Struct pelite::pe32::scanner::Scanner

pub struct Scanner<P> { /* fields omitted */ }

Pattern scanner.

For more information see the module-level documentation.

Methods

impl<'a, P: Pe<'a>> Scanner<P>

pub fn finds(&self, pat: &[Atom], range: Range<Rva>, save: &mut [Rva]) -> bool

Finds the unique match for the pattern in the given range.

The pattern may contain instructions to capture interesting addresses, these are stored in the save array. Out of bounds stores are simply ignored, ensure the save array is large enough for the given pattern.

In case of mismatch, ie. returns false, the save array is still overwritten with temporary data and should be considered trashed. Keep a copy, invoke with a fresh save array or reexecute the pattern at the saved cursor to get around this.

Returns false if no match is found or multiple matches are found to prevent subtle bugs where a pattern goes stale by not being unique any more.

Use matches(pat, range).next(save) if just the first match is desired.

pub fn finds_code(&self, pat: &[Atom], save: &mut [Rva]) -> bool

Finds the unique code match for the pattern.

Restricts the range to the code section. See finds for more information.

pub fn matches<'pat>(
    &self,
    pat: &'pat [Atom],
    range: Range<Rva>
) -> Matches<'pat, P>

Returns an iterator over the matches of a pattern within the given range.

pub fn matches_code<'pat>(&self, pat: &'pat [Atom]) -> Matches<'pat, P>

Returns an iterator over the code matches of a pattern.

Restricts the range to the code section. See matches for more information.

pub fn exec(&self, cursor: Rva, pat: &[Atom], save: &mut [Rva]) -> bool

Pattern interpreter, returns if the pattern matches the binary image at the given rva.

The pattern may contain instructions to capture interesting addresses, these are stored in the save array. Out of bounds stores are simply ignored, ensure the save array is large enough for the given pattern.

In case of mismatch, ie. returns false, the save array is still overwritten with temporary data and should be considered trashed. Keep a copy, invoke with a fresh save array or reexecute the pattern at the saved cursor to get around this.

Trait Implementations

impl<P: Clone> Clone for Scanner<P>

fn clone(&self) -> Scanner<P>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<P: Copy> Copy for Scanner<P>