1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102
|
#ifndef SIGNATURESCANNER_H
#define SIGNATURESCANNER_H
#include <iostream>
#include <string>
#include <windows.h>
#include <tlhelp32.h>
using std::cout;
using std::endl;
using std::string;
class SignatureScanner
{
public:
typedef struct MODULE
{
struct MODULE *MODULE;
struct MOD *MOD;
DWORD Base, Size;
} MODULE;
MODULE TargetModule;
HANDLE TargetProcess;
DWORD TargetId;
HANDLE GetProcess(char* processName)
{
HANDLE ProcHandle = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 Entry;
Entry.dwSize = sizeof(Entry);
do {
if (!strcmp(Entry.szExeFile, processName)){
TargetId = Entry.th32ProcessID;
CloseHandle(ProcHandle);
TargetProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, TargetId);
return TargetProcess;
}
}
while (Process32Next(ProcHandle, &Entry));
return false;
}
MODULE GetModule(char* moduleName){
HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, TargetId);
MODULEENTRY32 ModuleEntry;
ModuleEntry.dwSize = sizeof(ModuleEntry);
do{
if(!strcmp(ModuleEntry.szModule, moduleName)){
CloseHandle(hModule);
MODULE TargetModule = {(DWORD)ModuleEntry.hModule, (DWORD)ModuleEntry.modBaseSize};
}
}while (Module32Next(hModule, &ModuleEntry));
return {(DWORD)false, (DWORD)false};
}
template <typename var>
bool WriteMemory(DWORD Address, var Value){
return WriteProcessMemory(TargetProcess,(LPVOID)Address, &Value, sizeof(var), 0);
}
template <typename var>
var ReadMemory(DWORD Address){
var value;
ReadProcessMemory(TargetProcess,(LPVOID)Address, &value, sizeof(var), 0);
}
bool MemoryCompare(const byte* data, const byte* mask, const char* szMask){
for (; *szMask; ++szMask, ++data, ++mask){
if (*szMask == 'X' && *data != *mask){
return false;
}
}
return (*szMask == 0);
}
DWORD FindSignature(DWORD SigStart, DWORD SigSize, const char* Signature, const char* Mask)
{
byte* data = new byte[SigSize];
SIZE_T BytesRead;
ReadProcessMemory(TargetProcess, (LPVOID)SigStart, data, SigSize, &BytesRead);
for (DWORD i=0; i<SigSize; i++){
if(MemoryCompare((const byte*)(data + i), (const byte*)Signature, Mask)){
delete[] data;
return SigStart + i;
}
}
return 0;
}
};
#endif // SIGNATURESCANNER_H
| |