Find signature pattern in memory Base memory search reference, about 10x slower than the AVX2 version
| 176 | // Find signature pattern in memory |
| 177 | // Base memory search reference, about 10x slower than the AVX2 version |
| 178 | uint8_t* SigSearch::FindCommon(uint8_t* input, size_t inputLen, const Signature &sig, bool hasWildcards) |
| 179 | { |
| 180 | if (!hasWildcards) { |
| 181 | // If no wildcards, faster to use a memcmp() type |
| 182 | const uint8_t *pat = sig.bytes.data(); |
| 183 | const uint8_t *end = (input + inputLen); |
| 184 | const uint8_t first = *pat; |
| 185 | size_t sigLen = sig.bytes.size(); |
| 186 | |
| 187 | // Setup last in the pattern length byte quick for rejection test |
| 188 | size_t lastIdx = (sigLen - 1); |
| 189 | uint8_t last = pat[lastIdx]; |
| 190 | |
| 191 | for (uint8_t* ptr = input; ptr < end; ++ptr) { |
| 192 | if ((ptr[0] == first) && (ptr[lastIdx] == last)) { |
| 193 | if (memcmp(ptr+1, pat+1, sigLen-2) == 0) |
| 194 | return ptr; |
| 195 | } |
| 196 | } |
| 197 | } |
| 198 | else { |
| 199 | const uint8_t *pat = sig.bytes.data(); |
| 200 | const uint8_t *msk = sig.mask.data(); |
| 201 | const uint8_t *end = (input + inputLen); |
| 202 | const uint8_t first = *pat; |
| 203 | size_t sigLen = sig.bytes.size(); |
| 204 | size_t lastIdx = (sigLen - 1); |
| 205 | uint8_t last = pat[lastIdx]; |
| 206 | |
| 207 | for (uint8_t* ptr = input; ptr < end; ++ptr) { |
| 208 | if ((ptr[0] == first) && (ptr[lastIdx] == last)) { |
| 209 | const uint8_t *patPtr = pat+1; |
| 210 | const uint8_t *mskPtr = msk+1; |
| 211 | const uint8_t *memPtr = ptr+1; |
| 212 | bool found = true; |
| 213 | |
| 214 | for (size_t i = 0; (i < sigLen-2) && (memPtr < end); ++mskPtr, ++patPtr, ++memPtr, i++) { |
| 215 | if (!*mskPtr) |
| 216 | continue; |
| 217 | |
| 218 | if (*memPtr != *patPtr) { |
| 219 | found = false; |
| 220 | break; |
| 221 | } |
| 222 | } |
| 223 | |
| 224 | if (found) |
| 225 | return ptr; |
| 226 | } |
| 227 | } |
| 228 | } |
| 229 | |
| 230 | return nullptr; |
| 231 | } |
| 232 | |
| 233 | // ------------------------------------------------------------------------------------------------ |
| 234 |