C/C++ 内存遍历与KMP特征搜索

内存遍历，枚举数据，实现特征码扫描。

内存遍历: 每次读入4096字节，然后每16个字符换一次行，遍历内存 0x00401000 - 0x7FFFFFFF。

#include <stdio.h>  
#include <stdlib.h>  
#include <windows.h>  

VOID ScanAddress(HANDLE process)
{
    const DWORD beginAddr = 0x00401000;
    const DWORD endAddr = 0x7FFFFFFF;
    const DWORD pageSize = 4096;

    BOOL _break = FALSE;
    BYTE page[pageSize];
    DWORD tmpAddr = beginAddr;
    while (tmpAddr <= endAddr)
    {
        ::ReadProcessMemory(process, (LPCVOID)tmpAddr, &page, pageSize, 0);

        for (int x = 0; x < 4096; x++)
        {

            if (x % 16 != 0)
            {
                DWORD ch = page[x];

                if (ch >= 0 && ch <= 15)
                {
                    printf("0%x ", ch);
                }
                else
                {
                    printf("%x ", ch);
                }
            }
            else
                printf(" | %x n", tmpAddr);
        }
        tmpAddr += pageSize;
    }
}

int main(int argc, char* argv[])
{
    HANDLE process = ::OpenProcess(PROCESS_ALL_ACCESS, false, 4748);
    ScanAddress(process);
    ::CloseHandle(process);

    system("pause");
    return 0;
}

过程：

#include <stdio.h>  
#include <stdlib.h>  
#include <windows.h>  

VOID ScanAddress(HANDLE Process)
{
    const DWORD beginAddr = 0x00401000;
    const DWORD endAddr = 0x7FFFFFFF;

    unsigned char shell[5] = {0x55,0x8b,0xec,0x6a,0xff};
    unsigned char *read = new unsigned char[5];


    for (int x = 0; x < beginAddr; x++)
    {
        DWORD addr = beginAddr + x;
        ReadProcessMemory(Process, (LPVOID)addr, read, 5, 0);
        printf("%x :", addr);
        for (int y = 0; y < 5; y++)
            printf("%02x ",read[y]);
        printf("n");
    }
}

int main(int argc, char* argv[])
{
    HANDLE process = ::OpenProcess(PROCESS_ALL_ACCESS, false, 1772);
    ScanAddress(process);
    /*
    unsigned char set[] = { 4,41,55 };
    unsigned char aa[] = { 4, 41, 55 };
    int ret = memcmp(set, aa, 3);
    printf("%d n", ret);
    */
    //ScanAddress(process);
    //::CloseHandle(process);
    system("pause");
    return 0;
}

寻找开始

#include <stdio.h>  
#include <stdlib.h>  
#include <windows.h>  

VOID ScanAddress(HANDLE Process)
{
    const DWORD beginAddr = 0x00401000;
    const DWORD endAddr = 0x7FFFFFFF;

    unsigned char shell[6] = {0xff,0x75,0x10,0xff,0x75,0x0c};

    unsigned char *read = new unsigned char[6];

    for (int x = 0; x < 684032; x++)
    {
        DWORD addr = beginAddr + x;
        ReadProcessMemory(Process, (LPVOID)addr, read, 6, 0);
        int a = memcmp(read, shell, 6);

        if (a == 0)
        {
            printf("%x :", addr);

            for (int y = 0; y < 6; y++)
            {
                printf("%02x ", read[y]);
            }

            printf(" n");
        }
    }
}
int main(int argc, char* argv[])
{
    HANDLE process = ::OpenProcess(PROCESS_ALL_ACCESS, false, 1772);
    ScanAddress(process);
    system("pause");
    return 0;
}

KMP算法搜索特征码： KMP算法每次在4096字节中寻找特征，成功返回位置，失败返回-1

#include <iostream>
#include <string>

using namespace std;

/* P 为模式串，下标从 0 开始 */
void GetNextval(string SubString, int nextval[])
{
    int SubStringLen = SubString.size();
    int i = 0;
    int j = -1;
    nextval[0] = -1;

    while (i < SubStringLen)
    {
        if (j == -1 || SubString[i] == SubString[j])
        {
            i++; j++;
            if (SubString[i] != SubString[j])
                nextval[i] = j;
            else
                nextval[i] = nextval[j];
        }
        else
        {
            j = nextval[j];
        }
    }
}

/* 在 MainString 中找到 SubString 第一次出现的位置 下标从0开始*/
int KMPSearchString(string MainString, string SubString, int next[])
{
    GetNextval(SubString, next);

    int MainStringIndex = 0;                 // 存储主字符串下标
    int SubStringIndex = 0;                  // 存储子字符串下标
    int MainStringLen = MainString.size();   // 主字符串大小
    int SubStringLen = SubString.size();     // 子字符串大小

    // 循环遍历字符串,因为末尾 '' 的存在，所以不会越界
    while (MainStringIndex < MainStringLen && SubStringIndex < SubStringLen)
    {
        // MainString 的第一个字符不匹配或 MainString[] == SubString[]
        if (SubStringIndex == -1 || MainString[MainStringIndex] == SubString[SubStringIndex])
        {
            MainStringIndex++; SubStringIndex++;
        }
        else   // 当字符串匹配失败则跳转
        {
            SubStringIndex = next[SubStringIndex];
        }
    }
    // 最后匹配成功直接返回位置
    if (SubStringIndex == SubStringLen)
        return MainStringIndex - SubStringIndex;
    return -1;
}

int main(int argc, char *argv[])
{
    int next[100] = { 0 };

    char *Str = "e5 8d 64 24 fc ba ff ff ff ff 92 f0 0f c1";
    char *Search = "ba ff ff ff ff 92 f0";

    // 在Str字符串中找Search子串,找到后返回位置
    int ret = KMPSearchString(Str, Search,next);

    printf("%d n", ret);


    system("pause");
    return 0;
}

将上方代码整合，可实现根据特征码动态打补丁：

int main(int argc, char* argv[])
{
    HANDLE Process = OpenProcess(PROCESS_ALL_ACCESS, false, 2876);

    // 搜索指定特征码的地址数据.
    unsigned char FindCode[6] = { 0xff, 0x75, 0x10, 0xff, 0x75, 0x0c };
    DWORD ret = ScanAddress(Process, FindCode, 6);
    printf("特征地址: %x n", ret);

    // 给指定位置动态打补丁
    unsigned char Pack[6] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
    WriteProcessMemory(Process, (LPVOID)ret, Pack, 6, 0);

    system("pause");
    return 0;
}