VB.net只需要32个字节就可以搜索

时间:2016-04-29 22:51:08

标签: vb.net bytearray wildcard

这是一个在字节数组中搜索字节模式(在进程内存中)的函数。 其中SearchFor是要查找的字节数组。 SearchInReadProcessMemory外部函数转储的字节数组。这也是使用通配符"?"完成的。

问题是如果字节模式长度小于或等于32,它将搜索。否则返回intptr.zero。我不知道为什么。

Private Function WildCard(ByVal SearchIn As Byte(), ByVal SearchFor As Byte()) As IntPtr
        Dim l As Integer = 0, m = 0
        Dim iEnd As Integer = SearchFor.Length
        Dim sBytes As Integer() = New Integer(&H100 - 1) {}
        Dim i As Integer
        For i = 0 To iEnd - 1
            If (SearchFor(i) = &H3F) Then
                l = (l Or (CInt(1) << ((iEnd - i) - 1)))
            End If
        Next i
        If (l <> 0) Then
            Dim j As Integer
            For j = 0 To sBytes.Length - 1
                sBytes(j) = l
            Next j
        End If
        l = 1
        Dim index As Integer = (iEnd - 1)
        Do While (index >= 0)
            sBytes(SearchFor(index)) = (sBytes(SearchFor(index)) Or l)
            index -= 1
            l = (l << 1)
        Loop
        Do While (m <= (SearchIn.Length - SearchFor.Length))
            l = (SearchFor.Length - 1)
            Dim length As Integer = SearchFor.Length
            Dim k As Integer = -1
            Do While (k <> 0)
                k = (k And sBytes(SearchIn((m + l))))
                If (k <> 0) Then
                    If (l = 0) Then
                        Return New IntPtr(m)
                    End If
                    length = l
                End If
                l -= 1
                k = (k << 1)
            Loop
            m = (m + length)
        Loop
        Return IntPtr.Zero
    End Function

0 个答案:

没有答案