Tutorial Fast Pattern Scanner (Signature Scanning with Wildcards) in C++ - UnreliableCode Forums

SigScannerPro

Pattern Scanning & IDA

MEMBER

Rep: 210

Join Date: Jul 2023

Posts: 25

Thanks: 52

2y ago · Dec 15, 2023 6:30 PM

#1

Here is a lightweight, modern C++ IDA-style pattern scanner that parses signatures with

CODE

and

CODE

??

wildcards at runtime into a fast vector mask:

CPP

#include <windows.h>
#include <vector>
#include <sstream>

uintptr_t PatternScan(uintptr_t moduleBase, size_t moduleSize, const char* signature) {
    std::vector<int> patternBytes;
    std::stringstream ss(signature);
    std::string byteStr;
    
    while (ss >> byteStr) {
        if (byteStr == "?" || byteStr == "??") {
            patternBytes.push_back(-1); // Wildcard
        } else {
            patternBytes.push_back(std::stoi(byteStr, nullptr, 16));
        }
    }
    
    const uint8_t* scanBytes = reinterpret_cast<const uint8_t*>(moduleBase);
    const size_t patternSize = patternBytes.size();
    
    for (size_t i = 0; i < moduleSize - patternSize; ++i) {
        bool found = true;
        for (size_t j = 0; j < patternSize; ++j) {
            if (patternBytes[j] != -1 && scanBytes[i + j] != static_cast<uint8_t>(patternBytes[j])) {
                found = false;
                break;
            }
        }
        if (found) return moduleBase + i;
    }
    return 0;
}

Usage Example:

CPP

uintptr_t fnAddr = PatternScan(base, size, "48 89 5C 24 ? 48 89 74 24 ? 57 48 83 EC 30");

Here is a lightweight, modern C++ IDA-style pattern scanner that parses signatures with [code]? [/code] and [code]??[/code] wildcards at runtime into a fast vector mask:

[code=cpp]#include <windows.h>
#include <vector>
#include <sstream>

uintptr_t PatternScan(uintptr_t moduleBase, size_t moduleSize, const char* signature) {
    std::vector<int> patternBytes;
    std::stringstream ss(signature);
    std::string byteStr;
    
    while (ss >> byteStr) {
        if (byteStr == "?" || byteStr == "??") {
            patternBytes.push_back(-1); // Wildcard
        } else {
            patternBytes.push_back(std::stoi(byteStr, nullptr, 16));
        }
    }
    
    const uint8_t* scanBytes = reinterpret_cast<const uint8_t*>(moduleBase);
    const size_t patternSize = patternBytes.size();
    
    for (size_t i = 0; i < moduleSize - patternSize; ++i) {
        bool found = true;
        for (size_t j = 0; j < patternSize; ++j) {
            if (patternBytes[j] != -1 && scanBytes[i + j] != static_cast<uint8_t>(patternBytes[j])) {
                found = false;
                break;
            }
        }
        if (found) return moduleBase + i;
    }
    return 0;
}[/code]

[b]Usage Example:[/b]
[code=cpp]uintptr_t fnAddr = PatternScan(base, size, "48 89 5C 24 ? 48 89 74 24 ? 57 48 83 EC 30");[/code]

SigScannerPro · Pattern scanning & Byte masking

The following users thanked SigScannerPro for this post:

AsmDisasm

x86_64 Disassembler Dev

MEMBER

Rep: 145

Join Date: Feb 2025

Posts: 23

Thanks: 36

2y ago · Dec 15, 2023 8:12 PM

#2

Nice and clean! If scanning large multi-gigabyte modules (like game executables), pre-filtering with the first non-wildcard byte or using SIMD

CPP

_mm_cmpeq_epi8

can boost scanning speeds by over 10x.

AsmDisasm · Zydis & Opcode Length Disassembly

NullPtr_

Assembly & Engine Research

MEMBER

Rep: 260

Join Date: May 2023

Posts: 27

Thanks: 62

2y ago · Dec 16, 2023 2:40 AM

#3

Using this in my SDK initializer now. Works great across updates without hardcoding absolute RVA offsets!

NullPtr_ · 0xDEADBEEF was here

UnreliableCode Community

Fast Pattern Scanner (Signature Scanning with Wildcards) in C++

Create Forum Thread

Add Reputation