特征码模糊搜索通配符问题

小白白白白白啊

如图这是ce里面搜索的特征码
?8 ?? ?? ?? 00 00 00 00 40 ?? ?? ?? 00 00 00 00 04 00 00 00 ?? ?? ?? ?? FF

而在C++中我使用的是SunDay的算法 它只支持连续?? 不支持?8这种
求助各位大佬能否有办法实现如CE这样的搜法

菜鸟囚徒

08 18 28 ---- F8   哈哈哈哈

1752328925

换一种方法

风度猫

?号 支持不支持 得看你算法里自己写的匹配是啥吧?

小白白白白白啊

风度猫 发表于 2024-3-7 19:21
?号 支持不支持 得看你算法里自己写的匹配是啥吧?

我这个算法不支持?8 但是支持?? 所以我发帖问一下有没有?8支持这种的算法

风度猫

小白白白白白啊 发表于 2024-3-7 22:04
我这个算法不支持?8 但是支持?? 所以我发帖问一下有没有?8支持这种的算法

  

#include
#include
#include
#include

using namespace std;

#define BLOCKMAXSIZE 409600//每次读取内存的最大大小
BYTE* MemoryData;//每次将读取的内存读入这里
short Next[260];

//特征码转字节集
WORD GetTzmArray (char* Tzm, WORD* TzmArray)
{
int len = 0;
WORD TzmLength = strlen (Tzm) / 3 + 1;

for (int i = 0; i < strlen (Tzm); )//将十六进制特征码转为十进制
{
char num[2];
num[0] = Tzm[i++];
num[1] = Tzm[i++];
i++;
if (num[0] != ' ?' && num[1] != '?')
{
int sum = 0;
WORD a[2];
for (int i = 0; i < 2; i++)
{
if (num[i] >= ' 0' && num[i] <= '9')
{
a[i] = num[i] - ' 0';
}
else if (num[i] >= ' a' && num[i] <= 'z')
{
a[i] = num[i] - 87;
}
else if (num[i] >= ' A' && num[i] <= 'Z')
{
a[i] = num[i] - 55;
}

}
sum = a[0] * 16 + a[1];
TzmArray[len++] = sum;
}
else
{
TzmArray[len++] = 256;
}
}
return TzmLength;
}

//获取Next数组
void GetNext (short* next, WORD* Tzm, WORD TzmLength)
{
//特征码 (字节集)的每个字节的范围在0-255 (0-FF)之间，256用来表示问号，到260是为了防止越界
for (int i = 0; i < 260; i++)
next[i] = -1;
for (int i = 0; i < TzmLength; i++)
next[Tzm[i]] = i;
}

//搜索一块内存
void SearchMemoryBlock (HANDLE hProcess, WORD* Tzm, WORD TzmLength, unsigned __int64 StartAddress, unsigned long size, vector& ResultArray)
{
if (!ReadProcessMemory (hProcess, (LPCVOID)StartAddress, MemoryData, size, NULL))
{
return;
}

for (int i = 0, j, k; i < size;)
{
j = i; k = 0;

for (; k < TzmLength && j < size && (Tzm[k] == MemoryData[j] || Tzm[k] == 256); k++, j++);

if (k == TzmLength)
{
ResultArray.push_back (StartAddress + i);
}

if ( (i + TzmLength) >= size)
{
return;
}

int num = Next[MemoryData[i + TzmLength]];
if (num == -1)
i += (TzmLength - Next[256]);//如果特征码有问号，就从问号处开始匹配，如果没有就i+=-1
else
i += (TzmLength - num);
}
}

//搜索整个程序
int SearchMemory (HANDLE hProcess, char* Tzm, unsigned __int64 StartAddress, unsigned __int64 EndAddress, int InitSize, vector& ResultArray)
{
int i = 0;
unsigned long BlockSize;
MEMORY_BASIC_INFORMATION mbi;

WORD TzmLength = strlen (Tzm) / 3 + 1;
WORD* TzmArray = new WORD[TzmLength];

GetTzmArray (Tzm, TzmArray);
GetNext (Next, TzmArray, TzmLength);

