unit FindPatterns;

interface

uses
 CodeSiteLogging,
 Winapi.Windows;

 function FindPcore: DWORD;

implementation

function _Compare(R, L: Pointer; Mask: PAnsiChar): Boolean;
var
 K: Integer;
begin
 for K := 0 to Length(Mask) -1 do
  begin
   if (Mask[K] = 'x') and (PByte(Integer(R) + K)^ <> PByte(Integer(L) + K)^) then
    Exit(False)
  end;
 Result := True;
end;

function FindPattern (R, L: Pointer; Len: DWORD; Mask: PAnsiChar): DWORD;
var
 K: Integer;
begin
 Result := 0;
 for K := 0 to Len -1 do
  begin
   if _Compare(Ptr(Integer(R) + K), L, Mask) then
     Exit(Integer(R) + K);
  end;
end;

function Scan(Mode: DWORD; Pattern: Pointer; Mask: PAnsiChar): DWORD;
var
  PageSize: DWORD;
  SystemInfo: SYSTEM_INFO;
  K, Offset, lpAddr: size_t;
  MemInfo: TMemoryBasicInformation;
begin
  GetSystemInfo(SystemInfo);
  PageSize := SystemInfo.dwPageSize;
  lpAddr := 00401000;

  while lpAddr < $7FFFFFFF do
   begin
    K := VirtualQuery(Pointer(lpAddr), MemInfo, SizeOf(TMemoryBasicInformation));
   if (K = ERROR_INVALID_PARAMETER) or (K = 0) then
    Break;

   if (MemInfo.Type_9 = MEM_MAPPED) then
    begin
     inc(lpAddr, memInfo.RegionSize);
     Continue;
    end;

   if (K = SizeOf(TMemoryBasicInformation)) and
      (memInfo.State = MEM_COMMIT) and
      (memInfo.RegionSize > 0) and
      (memInfo.Protect = Mode)
   then
    begin
     Offset := FindPattern(Pointer(lpAddr), Pattern, memInfo.RegionSize, Mask);
     if not (Offset = 0) then
      begin
       Result := Offset;

       CodeSite.SendFmtMsg('%x - %x',[Offset, PDWORD(Ptr(Offset))^]);
       Break;
      end;
    end;
    inc(lpAddr, memInfo.RegionSize);
   end;
end;

function FindPCore: DWORD;
const
Str_B80EB6 : array [0 .. 80] of Byte = ($55, $8B, $EC, $51, $89, $4D, $FC, $8B, $4D, $FC, $E8, $5D, $05, $00, $00, $8B, $45, $FC, $C9, $C3, $55, $8B, $EC, $51, $89, $4D, $FC, $C9, $C3, $55, $8B, $EC, $51, $51, $89, $4D, $FC, $8B, $4D, $FC, $E8, $3F, $05, $00, $00, $6A, $00, $6A, $01, $8D, $45, $08, $50, $8B, $4D, $FC, $E8, $24, $03, $00, $00, $8A, $45, $08, $88, $45, $F8, $80, $7D, $F8, $C1, $74, $08, $80, $7D, $F8, $C2, $74, $13, $EB, $22);
var
 Mask: PAnsiChar;
begin
 Mask := 'xxxxxxxxxxx????xxxxxxxxxxxxxxxxxxxxxxxxxx????xxxxxxxxxxxx????xxxxxxxxxxxxxxxxxxxx';
 Result := Scan(PAGE_READWRITE, @Str_B80EB6, Mask);
end;

end.