Externer Patternscan

Discussion in 'Source Code' started by hoschi111, Dec 2, 2013.

  1. hoschi111

    hoschi111 Administrator Staff Member Administrator

    Joined:
    Dec 19, 2017
    Messages:
    1,147
    Likes Received:
    2
    Aufruf:

    Variable (Long bei x64) = pScan(Adresse, AnzahlBytesZumScannen, PatternAlsStringArrayMitDezimalzahlen, MaskeAlsStringArray)
    ADR_KillstreakPrivate = pScan(&H144BA5500, 3000, {"130", "0", "241", "22", "00", "50", "00", "50", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "6", "16", "130"}, {"X", "X", "X", "X", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "?", "X", "X", "X", "X", "X"})



    Code:
      Private Function pScan(ByVal startadress As Long, ByVal maxbytestoscan As Integer, ByVal pattern() As String, ByVal mask() As String) As Long
            For i As Integer = 0 To maxbytestoscan
                Dim n() As Byte = ReadMemory(startadress + i, pattern.Length)
                For k As Integer = 0 To n.Length - 1
                    If mask(k) = "X" Then
    
    
                        If pattern(k) = n(k) Then
                            If k = n.Length - 1 Then
                                Return startadress + i
                            Else
                                Continue For
                            End If
                        Else
                            Exit For
                        End If
                    Else
                        Continue For
    
                    End If
                Next
            Next
            Return 0
        End Function
     
  2. krusty

    krusty Addicted Member Inventar

    Joined:
    Sep 8, 2012
    Messages:
    175
    Likes Received:
    0
    Schick, schick,
    kleiner Verbesserungsvorschlag:
    1. ByVal pattern() As String würde ich als ByVal pattern() As Byte deklarieren,
    denn bei If pattern(k) = n(k) Then vergleichst du sonst einen String auf ein Byte.

    2. ByVal mask() as String entweder als normalen String, oder als Char-Array
     
  3. VBTyp

    VBTyp Addicted Member Inventar

    Joined:
    Apr 16, 2013
    Messages:
    431
    Likes Received:
    1
    Wenn ich keine Fehler gemacht hab, sollt so der Patternscan viel einfacher aufzurufen sein und auch funktionieren ;)
    Code:
    Private Function pScan(ByVal startadress As Long, ByVal maxbytestoscan As Integer, ByVal pattern As String, ByVal mask As String) As Long
            Dim patternn As String() = pattern.Remove(0, 1).Replace("x", "&H").Split("\")
            Dim maskk(0 To mask.Length - 1) As String
            For i As Integer = 0 To mask.Length - 1
                maskk(i) = mask.Substring(i, 1)
            Next
            For i As Integer = 0 To maxbytestoscan
                Dim n() As Byte = Memory.ReadBytes(proc, startadress + i, patternn.Length)
                For k As Integer = 0 To n.Length - 1
                    If maskk(k) = "X" Then
                        If patternn(k) = n(k) Then
                            If k = n.Length - 1 Then
                                Return startadress + i
                            Else
                                Continue For
                            End If
                        Else
                            Exit For
                        End If
                    Else
                        Continue For
    
                    End If
                Next
            Next
            Return 0
        End Function
    
     
  4. hoschi111

    hoschi111 Administrator Staff Member Administrator

    Joined:
    Dec 19, 2017
    Messages:
    1,147
    Likes Received:
    2
    Kleinigkeit: Du ersetzt mit "x", prüfst aber auf "X".
    War jetzt das Erste, was mir auffiel.
     
  5. VBTyp

    VBTyp Addicted Member Inventar

    Joined:
    Apr 16, 2013
    Messages:
    431
    Likes Received:
    1
    Ich hab nur deinen Source modifiziert ;) Ausserdem wird in maskk auf X überprüft und net in patternn
     
  6. hoschi111

    hoschi111 Administrator Staff Member Administrator

    Joined:
    Dec 19, 2017
    Messages:
    1,147
    Likes Received:
    2
    Uppsi... da hab ich mich wohl verguckt. ;)
    Wie ist denn bei dir der Aufruf?
     
  7. AimBRoT

    AimBRoT Addicted Member Inventar

    Joined:
    Aug 1, 2012
    Messages:
    529
    Likes Received:
    0
    Das ist dafür gedacht das du das pattern direkt so kopieren kannst z.b. bei olly ausm SigMaker... und nicht das "\0xBYTE\0xBYTE\..." removen musst
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.