Skip to content

Instantly share code, notes, and snippets.

@NyaMisty
Last active September 9, 2022 23:05
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save NyaMisty/e2eec06b1f8907553138aa11b1349977 to your computer and use it in GitHub Desktop.
Save NyaMisty/e2eec06b1f8907553138aa11b1349977 to your computer and use it in GitHub Desktop.
search for mem with hex pattern contains wildcards
#include <stdio.h>
#include <stdlib.h>
static void* mem_scan(const void* addr, size_t size, const char* hex_pattern) {
union pattern_holder {
struct {
unsigned char content : 8;
unsigned char mask : 8;
};
wchar_t pat_char;
} pattern[1024] = { 0 };
int pat_len = 0;
const int pat_c_init = 0x1FF;
int pat_c = pat_c_init;
while(pat_len < 1024) {
char c = *hex_pattern++;
if (!c) {
break;
}
switch (c) {
case '\t':
case '\n':
case '\r':
case ' ':
case ',':
case '-':
case ':':
continue;
default:
break;
}
unsigned char uc = (unsigned char)c;
if (uc - '0' <= 9u) {
pat_c = (pat_c << 4) | (uc - '0');
} else if (uc - 'A' <= 6u) {
pat_c = (pat_c << 4) | (uc - 'A' + 10);
} else if (uc - 'a' <= 6u) {
pat_c = (pat_c << 4) | (uc - 'a' + 10);
} else if (c == '?') {
pat_c = (pat_c ^ 0xF0) << 4;
} else {
return NULL;
}
if (pat_c & 0xFFFF0000) {
pattern[pat_len++].pat_char = pat_c;
pat_c = pat_c_init;
}
}
if (!pat_len) return NULL;
char* _addr = (char*)addr;
for (int addr_off = 0; addr_off < size; addr_off++) {
for (int pat_off = 0; pat_off <= pat_len; pat_off++) {
if (pat_off == pat_len) {
return _addr + addr_off;
}
if ((pattern[pat_off].mask & _addr[addr_off + pat_off]) != pattern[pat_off].content) {
break;
}
}
}
return NULL;
}
int main() {
char buf1[] = "ABCDEFGHIJKLMNOPQRST";
char pat[] = "44 45 46 4? 48";
//char pat[] = "41 4? 43";
char *ret = (char *)mem_scan(buf1, sizeof(buf1), pat);
printf("%d", ret - buf1);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment