-
Notifications
You must be signed in to change notification settings - Fork 0
/
memory.hh
94 lines (74 loc) · 2.56 KB
/
memory.hh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
#include <cstdint>
#ifndef WIN32
#define PBYTE uint8_t*
#define BYTE uint8_t
#define PWORD uint16_t*
#endif
namespace memory {
static inline uintptr_t occurence(uintptr_t start, uintptr_t end, const char* pattern) {
#define in_range(x, a, b) (x >= a && x <= b)
#define get_bits(x) (in_range((x & (~0x20)), 'A', 'F') ? ((x & (~0x20)) - 'A' + 0xA): (in_range(x, '0', '9') ? x - '0': 0))
#define get_byte(x) (get_bits(x[0]) << 4 | get_bits(x[1]))
uintptr_t match = (uintptr_t)nullptr;
const char* current = pattern;
for (uintptr_t pCur = start; pCur < end; pCur++) {
if (!*current)
return match;
if (*(PBYTE)current == ('\?') || *(BYTE*)pCur == get_byte(current)) {
if (!match)
match = pCur;
if (!current[2])
return match;
if (*(PWORD)current == (0x3f3f /* '\?\?' */) || *(PBYTE)current != ('\?'))
current += 3;
else
current += 2;
}
else {
current = pattern;
match = 0;
}
}
return (uintptr_t)nullptr;
}
#ifdef WIN32
uintptr_t occurence(const char* module, const char* pattern) {
#define in_range(x, a, b) (x >= a && x <= b)
#define get_bits(x) (in_range((x & (~0x20)), 'A', 'F') ? ((x & (~0x20)) - 'A' + 0xA): (in_range(x, '0', '9') ? x - '0': 0))
#define get_byte(x) (get_bits(x[0]) << 4 | get_bits(x[1]))
MODULEINFO mod;
K32GetModuleInformation(GetCurrentProcess(), GetModuleHandleA(module), &mod, sizeof(MODULEINFO));
uintptr_t start = (uintptr_t)mod.lpBaseOfDll;
uintptr_t end = (uintptr_t)mod.lpBaseOfDll + (uintptr_t)mod.SizeOfImage;
uintptr_t match = (uintptr_t)nullptr;
const char* current = pattern;
for (uintptr_t pCur = start; pCur < end; pCur++) {
if (!*current)
return match;
if (*(PBYTE)current == ('\?') || *(BYTE*)pCur == get_byte(current)) {
if (!match)
match = pCur;
if (!current[2])
return match;
if (*(PWORD)current == ('\?\?') || *(PBYTE)current != ('\?'))
current += 3;
else
current += 2;
}
else {
current = pattern;
match = 0;
}
}
return (uintptr_t)nullptr;
}
#endif
static inline uintptr_t dereference(uintptr_t address, unsigned int offset)
{
if (address == 0)
return (uintptr_t)nullptr;
if (sizeof(uintptr_t) == 8)
return address + (int)((*(int*)(address + offset) + offset) + sizeof(int));
return *(uintptr_t*)(address + offset);
}
}