Advertisement
Guest User

Untitled

a guest
Apr 22nd, 2019
376
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.83 KB | None | 0 0
  1. // my usage
  2. got_lock = BBSearchPattern((PCUCHAR)"\x48\x8D\x0D\xCC\xCC\xCC\xCC\xE8\xCC\xCC\xCC\xCC\x48\x8B\x0D\xCC\xCC\xCC\xCC\x33\xDB", (UCHAR)"xxx????x????xxx????xx", (ULONG_PTR)21, (VOID*)nt, ntsize, &lock_add);
  3. got_cache = BBSearchPattern((PCUCHAR)"\x48\x8D\x0D\xCC\xCC\xCC\xCC\xE8\xCC\xCC\xCC\xCC\x3D\xCC\xCC\xCC\xCC\x0F\x83\xCC\xCC\xCC\xCC", (UCHAR)"xxx????x????x????xx????", (ULONG_PTR)23, (VOID*)nt, ntsize, &cache_add);
  4.  
  5. // i have confirmed everything used is good, the ntbase is identical to the base in my pc and the ntsize is the right size it needs to be
  6.  
  7. // their usage
  8. PVOID ptr = NULL;
  9. NTSTATUS status = BBSearchPattern( pattern, wildcard, len, (PUCHAR)base + pSection->VirtualAddress, pSection->Misc.VirtualSize, &ptr );
  10. if (NT_SUCCESS( status ))
  11. *(PULONG)ppFound = (ULONG)((PUCHAR)ptr - (PUCHAR)base);
  12.  
  13. return status;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement