Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- class CPatternScan
- {
- private:
- MODULEENTRY32 ModuleToScan;
- HANDLE HandleToScan;
- BYTE* DumpedRegion;
- DWORD StartAddress;
- DWORD ScanSize;
- public:
- void Init(HANDLE HandleToScan, MODULEENTRY32 ModuleToScan, DWORD StartAddress, DWORD ScanSize)
- {
- this->HandleToScan = HandleToScan;
- this->ModuleToScan = ModuleToScan;
- this->StartAddress = StartAddress;
- this->ScanSize = ScanSize;
- }
- bool Dump()
- {
- this->DumpedRegion = new BYTE[this->ScanSize];
- bool rpmResult;
- rpmResult =
- ReadProcessMemory(
- this->HandleToScan,
- reinterpret_cast<LPCVOID>(this->StartAddress),
- DumpedRegion,
- ScanSize,
- NULL
- ) == TRUE;
- if (!rpmResult)
- {
- delete [] DumpedRegion;
- return false;
- }
- return true;
- }
- bool MaskCheck(int StartOffset, std::string Mask, const BYTE* Pattern, const size_t& PatternSize)
- {
- for (unsigned int i=0; i<PatternSize; i++)
- {
- if (Mask[i] == '?') continue;
- if (Mask[i] == 'x' && Pattern[i] != this->DumpedRegion[StartOffset + i])
- return false;
- else
- printf("Pattern[i] found: %x - Found: %x \n", Pattern[i], this->DumpedRegion[StartOffset + i]);
- }
- return true;
- }
- DWORD FindPattern(const BYTE* Pattern, const size_t& PatternSize, std::string Mask, int AddValue)
- {
- if (DumpedRegion == nullptr) if (!this->Dump()) return NULL;
- if (Mask.length() != PatternSize) return NULL;
- for (DWORD i=0; i<ScanSize; i++)
- {
- if (this->MaskCheck(i, Mask, Pattern, PatternSize))
- return this->StartAddress + (i + AddValue);
- }
- return NULL;
- }
- void ResetDump()
- {
- this->DumpedRegion = nullptr;
- }
- };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement