External Scan Pattern

Code:

DWORD ScanPatternEx(HANDLE hProc, DWORD base, DWORD len, BYTE* sig, char* mask)
{
	BYTE* buf = (BYTE*)VirtualAlloc(0, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if(ReadProcessMemory(hProc,(LPCVOID)base,buf,len,NULL) == false)
	{
		char buf2[64];
		sprintf(buf2, "RPM Error code: %d", GetLastError());
		MessageBoxA(0,buf2, "Error", MB_OK);
		return NULL;
	}
	for(int i = 0; i < len; i++)
	{
		if((buf[i] == sig[0] && mask[0] == 'x')||(mask[0] == '?'))
		{
			for(int x = 0;; x++)
			{
				if(mask[x] == 'x')
				{
					if(buf[i+x] == sig[x])
						continue;
					else
						break;
				}
				else if(mask[x] == 0x00)
				{
					return (DWORD)(base+i);
				}
			}
		}
	}
	return NULL;
}

Nice, GJ

if(buf[i+x] == sig[x])

when i == len - 1 , and x > 1

read past end of buff?

Originally Posted by abuckau907

if(buf[i+x] == sig[x])

when i == len - 1 , and x > 1

writes past end of buff?

My bad. Updated code

Code:

[B]DWORD ScanPatternEx(HANDLE hProc, DWORD base, DWORD len, BYTE* sig, char* mask, int offset = 0)
{
	BYTE* buf = (BYTE*)VirtualAlloc(0, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if(ReadProcessMemory(hProc,(LPCVOID)base,buf,len,NULL) == false)
	{
		char buf2[64];
		sprintf(buf2, "RPM Error code: %d", GetLastError());
		MessageBoxA(0,buf2, "Error", MB_OK);
		return NULL;
	}
	for(int i = 0; i < (len-strlen(mask)); i++)
	{
		if((buf[i] == sig[0] && mask[0] == 'x')||(mask[0] == '?'))
		{
			for(int x = 0;; x++)
			{
				if(mask[x] == 'x')
				{
					if(buf[i+x] == sig[x])
						continue;
					else
						break;
				}
				else if(mask[x] == 0x00)
				{
					return (DWORD)(base+i+offset);
				}
			}
		}
	}
	return NULL;
}

for(int i = 0; i < (len-strlen(mask)); i++)

'<' should be '<=' else you won't find the pattern at the very end of the buffer.
(off by one. Could instead change "len-strlen(mask)" to "(len-strlen(mask))+1")

Thanks for updating.

External Scan Pattern

Post a Reply

Similar Threads

Tags for this Thread