Last active
September 9, 2022 23:05
-
-
Save NyaMisty/e2eec06b1f8907553138aa11b1349977 to your computer and use it in GitHub Desktop.
search for mem with hex pattern contains wildcards
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <stdio.h> | |
#include <stdlib.h> | |
static void* mem_scan(const void* addr, size_t size, const char* hex_pattern) { | |
union pattern_holder { | |
struct { | |
unsigned char content : 8; | |
unsigned char mask : 8; | |
}; | |
wchar_t pat_char; | |
} pattern[1024] = { 0 }; | |
int pat_len = 0; | |
const int pat_c_init = 0x1FF; | |
int pat_c = pat_c_init; | |
while(pat_len < 1024) { | |
char c = *hex_pattern++; | |
if (!c) { | |
break; | |
} | |
switch (c) { | |
case '\t': | |
case '\n': | |
case '\r': | |
case ' ': | |
case ',': | |
case '-': | |
case ':': | |
continue; | |
default: | |
break; | |
} | |
unsigned char uc = (unsigned char)c; | |
if (uc - '0' <= 9u) { | |
pat_c = (pat_c << 4) | (uc - '0'); | |
} else if (uc - 'A' <= 6u) { | |
pat_c = (pat_c << 4) | (uc - 'A' + 10); | |
} else if (uc - 'a' <= 6u) { | |
pat_c = (pat_c << 4) | (uc - 'a' + 10); | |
} else if (c == '?') { | |
pat_c = (pat_c ^ 0xF0) << 4; | |
} else { | |
return NULL; | |
} | |
if (pat_c & 0xFFFF0000) { | |
pattern[pat_len++].pat_char = pat_c; | |
pat_c = pat_c_init; | |
} | |
} | |
if (!pat_len) return NULL; | |
char* _addr = (char*)addr; | |
for (int addr_off = 0; addr_off < size; addr_off++) { | |
for (int pat_off = 0; pat_off <= pat_len; pat_off++) { | |
if (pat_off == pat_len) { | |
return _addr + addr_off; | |
} | |
if ((pattern[pat_off].mask & _addr[addr_off + pat_off]) != pattern[pat_off].content) { | |
break; | |
} | |
} | |
} | |
return NULL; | |
} | |
int main() { | |
char buf1[] = "ABCDEFGHIJKLMNOPQRST"; | |
char pat[] = "44 45 46 4? 48"; | |
//char pat[] = "41 4? 43"; | |
char *ret = (char *)mem_scan(buf1, sizeof(buf1), pat); | |
printf("%d", ret - buf1); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment