{

m_ulModule = ulModule;

m_ulBase = ulBase;

m_ulSize = ulSize;

{

Signature_t sig_t = {new unsigned char[iLength+1], ulAddr};

strcpy((char*) sig_t.m_szSignature, (char*) sigstr);

m_Signatures.push_back(sig_t);

{

PythonLog(4, "Searching for a cached signature...");

for (std::list<Signature_t>::iterator iter=m_Signatures.begin(); iter != m_Signatures.end(); ++iter)

{

Signature_t sig = *iter;

if (strcmp((const char *) sig.m_szSignature, (const char *) sigstr) == 0)

{

PythonLog(4, "Found a cached signature!");

result = new CPointer(sig.m_ulAddr);

return true;

}

}

PythonLog(4, "Could not find a cached signature.");

return false;

{

PythonLog(4, "Searching in the binary...");

CPointer* pPtr = FindSignatureRaw(oSignature);

if (pPtr->IsValid())

{

PythonLog(4, "Found a signature in the binary!");

AddSignatureToCache(sigstr, iLength, pPtr->m_ulAddr);

result = pPtr;

return true;

}

delete pPtr;

PythonLog(4, "Could not find the signature in the binary.");

return false;

{

CPointer* pPtr = FindSignatureRaw(oSignature);

if (!pPtr->IsValid())

{

PythonLog(4, "Could not find a hooked signature.");

delete pPtr;

return false;

}

PythonLog(4, "Found a hooked signature!");

PythonLog(4, "Checking if it's unique...");

// Add iLength, so we start searching after the match

CPointer new_ptr = CPointer(pPtr->m_ulAddr + len(oSignature));

// Got another match after the first one?

CPointer* pNext = new_ptr.SearchBytes(oSignature, (m_ulBase + m_ulSize) - new_ptr.m_ulAddr);

bool bIsValid = pNext->IsValid();

delete pNext;

if (bIsValid)

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Found more than one hooked signatures. Please pass more bytes.");

PythonLog(4, "Signature is unique!");

AddSignatureToCache(sigstr, iLength, pPtr->m_ulAddr);

result = pPtr;

return true;

{

dict result;

#ifdef _WIN32

PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER) m_ulModule;

if (dos_header->e_magic != IMAGE_DOS_SIGNATURE)

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Unable to retrieve DOS header.")

PIMAGE_NT_HEADERS nt_headers = (PIMAGE_NT_HEADERS) ((BYTE *) m_ulModule + dos_header->e_lfanew);

if (nt_headers->Signature != IMAGE_NT_SIGNATURE)

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Unable to retrieve NT headers.")

if (nt_headers->OptionalHeader.NumberOfRvaAndSizes <= 0)

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Invalid number of directories in the optional header.")

PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY) (

(BYTE *) m_ulModule

+ nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

if (exports->AddressOfNames == NULL)

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Address of names is NULL.")

BYTE** symbols = (BYTE**)(m_ulModule + exports->AddressOfNames);

for (DWORD i=0; i < exports->NumberOfNames; i++)

{

const char* name = (const char*) (m_ulModule + symbols[i]);

// TODO: Don't use GetProcAddress. There is probably a faster way

result[name] = CPointer((unsigned long) GetProcAddress((HMODULE) m_ulModule, name));

}

#elif __linux__

// TODO: Remove duplicated code. See also: FindSymbol()

struct link_map *dlmap;

struct stat dlstat;

int dlfile;

uintptr_t map_base;

Elf32_Ehdr *file_hdr;

Elf32_Shdr *sections, *shstrtab_hdr, *symtab_hdr, *strtab_hdr;

Elf32_Sym *symtab;

const char *shstrtab, *strtab;

uint16_t section_count;

uint32_t symbol_count;

dlmap = (struct link_map *) m_ulModule;

symtab_hdr = NULL;

strtab_hdr = NULL;

dlfile = open(dlmap->l_name, O_RDONLY);

if (dlfile == -1 || fstat(dlfile, &dlstat) == -1)

{

close(dlfile);

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Failed to open file.")

}

/* Map library file into memory */

file_hdr = (Elf32_Ehdr *)mmap(NULL, dlstat.st_size, PROT_READ, MAP_PRIVATE, dlfile, 0);

map_base = (uintptr_t)file_hdr;

close(dlfile);

if (file_hdr == MAP_FAILED)

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Failed to map file.")

if (file_hdr->e_shoff == 0 || file_hdr->e_shstrndx == SHN_UNDEF)

{

munmap(file_hdr, dlstat.st_size);

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "No section header string table has been found.")

}

sections = (Elf32_Shdr *)(map_base + file_hdr->e_shoff);

section_count = file_hdr->e_shnum;

/* Get ELF section header string table */

shstrtab_hdr = &sections[file_hdr->e_shstrndx];

shstrtab = (const char *)(map_base + shstrtab_hdr->sh_offset);

/* Iterate sections while looking for ELF symbol table and string table */

for (uint16_t i = 0; i < section_count; i++)

{

Elf32_Shdr &hdr = sections[i];

const char *section_name = shstrtab + hdr.sh_name;

if (strcmp(section_name, ".symtab") == 0)

symtab_hdr = &hdr;

else if (strcmp(section_name, ".strtab") == 0)

strtab_hdr = &hdr;

}

/* Uh oh, we don't have a symbol table or a string table */

if (symtab_hdr == NULL || strtab_hdr == NULL)

{

munmap(file_hdr, dlstat.st_size);

BOOST_RAISE_EXCEPTION(PyExc_ValueError, "No symbol table or string table found.")

}

symtab = (Elf32_Sym *)(map_base + symtab_hdr->sh_offset);

strtab = (const char *)(map_base + strtab_hdr->sh_offset);

symbol_count = symtab_hdr->sh_size / symtab_hdr->sh_entsize;

/* Iterate symbol table starting from the position we were at last time */

for (uint32_t i = 0; i < symbol_count; i++)

{

Elf32_Sym &sym = symtab[i];

unsigned char sym_type = ELF32_ST_TYPE(sym.st_info);

const char *sym_name = strtab + sym.st_name;

/* Skip symbols that are undefined or do not refer to functions or objects */

if (sym.st_shndx == SHN_UNDEF || (sym_type != STT_FUNC && sym_type != STT_OBJECT))

continue;

result[sym_name] = CPointer((unsigned long)(dlmap->l_addr + sym.st_value));

}

// Unmap the file now.

munmap(file_hdr, dlstat.st_size);

#else

#error Unsupported platform.

#endif

return result;

{

int stringlen = strlen(szString);

int suffixlen = strlen(szSuffix);

if (suffixlen > stringlen)

return false;

return strncmp(szString + stringlen - suffixlen, szSuffix, suffixlen) == 0;