[mac] Pattern Finder - Help needed

[Tanaris4]

I've been modeling my pattern finder after the version posted here written in C. (Sorry I don't have a link the thread, but it's here: http://tanaris4.ampaste.net/f26f65cab )

Basically It's not ever returning the correct offset and I'm COMPLETELY stumped as to why. I'm using the PatternMaker IDA plugin to actually pull the patterns/masks from the mac wow executable. Then of course I simple execute dumpOffsets and the data returned is never correct, generally just 0x0. It doesn't find them in memory and I'm not sure why.

Sorry it's in objective-C, but I don't think anyone should have any issues taking a look at it (as it's basically C). Ignore the memory reading parts to memoryChunk, there shouldn't be any issues there.

OffsetController.m - pocketgnome - Project Hosting on Google Code

Thanks in advance, and sorry it's messy, I'll clean it up when it actually works.

[flo8464]

II'm using the PatternMaker IDA plugin to actually pull the patterns/masks from the mac wow executable.

Sorry I don't know a solution for your problem yet, but could give me a link to that lugin? Sounds interesting.

[Tanaris4]

Here is the IDA Plugin: http://dump.ifeedr.com/PatternMaker.zip

ALL credits go to ostapus, I didn't create it by any means hah.

Just dump it into your plugins folder in IDA Pro

Anyone have any ideas on the original post? Hate that it's not working, it should just work via memory reads right?

[Tanaris4]

Anyone have any ideas here? :-( Really struggling on dynamically finding these offsets

[flo8464]

Thanks for the link at first, +rep for that, takes away a bunch of work for me.

To your problem, why don't you just copy a chunk of memory from your target process using ReadProcessMemory, parse that chunk like the C-function does and if nothing is found copy next chunk?
Or don't you have pointers in objective-C? (I read anything about that)

[Tanaris4]

Thanks for the link at first, +rep for that, takes away a bunch of work for me.

To your problem, why don't you just copy a chunk of memory from your target process using ReadProcessMemory, parse that chunk like the C-function does and if nothing is found copy next chunk?
Or don't you have pointers in objective-C? (I read anything about that)

This is what the code does, I just copy a chunk of memory, then loop through it comparing bytes

[vulcanaoc]

Regular expressions

[Tanaris4]

Regular expressions

why would that be any more efficient than a byte by byte comparison? Also that's not the point - as I'm sure I'd run into the exact same problem I'm having now :/

[vulcanaoc]

why would that be any more efficient than a byte by byte comparison? Also that's not the point - as I'm sure I'd run into the exact same problem I'm having now :/

Because using a regular expression library would replace your (possibly) buggy pattern searching code. Additionally, certain implementations could perform faster on average than the linear search that you're doing. Otherwise- debug, debug, debug.

[Tanaris4]

I was using the exact same functions that others were using, so that's why i don't think the problem is in the searching.