Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // my usage
- got_lock = BBSearchPattern((PCUCHAR)"\x48\x8D\x0D\xCC\xCC\xCC\xCC\xE8\xCC\xCC\xCC\xCC\x48\x8B\x0D\xCC\xCC\xCC\xCC\x33\xDB", (UCHAR)"xxx????x????xxx????xx", (ULONG_PTR)21, (VOID*)nt, ntsize, &lock_add);
- got_cache = BBSearchPattern((PCUCHAR)"\x48\x8D\x0D\xCC\xCC\xCC\xCC\xE8\xCC\xCC\xCC\xCC\x3D\xCC\xCC\xCC\xCC\x0F\x83\xCC\xCC\xCC\xCC", (UCHAR)"xxx????x????x????xx????", (ULONG_PTR)23, (VOID*)nt, ntsize, &cache_add);
- // i have confirmed everything used is good, the ntbase is identical to the base in my pc and the ntsize is the right size it needs to be
- // their usage
- PVOID ptr = NULL;
- NTSTATUS status = BBSearchPattern( pattern, wildcard, len, (PUCHAR)base + pSection->VirtualAddress, pSection->Misc.VirtualSize, &ptr );
- if (NT_SUCCESS( status ))
- *(PULONG)ppFound = (ULONG)((PUCHAR)ptr - (PUCHAR)base);
- return status;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement