Function ScanPattern

xdb/SundaySearch.cpp:22–52

}

size_t ScanPattern(HANDLE hProcess, BYTE* pattern, int pLen, std::vector<LPVOID>& results)
{
    const size_t MEM_SIZE = 0x1000;
    BYTE mem[MEM_SIZE] = { 0 };
    MEMORY_BASIC_INFORMATION mbi = { 0 };
#ifndef _WIN64
    for (size_t curAddress = 0x10000; curAddress < 0xFFFEFFFF; curAddress += mbi.RegionSize)
#else
    for (size_t curAddress = 0x10000; curAddress < 0x00007FFFFFFEFFFFULL; curAddress += mbi.RegionSize)
#endif
    {
        VirtualQueryEx(hProcess, (void*)curAddress, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
#ifndef _WIN64
        if ((int)mbi.RegionSize <= 0) break;
#else
        if ((long long)mbi.RegionSize <= 0) break;
#endif
        if (mbi.State != MEM_COMMIT) continue;
        for (size_t memIndex = 0; memIndex < (size_t)mbi.RegionSize / MEM_SIZE; memIndex++)
        {
            size_t beginAddress = curAddress + memIndex * MEM_SIZE;
            size_t numberOfRead = 0;
            BOOL bRead = ReadProcessMemory(hProcess, (void*)(beginAddress), mem, MEM_SIZE, &numberOfRead);
            std::vector<size_t> offsets;
            size_t count = SundaySearch(mem, MEM_SIZE, pattern, pLen, offsets);
            for(auto &offset : offsets)
                results.push_back((LPVOID)(beginAddress + offset));
        }
    }
    return results.size();
}