pub fn find_sigs(
        process: &mut Win32Process<impl VirtualMemory>,
        disasm: &Disasm,
        target_global: Address,
    ) -> Result<Vec<String>> {
        let addrs = disasm
            .inverse_map()
            .get(&target_global)
            .ok_or(Error::Other("Invalid global variable"))?;

        let module = process
            .module_list()?
            .into_iter()
            .find(|m| m.base <= target_global && m.base + m.size > target_global)
            .ok_or(Error::Other("Could not find target module"))?;

        let mut image = vec![0; size::kb(128)];

        process
            .virt_mem
            .virt_read_raw_into(module.base, &mut image)
            .data_part()?;

        let pefile =
            PeFile::from_bytes(&image).map_err(|_| Error::Other("Failed to parse header"))?;

        const IMAGE_SCN_CNT_CODE: u32 = 0x20;

        let ranges: Vec<(Address, usize)> = pefile
            .section_headers()
            .iter()
            .filter(|s| (s.Characteristics & IMAGE_SCN_CNT_CODE) != 0)
            .map(|s| {
                (
                    module.base + s.VirtualAddress as usize,
                    s.VirtualSize as usize,
                )
            })
            .collect();

        let mut bufs: Vec<(Address, [u8; MAX_SIG_LENGTH])> =
            addrs.iter().map(|&a| (a, [0; MAX_SIG_LENGTH])).collect();

        let mut read_list: Vec<_> = bufs
            .iter_mut()
            .map(|(a, b)| VirtualReadData(*a, b))
            .collect();

        process
            .virt_mem
            .virt_read_raw_list(&mut read_list)
            .data_part()?;

        let bitness = process.proc_info.proc_arch.bits().into();

        let mut states: Vec<_> = bufs
            .iter()
            .map(|(start_ip, buf)| {
                let mut decoder = Decoder::new(bitness, buf, DecoderOptions::NONE);
                decoder.set_ip(start_ip.as_u64());
                Sigstate {
                    start_ip: *start_ip,
                    buf,
                    decoder,
                    instrs: vec![],
                    mask: vec![],
                }
            })
            .collect();

        let mut out = vec![];

        loop {
            let mut added = false;
            for s in states.iter_mut() {
                if s.add_single_instr() {
                    added = true;
                }
            }
            if !added
                || Self::has_unique_matches(&states, &mut process.virt_mem, &ranges, &mut out)?
            {
                break;
            }
        }

