wurgg / pscan Goto Github PK

convert input pattern to vec of u8 for easy comparison.
this should probably be what is in the ScanResult obj

right now the CLI tool is just a very simple harness to use the pscan lib. We should develop it further to be a fully fledged CLI interface to pscan lib.

more of an edge case, but we need to handle if a pattern can continue over chunk boundaries.

// This block is what allows us to detect matches over chunk boundaries.
// When we're close enough to a boundary that a pattern match could overrun, we
// copy the final bytes in the buffer to the start of the buffer, then read into
// the rest of the buffer.

add module scan so we can just scan the module instead of the entire process. User should still have option to scan entire process though it is not recommended

scanner mod.rs
After getting the correct process -> determine process size -> split into chunks [4096 bytes?]
These chunks will be fed to the scan method (e.g. brute force or algo1)

• We should get all this info together before / during init ScanResult struct

• pattern

• mask

• begin_addr

• size

• handle to proc

• var: bytesRead

• var: oldVProtect

• var: buffer to read data to

• mbi

[1] VirtualQueryEx (get our MBI)
[2] loop over each chunk (mbi.regionSize)
[3] check that its good memory using virtualqueryex & mbi.State, mbi.Protect
[4] delete our buffer from last read
[5] if VirtualProtect ex (save original protext to var: oldVProtect
[6] Read Procress Memory
[7] Restore protect using VirtualProtectEx
[8] pass data to scan method
[9] did the scan method find it? break or continue

instead of big fat long use statements, lets use some of the namespace in line so its clear where this comes from.

From:

use windows::Win32::System::Diagnostics::ToolHelp::{PROCESSENTRY32, MODULEENTRY32, TH32CS_SNAPPROCESS, Process32First, Process32Next, Module32First, Module32Next, CreateToolhelp32Snapshot, CREATE_TOOLHELP_SNAPSHOT_FLAGS, Toolhelp32ReadProcessMemory};

To:
pub fn get_module(pid: u32) -> windows::Win32::System::Memory::MEMORY_BASIC_INFORMATION {...}

the main scanner mod (src/scanner/mod.rs) is getting too fat. Move all defined custom types/structs to their own file

src/structs/mod.rs
PatternByte
Pattern
ScanResult

Chunks of data will be given to the scan method one at a time. Use a brute force approach to scan each byte looking for the patter/mask combo

instead of putting an entire function in unsafe block, only put what is needed (if possible)