goblin-sigscan-pattern 0.1.0

Shared pattern parser for goblin-sigscan
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# goblin-sigscan

`goblin-sigscan` provides pelite-style pattern parsing and scanner behavior over
goblin-backed PE/ELF/Mach binaries.

## Workspace crates

- `crates/goblin-sigscan-pattern`: pattern parser and atom model
- `crates/goblin-sigscan`: scanner/runtime API and format wrappers
- `crates/goblin-sigscan-macros`: `pattern!` compile-time parsing macro
- `crates/goblin-sigscan-cli`: small CLI for pelite-style signature scanning

## Quick start

```rust
use goblin_sigscan::pattern;

let atoms = pattern::parse("48 8B ? ? ? ? 48 89")?;
let save_slots = pattern::save_len(&atoms);
assert!(save_slots >= 1);
# Ok::<(), goblin_sigscan::pattern::ParsePatError>(())
```

Before scanning, ensure the `save` buffer has enough capacity for at least
`pattern::save_len(&atoms)` elements (or `PreparedPattern::required_slots()`).
Slot `0` always holds the match base address.

For syntax onboarding, see the public docs on `goblin_sigscan::pattern` and
`goblin_sigscan_pattern::parse`.

Docs.rs navigation shortcuts:

- crate tutorial: <https://docs.rs/goblin-sigscan/latest/goblin_sigscan/>
- pattern module: <https://docs.rs/goblin-sigscan/latest/goblin_sigscan/pattern/>
- parser crate: <https://docs.rs/goblin-sigscan-pattern/latest/goblin_sigscan_pattern/>

## Benchmarks

See `scripts/README.md` for benchmark workflows, A/B comparisons, and guidance
for reducing run-to-run noise.

## Credits

This project borrows heavily from the original pelite pattern model and syntax.
Huge thanks to CasualX and his pelite project:

- <https://github.com/CasualX/pelite>
- <https://docs.rs/pelite/latest/pelite/pattern/>

## License

Licensed under the MIT License. See `LICENSE` for details.