//初始化结果数组
ResultArray.clear ();
ResultArray.reserve (InitSize);

while (VirtualQueryEx (hProcess, (LPCVOID)StartAddress, &mbi, sizeof (mbi)) != 0)
{
//获取可读可写和可读可写可执行的内存块
if (mbi.Protect == PAGE_READWRITE || mbi.Protect == PAGE_EXECUTE_READWRITE)
{
i = 0;
BlockSize = mbi.RegionSize;
//搜索这块内存
while (BlockSize >= BLOCKMAXSIZE)
{
SearchMemoryBlock (hProcess, TzmArray, TzmLength, StartAddress + (BLOCKMAXSIZE * i), BLOCKMAXSIZE, ResultArray);
BlockSize -= BLOCKMAXSIZE; i++;
}
SearchMemoryBlock (hProcess, TzmArray, TzmLength, StartAddress + (BLOCKMAXSIZE * i), BlockSize, ResultArray);

}
StartAddress += mbi.RegionSize;

if (EndAddress != 0 && StartAddress > EndAddress)
{
return ResultArray.size ();
}
}
free (TzmArray);
return ResultArray.size ();
}

int main ()
{
//初始化MemoryData大小
MemoryData = new BYTE[BLOCKMAXSIZE];

DWORD pid=0;
vector ResultArray;
cout << "请输入进程ID：" << endl;
cin >> pid;

//通过进程ID获取进程句柄
HANDLE hProcess = OpenProcess (PROCESS_ALL_ACCESS, false, pid);

int start = clock ();
SearchMemory (hProcess, (char*)"FF 3F FF ?? FF F2", 0x410000, 0xFFFFFFFF, 30, ResultArray);
int end = clock ();

cout << "用时：" << end-start << "毫秒"<<endl;
cout << "搜索到" << ResultArray.size () << "个结果" << endl;

for (vector::iterator it = ResultArray.begin (); it != ResultArray.end (); it++)
{
printf ("%x\n", *it);
}

