pub struct Pattern { /* private fields */ }Expand description
A byte pattern used for scanning memory regions.
Patterns consist of exact byte matches and wildcard positions. They can be constructed from IDA-style signature strings or code-style byte/mask pairs.
Implementations§
Source§impl Pattern
impl Pattern
Sourcepub fn from_ida(signature: &str) -> Result<Self>
pub fn from_ida(signature: &str) -> Result<Self>
Creates a pattern from an IDA-style signature string.
Each token is separated by whitespace. Exact bytes are specified as
two-character hex values. Wildcards are represented by ? or ??.
use procmod_scan::Pattern;
let pattern = Pattern::from_ida("48 8B ?? 89 ? 0F").unwrap();Sourcepub fn from_code(bytes: &[u8], mask: &str) -> Result<Self>
pub fn from_code(bytes: &[u8], mask: &str) -> Result<Self>
Creates a pattern from a code-style byte/mask pair.
The mask string uses x for exact byte matches and ? for wildcards,
one character per byte. The mask length must equal the bytes length.
use procmod_scan::Pattern;
let pattern = Pattern::from_code(b"\x48\x8B\x00\x89", "xx?x").unwrap();Sourcepub fn from_tokens(tokens: Vec<Token>) -> Result<Self>
pub fn from_tokens(tokens: Vec<Token>) -> Result<Self>
Creates a pattern from raw tokens.
Returns an error if the token list is empty.
Sourcepub fn scan(&self, data: &[u8]) -> Vec<usize>
pub fn scan(&self, data: &[u8]) -> Vec<usize>
Finds all offsets in data where this pattern matches.
Returns an empty vec if no matches are found. Matches may overlap.
Sourcepub fn scan_first(&self, data: &[u8]) -> Option<usize>
pub fn scan_first(&self, data: &[u8]) -> Option<usize>
Finds the first offset in data where this pattern matches.
Returns None if no match is found.