Untitled
unknown
c_cpp
a year ago
5.1 kB
8
Indexable
#include <iostream>
#include <windows.h>
#include <tlhelp32.h>
#include <string.h>
#include <comdef.h>
#include <stdlib.h>
#include <array>
#include <chrono>
#include "ps.h"
#include <vector>
HANDLE GetProcessByName(LPCWSTR procName)
{
HANDLE hProcess = NULL;
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32W process;
process.dwSize = sizeof(process);
if (Process32FirstW(snapshot, &process))
{
while (Process32NextW(snapshot, &process))
{
if (wcscmp(process.szExeFile, procName) == 0)
{
wprintf(L"%ls\n", process.szExeFile);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process.th32ProcessID);
CloseHandle(snapshot);
return hProcess;
}
}
}
printf("Process not found.\n");
return hProcess;
}
bool PatternCheck(std::vector<unsigned char> buffer, std::vector<unsigned char> pattern, size_t bufferlen, int& index)
{
size_t bufferSize = bufferlen - pattern.size();
size_t patternSize = pattern.size();
for (int i = 0;i < bufferSize;i++)
{
if (buffer[i] != pattern[0])
{
continue;
}
else
{
for (int j = 1;j < patternSize;j++)
{
if (pattern[j] == 0)
{
continue;
}
else if (buffer[i+j] != pattern[j])
{
break;
}
if (j == patternSize - 1)
{
index = i;
return true;
}
}
}
}
return false;
}
std::vector<unsigned char> StringToVector(std::string sPattern)
{
size_t len = sPattern.size();
len = ((len-2)/3)+1;
std::vector<unsigned char> buffer;
buffer.resize(len);
int index = 0;
for (int i = 0;i < len;i++)
{
const char * hexchar = sPattern.substr(index,2).c_str();
buffer[i] = strtol(hexchar, NULL, 16);
index += 3;
}
return buffer;
}
__declspec(dllexport) bool SearchPattern(LPCWSTR proc, LPCSTR sPattern, DWORD64& addr, double& timeTaken, DWORD64 startAddr = 0)
{
MEMORY_BASIC_INFORMATION mbi = {};
SYSTEM_INFO si = {};
GetSystemInfo(&si);
const int memcommit = 0x1000;
const int privatetype = 0x20000;
const int pnoaccess = 0x01;
size_t bytesRead;
HANDLE hProcess = GetProcessByName(proc);
std::vector<unsigned char> pattern = StringToVector(sPattern);
DWORD64 min;
LPCVOID sys_min;
if (startAddr == 0)
{
min = (DWORD64)si.lpMinimumApplicationAddress;
sys_min = (LPCVOID)si.lpMinimumApplicationAddress;
}
else
{
min = startAddr + 1;
sys_min = (LPCVOID)min;
}
DWORD64 max = (DWORD64)si.lpMaximumApplicationAddress;
LPCVOID sys_max = (LPCVOID)si.lpMaximumApplicationAddress;
std::chrono::steady_clock::time_point steady_start, steady_end;
steady_start = std::chrono::steady_clock::now();
while (min < max)
{
VirtualQueryEx(hProcess, sys_min, &mbi, sizeof(mbi));
if (mbi.State == memcommit && mbi.Protect != pnoaccess && mbi.Type == privatetype)
{
std::vector<unsigned char> buffer(mbi.RegionSize);
ReadProcessMemory(hProcess, sys_min, buffer.data(), mbi.RegionSize, &bytesRead);
int index = 0;
if (PatternCheck(buffer, pattern, mbi.RegionSize, index))
{
addr = (min + index);
steady_end = std::chrono::steady_clock::now();
double time = std::chrono::duration<double>(steady_end - steady_start).count();
timeTaken = time;
return true;
break;
}
}
min += (DWORD64)mbi.RegionSize;
sys_min = (LPCVOID)min;
}
steady_end = std::chrono::steady_clock::now();
double time = std::chrono::duration<double>(steady_end - steady_start).count();
timeTaken = time;
return false;
}Editor is loading...
Leave a Comment