Cpp-FindPattern/FindPattern.h at master · igromanru/Cpp-FindPattern · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
#pragma once

#include <cstdint>
#include <windows.h>
#include <cstring>
#include <psapi.h>

/**
 * Author: Igromanru
 * Credits: KN4CK3R, SilverDeath, Dr.Pepper
 * Date: 7.07.2018
 */
namespace IgroWidgets
{
    inline bool FindPatternDump(const unsigned char* dump, const size_t length, const unsigned char* pattern, const char* mask, size_t &outOffset, int getXResult = 1)
    {
        const size_t maskLength = std::strlen(mask);
        auto resultCount = 0;

        for (size_t offset = 0; offset <= length - maskLength; ++offset)
        {
            bool match = true;
            for (size_t patternPos = 0; patternPos < maskLength; ++patternPos)
            {
                if (mask[patternPos] != '?' && dump[offset + patternPos] != pattern[patternPos])
                {
                    match = false;
                    break;
                }
            }

            if (match)
            {
                resultCount++;
                if (resultCount == getXResult)
                {
                    outOffset = offset;
                    return true;
                }
            }
        }

        outOffset = 0;
        return false;
    }

    inline uintptr_t FindPatternExternal(HANDLE processHanlde, uintptr_t address, size_t searchLength, const unsigned char *pattern, const char *mask)
    {
        uintptr_t result = 0;
        auto buffer = new unsigned char[searchLength];
        size_t readSize;
        if (ReadProcessMemory(processHanlde, (LPVOID)address, buffer, searchLength, &readSize) && searchLength == readSize)
        {
            size_t offset;
            if (FindPatternDump(buffer, searchLength, pattern, mask, offset))
            {
                result = address + offset;
            }
        }
        delete[] buffer;
        return result;
    }

    inline uintptr_t FindPatternExternal(HANDLE processHanlde, HMODULE moduleHandle, const unsigned char *pattern, const char *mask)
    {
        uintptr_t result = 0;
        MODULEINFO info;
        SecureZeroMemory(&info, sizeof(info));
        const auto moduleAddress = reinterpret_cast<uintptr_t>(moduleHandle);
        if (GetModuleInformation(processHanlde, moduleHandle, &info, sizeof(MODULEINFO)))
        {
            return FindPatternExternal(processHanlde, moduleAddress, info.SizeOfImage, pattern, mask);
        }
        return result;
    }

    inline bool MatchPattern(const uintptr_t start, const unsigned char *pattern, const char *mask)
    {
        for (size_t i = 0; mask[i]; i++)
        {
            if (mask[i] != '?' && reinterpret_cast<const unsigned char *>(start)[i] != pattern[i])
            {
                return false;
            }
        }

        return true;
    }

    inline uintptr_t FindPattern(const uintptr_t start, const size_t length, const unsigned char *pattern, const char *mask)
    {
        const auto last = start + length - std::strlen(mask);

        for (auto it = start; it <= last; ++it)
        {
            if (MatchPattern(it, pattern, mask))
                return it;
        }

        return 0;
    }

    inline uintptr_t FindPattern(const HANDLE processHanlde, const HMODULE moduleHandle, const unsigned char *pattern, const char *mask)
    {
        uintptr_t result = 0;
        MODULEINFO info;
        SecureZeroMemory(&info, sizeof(info));
        if (GetModuleInformation(processHanlde, moduleHandle, &info, sizeof(MODULEINFO)))
        {
            result = FindPattern(reinterpret_cast<uintptr_t>(moduleHandle), info.SizeOfImage, pattern, mask);
        }
        return result;
    }

    inline uintptr_t FindPattern(const HMODULE moduleHandle, const unsigned char *pattern, const char *mask)
    {
        return FindPattern(GetCurrentProcess(), moduleHandle, pattern, mask);
    }

    inline uintptr_t ReadRIPAddress(HANDLE processHanlde, const uintptr_t address, const uint32_t firstOffset, const uint32_t secondOffset)
    {
        uintptr_t result = 0;
        uint32_t offset;
        if (ReadProcessMemory(processHanlde, reinterpret_cast<LPCVOID>(address + firstOffset), &offset, sizeof(uint32_t), nullptr) != 0)
        {
            result = address + offset + secondOffset;
        }
        return result;
    }

    inline uintptr_t ReadRIPAddressPtr(HANDLE processHanlde, const uintptr_t address, const uint32_t offsetOffset, const uint32_t instructionLength)
    {
        uintptr_t result = 0;
        uint32_t offset;
        if (ReadProcessMemory(processHanlde, reinterpret_cast<LPCVOID>(address + offsetOffset), &offset, sizeof(uint32_t), nullptr) != 0)
        {
            uintptr_t tmpResult;
            if (ReadProcessMemory(processHanlde, reinterpret_cast<LPCVOID>(address + instructionLength + offset), &tmpResult, sizeof(uintptr_t), nullptr) != 0)
            {
                result = tmpResult;
            }
        }
        return result;
    }
}