blob: d668eaa94c9df390d617a46369ef55e1fc5525cd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
#pragma once
#include "typedef.h"
#include "util.h"
class VMT {
U64 ptr;
public:
VMT( U64 ptr ) : ptr( ptr ) {}
U64 get( U32 index ) {
return *(U64*)( ptr + index * sizeof( U64 ) );
}
U64 set( U32 index, U64 func ) {
U64 o = get( index );
*(U64*)( ptr + index * sizeof( U64 ) ) = func;
return o;
}
};
static U64 u_find_pattern( U64 module, const char* pattern, U64 start = 0 ) {
U32 len;
U8* sig_bytes = u_parse_signature( pattern, &len );
if( !sig_bytes || len <= 2 )
return 0;
IMAGE_DOS_HEADER dos_hdr;
IMAGE_NT_HEADERS64 nt_hdr;
U32 size;
dos_hdr = *(IMAGE_DOS_HEADER*)module;
nt_hdr = *(IMAGE_NT_HEADERS64*)( module + dos_hdr.e_lfanew );
size = nt_hdr.OptionalHeader.SizeOfImage;
for( U64 off = start - module; off < size; ++off ) {
if( u_binary_match( (U8*)( module + off ), sig_bytes, len ) ) {
free( sig_bytes );
return module + off;
}
}
return 0;
}
|