Skip to main content

Module raw_padding

Module raw_padding 

Source
Expand description

§Raw Padding Scanner

This module scans a slice of bytes to identify sequences of a single repeating byte value. This is commonly used to find runs of NOPs (0x90), NULLs (0x00), or trap/INT3 (0xCC) which can denote code caves or padding zones inside binary sections.

Functions§

scan_raw_padding
Scans a byte slice for consecutive runs of target_byte of length at least min_length. Returns the absolute virtual memory addresses of all bytes within the matching runs.