-
Notifications
You must be signed in to change notification settings - Fork 0
/
memory.hpp
61 lines (53 loc) · 2.54 KB
/
memory.hpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
#include <vector>
#include <string_view>
#include "minhook/MinHook.h"
#pragma comment(lib, "libMinHook.x64.lib")
std::uintptr_t FindPattern(const std::uintptr_t pModuleBaseAddress, const char* szSignature, const std::size_t nSelectResultIndex) {
if (!pModuleBaseAddress) return NULL;
constexpr auto PatternToBytes = [](const char* szpattern) {
auto m_iBytes = std::vector<int>{};
const auto szStartAddr = const_cast<char*>(szpattern);
const auto szEndAddr = const_cast<char*>(szpattern) + strlen(szpattern);
for (auto szCurrentAddr = szStartAddr; szCurrentAddr < szEndAddr; ++szCurrentAddr) {
if (*szCurrentAddr == '?') {
++szCurrentAddr;
if (*szCurrentAddr == '?') ++szCurrentAddr;
m_iBytes.push_back(-1);
}
else m_iBytes.push_back(strtoul(szCurrentAddr, &szCurrentAddr, 16));
}
return m_iBytes;
};
const auto pDosHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(pModuleBaseAddress);
const auto pNTHeaders = reinterpret_cast<PIMAGE_NT_HEADERS>(reinterpret_cast<std::uint8_t*>(pModuleBaseAddress + pDosHeader->e_lfanew));
const auto dwSizeOfImage = pNTHeaders->OptionalHeader.SizeOfImage;
auto m_iPatternBytes = PatternToBytes(szSignature);
const auto pScanBytes = reinterpret_cast<std::uint8_t*>(pModuleBaseAddress);
const auto m_iPatternBytesSize = m_iPatternBytes.size();
const auto m_iPatternBytesData = m_iPatternBytes.data();
std::size_t nFoundResults = 0;
for (auto i = 0ul; i < dwSizeOfImage - m_iPatternBytesSize; ++i) {
auto already_found = true;
for (auto j = 0ul; j < m_iPatternBytesSize; ++j) {
if (pScanBytes[i + j] != m_iPatternBytesData[j] && m_iPatternBytesData[j] != -1) {
already_found = false;
break;
}
}
if (already_found) {
if (nSelectResultIndex != 0) {
if (nFoundResults < nSelectResultIndex) {
nFoundResults++;
already_found = false;
}
else return reinterpret_cast<std::uintptr_t>(&pScanBytes[i]);
}
else return reinterpret_cast<std::uintptr_t>(&pScanBytes[i]);
}
}
return NULL;
}
std::uintptr_t GetAbsoluteAddress(const std::uintptr_t instruction_ptr, const short offset, const short size)
{
return instruction_ptr + *reinterpret_cast<std::int32_t*>(instruction_ptr + offset) + size;
}