        Ok(out)
    }
/// Find code signatures for the given target global.
///
/// * `process` - target profcess
/// * `disasm` - instance to disassembler state
/// * `target_global` - target global variable to sig
Find code signatures for the given target global.
Find code signatures for the given target global .
pub fn find_sigs(
        process: &mut Win32Process<impl VirtualMemory>,
        disasm: &Disasm,
        target_global: Address,
    ) -> Result<Vec<String>> {
        let addrs = disasm
            .inverse_map()
            .get(&target_global)
            .ok_or(Error::Other("Invalid global variable"))?;
        let module = process
            .module_list()?
            .into_iter()
            .find(|m| m.base <= target_global && m.base + m.size > target_global)
            .ok_or(Error::Other("Could not find target module"))?;
        let mut image = vec![0; size::kb(128)];
        process
            .virt_mem
            .virt_read_raw_into(module.base, &mut image)
            .data_part()?;
        let pefile =
            PeFile::from_bytes(&image).map_err(|_| Error::Other("Failed to parse header"))?;
        const IMAGE_SCN_CNT_CODE: u32 = 0x20;
        let ranges: Vec<(Address, usize)> = pefile
            .section_headers()
            .iter()
            .filter(|s| (s.Characteristics & IMAGE_SCN_CNT_CODE) != 0)
            .map(|s| {
                (
                    module.base + s.VirtualAddress as usize,
                    s.VirtualSize as usize,
                )
            })
            .collect();
        let mut bufs: Vec<(Address, [u8; MAX_SIG_LENGTH])> =
            addrs.iter().map(|&a| (a, [0; MAX_SIG_LENGTH])).collect();
        let mut read_list: Vec<_> = bufs
            .iter_mut()
            .map(|(a, b)| VirtualReadData(*a, b))
            .collect();
        process
            .virt_mem
            .virt_read_raw_list(&mut read_list)
            .data_part()?;
        let bitness = process.proc_info.proc_arch.bits().into();
        let mut states: Vec<_> = bufs
            .iter()
            .map(|(start_ip, buf)| {
                let mut decoder = Decoder::new(bitness, buf, DecoderOptions::NONE);
                decoder.set_ip(start_ip.as_u64());
                Sigstate {
                    start_ip: *start_ip,
                    buf,
                    decoder,
                    instrs: vec![],
                    mask: vec![],
                }
            })
            .collect();
        let mut out = vec![];
        loop {
            let mut added = false;
            for s in states.iter_mut() {
                if s.add_single_instr() {
                    added = true;
                }
            }
            if !added
                || Self::has_unique_matches(&states, &mut process.virt_mem, &ranges, &mut out)?
            {
                break;
            }
        }
        Ok(out)
    }
pub fn find_sigs ( process : & mut Win32Process < impl VirtualMemory > , disasm : & Disasm , target_global : Address , ) -> Result < Vec < String > > { let addrs = disasm . inverse_map ( ) . get ( & target_global ) . ok_or ( Error :: Other ( " " ) ) ? ; let module = process . module_list ( ) ? . into_iter ( ) . find ( | m | m . base <= target_global && m . base + m . size > target_global ) . ok_or ( Error :: Other ( " " ) ) ? ; let mut image = vec ! [ 0 size kb ( 128 ) ] ; process . virt_mem . virt_read_raw_into ( module . base , & mut image ) . data_part ( ) ? ; let pefile = PeFile :: from_bytes ( & image ) . map_err ( | _ | Error :: Other ( " " ) ) ? ; const IMAGE_SCN_CNT_CODE : u32 = 0x20 ; let ranges : Vec < ( Address , usize ) > = pefile . section_headers ( ) . iter ( ) . filter ( | s | ( s . Characteristics & IMAGE_SCN_CNT_CODE ) != 0 ) . map ( | s | { ( module . base + s . VirtualAddress as usize , s . VirtualSize as usize , ) } ) . collect ( ) ; let mut bufs : Vec < ( Address , [ u8 ; MAX_SIG_LENGTH ] ) > = addrs . iter ( ) . map ( | & a | ( a , [ 0 ; MAX_SIG_LENGTH ] ) ) . collect ( ) ; let mut read_list : Vec < _ > = bufs . iter_mut ( ) . map ( | ( a , b ) | VirtualReadData ( * a , b ) ) . collect ( ) ; process . virt_mem . virt_read_raw_list ( & mut read_list ) . data_part ( ) ? ; let bitness = process . proc_info . proc_arch . bits ( ) . into ( ) ; let mut states : Vec < _ > = bufs . iter ( ) . map ( | ( start_ip , buf ) | { let mut decoder = Decoder :: new ( bitness , buf , DecoderOptions :: NONE ) ; decoder . set_ip ( start_ip . as_u64 ( ) ) ; Sigstate { start_ip : * start_ip , buf , decoder , instrs : vec ! [ ] , mask : vec ! [ ] , } } ) . collect ( ) ; let mut out = vec ! [ ] ; loop { let mut added = false ; for s in states . iter_mut ( ) { if s . add_single_instr ( ) { added = true ; } } if ! added || Self :: has_unique_matches ( & states , & mut process . virt_mem , & ranges , & mut out ) ? { break ; } } Ok ( out ) }
Find code signatures for the given target global.
Find code signatures for the given target global .
process
&mut Win32Process<impl VirtualMemory>
disasm
&Disasm
target_global
Address
process
&mut Win32Process<impl VirtualMemory>
disasm
&Disasm
target_global
Address