(二)記憶體掃描器(面向物件版)

#pragma once
#include<Windows.h>
#include<iostream>
#include<vector>
using namespace std;

#define IS_IN_SEARCH(mb,offset) (mb->searchmask[(offset)/8] & (1<<((offset)%8)))
#define REMOVE_FROM_SEARCH(mb,offset) mb->searchmask[(offset)/8]&=~(1<<((offset)%8));
typedef struct _MEMBLOCK
{
	HANDLE hProcess;
	PVOID addr;
	int size;
	char* buffer;

	char* searchmask;//標志每一位元組的資料是否在搜索串列中
	int matches;	 //匹配的資料個數
	int data_size;   //資料大小(單位位元組)
	struct _MEMBLOCK* next;
}MEMBLOCK;

typedef struct _AddrValue
{
	PVOID addr;
	int val;
}AddrValue;

typedef enum
{
	COND_UNCONDITIONAL, //every bytes
	COND_EQUALS,		//bytes particular value
	COND_INCREASE,		//bytes value increased
	COND_DECREASE,		//bytes value decreased
}SEARCH_CONDITION;



class Scanner
{
	
public:
	~Scanner()
	{
		if (scan)  free_scan();
	}
	/*掃描*/
	bool first_scan(int pid, int data_size, int start_val, SEARCH_CONDITION start_cond = COND_EQUALS);
	void next_scan(int val, SEARCH_CONDITION condition = COND_EQUALS);

	/*記憶體讀寫*/
	void poke(PVOID addr, int val);
	int peek(PVOID addr);
	
	/*統計記憶體資料*/
	vector<AddrValue> get_data();//獲取滿足條件的記憶體地址及數值
	void print_matches(); //列印記憶體資料 (UI的不需要)
	int get_match_count();//獲取滿足條件的資料數量

private:
	/*單個記憶體塊*/
	MEMBLOCK* create_memblock(HANDLE hProcess, MEMORY_BASIC_INFORMATION* meminfo, int data_size);
	void update_memblock(MEMBLOCK* mb, SEARCH_CONDITION condition, int val);
	void free_memblock(MEMBLOCK* mb);

	/*所有記憶體塊*/
	MEMBLOCK* create_scan(int pid, int data_size);
	void update_scan(SEARCH_CONDITION condition, int val);
	void dump_scan_info();
	void free_scan();

private:
	MEMBLOCK* scan = NULL;//掃描器
	int data_size;		  //資料大小
	HANDLE hProcess;	  //當前行程句柄
};

#include"scanner.h"


MEMBLOCK* Scanner::create_memblock(HANDLE hProcess, MEMORY_BASIC_INFORMATION* meminfo, int data_size)
{
	MEMBLOCK* mb = (MEMBLOCK*)malloc(sizeof(MEMBLOCK));
	if (mb)
	{
		mb->hProcess = hProcess;
		mb->addr = meminfo->BaseAddress;
		mb->size = meminfo->RegionSize;
		mb->buffer = (char*)malloc(meminfo->RegionSize);

		//初始化搜索掩碼為0xff，表示每一個位元組都在搜索串列中
		mb->searchmask = (char*)malloc(meminfo->RegionSize / 8);
		memset(mb->searchmask, 0xff, meminfo->RegionSize / 8);

		mb->matches = meminfo->RegionSize;
		mb->data_size = data_size;
		mb->next = NULL;
	}

	return mb;
}

void Scanner::update_memblock(MEMBLOCK* mb, SEARCH_CONDITION condition, int val)
{
	static unsigned char tempbuf[128 * 1024];//0x20000
	unsigned int bytes_left;//當前未處理的位元組數
	unsigned int total_read;//已經處理的位元組數
	unsigned int bytes_to_read;
	SIZE_T bytes_read;

	if (mb->matches > 0)
	{
		bytes_left = mb->size;
		total_read = 0;

		mb->matches = 0;

		while (bytes_left)
		{
			bytes_to_read = (bytes_left > sizeof(tempbuf)) ? sizeof(tempbuf) : bytes_left;
			ReadProcessMemory(mb->hProcess, (LPCVOID)((SIZE_T)mb->addr + total_read), tempbuf, bytes_to_read, &bytes_read);
			//如果讀失敗了，則結束
			if (bytes_to_read != bytes_read) break;

			//條件搜索處
			if (condition == COND_UNCONDITIONAL)//無條件，則所有資料都匹配
			{
				memset(mb->searchmask + total_read / 8, 0xff, bytes_read / 8);
				mb->matches += bytes_read;
			}
			else//遍歷臨時buffer
			{
				for (int offset = 0; offset < bytes_read; offset += mb->data_size)
				{
					if (IS_IN_SEARCH(mb, (total_read + offset)))
					{
						BOOL is_match = FALSE;
						int temp_val;
						int prev_val;
						switch (mb->data_size)//獲取臨時數值的大小
						{
						case 1:
							temp_val = tempbuf[offset];
							prev_val = *((char*)&mb->buffer[total_read + offset]);
							break;
						case 2:
							temp_val = *((short*)&tempbuf[offset]);
							prev_val = *((short*)&mb->buffer[total_read + offset]);
							break;
						case 4:
						default:
							temp_val = *((int*)&tempbuf[offset]);
							prev_val = *((short*)&mb->buffer[total_read + offset]);
							break;
						}