return 0;
}

#include<br /> #include<br /> #include<br /> #include<br /> <br /> using namespace std;<br /> <br /> #define BLOCKMAXSIZE 409600//每次读取内存的最大大小<br /> BYTE* MemoryData;//每次将读取的内存读入这里<br /> short Next[260];<br /> <br /> //特征码转字节集<br /> WORD GetTzmArray(char* Tzm, WORD* TzmArray)<br /> {<br />         int len = 0;<br />         WORD TzmLength = strlen(Tzm) / 3 + 1;<br /> <br />         for (int i = 0; i < strlen(Tzm); )//将十六进制特征码转为十进制<br />         {<br />                 char num[2];<br />                 num[0] = Tzm[i++];<br />                 num[1] = Tzm[i++];<br />                 i++;<br />                 if (num[0] != '?' && num[1] != '?')<br />                 {<br />                         int sum = 0;<br />                         WORD a[2];<br />                         for (int i = 0; i < 2; i++)<br />                         {<br />                                 if (num<i> >= '0' && num<i> <= '9')<br />                                 {<br />                                         a<i> = num<i> - '0';<br />                                 }<br />                                 else if (num<i> >= 'a' && num<i> <= 'z')<br />                                 {<br />                                         a<i> = num<i> - 87;<br />                                 }<br />                                 else if (num<i> >= 'A' && num<i> <= 'Z')<br />                                 {<br />                                         a<i> = num<i> - 55;<br />                                 }<br /> <br />                         }<br />                         sum = a[0] * 16 + a[1];<br />                         TzmArray[len++] = sum;<br />                 }<br />                 else<br />                 {<br />                         TzmArray[len++] = 256;<br />                 }<br />         }<br />         return TzmLength;<br /> }<br /> <br /> //获取Next数组<br /> void GetNext(short* next, WORD* Tzm, WORD TzmLength)<br /> {<br />         //特征码(字节集)的每个字节的范围在0-255(0-FF)之间，256用来表示问号，到260是为了防止越界<br />         for (int i = 0; i < 260; i++)<br />                 next<i> = -1;<br />         for (int i = 0; i < TzmLength; i++)<br />                 next[Tzm<i>] = i;<br /> }<br /> <br /> //搜索一块内存<br /> void SearchMemoryBlock(HANDLE hProcess, WORD* Tzm, WORD TzmLength, unsigned __int64 StartAddress, unsigned long size, vector& ResultArray)<br /> {<br />         if (!ReadProcessMemory(hProcess, (LPCVOID)StartAddress, MemoryData, size, NULL))<br />         {<br />                 return;<br />         }<br /> <br />         for (int i = 0, j, k; i < size;)<br />         {<br />                 j = i; k = 0;<br /> <br />                 for (; k < TzmLength && j < size && (Tzm[k] == MemoryData[j] || Tzm[k] == 256); k++, j++);<br /> <br />                 if (k == TzmLength)<br />                 {<br />                         ResultArray.push_back(StartAddress + i);<br />                 }<br /> <br />                 if ((i + TzmLength) >= size)<br />                 {<br />                         return;<br />                 }<br /> <br />                 int num = Next[MemoryData[i + TzmLength]];<br />                 if (num == -1)<br />                         i += (TzmLength - Next[256]);//如果特征码有问号，就从问号处开始匹配，如果没有就i+=-1<br />                 else<br />                         i += (TzmLength - num);<br />         }<br /> }<br /> <br /> //搜索整个程序<br /> int SearchMemory(HANDLE hProcess, char* Tzm, unsigned __int64 StartAddress, unsigned __int64 EndAddress, int InitSize, vector& ResultArray)<br /> {<br />         int i = 0;<br />         unsigned long BlockSize;<br />         MEMORY_BASIC_INFORMATION mbi;<br /> <br />         WORD TzmLength = strlen(Tzm) / 3 + 1;<br />         WORD* TzmArray = new WORD[TzmLength];<br /> <br />         GetTzmArray(Tzm, TzmArray);<br />         GetNext(Next, TzmArray, TzmLength);<br /> <br />         //初始化结果数组<br />         ResultArray.clear();<br />         ResultArray.reserve(InitSize);<br /> <br />         while (VirtualQueryEx(hProcess, (LPCVOID)StartAddress, &mbi, sizeof(mbi)) != 0)<br />         {<br />                 //获取可读可写和可读可写可执行的内存块<br />                 if (mbi.Protect == PAGE_READWRITE || mbi.Protect == PAGE_EXECUTE_READWRITE)<br />                 {<br />                         i = 0;<br />                         BlockSize = mbi.RegionSize;<br />                         //搜索这块内存<br />                         while (BlockSize >= BLOCKMAXSIZE)<br />                         {<br />                                 SearchMemoryBlock(hProcess, TzmArray, TzmLength, StartAddress + (BLOCKMAXSIZE * i), BLOCKMAXSIZE, ResultArray);<br />                                 BlockSize -= BLOCKMAXSIZE; i++;<br />                         }<br />                         SearchMemoryBlock(hProcess, TzmArray, TzmLength, StartAddress + (BLOCKMAXSIZE * i), BlockSize, ResultArray);<br /> <br />                 }<br />                 StartAddress += mbi.RegionSize;<br /> <br />                 if (EndAddress != 0 && StartAddress > EndAddress)<br />                 {<br />                         return ResultArray.size();<br />                 }<br />         }<br />         free(TzmArray);<br />         return ResultArray.size();<br /> }<br /> <br /> int main()<br /> {<br />         //初始化MemoryData大小<br />         MemoryData = new BYTE[BLOCKMAXSIZE];<br /> <br />         DWORD pid=0;<br />         vector ResultArray;<br />         <br />         cout << "请输入进程ID：" << endl;<br />         cin >> pid;<br /> <br />         //通过进程ID获取进程句柄<br />         HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);<br /> <br />         int start = clock();<br />         SearchMemory(hProcess, (char*)"FF 3F FF ?? FF F2", 0x410000, 0xFFFFFFFF, 30, ResultArray);<br />         int end = clock();<br /> <br />         cout << "用时：" << end-start << "毫秒"<<endl;<br />         cout << "搜索到" << ResultArray.size() << "个结果" << endl;<br /> <br />         for (vector::iterator it = ResultArray.begin(); it != ResultArray.end(); it++)<br />         {<br />                 printf("%x\n", *it);<br />         }<br /> <br />         return 0;<br /> }

</endl;

<endl;
自行脑补</endl;

小白白白白白啊

风度猫 发表于 2024-3-7 22:10
[e=0]#include
#include
#include

这个算法就是我从网上找的 一模一样 好像不支持?8

暗神逆向

改一下特征码。把?8改成??。。如果要检查?8相当于一个字节的数字还要拆分成2个数进行比对。效率上也不行。