1 files changed, 124 insertions, 0 deletions
diff --git a/sigscan.cpp b/sigscan.cpp
new file mode 100644
index 0000000..f8ab0e3
--- /dev/null
+++ b/sigscan.cpp
@@ -0,0 +1,124 @@
+#include <string.h>
+#include "sigscan.h"
+ 
+/* There is no ANSI ustrncpy */
+unsigned char* ustrncpy(unsigned char *dest, const unsigned char *src, int len) {
+    while(len--)
+        dest[len] = src[len];
+ 
+    return dest;
+}
+ 
+/* //////////////////////////////////////
+    CSigScan Class
+    ////////////////////////////////////// */
+unsigned char* CSigScan::base_addr;
+size_t CSigScan::base_len;
+void *(*CSigScan::sigscan_dllfunc)(const char *pName, int *pReturnCode);
+ 
+/* Initialize the Signature Object */
+int CSigScan::Init(const unsigned char *sig, const char *mask, size_t len) {
+    is_set = 0;
+ 
+    sig_len = len;
+        if ( sig_str )
+                delete[] sig_str;
+    sig_str = new unsigned char[sig_len];
+    ustrncpy(sig_str, sig, sig_len);
+ 
+        if ( sig_mask )
+                delete[] sig_mask;
+    sig_mask = new char[sig_len/*+1*/];
+    strncpy(sig_mask, mask, sig_len);
+    //sig_mask[sig_len+1] = 0;
+ 
+    if(!base_addr)
+        return 2; // GetDllMemInfo() Failed
+ 
+    if((sig_addr = FindSignature()) == NULL)
+        return 1; // FindSignature() Failed
+ 
+    is_set = 1;
+    // SigScan Successful!
+        return 0;
+}
+ 
+/* Destructor frees sig-string allocated memory */
+CSigScan::~CSigScan(void) {
+    delete[] sig_str;
+    delete[] sig_mask;
+}
+ 
+/* Get base address of the server module (base_addr) and get its ending offset (base_len) */
+bool CSigScan::GetDllMemInfo(void) {
+    void *pAddr = (void*)sigscan_dllfunc;
+    base_addr = 0;
+    base_len = 0;
+ 
+    #ifdef WIN32
+    MEMORY_BASIC_INFORMATION mem;
+ 
+    if(!pAddr)
+        return false; // GetDllMemInfo failed!pAddr
+ 
+    if(!VirtualQuery(pAddr, &mem, sizeof(mem)))
+        return false;
+ 
+    base_addr = (unsigned char*)mem.AllocationBase;
+ 
+    IMAGE_DOS_HEADER *dos = (IMAGE_DOS_HEADER*)mem.AllocationBase;
+    IMAGE_NT_HEADERS *pe = (IMAGE_NT_HEADERS*)((unsigned long)dos+(unsigned long)dos->e_lfanew);
+ 
+    if(pe->Signature != IMAGE_NT_SIGNATURE) {
+        base_addr = 0;
+        return false; // GetDllMemInfo failedpe points to a bad location
+    }
+ 
+    base_len = (size_t)pe->OptionalHeader.SizeOfImage;
+ 
+    #else
+ 
+    Dl_info info;
+    struct stat buf;
+ 
+    if(!dladdr(pAddr, &info))
+        return false;
+ 
+    if(!info.dli_fbase || !info.dli_fname)
+        return false;
+ 
+    if(stat(info.dli_fname, &buf) != 0)
+        return false;
+ 
+    base_addr = (unsigned char*)info.dli_fbase;
+    base_len = buf.st_size;
+    #endif
+ 
+    return true;
+}
+ 
+/* Scan for the signature in memory then return the starting position's address */
+void* CSigScan::FindSignature(void) {
+    unsigned char *pBasePtr = base_addr;
+    unsigned char *pEndPtr = base_addr+base_len;
+    size_t i;
+ 
+    while(pBasePtr < pEndPtr) {
+        for(i = 0;i < sig_len;i++) {
+            if((sig_mask[i] != '?') && (sig_str[i] != pBasePtr[i]))
+                break;
+        }
+ 
+        // If 'i' reached the end, we know we have a match!
