Struct scanner::Scanner

pub struct Scanner<'a> { /* fields omitted */ }

Pattern scan context.

Methods

impl<'a> Scanner<'a>

fn new(haystack: &'a [u8], scan: Range<u32>, vbase: u64) -> Scanner<'a>

Create a new Scanner from raw components.

Arguments

• haystack

  Slice of valid memory to scan inside. Any time the scan goes outside this slice, the match has failed.

  A reference to the haystack is kept, tying the Scanner's lifetime to the haystack.

• scan

  Check only for matches within this range, but allow patterns to chase pointers in the whole haystack.

• vbase

  Code might not be at the place where it's actually being executed, this would make it impossible to chase absolute pointers.

  This is where vbase comes in, it translates absolute addresses to offsets within the haystack by simply subtracting it.

  Set it to the virtual address of where haystack is expecting it is located in memory.

Panics

Scan range must be contained within the haystack, enforced by panic.

fn find(&self, pat: &[Unit]) -> Option<Match<'a>>

Scan for a single unique match.

Arguments

• pat

  The pattern to match.

Return value

Fails with None if there's no match, or more than one match was found.

fn iter<'p, 's>(&'s self, pat: &'p [Unit]) -> ScanIter<'a, 'p, 's>

Iterate over all matches.

Arguments

• pat

  The pattern being matched.

Return value

Iterator over the matches.

fn mach(&self, ptr: u32, pat: &[Unit]) -> Option<Match<'a>>

Match a pattern to a specific ptr.

Arguments

• ptr

  Offset in the haystack to match the pattern at.

• pat

  The pattern to match.

Return value

None if mismatch, Some(Match) if matched.

Remarks

I'd like to name this function match but that's a keyword...

Trait Implementations

impl<'a> Clone for Scanner<'a>

fn clone(&self) -> Scanner<'a>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for Scanner<'a>

fn fmt(&self, __arg_0: &mut Formatter) -> Result

Formats the value using the given formatter.

impl<'a, 'b> From<&'b PeView<'a>> for Scanner<'a>

fn from(pe: &'b PeView<'a>) -> Scanner<'a>

Performs the conversion.

impl<'a, 'b> From<&'b PeView<'a>> for Scanner<'a>

fn from(pe: &'b PeView<'a>) -> Scanner<'a>

Performs the conversion.