Overloaded FindPatternSIMD that only takes 1 string.

* Uses IDA Style Pattern, Byte Array and Mask get created from that pattern.
This commit is contained in:
PixieCore 2022-06-25 00:08:02 +02:00
parent 39de0c3687
commit 5ecac66dba
4 changed files with 45 additions and 0 deletions

View File

@ -23,6 +23,7 @@ public:
CModule(void) = default;
CModule(const string& moduleName);
CMemory FindPatternSIMD(const uint8_t* szPattern, const char* szMask) const;
CMemory FindPatternSIMD(const string& svPattern) const;
CMemory FindString(const string& string, const ptrdiff_t occurence = 1, bool nullTerminator = false) const;
CMemory FindStringReadOnly(const string& svString, bool nullTerminator) const;

View File

@ -45,6 +45,7 @@ string StringUnescape(const string& svInput);
vector<int> StringToBytes(const string& svInput, bool bNullTerminator);
vector<int> PatternToBytes(const string& svInput);
pair<vector<uint8_t>, string> PatternToBytesAndMask(const string& svInput);
vector<int> IntToDigits(int iValue);
/////////////////////////////////////////////////////////////////////////////

View File

@ -102,6 +102,18 @@ CMemory CModule::FindPatternSIMD(const uint8_t* szPattern, const char* szMask) c
return CMemory();
}
//-----------------------------------------------------------------------------
// Purpose: find array of bytes in process memory using SIMD instructions
// Input : *szPattern
// Output : CMemory
//-----------------------------------------------------------------------------
CMemory CModule::FindPatternSIMD(const string& svPattern) const
{
const pair patternInfo = PatternToBytesAndMask(svPattern);
return FindPatternSIMD(patternInfo.first.data(), patternInfo.second.c_str());
}
//-----------------------------------------------------------------------------
// Purpose: find address of input string constant in read only memory
// Input : *svString -

View File

@ -664,6 +664,37 @@ vector<int> PatternToBytes(const string& svInput)
return vBytes;
};
///////////////////////////////////////////////////////////////////////////////
// For converting a string pattern with wildcards to an array of bytes and mask.
pair<vector<uint8_t>, string> PatternToBytesAndMask(const string& svInput)
{
char* pszPatternStart = const_cast<char*>(svInput.c_str());
char* pszPatternEnd = pszPatternStart + strlen(svInput.c_str());
vector<uint8_t> vBytes = vector<uint8_t>{ };
string szMask = string();
for (char* pszCurrentByte = pszPatternStart; pszCurrentByte < pszPatternEnd; ++pszCurrentByte)
{
if (*pszCurrentByte == '?')
{
++pszCurrentByte;
if (*pszCurrentByte == '?')
{
++pszCurrentByte; // Skip double wildcard.
}
vBytes.push_back(0); // Push the byte back as invalid.
szMask.append("?");
}
else
{
vBytes.push_back(strtoul(pszCurrentByte, &pszCurrentByte, 16));
szMask.append("x");
}
}
return make_pair(vBytes, szMask);
};
///////////////////////////////////////////////////////////////////////////////
// For converting a integer into digits.
vector<int> IntToDigits(int iValue)