Replies: 2 comments
-
The solution I have is this (requires C++20 due to the usage of std::optional<uint8_t> HexCharToByte(char c) noexcept
{
if (c >= '0' && c <= '9')
return c - '0';
if (c >= 'A' && c <= 'F')
return c - 'A' + 10;
if (c >= 'a' && c <= 'f')
return c - 'a' + 10;
return std::nullopt;
}
std::vector<std::optional<uint8_t>> ConvertToByteArray(std::string_view byteStr) {
if (byteStr.empty()) {
return {};
}
std::vector<std::optional<uint8_t>> result{};
const bool isCodeStyle = byteStr[0] == '\\';
const std::string_view pattern = isCodeStyle ? R"(\x)" : " ";
const std::string_view wildcard = isCodeStyle ? "2A" : "?";
auto split = std::views::split(byteStr, pattern);
for (auto&& str : split) {
if (str.empty()) {
continue;
}
// std::string_view(std::subrange) constructor only exists in C++23 or above
const std::string_view byte(str.begin(), str.end());
if (byte == wildcard) {
result.emplace_back(std::nullopt);
continue;
}
auto high = HexCharToByte(byte[0]);
auto low = HexCharToByte(byte[1]);
// if then is malformed, return nothing
// maybe print error message here?
if (!high.has_value() || !low.has_value()) [[unlikely]] {
return {};
}
result.emplace_back((high.value() << 4) | low.value());
}
return result;
} |
Beta Was this translation helpful? Give feedback.
0 replies
-
Closed by #407, thanks for the contribution 🧡 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Currently the FindSignature only supports the old-fashion
\x2A
as a wildcard. However, if a signature is outdated after an update, finding it in an old binary will need to remove all\
and replace2A
with?
and that will be tedious if there are a lot of outdated signature IMO.Since most signature-maker plugins like A200K/IDA-Pro-SigMaker and senator715/IDA-Fusion generate either IDA style (
48 89 1D ? ? ? ?
) or code stlye (\x48\x89\x1D\x00\x00\x00\x00
) with bitmask provided, to make compatible with current signature style will require to generate code style signature and replace\x00
with\x2A
or modify the plugin so it will generate signatures with\x2A
as wildcard, and both are a no-go IMO.I can make a pr if needed, please let me know :)
Beta Was this translation helpful? Give feedback.
All reactions