| 1003 | } |
| 1004 | |
| 1005 | uintptr_t intel_driver::FindPatternAtKernel(uintptr_t dwAddress, uintptr_t dwLen, BYTE* bMask, const char* szMask) { |
| 1006 | if (!dwAddress) { |
| 1007 | Log::Error("No module address to find pattern", false); |
| 1008 | return 0; |
| 1009 | } |
| 1010 | |
| 1011 | if (dwLen > 1024 * 1024 * 1024) { //if read is > 1GB |
| 1012 | Log::Error("Can't find pattern, Too big section", false); |
| 1013 | return 0; |
| 1014 | } |
| 1015 | |
| 1016 | auto sectionData = std::make_unique<BYTE[]>(dwLen); |
| 1017 | if (!ReadMemory(dwAddress, sectionData.get(), dwLen)) { |
| 1018 | Log::Error("Read failed in FindPatternAtKernel", false); |
| 1019 | return 0; |
| 1020 | } |
| 1021 | |
| 1022 | auto result = kdmUtils::FindPattern((uintptr_t)sectionData.get(), dwLen, bMask, szMask); |
| 1023 | |
| 1024 | if (result <= 0) { |
| 1025 | return 0; |
| 1026 | } |
| 1027 | result = dwAddress - (uintptr_t)sectionData.get() + result; |
| 1028 | return result; |
| 1029 | } |
| 1030 | |
| 1031 | uintptr_t intel_driver::FindSectionAtKernel(const char* sectionName, uintptr_t modulePtr, PULONG size) { |
| 1032 | if (!modulePtr) |