Created
December 28, 2018 03:28
-
-
Save ZaronZ/37fb18050cb620311c61b2a5b029c6e6 to your computer and use it in GitHub Desktop.
Windows intenal SEH find pattern
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <windows.h> | |
#include <stdint.h> | |
uint8_t* findPattern(const char* data, size_t size) | |
{ | |
SYSTEM_INFO systemInfo; | |
GetNativeSystemInfo(&systemInfo); | |
for (uint8_t* p = (uint8_t*)systemInfo.lpMinimumApplicationAddress; p < (uint8_t*)systemInfo.lpMaximumApplicationAddress; p++) { | |
__try { | |
if (!memcmp(p, data, size)) | |
return p; | |
} | |
__except (EXCEPTION_EXECUTE_HANDLER) { | |
if ((uintptr_t)p % systemInfo.dwPageSize == 0) { | |
p += systemInfo.dwPageSize - 1; | |
} | |
} | |
} | |
return nullptr; | |
} | |
int main() | |
{ | |
auto test = findPattern("\xCC", 1); | |
system("pause"); | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment