetools.com/forumdisplay.php?f=46)

- - [C++] Pattern Scanner (https://forum.exetools.com/showthread.php?t=17379)

[C++] Pattern Scanner

I wrote a pattern scanner that makes use of C++11 features a while back and decided to adjust it to no longer require a mask be passed with it. Instead, the pattern is parsed for wildcards and handled accordingly.

This should be cross-platform and 64bit friendly.

PHP Code:


		
			


/**

 * Scans the given data for the pattern.

 *

 * @param {vector} data                     The data to scan within for the given pattern.

 * @param {intptr_t} baseAddress            The base address of where the scan is starting from.

 * @param {const char*} lpPattern           The pattern to scan for. (Wildcards are marked as ?? per byte.)

 * @param {intptr_t} offset                 The offset to add to the found location.

 * @param {intptr_t} resultUsage            The result offset to use when locating signatures that match multiple locations.

 * @returns {intptr_t}                      The address where the pattern was found, 0 otherwise.

 */

intptr_t FindPattern(std::vector<unsigned char> data, intptr_t baseAddress, const char* lpPattern, intptr_t offset, intptr_t resultUsage)

{

    // Ensure the incoming pattern is properly aligned..

    if (strlen(lpPattern) % 2 > 0)

        return 0;



    // Convert the pattern to a vector of data..

    std::vector<std::pair<unsigned char, bool>> pattern;

    for (size_t x = 0, y = strlen(lpPattern) / 2; x < y; x++)

    {

        // Obtain the current byte..

        std::stringstream stream(std::string(lpPattern + (x * 2), 2));



        // Check if this is a wildcard..

        if (stream.str() == "??")

            pattern.push_back(std::make_pair(00, false));

        else

        {

            auto byte = strtol(stream.str().c_str(), nullptr, 16);

            pattern.push_back(std::make_pair((unsigned char)byte, true));

        }

    }



    auto scanStart = data.begin();

    auto resultCnt = 0;



    while (true)

    {

        // Search for the pattern..

        auto ret = std::search(scanStart, data.end(), pattern.begin(), pattern.end(),

            [&](unsigned char curr, std::pair<unsigned char, bool> currPattern)

        {

            return (!currPattern.second) || curr == currPattern.first;

        });



        // Did we find a match..

        if (ret != data.end())

        {

            // If we hit the usage count, return the result..

            if (resultCnt == resultUsage || resultUsage == 0)

                return (std::distance(data.begin(), ret) + baseAddress) + offset;



            // Increment the found count and scan again..

            ++resultCnt;

            scanStart = ++ret;

        }

        else

            break;

    }



    return 0;

}

Example usage:

PHP Code:


		
			
    // Obtain the raw data of the memory to scan..

    std::vector<unsigned char> rawdata(0x00400000, 0x00400000 + 0x01000000);



    // Scan for the pattern..

    auto result = FindPattern(std::ref(rawdata), (intptr_t)0x00400000, "8B0D????????8B15????????83EC18535556", 2, 0);

    if (result == 0)

        // Not found..

    else

        // Found..

A version in C# that I made for my Steamless project:

PHP Code:


		
			
        /// <summary>

        /// Scans the given data for the given pattern.

        /// 

        /// Notes:

        ///     Patterns are assumed to be 2 byte hex values with spaces.

        ///     Wildcards are represented by ??.

        /// </summary>

        /// <param name="data"></param>

        /// <param name="pattern"></param>

        /// <returns></returns>

        public static uint FindPattern(byte[] data, string pattern)

        {

            try

            {

                // Trim the pattern from extra whitespace..

                var trimPattern = pattern.Replace(" ", "").Trim();



                // Convert the pattern to a byte array..

                var patternMask = new List<bool>();

                var patternData = Enumerable.Range(0, trimPattern.Length).Where(x => x % 2 == 0)

                                            .Select(x =>

                                                {

                                                    var bt = trimPattern.Substring(x, 2);

                                                    patternMask.Add(!bt.Contains('?'));

                                                    return bt.Contains('?') ? (byte)0 : Convert.ToByte(bt, 16);

                                                }).ToArray();



                // Scan the given data for our pattern..

                for (var x = 0; x < data.Length; x++)

                {

                    if (!patternData.Where((t, y) => patternMask[y] && t != data[x + y]).Any())

                        return (uint)x;

                }



                return 0;

            }

            catch

            {

                return 0;

            }

        }

Example usage can be seen in Steamless here:

Code:

https://github.com/atom0s/Steamless

Here is a version I did. It supports nibble wildcards for the more fine-grained users. It also has a parallel signature scanner.

https://github.com/mrexodia/PatternFinder

Quote:

Originally Posted by mr.exodia (Post 104236)

Here is a version I did. It supports nibble wildcards for the more fine-grained users. It also has a parallel signature scanner.

https://github.com/mrexodia/PatternFinder

Just a question, but have you ever really put the nibble support to use much? I personally never found it useful in scanners and felt it just added bloat to the code for something that could just be a full wildcard byte. Just wondering what some situations are that others found it useful.

@atom0s: sure, I mainly use it for a more fine-grained matching on instructions with wildcard registers, for example FF D0 (call eax), for call reg you need to match FF D?, so without nibbles you would match on FF and this also matches a lot of other shit (invalid instructions, inc [reg], call [] etc). I agree that in signature matching it isn't quite useful, but if you need to find the next 'call reg' in a reliable way you need nibble matching. Same applies to 'push reg'.

Obviously if you feel it's a bloat you shouldn't use it :) I just commented so other people don't have to implement it themselves.

Greetings