-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add signature scanning #58
base: main
Are you sure you want to change the base?
Conversation
what did you do to docs?? 😭 |
I used a website for editing the Markdown file, I guess it screwed up the formatting 😭 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
1 small (big) bug
@EXtremeExploit I think I've fixed this in my latest commit? I ran with your idea of turning it into a uint16_t. An FF byte in the string should now be converted to 0x00FF and an ?? byte in the string should be converted to 0xFF00. A pretty big oversight and I'm surprised I didn't catch it, sorry :( |
Would also be cool to also add the example you provided in the PR comment on the docs, just a thought i had while reviewing |
Done :) |
src/signature.c
Outdated
free(pattern); | ||
free(regions); | ||
|
||
lua_pushstring(L, hex_str); // Push the hexadecimal string onto the Lua stack |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Im kinda confused, the function returns a string that contains the address in hexadecimal, but the result in the example is used as an argument for readAddress which accepts numbers, not strings. Is it casting it to a number by some miracle?
-- Perform the signature scan to find the initial address | ||
featuretest = sig_scan("89 5C 24 ?? 89 44 24 ?? 74 ?? 48 8D 15", 4) | ||
|
||
if featuretest == 0 then |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Im a bit confused, i could be wrong or right and sig_scan has to return a number
@EXtremeExploit Lua seems to automatically handle the conversion of hexadecimal strings to numbers. Example: current.isLoading = readAddress('bool', "0x58FAAC") I replaced the hex number in this line in the Jet Set Radio autosplitter with a string representation of the same hex number, and it still worked perfectly fine. I think it would be better to just leave the conversion to Lua as trying to do it in C can lead to lots of unnecessary complications (with hex numbers containing letters and whatnot). I'll add a note in the documentation about this to prevent any confusion. |
does it still work if you remove the "0x"? beause thats what sig_func is returning, if it works fine then i think it can get approved. i asked wins1ey and told me to just approve it and not merge it yet because of the other open PR if thats fine |
Any update? |
It seems like Lua only recognizes hexadecimal numbers if they're prefixed with "0x", so I've modified the code to prefix the found address with "0x" and I've changed it so that it returns a string instead of an integer. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm. i will wait for wins1ey to merge
This PR adds a signature scanning function to LibreSplit.
Signature scanning scans the process for a specific byte array and returns the address of where that byte array is located. This is useful for executables that are frequently updated.
The
sig_scan
function takes a string of an IDA-style byte array and can also take an integer offset as a second parameter.Example:
signature = sig_scan("89 5C 24 ?? 89 44 24 ?? 74 ?? 48 8D 15", 4)
Returns:
14123ce19
Here is a small demo script for SPRAWL, which is game that uses signature scanning in its autosplitter: