diff --git a/vnrhook/src/util/memdbg/memsearch.cc b/vnrhook/src/util/memdbg/memsearch.cc index 3bfc12a..826348f 100644 --- a/vnrhook/src/util/memdbg/memsearch.cc +++ b/vnrhook/src/util/memdbg/memsearch.cc @@ -13,100 +13,20 @@ enum : BYTE { byte_int3 = 0xcc }; enum : WORD { word_2int3 = 0xcccc }; // jichi 4/19/2014: Return the integer that can mask the signature +// Artikash 8/4/2018: change implementation DWORD sigMask(DWORD sig) { - __asm - { - xor ecx,ecx - mov eax,sig -_mask: - shr eax,8 - inc ecx - test eax,eax - jnz _mask - sub ecx,4 - neg ecx - or eax,-1 - shl ecx,3 - shr eax,cl - } + DWORD count = 0; + while (sig) + { + sig >>= 8; + ++count; + } + count -= 4; + count = -count; + return 0xffffffff >> (count << 3); } -#if 0 -/** - * Search from stopAddress back to startAddress - range - * This function is not well debugged - */ -DWORD reverseSearchPattern(DWORD base, DWORD base_length, LPCVOID search, DWORD search_length) // KMP -{ - __asm - { - mov eax,search_length -alloc: - push 0 - sub eax,1 - jnz alloc - - mov edi,search - mov edx,search_length - mov ecx,1 - xor esi,esi -build_table: - mov al,byte ptr [edi+esi] - cmp al,byte ptr [edi+ecx] - sete al - test esi,esi - jz pre - test al,al - jnz pre - mov esi,[esp+esi*4-4] - jmp build_table -pre: - test al,al - jz write_table - inc esi -write_table: - mov [esp+ecx*4],esi - - inc ecx - cmp ecx,edx - jb build_table - - mov esi,base - xor edx,edx - mov ecx,edx -matcher: - mov al,byte ptr [edi+ecx] - cmp al,byte ptr [esi-edx] // jichi 6/1/2014: The only place that is modified - sete al - test ecx,ecx - jz match - test al,al - jnz match - mov ecx, [esp+ecx*4-4] - jmp matcher -match: - test al,al - jz pre2 - inc ecx - cmp ecx,search_length - je finish -pre2: - inc edx - cmp edx,base_length // search_length - jb matcher - mov edx,search_length - dec edx -finish: - mov ecx,search_length - sub edx,ecx - lea eax,[edx+1] - lea ecx,[ecx*4] - add esp,ecx - } -} -#endif // 0 - // Modified from ITH findCallOrJmpAbs // Example call: // 00449063 |. ff15 5cf05300 call dword ptr ds:[<&gdi32.getglyphoutli>; \GetGlyphOutlineA diff --git a/vnrhook/src/util/util.cc b/vnrhook/src/util/util.cc index 3babc7b..3c8c2de 100644 --- a/vnrhook/src/util/util.cc +++ b/vnrhook/src/util/util.cc @@ -9,23 +9,18 @@ namespace { // unnamed // jichi 4/19/2014: Return the integer that can mask the signature +// Artikash 8/4/2018: change implementation DWORD SigMask(DWORD sig) { - __asm - { - xor ecx,ecx //ecx = 0 - mov eax,sig //eax = sig -_mask: - shr eax,8 // eax >>= 8 - inc ecx //++ecx - test eax,eax // if (eax > 0) - jnz _mask //goto _mask - sub ecx,4 //ecx -= 4 - neg ecx //ecx *= -1 - or eax,-1 - shl ecx,3 - shr eax,cl - } + DWORD count = 0; + while (sig) + { + sig >>= 8; + ++count; + } + count -= 4; + count = -count; + return 0xffffffff >> (count << 3); } } // namespace unnamed