Struct Scanner 

pub struct Scanner { /* private fields */ }

configurable pattern scanner

uses SIMD acceleration (AVX2/SSE2) when available and alignment is 1

Implementations

impl Scanner

pub fn scan_module(&self, module: &Module<'_>) -> Result<Vec<ScanMatch>>

scan loaded module for pattern

pub fn scan_module_first( &self, module: &Module<'_>, ) -> Result<Option<ScanMatch>>

scan module, returning first match

pub fn scan_region(&self, region: &MemoryRegion) -> Result<Vec<ScanMatch>>

scan memory region for pattern

pub fn scan_executable_regions(&self) -> Result<Vec<ScanMatch>>

scan all executable memory regions

pub fn scan_all_regions(&self) -> Result<Vec<ScanMatch>>

scan all committed memory regions (more thorough, slower)

impl Scanner

pub fn new(pattern: &str) -> Result<Self>

create scanner from pattern string (auto-detect format)

pub fn from_pattern(pattern: Pattern) -> Self

create scanner from pre-parsed pattern

pub fn alignment(self, align: usize) -> Self

set scan alignment (1, 2, 4, 8, 16)

patterns will only be checked at addresses aligned to this value note: SIMD acceleration is disabled when alignment > 1

pub fn max_results(self, max: usize) -> Self

limit maximum number of results

pub fn scan_slice(&self, data: &[u8]) -> Vec<usize>

scan byte slice for pattern, returning offsets

pub fn scan_slice_first(&self, data: &[u8]) -> Option<usize>

scan byte slice, returning first match offset

pub unsafe fn scan_range( &self, start: usize, size: usize, ) -> Result<Vec<ScanMatch>>

scan memory range for pattern

Safety

caller must ensure the memory range [start, start+size) is readable

pub unsafe fn scan_range_first( &self, start: usize, size: usize, ) -> Result<Option<ScanMatch>>

scan memory range, returning first match

Safety

caller must ensure the memory range [start, start+size) is readable