Skip to content

Instantly share code, notes, and snippets.

@ZaronZ
Created December 28, 2018 03:28
Show Gist options
  • Save ZaronZ/37fb18050cb620311c61b2a5b029c6e6 to your computer and use it in GitHub Desktop.
Save ZaronZ/37fb18050cb620311c61b2a5b029c6e6 to your computer and use it in GitHub Desktop.
Windows intenal SEH find pattern
#include <windows.h>
#include <stdint.h>
uint8_t* findPattern(const char* data, size_t size)
{
SYSTEM_INFO systemInfo;
GetNativeSystemInfo(&systemInfo);
for (uint8_t* p = (uint8_t*)systemInfo.lpMinimumApplicationAddress; p < (uint8_t*)systemInfo.lpMaximumApplicationAddress; p++) {
__try {
if (!memcmp(p, data, size))
return p;
}
__except (EXCEPTION_EXECUTE_HANDLER) {
if ((uintptr_t)p % systemInfo.dwPageSize == 0) {
p += systemInfo.dwPageSize - 1;
}
}
}
return nullptr;
}
int main()
{
auto test = findPattern("\xCC", 1);
system("pause");
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment