#include // Precompile header #define IsAddressValid(p) (IsBadReadPtr((PVOID)p, 1) == false) //**************************************************************************** // --- FindCodeByTemplate --- // // Purpose: Find code by template. // Input: LPBYTE p1 - Start address // UINT len1 - Maximal size // WORD * p2 - Address of template // UINT len2 - Length of template // Output: LPBYTE - Address of code matches the template or NULL // Written: by Eduard Mishkurov 28.04.2000 //**************************************************************************** LPBYTE FindCodeByTemplate(LPBYTE p1, UINT len1, WORD * p2, UINT len2) { for (; len2 && HIBYTE(*p2); len2--, p2++) ; LPBYTE lpPos = p1; for (UINT i = 0; i < len1; i++) { if (len1 - i < len2) break; LPBYTE lpSrc = &lpPos[i]; if (IsAddressValid(lpSrc)) { WORD * lpDst = p2; UINT j = 0; for (j = 0; j < len2 && j + i < len1; j++, lpSrc++, lpDst++) { if (HIBYTE(*lpDst)) continue; else if (!IsAddressValid(lpSrc) || *lpSrc != LOBYTE(*lpDst)) break; } if (j == len2) return &lpPos[i]; } } return NULL; }