| 933 | } |
| 934 | |
| 935 | uintptr_t intel_driver::FindPatternAtKernel(HANDLE device_handle, uintptr_t dwAddress, uintptr_t dwLen, BYTE* bMask, const char* szMask) { |
| 936 | if (!dwAddress) { |
| 937 | Log(L"[-] No module address to find pattern" << std::endl); |
| 938 | return 0; |
| 939 | } |
| 940 | |
| 941 | if (dwLen > 1024 * 1024 * 1024) { //if read is > 1GB |
| 942 | Log(L"[-] Can't find pattern, Too big section" << std::endl); |
| 943 | return 0; |
| 944 | } |
| 945 | |
| 946 | auto sectionData = std::make_unique<BYTE[]>(dwLen); |
| 947 | if (!ReadMemory(device_handle, dwAddress, sectionData.get(), dwLen)) { |
| 948 | Log(L"[-] Read failed in FindPatternAtKernel" << std::endl); |
| 949 | return 0; |
| 950 | } |
| 951 | |
| 952 | auto result = utils::FindPattern((uintptr_t)sectionData.get(), dwLen, bMask, szMask); |
| 953 | |
| 954 | if (result <= 0) { |
| 955 | Log(L"[-] Can't find pattern" << std::endl); |
| 956 | return 0; |
| 957 | } |
| 958 | result = dwAddress - (uintptr_t)sectionData.get() + result; |
| 959 | return result; |
| 960 | } |
| 961 | |
| 962 | uintptr_t intel_driver::FindSectionAtKernel(HANDLE device_handle, const char* sectionName, uintptr_t modulePtr, PULONG size) { |
| 963 | if (!modulePtr) |
nothing calls this directly
no outgoing calls
no test coverage detected