						switch (condition)//根據不同搜索條件處理
						{
						case COND_EQUALS:
							is_match = (temp_val == val);
							break;
						case COND_INCREASE:
							is_match = (temp_val > prev_val);
							break;
						case COND_DECREASE:
							is_match = (temp_val < prev_val);
							break;
						default:
							break;
						}

						if (is_match)
						{
							mb->matches++;
						}
						else
						{
							REMOVE_FROM_SEARCH(mb, (total_read + offset));
						}
					}
				}
			}


			memcpy(mb->buffer + total_read, tempbuf, bytes_read);

			bytes_left -= bytes_read;
			total_read += bytes_read;
		}
		mb->size = total_read;

	}
}

void Scanner::free_memblock(MEMBLOCK* mb)
{
	if (mb)
	{
		if (mb->buffer)
		{
			free(mb->buffer);
		}
		if (mb->searchmask)
		{
			free(mb->searchmask);
		}
		free(mb);
	}
}


MEMBLOCK* Scanner::create_scan(int pid, int data_size)
{
	MEMBLOCK* mb_list = NULL;
	MEMORY_BASIC_INFORMATION meminfo;
	PVOID addr = 0;

	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
	if (hProcess)
	{
		while (1)
		{
			//查詢失敗，回傳
			if (!VirtualQueryEx(hProcess, addr, &meminfo, sizeof(meminfo)))
			{
				break;
			}
#define WRITABLE (PAGE_READWRITE|PAGE_WRITECOPY|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY)

			if ((meminfo.State & MEM_COMMIT) && (meminfo.Protect & WRITABLE))
			{
				MEMBLOCK* mb = create_memblock(hProcess, &meminfo, data_size);
				//頭插法將掃描的記憶體塊存入記憶體塊串列中
				if (mb)
				{
					//update_memblock(mb);
					mb->next = mb_list;
					mb_list = mb;
				}
			}

			addr = (LPVOID)((SIZE_T)meminfo.BaseAddress + meminfo.RegionSize);
		}
	}

	return mb_list;
}

void Scanner::update_scan(SEARCH_CONDITION condition, int val)
{
	MEMBLOCK* mb = scan;
	while (mb)
	{
		update_memblock(mb, condition, val);
		mb = mb->next;
	}
}

void Scanner::dump_scan_info()
{
	MEMBLOCK* mb = scan;
	while (mb)
	{
		//列印記憶體塊
		printf("0x%08x 0x%08x\r\n", mb->addr, mb->size);

		mb = mb->next;

		//列印記憶體塊中資料
		for (int i = 0; i < mb->size; i++)
		{
			printf("%02x ", mb->buffer[i]);
			if (i % 16 == 0) printf("\r\n");
		}
		printf("\r\n");
	}
}

void Scanner::free_scan()
{
	CloseHandle(scan->hProcess);
	while (scan)
	{
		MEMBLOCK* mb = scan;
		scan = scan->next;
		free_memblock(mb);
	}
}



int Scanner::peek(PVOID addr)
{
	int val = 0;
	if (!ReadProcessMemory(hProcess, addr, &val, data_size, NULL))
	{
		printf("peek failed\r\n");
	}
	return val;
}

void Scanner::poke(PVOID addr, int val)//寫記憶體
{
	if (!WriteProcessMemory(hProcess, addr, &val, data_size, NULL))
	{
		printf("poke failed\r\n");
	}
}

void Scanner::print_matches()
{
	vector<AddrValue> data = https://www.cnblogs.com/hanpto/archive/2023/03/22/get_data();
	for (int i = 0; i < data.size(); i++)
	{
		printf("0x%08x : %d\r\n", data[i].addr, data[i].val);
	}

}

vector<AddrValue> Scanner::get_data()
{
	vector<AddrValue> data;
	MEMBLOCK* mb = scan;
	while (mb)
	{
		for (int offset = 0; offset < mb->size; offset += mb->data_size)
		{
			if (IS_IN_SEARCH(mb, offset))
			{
				int val = peek((PVOID)((SIZE_T)mb->addr + offset));
				AddrValue temp;
				temp.addr = (PVOID)((SIZE_T)mb->addr + offset);
				temp.val = val;
				data.push_back(temp);
			}
		}
		mb = mb->next;
	}
	return data;
}

int Scanner::get_match_count()
{
	MEMBLOCK* mb = scan;
	int count = 0;
	while (mb)
	{
		count += mb->matches;
		mb = mb->next;
	}
	return count;
}


bool Scanner::first_scan(int pid, int _data_size, int start_val, SEARCH_CONDITION start_cond)
{
	data_size = _data_size;
	if (scan)
	{
		free_scan();
	}
	scan = create_scan(pid, data_size);
	
	if (scan)
	{
		update_scan(start_cond, start_val);
		return true;
	}
		
	else
		return false;
}
void Scanner::next_scan(int val, SEARCH_CONDITION condition)
{
	update_scan(condition, val);
}