forked from komashchenko/DynLibUtils
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmodule.cpp
More file actions
175 lines (151 loc) · 6.37 KB
/
Copy pathmodule.cpp
File metadata and controls
175 lines (151 loc) · 6.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
// DynLibUtils
// Copyright (C) 2023 komashchenko (Phoenix)
// https://github.com/komashchenko/DynLibUtils
#include "module.h"
#include "memaddr.h"
#include <cstring>
#include <cmath>
#include <emmintrin.h>
using namespace libmodule;
//-----------------------------------------------------------------------------
// Purpose: constructor
// Input : szModuleName (without extension .dll/.so)
//-----------------------------------------------------------------------------
CModule::CModule(const std::string_view szModuleName) : m_pModuleHandle(nullptr) {
InitFromName(szModuleName);
}
//-----------------------------------------------------------------------------
// Purpose: constructor
// Input : pModuleMemory
//-----------------------------------------------------------------------------
CModule::CModule(const CMemory pModuleMemory) : m_pModuleHandle(nullptr) {
InitFromMemory(pModuleMemory);
}
//-----------------------------------------------------------------------------
// Purpose: Converts a string pattern with wildcards to an array of bytes and mask
// Input : svInput
// Output : std::pair<std::vector<uint8_t>, std::string>
//-----------------------------------------------------------------------------
std::pair<std::vector<uint8_t>, std::string> CModule::PatternToMaskedBytes(const std::string_view svInput) {
char* pszPatternStart = const_cast<char*>(svInput.data());
char* pszPatternEnd = pszPatternStart + svInput.size();
std::vector<uint8_t> vBytes;
std::string svMask;
for (char* pszCurrentByte = pszPatternStart; pszCurrentByte < pszPatternEnd; ++pszCurrentByte) {
if (*pszCurrentByte == '?') {
++pszCurrentByte;
if (*pszCurrentByte == '?') {
++pszCurrentByte; // Skip double wildcard.
}
vBytes.push_back(0); // Push the byte back as invalid.
svMask += '?';
} else {
vBytes.push_back(static_cast<uint8_t>(strtoul(pszCurrentByte, &pszCurrentByte, 16)));
svMask += 'x';
}
}
return std::make_pair(std::move(vBytes), std::move(svMask));
}
//-----------------------------------------------------------------------------
// Purpose: Finds an array of bytes in process memory using SIMD instructions
// Input : *pPattern
// szMask
// pStartAddress
// *pModuleSection
// Output : CMemory
//-----------------------------------------------------------------------------
CMemory CModule::FindPattern(const CMemory pPattern, const std::string_view szMask, const CMemory pStartAddress,
const ModuleSections_t* pModuleSection) const {
const uint8_t* pattern = pPattern.RCast<const uint8_t*>();
const ModuleSections_t* section = pModuleSection ? pModuleSection : &m_ExecutableCode;
if (!section->IsSectionValid()) {
return CMemory();
}
const uintptr_t nBase = section->m_pSectionBase;
const size_t nSize = section->m_nSectionSize;
const size_t nMaskLen = szMask.length();
const uint8_t* pData = reinterpret_cast<uint8_t*>(nBase);
const uint8_t* pEnd = pData + nSize - nMaskLen;
if (pStartAddress) {
const uint8_t* startAddress = pStartAddress.RCast<uint8_t*>();
if (pData > startAddress || startAddress > pEnd) {
return CMemory();
}
pData = startAddress;
}
int nMasks[64]; // 64*16 = enough masks for 1024 bytes.
const uint8_t iNumMasks = static_cast<uint8_t>(std::ceil(static_cast<float>(nMaskLen) / 16.f));
memset(nMasks, 0, iNumMasks * sizeof(int));
for (uint8_t i = 0; i < iNumMasks; ++i) {
for (int8_t j = static_cast<int8_t>(std::min<size_t>(nMaskLen - i * 16, 16)) - 1; j >= 0; --j) {
if (szMask[i * 16 + j] == 'x') {
nMasks[i] |= 1 << j;
}
}
}
const __m128i xmm1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pattern));
__m128i xmm2, xmm3, msks;
for (; pData != pEnd; _mm_prefetch(reinterpret_cast<const char*>(++pData + 64), _MM_HINT_NTA)) {
xmm2 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(pData));
msks = _mm_cmpeq_epi8(xmm1, xmm2);
if ((_mm_movemask_epi8(msks) & nMasks[0]) == nMasks[0]) {
bool bFound = true;
for (uint8_t i = 1; i < iNumMasks; ++i) {
xmm2 = _mm_loadu_si128(reinterpret_cast<const __m128i*>((pData + i * 16)));
xmm3 = _mm_loadu_si128(reinterpret_cast<const __m128i*>((pattern + i * 16)));
msks = _mm_cmpeq_epi8(xmm2, xmm3);
if ((_mm_movemask_epi8(msks) & nMasks[i]) != nMasks[i]) {
bFound = false;
break;
}
}
if (bFound) {
return pData;
}
}
}
return CMemory();
}
//-----------------------------------------------------------------------------
// Purpose: Finds a string pattern in process memory using SIMD instructions
// Input : svPattern
// pStartAddress
// *pModuleSection
// Output : CMemory
//-----------------------------------------------------------------------------
CMemory CModule::FindPattern(const std::string_view svPattern, const CMemory pStartAddress, const ModuleSections_t* pModuleSection) const {
const std::pair patternInfo = PatternToMaskedBytes(svPattern);
return FindPattern(patternInfo.first.data(), patternInfo.second, pStartAddress, pModuleSection);
}
//-----------------------------------------------------------------------------
// Purpose: Gets a module section by name (example: '.rdata', '.text')
// Input : svModuleName
// Output : ModuleSections_t
//-----------------------------------------------------------------------------
CModule::ModuleSections_t CModule::GetSectionByName(const std::string_view svSectionName) const {
for (const ModuleSections_t& section : m_vModuleSections) {
if (section.m_svSectionName == svSectionName) {
return section;
}
}
return ModuleSections_t();
}
//-----------------------------------------------------------------------------
// Purpose: Returns the module handle
//-----------------------------------------------------------------------------
void* CModule::GetModuleAddress() const noexcept {
return m_pModuleHandle;
}
//-----------------------------------------------------------------------------
// Purpose: Returns the module path
//-----------------------------------------------------------------------------
std::string_view CModule::GetModulePath() const {
return m_sModulePath;
}
//-----------------------------------------------------------------------------
// Purpose: Returns the module name
//-----------------------------------------------------------------------------
std::string_view CModule::GetModuleName() const {
std::string_view svModulePath(m_sModulePath);
return svModulePath.substr(svModulePath.find_last_of("/\\") + 1);
}