h33p / vmread

A library to read/write memory to Windows on KVM

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Pattern search can't handle multiple ?? regions

seeker25 opened this issue · comments

uintptr_t genv = PatternScan::FindPattern("E8 ? ? ? ? 48 8B ? ? ? ? ? 48 8D ? ? ? ? ? 48 8B ? ? ? ? ? 48 8B ? FF 50 78", minAddress, maxAddress); + 0x07; fprintf(out,"Searching for Pattern: \n"); fprintf(out, "%s\n", pattern.c_str()); fprintf(out,"Found Pattern: \n"); for (int z = 0; z < 32; z++) fprintf(out,"%02x ", i.Read<unsigned char>(genv+z)); fprintf(out, "\n");
Output:

Searching for Pattern:
E8 ?? ?? ?? ?? 48 8B ?? ?? ?? ?? ?? 48 8D ?? ?? ?? ?? ?? 48 8B ?? ?? ?? ?? ?? 48 8B ?? FF 50 78

Found Pattern:
e8 a6 8a 00 00 48 8b c8 48 85 c0 75 07 ff 15 f8 fd 01 00 cc 48 83 c0 27 48 83 e0 e0 48 89 48 f8

As you can see here, it doesn't seem to follow the pattern after the first ??.

commented

This should be filed on the m0dular repo, but it does seem serious, I will have to look into it.