Struct pelite::pe32::scanner::Scanner [−][src]
pub struct Scanner<P> { /* fields omitted */ }
Pattern scanner.
For more information see the module-level documentation.
Methods
impl<'a, P: Pe<'a> + Copy> Scanner<P>
[src]
impl<'a, P: Pe<'a> + Copy> Scanner<P>
pub fn finds(self, pat: &[Atom], range: Range<Rva>, save: &mut [Rva]) -> bool
[src]
pub fn finds(self, pat: &[Atom], range: Range<Rva>, save: &mut [Rva]) -> bool
Finds the unique match for the pattern in the given range.
The pattern may contain instructions to capture interesting addresses, these are stored in the save array. Out of bounds stores are simply ignored, ensure the save array is large enough for the given pattern.
In case of mismatch, ie. returns false, the save array is still overwritten with temporary data and should be considered trashed. Keep a copy, invoke with a fresh save array or reexecute the pattern at the saved cursor to get around this.
Returns false
if no match is found or multiple matches are found to prevent subtle bugs where a pattern goes stale by not being unique any more.
Use matches(pat, range).next(save)
if just the first match is desired.
pub fn finds_code(self, pat: &[Atom], save: &mut [Rva]) -> bool
[src]
pub fn finds_code(self, pat: &[Atom], save: &mut [Rva]) -> bool
Finds the unique code match for the pattern.
Restricts the range to the code section. See finds
for more information.
pub fn matches(self, pat: &[Atom], range: Range<Rva>) -> Matches<P>
[src]
pub fn matches(self, pat: &[Atom], range: Range<Rva>) -> Matches<P>
Returns an iterator over the matches of a pattern within the given range.
pub fn matches_code(self, pat: &[Atom]) -> Matches<P>
[src]
pub fn matches_code(self, pat: &[Atom]) -> Matches<P>
Returns an iterator over the code matches of a pattern.
Restricts the range to the code section. See matches
for more information.
pub fn exec(self, cursor: Rva, pat: &[Atom], save: &mut [Rva]) -> bool
[src]
pub fn exec(self, cursor: Rva, pat: &[Atom], save: &mut [Rva]) -> bool
Pattern interpreter.
Returns if the pattern matches the binary image at the given rva.
The pattern may contain instructions to capture interesting addresses, these are stored in the save array. Out of bounds stores are simply ignored, ensure the save array is large enough for the given pattern.
In case of mismatch, ie. returns false, the save array is still overwritten with temporary data and should be considered trashed. Keep a copy, invoke with a fresh save array or reexecute the pattern at the saved cursor to get around this.