+        if(i == sig_len)
+            return (void*)pBasePtr;
+ 
+        pBasePtr++;
+    }
+ 
+    return NULL;
+}

diff --git a/sigscan.cpp b/sigscan.cpp new file mode 100644 index 0000000..f8ab0e3 --- /dev/null +++ b/sigscan.cpp
@@ -0,0 +1,124 @@
	1	#include <string.h>
	2	#include "sigscan.h"
	3
	4	/* There is no ANSI ustrncpy */
	5	unsigned char* ustrncpy(unsigned char dest, const unsigned char src, int len) {
	6	while(len--)
	7	dest[len] = src[len];
	8
	9	return dest;
	10	}
	11
	12	/* //////////////////////////////////////
	13	CSigScan Class
	14	////////////////////////////////////// */
	15	unsigned char* CSigScan::base_addr;
	16	size_t CSigScan::base_len;
	17	void (CSigScan::sigscan_dllfunc)(const char pName, int pReturnCode);
	18
	19	/* Initialize the Signature Object */
	20	int CSigScan::Init(const unsigned char sig, const char mask, size_t len) {
	21	is_set = 0;
	22
	23	sig_len = len;
	24
	25	if ( sig_str )
	26	delete[] sig_str;
	27
	28	sig_str = new unsigned char[sig_len];
	29	ustrncpy(sig_str, sig, sig_len);
	30
	31	if ( sig_mask )
	32	delete[] sig_mask;
	33
	34	sig_mask = new char[sig_len/+1/];
	35	strncpy(sig_mask, mask, sig_len);
	36	//sig_mask[sig_len+1] = 0;
	37
	38	if(!base_addr)
	39	return 2; // GetDllMemInfo() Failed
	40
	41	if((sig_addr = FindSignature()) == NULL)
	42	return 1; // FindSignature() Failed
	43
	44	is_set = 1;
	45	// SigScan Successful!
	46
	47	return 0;
	48	}
	49
	50	/* Destructor frees sig-string allocated memory */
	51	CSigScan::~CSigScan(void) {
	52	delete[] sig_str;
	53	delete[] sig_mask;
	54	}
	55
	56	/* Get base address of the server module (base_addr) and get its ending offset (base_len) */
	57	bool CSigScan::GetDllMemInfo(void) {
	58	void pAddr = (void)sigscan_dllfunc;
	59	base_addr = 0;
	60	base_len = 0;
	61
	62	#ifdef WIN32
	63	MEMORY_BASIC_INFORMATION mem;
	64
	65	if(!pAddr)
	66	return false; // GetDllMemInfo failed!pAddr
	67
	68	if(!VirtualQuery(pAddr, &mem, sizeof(mem)))
	69	return false;
	70
	71	base_addr = (unsigned char*)mem.AllocationBase;
	72
	73	IMAGE_DOS_HEADER dos = (IMAGE_DOS_HEADER)mem.AllocationBase;
	74	IMAGE_NT_HEADERS pe = (IMAGE_NT_HEADERS)((unsigned long)dos+(unsigned long)dos->e_lfanew);
	75
	76	if(pe->Signature != IMAGE_NT_SIGNATURE) {
	77	base_addr = 0;
	78	return false; // GetDllMemInfo failedpe points to a bad location
	79	}
	80
	81	base_len = (size_t)pe->OptionalHeader.SizeOfImage;
	82
	83	#else
	84
	85	Dl_info info;
	86	struct stat buf;
	87
	88	if(!dladdr(pAddr, &info))
	89	return false;
	90
	91	if(!info.dli_fbase \|\| !info.dli_fname)
	92	return false;
	93
	94	if(stat(info.dli_fname, &buf) != 0)
	95	return false;
	96
	97	base_addr = (unsigned char*)info.dli_fbase;
	98	base_len = buf.st_size;
	99	#endif
	100
	101	return true;
	102	}
	103
	104	/* Scan for the signature in memory then return the starting position's address */
	105	void* CSigScan::FindSignature(void) {
	106	unsigned char *pBasePtr = base_addr;
	107	unsigned char *pEndPtr = base_addr+base_len;
	108	size_t i;
	109
	110	while(pBasePtr < pEndPtr) {
	111	for(i = 0;i < sig_len;i++) {
	112	if((sig_mask[i] != '?') && (sig_str[i] != pBasePtr[i]))
	113	break;
	114	}
	115
	116	// If 'i' reached the end, we know we have a match!
	117	if(i == sig_len)
	118	return (void*)pBasePtr;
	119
	120	pBasePtr++;
	121	}
	122
	123	return NULL;
	124	}