How to find a sequence of bytes on the target program from my injected dll?

22 Views Asked by At

I'm developing a DLL that is injected into a process and uses some memory addresses. My idea is that my DLL finds and updates those addresses automatically, as I have the patterns and I can find them perfectly in IDA with Search -> Sequence of bytes...

enter image description here

As you can see it finds the sequence of bytes with wildcards

enter image description here

Now, I'm trying to replicate this IDA functionality in my DLL.

What I've tried so far in my code is the following:

uintptr_t mainModule = NULL;
DWORD WINAPI MainFunc(HMODULE hModule) {
    AllocConsole();
    FILE* f;
    freopen_s(&f, "CONOUT$", "w", stdout);

    mainModule = (uintptr_t)GetModuleHandle(L"client.dll");
    if (hModule)
    {
        if (GetPatterns()) while (true) Sleep(1);    
    }
    else
    {
        std::cout << "Main module not found, press ENTER to exit..." << std::endl;
        getchar();
    }

    fclose(f);
    FreeConsole();
    FreeLibraryAndExitThread(hModule, 0);
    return 0;
}

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CloseHandle(CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)MainFunc, hModule, 0, nullptr));
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

bool Compare(const BYTE* pData, const BYTE* pMask, const char* pszMask) {
    for (; *pszMask; ++pszMask, ++pData, ++pMask) {
        if (*pszMask == 'x' && *pData != *pMask) {
            return false;
        }
    }
    return (*pszMask) == NULL;
}

uintptr_t FindPattern(uintptr_t dwAddress, DWORD dwLen, BYTE* bMask, const char* szMask) {
    for (DWORD i = 0; i < dwLen; i++)
        if (Compare((BYTE*)(dwAddress + i), bMask, szMask))
            return (uintptr_t)(dwAddress + i);
    return 0;
}

MODULEINFO mInfo;
bool GetPattern(BYTE pattern[], const char* mask)
{
    DWORD foundAddress = FindPattern(mainModule, mInfo.SizeOfImage, pattern, mask);

    if (foundAddress != 0) {
        std::cout << "Found pattern at: 0x" << std::hex << foundAddress << std::endl;
        return true;
    }
    
    std::cout << "Error: pattern not found" << std::endl;
    return false;
}

bool GetPatterns()
{
    if (GetModuleInformation(GetCurrentProcess(), (HMODULE)mainModule, &mInfo, sizeof(mInfo))) {
        BYTE pattern[] = { 0x48, 0x8B, 0x05, 0x00, 0x00, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x74, 0x00, 0x8B, 0x88 };
        const char* mask = "xxx????xxxx?xx";
        if (!GetPattern(pattern, mask)) return false;
    }
    else {
        std::cout << "Error: unable to get module info" << std::endl;
        return false;
    }

    return true;
}

And I'm getting an address as output Found pattern at: 0xcae401b0 that takes to nowhere:

enter image description here

(Trying client.dll + the output address but also takes to nowhere)

1

There are 1 best solutions below

0
kuhi On

Solved :)

Changing this line:

DWORD foundAddress = FindPattern(mainModule, mInfo.SizeOfImage, pattern, mask);

To this:

uintptr_t foundAddress = FindPattern(mainModule, mInfo.SizeOfImage, pattern, mask);