aobscan 0.3.0

AOBscan is a library for multi-threaded AOB memory scanning
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

use common::*;

mod common;

#[test]
/// Tests that the multi-threaded scanner can find a certain pattern in a random byte array,
/// using both IDA and code style signatures.
fn scan_multi_threaded() {
    // Create a random data buffer.
    let random_bytes = random_bytes(1024 * 1024 /* 1 MB */);

    // This is an AOB we want to find in the data.
    // It is going to be placed in the data buffer at the offset 0x2000.
    let target_offset = 0x2000;
    let known = b"\x55\x48\x89\xE5\x48\x8B\x00\x00\x00\x00\x00\x8B\x04\x07\x5D\xC3\x55\x48\x89\xE5\x41\x57\x41\x56\x41\x55\x41\x54\x53\x50\x49\x89\xFE";

    unsafe {
        // Copy the known bytes to the random data buffer.
        std::ptr::copy(
            known.as_ptr(),
            random_bytes.as_ptr().offset(target_offset) as *mut u8,
            known.len(),
        );
    }

    // Run the IDA-style AOB scan.
    let mut correct = false;
    let mut result = aobscan::PatternBuilder::from_ida_style("55 48 89 E5 ? 8B ? ? 00 ? ? 8B ? ? 5D C3")
        .unwrap()
        .with_all_threads()
        .build()
        .scan(&random_bytes, |offset| {
            if offset as isize == target_offset { correct = true; }
            true
        });

    assert!(correct);
    assert!(result);

    // Run the code-style AOB scan.
    correct = false;
    result = aobscan::PatternBuilder::from_code_style(
        b"\x55\x48\x89\xE5\x00\x8B\x00\x00\x00\x00\x00\x8B\x00\x00\x5D\xC3",
        "....?.??.??.??..",
    ).unwrap()
        .with_all_threads()
        .build()
        .scan(&random_bytes, |offset| {
            if offset as isize == target_offset { correct = true; }
            true
        });

    assert!(correct);
    assert!(result);
}