Advertisement
Wolfrost

C++ PatternScan Class

Mar 30th, 2016
414
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. class CPatternScan
  2. {
  3. private:
  4.  
  5.     MODULEENTRY32 ModuleToScan;
  6.     HANDLE HandleToScan;
  7.     BYTE* DumpedRegion;
  8.     DWORD StartAddress;
  9.     DWORD ScanSize;
  10.  
  11. public:
  12.  
  13.     void Init(HANDLE HandleToScan, MODULEENTRY32 ModuleToScan, DWORD StartAddress, DWORD ScanSize)
  14.     {
  15.         this->HandleToScan = HandleToScan;
  16.         this->ModuleToScan = ModuleToScan;
  17.         this->StartAddress = StartAddress;
  18.         this->ScanSize = ScanSize;
  19.     }
  20.  
  21.     bool Dump()
  22.     {
  23.         this->DumpedRegion = new BYTE[this->ScanSize];
  24.  
  25.         bool rpmResult;
  26.  
  27.         rpmResult =
  28.             ReadProcessMemory(
  29.             this->HandleToScan,
  30.             reinterpret_cast<LPCVOID>(this->StartAddress),
  31.             DumpedRegion,
  32.             ScanSize,
  33.             NULL
  34.             ) == TRUE;
  35.  
  36.         if (!rpmResult)
  37.         {
  38.             delete [] DumpedRegion;
  39.             return false;
  40.         }
  41.  
  42.         return true;
  43.     }
  44.  
  45.     bool MaskCheck(int StartOffset, std::string Mask, const BYTE* Pattern, const size_t& PatternSize)
  46.     {
  47.         for (unsigned int i=0; i<PatternSize; i++)
  48.         {
  49.             if (Mask[i] == '?') continue;
  50.  
  51.             if (Mask[i] == 'x' && Pattern[i] != this->DumpedRegion[StartOffset + i])
  52.                 return false;
  53.             else
  54.                 printf("Pattern[i] found: %x - Found: %x \n", Pattern[i], this->DumpedRegion[StartOffset + i]);
  55.         }
  56.         return true;
  57.     }
  58.  
  59.     DWORD FindPattern(const BYTE* Pattern, const size_t& PatternSize, std::string Mask, int AddValue)
  60.     {
  61.         if (DumpedRegion == nullptr) if (!this->Dump()) return NULL;
  62.  
  63.         if (Mask.length() != PatternSize) return NULL;
  64.  
  65.         for (DWORD i=0; i<ScanSize; i++)
  66.         {
  67.             if (this->MaskCheck(i, Mask, Pattern, PatternSize))
  68.                 return this->StartAddress + (i + AddValue);
  69.         }
  70.  
  71.         return NULL;
  72.     }
  73.  
  74.     void ResetDump()
  75.     {
  76.         this->DumpedRegion = nullptr;
  77.     }
  78.  
  79. };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement