Struct aobscan::Pattern

pub struct Pattern { /* private fields */ }

A pattern that can be used to scan for matches in a byte array.

This is the main type of this crate, and you can create it using the PatternBuilder struct.

Internally, a pattern is represented as a vector of bytes for the signature, a vector of booleans for the mask, and the number of threads to use.

Implementations

impl Pattern

pub fn new(signature: Vec<u8>, mask: Vec<bool>, threads: usize) -> Self

Creates a new pattern from the given signature, mask and threads number.

Arguments

• signature - The signature to scan for.
• mask - The mask in which the wildcard bytes are represented by false.
• threads - The number of threads to use.

Returns

The newly created pattern.

pub fn get_threads(&self) -> usize

Returns

The number of threads to use in scans of this pattern.

pub fn scan(
    &self,
    data: &[u8],
    callback: impl FnMut(usize) -> bool + Send + Sync
) -> bool

Performs the AOB scan in the given slice.

If specified, this function will split the data into chunks and scan each chunk in parallel.

Arguments

• data - The data slice to scan.
• callback - The callback to execute when a match is found.
  • The callback receives the offset of the match as an argument.
  • It should return true to continue scanning, or false to stop.

Returns

True if at least one match was found, otherwise false.

pub fn scan_object(
    &self,
    data: &[u8],
    section_name: &str,
    callback: impl FnMut(SectionResult) -> bool + Send + Sync
) -> Result<bool, ObjectError>

Performs the AOB scan in the specified object section of the given slice.

This function is useful for restricting the scan to a specific section of a binary file, such as the __text section.
This reduces the amount of data that needs to be scanned, and can drastically improve the scan speed.

If the section is not found, the scan is not performed, and false is returned.

FAT Mach-O binaries are also supported, and in this case all the THIN binaries are scanned for the given section.
Information about which THIN binary contains the match is returned in the callback.

Arguments

• data - The data slice to scan.
• section_name - The name of the section to scan. (e.g. __text)
• callback - The callback to execute when a match is found.
  • The callback receives a structure containing all the information of the match as argument.
  • It should return true to continue scanning, or false to stop.

Returns

Ok(true) if at least one match was found, Ok(false) if no matches were found, Err if an error occurred.

Trait Implementations

impl Clone for Pattern

fn clone(&self) -> Pattern

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Pattern

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Pattern

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the pattern as a string of hexadecimal bytes (or ‘?’) separated by spaces.

Arguments

• f - The formatter.

Returns

Whether the formatting was successful or not.

impl PartialEq<Pattern> for Pattern

fn eq(&self, other: &Pattern) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for Pattern

impl StructuralEq for Pattern

impl StructuralPartialEq for Pattern