dasaav-dsv/pattern16

The fastest x86-64 signature matching library.

Pattern16

The fastest x86-64 signature matching library.

Features:

• Faster than the fastest existing scanners by ~50%, with reliable singlethreaded speeds up to 25 GB/s for consecutive scans
• Aids reverse engineering by targeting assembly bytecode
• Designed and optimized for x86-64, with 32-bit support planned
• Support for all new (and old) CPU features
• Uses AVX1, SSE4.1, SSE2, CMOVE in order of availability, BMI2 and BMI1 (with fill-in functions)
• Header only, written in modern C++

Usage:

Include Pattern16.h and provide the address of a memory region's start, its length and the signature to search for formatted as a string:

#include "Pattern16.h"

void* regionStart = (void*)0x140000000;
size_t regionSize = 0x4000000;
std::string signature = "00 11 ?? ?? ?? ?? 66 77 [?1?0??01] 99 AA BB C? ?D EE FF";
void* address = Pattern16::find(regionStart, regionSize, signature);

Pattern16 signature rules:

• All byte values are represented in base16/hexadecimal notation
• Space characters are ignored completely even inside bit masks, so use them for formatting
• Symbols other than 0123456789ABCDEFabcdef[] are wildcards and can stand in for any byte or bit
• A sequence of symbols within sqare brackets [] represents a bit field. Don't forget there are 8 bits in a byte!
• Bits inside a bitfield can be masked with wildcard symbols
• A bitfield does not have to be limited to a single byte, [01xx1100 xxx11xx0] is a legal 2-byte masked bitfield

pattern16's Issues

Crashing when the signature is not found

Title, might possible solution is to return nullptr when not found (?)

Pattern16 finds itself

Pattern16 allocates memory which it eventually finds...

1. Run a process that definitely does not have a test string in memory
2. Check through a debugger or in any other way that this string is not in memory
3. Inject the library and let it finish scanning
4. Check again for the presence of this string in memory

Code to reproduce the problem

#include <Windows.h>
#include <iostream>

#include "pattern16/include/Pattern16.h"

void* ScanMemory(const char* string)
{
	uintptr_t* address = nullptr;

	MEMORY_BASIC_INFORMATION meminfo{};

	while (VirtualQuery(address, &meminfo, sizeof(meminfo)))
	{
		address = reinterpret_cast<uintptr_t*>
			(reinterpret_cast<SIZE_T>(meminfo.BaseAddress) + meminfo.RegionSize);

		if (!(meminfo.State == MEM_COMMIT &&
			meminfo.Type == MEM_PRIVATE &&
			meminfo.Protect == PAGE_READWRITE))
			continue;

		void* ptr = Pattern16::scan(meminfo.BaseAddress, meminfo.RegionSize, string);

		if (ptr)
			return ptr;
	}

	return nullptr;
}

int main()
{
	// Hello World
	void* ptr = ScanMemory("48 65 6C 6C 6F 20 57 6F 72 6C 64");

	if (ptr)
		std::cout << ptr << std::endl;
	else
		std::cout << "String not found!" << std::endl;

	system("pause");
	return EXIT_SUCCESS;
}

Are there any benchmarks to test.

This is the fastest algorithm I've ever used.
https://github.com/0x1F9F1/mem/blob/master/include/mem/simd_scanner.h

Unable to compile with clang-cl toolset

I'm using Visual Studio 2022 with clang-cl and getting errors with AVX, BMI, etc, even though the build is SSE.

Could you use this externally?

If you want a working external version, you could use FindPatternEx, as far is I know, there's no way to use this externally, you can only do it internally.
https://github.com/dark64/findpatternex/blob/a8eb0ae80633e54cd20fa701b77ba4db62de74ff/findpatternex/findpattern.h#L10-L45