Crate sigmatch

a memory signature search library for the Windows platform written in Rust.

It’s a basic version migrated from another C++ project of mine, with more features coming soon!

Quick Use

Assuming you’ve obtained the signatures via IDA-Pro-SigMaker.

Usage in project

[dependencies]
anyhow = "1.0"
sigmatch = "0.1"

fn main() {
     let Ok(mut _sker) = sigmatch::Seeker::with_name("user32.dll") else {
         return;
     };

     // IDA sig
     let Ok(_ida_example) = sker.search("E8 ? ? ? ? 45 33 F6 66 44 89 34 33") else {
         return;
     };

     // x64dbg sig
     let Ok(_x64dbg_example) = sker.search("E8 ?? ?? ?? ?? 45 33 F6 66 44 89 34 33") else {
         return;
     };

     // c sig + mask
     let Ok(_c_example) = sker.raw_search(
         b"\xE8\x00\x00\x00\x00\x45\x33\xF6\x66\x44\x89\x34\x33",
         "x????xxxxxxxx",
     ) else {
         return;
     };

     // rebind and reversese_search
     let _ = || -> anyhow::Result<()> {
         let _rebind_example = sker.bind("main")?.reverse_search("ab cd ?? ef")?;
         Ok(())
     }();

     // new Seeker
     let mut sker1 = sigmatch::Seeker::new();
     if sker1.bind("ntdll.dll").is_err() {
         return;
     }
}

More than examples can see: examples.

Structs

• Section
  Section Information.
• Seeker
  Seeker used for searching memory sections.