| 55 | } |
| 56 | |
| 57 | uintptr_t Utils::PatternScan(LPCSTR module, LPCSTR pattern) |
| 58 | { |
| 59 | static auto pattern_to_byte = [](const char* pattern) { |
| 60 | |
| 61 | auto bytes = std::vector<int>{}; |
| 62 | |
| 63 | auto start = const_cast<char*>(pattern); |
| 64 | |
| 65 | auto end = const_cast<char*>(pattern) + strlen(pattern); |
| 66 | |
| 67 | for (auto current = start; current < end; ++current) { |
| 68 | if (*current == '?') { |
| 69 | ++current; |
| 70 | if (*current == '?') |
| 71 | ++current; |
| 72 | bytes.push_back(-1); |
| 73 | } |
| 74 | else { |
| 75 | bytes.push_back(strtoul(current, ¤t, 16)); |
| 76 | } |
| 77 | } |
| 78 | return bytes; |
| 79 | }; |
| 80 | |
| 81 | auto mod = GetModuleHandleA(module); |
| 82 | if (!mod) |
| 83 | return 0; |
| 84 | |
| 85 | auto dosHeader = (PIMAGE_DOS_HEADER)mod; |
| 86 | auto ntHeaders = (PIMAGE_NT_HEADERS)((std::uint8_t*)mod + dosHeader->e_lfanew); |
| 87 | auto sizeOfImage = ntHeaders->OptionalHeader.SizeOfImage; |
| 88 | auto patternBytes = pattern_to_byte(pattern); |
| 89 | auto scanBytes = reinterpret_cast<std::uint8_t*>(mod); |
| 90 | auto s = patternBytes.size(); |
| 91 | auto d = patternBytes.data(); |
| 92 | |
| 93 | for (auto i = 0ul; i < sizeOfImage - s; ++i) { |
| 94 | bool found = true; |
| 95 | for (auto j = 0ul; j < s; ++j) { |
| 96 | if (scanBytes[i + j] != d[j] && d[j] != -1) { |
| 97 | found = false; |
| 98 | break; |
| 99 | } |
| 100 | } |
| 101 | |
| 102 | if (found) { |
| 103 | return (uintptr_t)&scanBytes[i]; |
| 104 | } |
| 105 | } |
| 106 | return 0; |
| 107 | } |