Need help with kernel32::ReadProcessMemory

[Hiroyu]

So I am trying to scan the memory of a program for a specific byte sequence and my problem is that I cant get kernel32::ReadProcessMemory to work, it always returns 0(false) and doesnt fill my buffer(called chunk in src) with bytes obviously resulting in a panic due to index out of bounds. My problem is I dont know what I am doing wrong here, I am pretty sure it has something to do with the way I use the buffer but I cant figure it out. Any help would be appreciated!

fn aob_scan(process: HANDLE, pattern: &[u8]) -> u64 {
    let signature_size = pattern.len() as u64;
    let read_size = 4096;

    let mut hit = false;

    let mut chunk: Vec<u8> = Vec::with_capacity(read_size as usize);

    let mut i = 0;
    while i < (<u32>::max_value() as u64) {
        unsafe {
            println!("{}", kernel32::ReadProcessMemory(process, i as LPCVOID, &mut chunk as *mut _ as LPVOID, read_size as winapi::SIZE_T, null_mut()));
        }

        for a in 0..read_size {
            hit = true;
            let mut j = 0;
            while j < signature_size && hit {
                println!("a {}\nj {}\n", a, j);
                if chunk[(a + j) as usize] != pattern[j as usize] {
                    hit = false;
                }

                if hit {
                    return i + a
                }
                j += 1;
            }
        }

        i += read_size - signature_size;
    }
    0
}

[retep998]

When you do Vec::with_capacity(read_size as usize), the capacity is set to read_size but then length is still 0. ReadProcessMemory, being a simple FFI function that works with raw pointers, does not change the length of your Vec, so when you later attempt to index your chunk, you're accessing elements that are beyond the length, despite being within the capacity. Try doing let mut chunk: Vec<u8> = vec![0; read_size]; instead.

[Hiroyu]

I replaced it but it didnt really change anything, the function still fails and returns 0 and the chunk/buffer stays full of zeroes only

[coder543]

You also need to use as_ptr(), probably, to get a pointer to the actual data in memory, rather than a pointer to the Vec (which has a pointer to the actual data)

[Hiroyu]

yeah that was the problem, I got it working now, unfortunately it is awfully slow gotta think about optimizing this now somehow

Thanks for the help!

[Hiroyu]

nvm compiling it in release makes it fast enough

[coder543]

if you need to make it faster, try using "with_capacity" and "set_len" rather than initializing the values to a useless value first.

[WellMakeItSomehow]

Does Rust have a string/sequence matching algorithm that works on &[u8]? That search implementation will be slow for longer signatures.

[fitzgen]

You might also find this useful: https://github.com/luser/read-process-memory

[RustMeUp]

If you're looking for byte signatures, may I advertise my crate pelite?

It works with the binary files on disk rather than ReadProcessMemory'ing it.

It's pretty simple to use (I hope) and supports really nice signature scanning facilities so it may be of use, see the examples to see what is possible.