Struct Pattern 

pub struct Pattern { /* private fields */ }

A byte pattern to find, where to look for it, and how to get from the match to the address wanted.

See the module docs for the syntax.

Examples

use imping_hook::scan::Pattern;

// The match starts four bytes into the function.
let function = Pattern::new("48 83 EC 20 33 DB").offset(-4).find()?;
// The function called at the match, in another module.
let callee = Pattern::new("E8 ?? ?? ?? ?? 48 8B D8")
    .in_module("engine.dll")
    .follow_call()
    .find()?;

Implementations

impl Pattern

pub fn new(pattern: &str) -> Self

Creates a pattern to find in the main module, such as "48 89 5C 24 ?? 57".

It’s parsed by find.

pub fn in_module(self, module: &str) -> Self

Searches a loaded module such as "engine.dll" instead of the main module.

pub fn offset(self, bytes: isize) -> Self

Moves the address this many bytes on from the start of the match, or back for a negative count.

pub fn follow_call(self) -> Self

Follows the call or jmp at the address to where it goes.

For a pattern that matches a call site rather than the function itself. The pattern must spell out the instruction’s E8 (call) or E9 (jmp) opcode at the offset, and cover its 4-byte displacement, which may be wildcards: "E8 ?? ?? ?? ?? 48 8B D8".

pub fn find(&self) -> Result<*const ()>

Finds the one place the pattern matches and returns the address it leads to.

The module must stay loaded while it’s searched.

Errors

• Error::InvalidPattern if the pattern can’t be parsed, or doesn’t spell out the call for follow_call.
• Error::PatternNotFound or Error::PatternNotUnique unless it matches exactly once.
• Error::ModuleNotFound if the module isn’t loaded.

Trait Implementations

impl Clone for Pattern

fn clone(&self) -> Pattern

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Pattern

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.