OSHFindPattern namespace

 
#ifndef OSH_FIND_PATTERN
#define OSH_FIND_PATTERN
 
#include <Windows.h>
#include "Misc/Exceptions.hpp"
 
namespace OSHFindPattern
{
	DWORD FindPattern(const HMODULE module, const BYTE *pattern, LPCTSTR mask);
	bool DataCompare(const BYTE *data, const BYTE *pattern, LPCTSTR mask);
};
 
#endif

/*
 * FindPattern and DataCompare function
 * Copyright (c) 2012 KN4CK3R https://www.oldschoolhack.me
 */
#include "OSHFindPattern.hpp"
 
using namespace OSHGui;
 
namespace OSHFindPattern
{
	bool DataCompare(const BYTE *data, const BYTE *pattern, LPCTSTR mask)
	{
		for (; *mask; ++mask, ++data, ++pattern)
		{
			if (*mask == 'x' && *data != *pattern)
			{
				return false;
			}
		}
 
		return *mask == 0;
	}
	//---------------------------------------------------------------------------
	DWORD FindPattern(const HMODULE module, const BYTE *pattern, LPCTSTR mask)
	{
		if (module == NULL || module == INVALID_HANDLE_VALUE)
		{
			throw Misc::ArgumentNullException("module");
		}
 
		PIMAGE_DOS_HEADER dosHeader =(PIMAGE_DOS_HEADER)module;
 
		if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE)
		{
			throw Misc::Exception("e_magic != IMAGE_DOS_SIGNATURE");
		}
 
		PIMAGE_NT_HEADERS NTHead = (PIMAGE_NT_HEADERS)((DWORD)dosHeader + (DWORD)dosHeader->e_lfanew);
 
		if (NTHead->Signature != IMAGE_NT_SIGNATURE)
		{
			throw Misc::Exception("Signature != IMAGE_NT_SIGNATURE");
		}
 
		DWORD address = (DWORD)module + NTHead->OptionalHeader.BaseOfCode;
		DWORD size = NTHead->OptionalHeader.SizeOfCode; 
 
		for (DWORD i = NULL; i < size; i++)
		{
			if (DataCompare((BYTE*)(address + i), pattern, mask))
			{
				return address + i;
			}
		}
 
		return NULL;
	}
	//---------------------------------------------------------------------------
}