Advertisement
CorrM

Untitled

Dec 29th, 2018
293
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 3.43 KB | None | 0 0
  1. //Internal Pattern Scan
  2. char* PatternScan::Scan(char* base, size_t size, AoBPattern pattern, int startFrom)
  3. {
  4.     size_t patternLength = pattern.Mask.length();
  5.  
  6.     if (size <= 0 || pattern.Mask.size() <= 0 || startFrom > size - pattern.Mask.size() || pattern.Mask.size() > size)
  7.         return 0;
  8.  
  9.     for (unsigned int i = startFrom; i < size - patternLength; i++)
  10.     {
  11.         bool found = true;
  12.         for (unsigned int j = 0; j < patternLength; j++)
  13.         {
  14.             if (pattern.Mask[j] != '?')
  15.             {
  16.                 unsigned char gg = *(unsigned char*)(base + i + j);
  17.                 if (pattern.Pattern[j] != gg)
  18.                 {
  19.                     found = false;
  20.                     break;
  21.                 }
  22.             }
  23.  
  24.             /*if (pattern.Mask[j] != '?' && pattern.Pattern[j] != *(base + i + j))
  25.             {
  26.                 found = false;
  27.                 break;
  28.             }*/
  29.         }
  30.  
  31.         if (found)
  32.         {
  33.             return (base + i);
  34.         }
  35.     }
  36.     return 0;
  37. }
  38.  
  39. //External Wrapper
  40. vector<uintptr_t> PatternScan::ScanEx2(BypaPH* ByPH, uintptr_t begin, uintptr_t end, AoBPattern pattern, bool firstOnly)
  41. {
  42.     /*SYSTEM_INFO sysInfo;
  43.     GetSystemInfo(&sysInfo);
  44.  
  45.     uintptr_t start = (uintptr_t)sysInfo.lpMinimumApplicationAddress;
  46.     uintptr_t end = (uintptr_t)sysInfo.lpMaximumApplicationAddress;*/
  47.  
  48.     vector<uintptr_t> ret;
  49.     vector<MemoryRegion> MemBlocks;
  50.     uintptr_t currentChunk = begin;
  51.  
  52.     HANDLE pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ByPH->pID);
  53.     while (currentChunk < end)
  54.     {
  55.         MEMORY_BASIC_INFORMATION mbi;
  56.  
  57.         auto QueryFail = VirtualQueryEx(pHandle, (LPVOID)currentChunk, &mbi, sizeof(mbi));
  58.         int laste = GetLastError();
  59.         if (!QueryFail)
  60.             return ret;
  61.  
  62.         char* buffer = 0;
  63.         bool isValid = mbi.State == MEM_COMMIT;
  64.         isValid &= (uintptr_t)mbi.BaseAddress < end;
  65.         isValid &= ((mbi.Protect & PAGE_GUARD) == 0);
  66.         isValid &= ((mbi.Protect & PAGE_NOACCESS) == 0);
  67.         isValid &= (mbi.Type == MEM_PRIVATE);
  68.        
  69.         if (isValid)
  70.         {
  71.             bool isWritable = ((mbi.Protect & PAGE_READWRITE) > 0) ||
  72.                 ((mbi.Protect & PAGE_WRITECOPY) > 0) ||
  73.                 ((mbi.Protect & PAGE_EXECUTE_READWRITE) > 0) ||
  74.                 ((mbi.Protect & PAGE_EXECUTE_WRITECOPY) > 0);
  75.  
  76.             bool isExecutable = ((mbi.Protect & PAGE_EXECUTE) > 0) ||
  77.                 ((mbi.Protect & PAGE_EXECUTE_READ) > 0) ||
  78.                 ((mbi.Protect & PAGE_EXECUTE_READWRITE) > 0) ||
  79.                 ((mbi.Protect & PAGE_EXECUTE_WRITECOPY) > 0);
  80.  
  81.             //isWritable &= writable;
  82.             //isExecutable &= executable;
  83.            
  84.             isValid &= isWritable || isExecutable;
  85.         }
  86.        
  87.         if (!isValid)
  88.         {
  89.             currentChunk = (uintptr_t)mbi.BaseAddress + mbi.RegionSize;
  90.             continue;
  91.         }
  92.  
  93.         if (isValid)
  94.         {
  95.             // Store Memory Blocks
  96.             MemoryRegion memBlock;
  97.             memBlock.address = currentChunk;
  98.             memBlock.regionSize = mbi.RegionSize;
  99.             MemBlocks.push_back(memBlock);
  100.         }
  101.  
  102.         currentChunk = currentChunk + mbi.RegionSize;
  103.     }
  104.  
  105.     parallel_for_each(MemBlocks.begin(), MemBlocks.end(), [&](MemoryRegion block)
  106.     {
  107.         // Read Memory
  108.         SIZE_T bytesRead;
  109.         char* buffer = new char[block.regionSize];
  110.         ByPH->RWVM(ByPH->m_hTarget, (LPVOID)block.address, buffer, block.regionSize, &bytesRead);
  111.         if (bytesRead == 0)
  112.         {
  113.             if (buffer)
  114.                 delete buffer;
  115.             return;
  116.         }
  117.  
  118.         // Scan The Pattern
  119.         char* internalAddress;
  120.         int start = 0;
  121.         while ((internalAddress = Scan(buffer, block.regionSize, pattern, start)) != 0)
  122.         {
  123.             uintptr_t offsetFromBuffer = internalAddress - buffer;
  124.             start += offsetFromBuffer + pattern.Mask.size();
  125.             uintptr_t match = block.address + offsetFromBuffer;
  126.             if (match <= 0x0) continue;
  127.             ret.push_back(match);
  128.         }
  129.  
  130.         delete buffer;
  131.     });
  132.  
  133.     return ret;
  134. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement