Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add signature scanning #58

Open
wants to merge 18 commits into
base: main
Choose a base branch
from
Open

Add signature scanning #58

wants to merge 18 commits into from

Conversation

Loomeh
Copy link
Collaborator

@Loomeh Loomeh commented Jul 11, 2024

This PR adds a signature scanning function to LibreSplit.

Signature scanning scans the process for a specific byte array and returns the address of where that byte array is located. This is useful for executables that are frequently updated.

The sig_scan function takes a string of an IDA-style byte array and can also take an integer offset as a second parameter.

Example:
signature = sig_scan("89 5C 24 ?? 89 44 24 ?? 74 ?? 48 8D 15", 4)

Returns:
14123ce19

Here is a small demo script for SPRAWL, which is game that uses signature scanning in its autosplitter:

process('Sprawl-Win64-Shipping.exe')

local featuretest = 0

function state()
    -- Perform the signature scan to find the initial address
    featuretest = sig_scan("89 5C 24 ?? 89 44 24 ?? 74 ?? 48 8D 15", 4)

    if featuretest == 0 then
        print("Signature scan did not find the address.")
    else
        -- Read an integer value from the found address
        local readValue = readAddress('int', 'Sprawl-Win64-Shipping.exe', featuretest)
        print("Feature test address: ", featuretest)
        print("Read value: ", readValue)
    end
end

@EXtremeExploit
Copy link
Collaborator

what did you do to docs?? 😭

@Loomeh
Copy link
Collaborator Author

Loomeh commented Jul 11, 2024

I used a website for editing the Markdown file, I guess it screwed up the formatting 😭

Copy link
Collaborator

@EXtremeExploit EXtremeExploit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 small (big) bug

src/signature.c Outdated Show resolved Hide resolved
src/signature.c Outdated Show resolved Hide resolved
@Loomeh
Copy link
Collaborator Author

Loomeh commented Jul 14, 2024

@EXtremeExploit I think I've fixed this in my latest commit? I ran with your idea of turning it into a uint16_t. An FF byte in the string should now be converted to 0x00FF and an ?? byte in the string should be converted to 0xFF00. A pretty big oversight and I'm surprised I didn't catch it, sorry :(

@EXtremeExploit
Copy link
Collaborator

Would also be cool to also add the example you provided in the PR comment on the docs, just a thought i had while reviewing

@Loomeh
Copy link
Collaborator Author

Loomeh commented Jul 14, 2024

Would also be cool to also add the example you provided in the PR comment on the docs, just a thought i had while reviewing

Done :)

src/signature.c Outdated
free(pattern);
free(regions);

lua_pushstring(L, hex_str); // Push the hexadecimal string onto the Lua stack
Copy link
Collaborator

@EXtremeExploit EXtremeExploit Jul 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Im kinda confused, the function returns a string that contains the address in hexadecimal, but the result in the example is used as an argument for readAddress which accepts numbers, not strings. Is it casting it to a number by some miracle?

-- Perform the signature scan to find the initial address
featuretest = sig_scan("89 5C 24 ?? 89 44 24 ?? 74 ?? 48 8D 15", 4)

if featuretest == 0 then
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same problem here, this will NEVER be true (if sig_scan returns "0")
image

Copy link
Collaborator

@EXtremeExploit EXtremeExploit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Im a bit confused, i could be wrong or right and sig_scan has to return a number

@Loomeh
Copy link
Collaborator Author

Loomeh commented Jul 14, 2024

Im a bit confused, i could be wrong or right and sig_scan has to return a number

@EXtremeExploit Lua seems to automatically handle the conversion of hexadecimal strings to numbers.

Example:

current.isLoading = readAddress('bool', "0x58FAAC")

I replaced the hex number in this line in the Jet Set Radio autosplitter with a string representation of the same hex number, and it still worked perfectly fine.

I think it would be better to just leave the conversion to Lua as trying to do it in C can lead to lots of unnecessary complications (with hex numbers containing letters and whatnot).

I'll add a note in the documentation about this to prevent any confusion.

@EXtremeExploit
Copy link
Collaborator

EXtremeExploit commented Jul 14, 2024

I replaced the hex number in this line in the Jet Set Radio autosplitter with a string representation of the same hex number, and it still worked perfectly fine.

does it still work if you remove the "0x"? beause thats what sig_func is returning, if it works fine then i think it can get approved.
My guess is that it works because you specifically specified the 0x saying the string is a hexadecimal number, but without it it would treat it as a base10 number

i asked wins1ey and told me to just approve it and not merge it yet because of the other open PR if thats fine

@IogaMaster
Copy link

Any update?

@Loomeh
Copy link
Collaborator Author

Loomeh commented Jul 31, 2024

It seems like Lua only recognizes hexadecimal numbers if they're prefixed with "0x", so I've modified the code to prefix the found address with "0x" and I've changed it so that it returns a string instead of an integer.

EXtremeExploit
EXtremeExploit previously approved these changes Aug 2, 2024
Copy link
Collaborator

@EXtremeExploit EXtremeExploit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm. i will wait for wins1ey to merge

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants