Broihon

Untitled

Jan 2nd, 2017
952
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include "Scan.h"
  2.  
  3. bool __fastcall INT_ComparePattern2(char * szSource, const char * szPattern, const char * szMask)
  4. {
  5.     while(*szMask)
  6.     {
  7.         if (*szMask <= '9')
  8.         {
  9.             szPattern   += ((*szMask) ^ 0x30);
  10.             szSource    += ((*szMask) ^ 0x30);
  11.         }
  12.         else
  13.         {
  14.             for (int i = ((*szMask) ^ 0x60); i; --i)
  15.                 if (*(szSource++) != *(szPattern++))
  16.                     return false;
  17.         }
  18.         ++szMask;
  19.     }
  20.  
  21.     return true;
  22. }
  23.  
  24. bool INT_ComparePattern(char * szSource, const char * szPattern, const char * szMask)
  25. {
  26.     for (; *szMask; ++szSource, ++szPattern, ++szMask)
  27.         if (*szMask == 'x' && *szSource != *szPattern)
  28.             return false;
  29.  
  30.     return true;
  31. }
  32.  
  33. char * INT_PatternScan(char * pData, UINT_PTR RegionSize, const char * szPattern, const char * szMask, int Len)
  34. {
  35.     for (UINT i = 0; i != RegionSize - Len; ++i, ++pData)
  36.         if (INT_ComparePattern(pData, szPattern, szMask))
  37.             return pData;
  38.  
  39.     return nullptr;
  40. }
  41.  
  42. char * PatternScan(char * pStart, UINT_PTR RegionSize, const char * szPattern, const char * szMask, int Len)
  43. {
  44.     char * pCurrent = pStart;
  45.  
  46.     while (pCurrent <= pStart + RegionSize - Len)
  47.     {
  48.         MEMORY_BASIC_INFORMATION MBI{ 0 };
  49.         if (!VirtualQuery(pCurrent, &MBI, sizeof(MEMORY_BASIC_INFORMATION)))
  50.             return nullptr;
  51.  
  52.         if (MBI.State == MEM_COMMIT && !(MBI.Protect & PAGE_NOACCESS || MBI.Protect & PAGE_GUARD))
  53.         {
  54.             if (pCurrent + MBI.RegionSize > pStart + RegionSize - Len)
  55.                 MBI.RegionSize = pStart + RegionSize - pCurrent + Len;
  56.  
  57.             char * Ret = INT_PatternScan(pCurrent, MBI.RegionSize, szPattern, szMask, Len);
  58.  
  59.             if (Ret)
  60.                 return Ret;
  61.         }
  62.         pCurrent += MBI.RegionSize;
  63.     }
  64.  
  65.     return nullptr;
  66. }
  67.  
  68. char * PatternScanEx(HANDLE hProc, char * pStart, UINT_PTR RegionSize, const char * szPattern, const char * szMask)
  69. {
  70.     DWORD Buffer = 0;
  71.     if (!GetHandleInformation(hProc, &Buffer))
  72.         return nullptr;
  73.  
  74.     char * pCurrent = pStart;
  75.     auto Len = lstrlenA(szMask);
  76.  
  77.     SIZE_T BufferSize = 0x10000;
  78.     char * Data = new char[BufferSize];
  79.  
  80.     while (pCurrent <= pStart + RegionSize - Len)
  81.     {
  82.         MEMORY_BASIC_INFORMATION MBI{ 0 };
  83.         if (!VirtualQueryEx(hProc, pCurrent, &MBI, sizeof(MEMORY_BASIC_INFORMATION)))
  84.             return nullptr;
  85.  
  86.         if (MBI.State == MEM_COMMIT && !(MBI.Protect & (PAGE_NOACCESS | PAGE_GUARD)))
  87.         {
  88.             if (BufferSize < MBI.RegionSize)
  89.             {
  90.                 delete[] Data;
  91.                 BufferSize = MBI.RegionSize;
  92.                 Data = new char[BufferSize];
  93.             }
  94.  
  95.             UINT_PTR Delta = pCurrent - reinterpret_cast<char*>(MBI.BaseAddress);
  96.             MBI.RegionSize -= Delta;
  97.  
  98.             if (pCurrent + MBI.RegionSize > pStart + RegionSize - Len)
  99.                 MBI.RegionSize -= pCurrent + MBI.RegionSize - pStart - RegionSize + Len;
  100.  
  101.             if (!ReadProcessMemory(hProc, pCurrent, Data, MBI.RegionSize, nullptr))
  102.             {
  103.                 pCurrent = pCurrent + MBI.RegionSize;
  104.                 continue;
  105.             }
  106.  
  107.             char * Ret = INT_PatternScan(Data, MBI.RegionSize, szPattern, szMask, Len);
  108.  
  109.             if (Ret)
  110.             {
  111.                 delete[] Data;
  112.                 return (Ret - Data + pCurrent);
  113.             }
  114.         }
  115.  
  116.         pCurrent = pCurrent + MBI.RegionSize;
  117.     }
  118.    
  119.     delete[] Data;
  120.  
  121.     return nullptr;
  122. }
Add Comment
Please, Sign In to add comment