133 lines
2.1 KiB
C++
133 lines
2.1 KiB
C++
|
|
|||
|
#include "sigs.h"
|
|||
|
|
|||
|
DWORD Findrekt(std::string moduleName, std::string Mask)
|
|||
|
{
|
|||
|
const char* pat = Mask.c_str();
|
|||
|
DWORD firstMatch = 0;
|
|||
|
DWORD rangeStart = (DWORD)GetModuleHandleA(moduleName.c_str());
|
|||
|
MODULEINFO miModInfo; GetModuleInformation(GetCurrentProcess(), (HMODULE)rangeStart, &miModInfo, sizeof(MODULEINFO));
|
|||
|
DWORD rangeEnd = rangeStart + miModInfo.SizeOfImage;
|
|||
|
for (DWORD pCur = rangeStart; pCur < rangeEnd; pCur++)
|
|||
|
{
|
|||
|
if (!*pat)
|
|||
|
{
|
|||
|
return firstMatch;
|
|||
|
}
|
|||
|
if (*(PBYTE)pat == '\?' || *(BYTE*)pCur == getByte(pat))
|
|||
|
{
|
|||
|
if (!firstMatch)
|
|||
|
{
|
|||
|
firstMatch = pCur;
|
|||
|
}
|
|||
|
|
|||
|
if (!pat[2])
|
|||
|
{
|
|||
|
return firstMatch;
|
|||
|
}
|
|||
|
|
|||
|
|
|||
|
if (*(PWORD)pat == '\?\?' || *(PBYTE)pat != '\?')
|
|||
|
{
|
|||
|
pat += 3;
|
|||
|
}
|
|||
|
else
|
|||
|
{
|
|||
|
pat += 2; //one ?
|
|||
|
}
|
|||
|
|
|||
|
}
|
|||
|
else
|
|||
|
{
|
|||
|
pat = Mask.c_str();
|
|||
|
firstMatch = 0;
|
|||
|
}
|
|||
|
}
|
|||
|
return NULL;
|
|||
|
}
|
|||
|
|
|||
|
bool streq(const char *s1, const char *s2)
|
|||
|
{
|
|||
|
for (; *s1 == *s2; s1++, s2++)
|
|||
|
{
|
|||
|
if (*s1 == '\0')
|
|||
|
return true;
|
|||
|
}
|
|||
|
|
|||
|
return false;
|
|||
|
}
|
|||
|
|
|||
|
void *FindString(void *ptr, const char *string)
|
|||
|
{
|
|||
|
char *start;
|
|||
|
char *str = nullptr;
|
|||
|
|
|||
|
for (start = (char *)ptr; str == nullptr; start++)
|
|||
|
{
|
|||
|
if (streq(start, string))
|
|||
|
str = start;
|
|||
|
}
|
|||
|
|
|||
|
while (1)
|
|||
|
{
|
|||
|
if (*(char **)start == str)
|
|||
|
return start;
|
|||
|
|
|||
|
start--;
|
|||
|
}
|
|||
|
|
|||
|
return nullptr;
|
|||
|
}
|
|||
|
|
|||
|
void *FindPattern(void *start, unsigned int len, const pattern *data)
|
|||
|
{
|
|||
|
const char *pattern = (char *)data + 5;
|
|||
|
const char *q = (char *)start;
|
|||
|
|
|||
|
for (int i = 0, mask = *(int *)((char *)data + 1); i < len; i++, q++)
|
|||
|
{
|
|||
|
const char *seq = pattern;
|
|||
|
const char *mem = q;
|
|||
|
|
|||
|
|
|||
|
register bool g = true;
|
|||
|
|
|||
|
for (int x = 0; x < 32; x++)
|
|||
|
{
|
|||
|
if ((mask & (1 << x)) && (mem[x] != *seq++))
|
|||
|
{
|
|||
|
g = false;
|
|||
|
break;
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
if (g) return (void *)(q + (int)*(unsigned char *)data);
|
|||
|
}
|
|||
|
|
|||
|
return nullptr;
|
|||
|
}
|
|||
|
|
|||
|
void *FindPattern(const char *l, const pattern *data)
|
|||
|
{
|
|||
|
return FindPattern(GetModuleHandle(l), -1, data);
|
|||
|
}
|
|||
|
|
|||
|
void *FindProlog(void *ptr)
|
|||
|
{
|
|||
|
unsigned char *ins = (unsigned char *)ptr;
|
|||
|
|
|||
|
while (ins > 0)
|
|||
|
{
|
|||
|
if ((ins[0] & 0xf0) == 0x50 &&
|
|||
|
(ins[1] & 0xf0) == 0x80 &&
|
|||
|
(ins[2] & 0x0f) == 0x0c)
|
|||
|
{
|
|||
|
return ins;
|
|||
|
}
|
|||
|
|
|||
|
ins--;
|
|||
|
}
|
|||
|
|
|||
|
return nullptr;
|
|||
|
}
|