Advertisement
R3v3rs3r

External process pattern scan with mask in all regio [C++]

Jul 24th, 2023
605
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ (WinAPI) 2.00 KB | Source Code | 0 0
  1. #include <Windows.h>
  2. #include <iostream>
  3.  
  4. // Function to scan the process's memory for a specific pattern with a mask
  5. void ScanMemoryWithMask(HANDLE processHandle, uintptr_t startAddress, const char* pattern, const char* mask) {
  6.     MEMORY_BASIC_INFORMATION memInfo;
  7.     SIZE_T bytesRead;
  8.     char buffer[1024];
  9.  
  10.     while (VirtualQueryEx(processHandle, reinterpret_cast<LPCVOID>(startAddress), &memInfo, sizeof(memInfo))) {
  11.         if (memInfo.State == MEM_COMMIT && (memInfo.Protect == PAGE_READWRITE || memInfo.Protect == PAGE_EXECUTE_READWRITE)) {
  12.             ReadProcessMemory(processHandle, memInfo.BaseAddress, buffer, memInfo.RegionSize, &bytesRead);
  13.  
  14.             for (SIZE_T i = 0; i < bytesRead; i++) {
  15.                 bool found = true;
  16.  
  17.                 for (SIZE_T j = 0; mask[j]; j++) {
  18.                     if (mask[j] != '?' && pattern[j] != buffer[i + j]) {
  19.                         found = false;
  20.                         break;
  21.                     }
  22.                 }
  23.  
  24.                 if (found) {
  25.                     uintptr_t address = reinterpret_cast<uintptr_t>(memInfo.BaseAddress) + i;
  26.                     std::cout << "Found pattern at address: 0x" << std::hex << address << std::endl;
  27.                     // You can do further processing with the found address here
  28.                 }
  29.             }
  30.         }
  31.  
  32.         startAddress += memInfo.RegionSize;
  33.     }
  34. }
  35.  
  36. int main() {
  37.     // Adjust these values according to your needs
  38.     const int targetProcessId = YOUR_TARGET_PROCESS_ID;
  39.     const char* pattern = "your_pattern_here";
  40.     const char* mask = "your_mask_here";
  41.  
  42.     HANDLE processHandle = OpenProcess(PROCESS_VM_READ, FALSE, targetProcessId);
  43.     if (processHandle == NULL) {
  44.         std::cout << "Failed to open the process." << std::endl;
  45.         return 1;
  46.     }
  47.  
  48.     // Call the function to scan the process's memory with the provided pattern and mask
  49.     ScanMemoryWithMask(processHandle, 0, pattern, mask);
  50.  
  51.     CloseHandle(processHandle);
  52.     return 0;
  53. }
  54.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement