registry.h 1.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. #pragma once
  2. #include <cstddef>
  3. #include <span>
  4. #include <string_view>
  5. namespace sunrise::client::patterns {
  6. /** One exact or wildcard byte in a compiled signature. */
  7. struct PatternByte {
  8. std::byte value{};
  9. bool exact{};
  10. };
  11. /** Named byte signature resolved against executable image ranges. */
  12. struct Pattern {
  13. std::string_view name;
  14. std::span<const PatternByte> bytes;
  15. };
  16. /** How many times one signature matched. */
  17. enum class MatchStatus : unsigned char {
  18. invalid,
  19. missing,
  20. unique,
  21. ambiguous,
  22. };
  23. /** Resolution status and unique address for one signature. */
  24. struct Match {
  25. MatchStatus status{MatchStatus::invalid};
  26. std::byte* address{};
  27. };
  28. /** One mapped executable range eligible for signature scans. */
  29. struct ImageRange {
  30. std::span<std::byte> bytes;
  31. };
  32. /** Resolves every registered pattern against one executable range. */
  33. [[nodiscard]] bool resolve_all(std::span<std::byte> image,
  34. std::span<const Pattern> patterns,
  35. std::span<Match> matches) noexcept;
  36. /** Resolves every pattern across disjoint executable image ranges. */
  37. [[nodiscard]] bool resolve_all(std::span<const ImageRange> image,
  38. std::span<const Pattern> patterns,
  39. std::span<Match> matches) noexcept;
  40. /**
  41. * Collects bounded matches for one signature that is expected to repeat.
  42. * Use this only where several matches are the evidence; single targets use resolve_all.
  43. * @param image Executable ranges to scan in address order.
  44. * @param output Fixed storage receiving match addresses in address order.
  45. * @return Number of addresses written, capped at the output size.
  46. */
  47. [[nodiscard]] std::size_t collect_matches(std::span<const ImageRange> image,
  48. const Pattern& pattern,
  49. std::span<std::byte*> output) noexcept;
  50. } // namespace sunrise::client::patterns