8using namespace sig_finder;
12 for (
size_t i = 0; (i + pattern_size) < buf_size; i++) {
13 if (max_iter != 0 && i > max_iter)
break;
14 if (memcmp(buffer + i, pattern_buf, pattern_size) == 0) {
33 std::string name =
"prolog32_" + std::to_string((
ULONGLONG)
i);
51 std::string name =
"prolog64_" + std::to_string((
ULONGLONG)
i);
63 Match m = sig_finder::find_first_match(
rootN, loadedData, loadedSize);
74 static sig_finder::Node rootN;
83 static sig_finder::Node rootN;
92 static sig_finder::Node rootN;
93 if (peconv::is_padding(loadedData, loadedSize, 0)) {
108 const bool is_any_exec = (protection & PAGE_EXECUTE_READWRITE)
109 || (protection & PAGE_EXECUTE_READ)
110 || (protection & PAGE_EXECUTE)
111 || (protection & PAGE_EXECUTE_WRITECOPY);
117 const bool is_read = (protection & PAGE_READWRITE)
118 || (protection & PAGE_READONLY);
124 if ((state & MEM_COMMIT) == 0) {
128 if (mapping_type != MEM_IMAGE && (mapping_type != MEM_MAPPED) && mapping_type != MEM_PRIVATE) {
132 if (protection & PAGE_NOACCESS) {
150 static bool isLoaded =
false;
151 if (isLoaded)
return 0;
154 std::vector<Signature*> signatures;
155 Signature::loadFromFile(filename, signatures);
156 const size_t added =
mainMatcher.addPatterns(signatures);
158 for (
auto itr = signatures.begin(); itr != signatures.end(); ++itr) {
159 Signature* sign = *itr;
167 static bool isLoaded =
false;
168 if (isLoaded)
return false;
181 if (peconv::is_padding(loadedData, loadedSize, 0)) {
184 const size_t matches = sig_finder::find_all_matches(
mainMatcher, loadedData, loadedSize, allMatches);
190 size_t customCount = 0;
191 for (
auto itr = allMatches.begin(); itr != allMatches.end(); ++itr) {
192 sig_finder::Match m = *itr;
194 const DWORD checks = m.sign->checksum();
198 customPatternMatches.push_back(m);
sig_finder::Node mainMatcher
#define PATTERN_NOT_FOUND
size_t load_pattern_file(const char *filename)
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
bool init_shellcode_patterns()
size_t is_32bit_code(BYTE *loadedData, size_t loadedSize)
bool is_readable(DWORD mapping_type, DWORD protection)
BYTE * find_pattern(BYTE *buffer, size_t buf_size, BYTE *pattern_buf, size_t pattern_size, size_t max_iter=0)
bool is_normal_inaccessible(DWORD state, DWORD mapping_type, DWORD protection)
bool is_code(BYTE *loadedData, size_t loadedSize)
bool is_executable(DWORD mapping_type, DWORD protection)
size_t is_64bit_code(BYTE *loadedData, size_t loadedSize)
size_t init_32_patterns(Node *rootN)
size_t search_till_pattern(sig_finder::Node &rootN, const BYTE *loadedData, size_t loadedSize)
size_t fill_iat(BYTE *vBuf, size_t vBufSize, IN const peconv::ExportsMapper *exportsMap, IN OUT IATBlock &iat, IN ThunkFoundCallback *callback)
size_t init_64_patterns(Node *rootN)
std::set< DWORD > HardcodedPatterns