[Contest] Do a cool engine hack or usage sample and win a T-shirt!

Some time ago i implemented my own pattern search that worked with patterns provided in c string like ?00 ?? 12 0C 2D Huh?

. TitanEngine however uses patterns provided in byte arrays, and you have to manually set wildcard byte. I noticed that function Find is just a mirror of FindEx. As Ex functions are always more powerful, Find had to be simplified, thats what i did. My modification of that function does not accept length of pattern and wildcard any more, and instead of byte array you have to provide c string pattern. Function allocates a temporary WORD array, then converts textual representation of bytes to numbers and stores in array. ?? are stored as 0?3F3F. Now you can see why temporary array is needed - to store wildcards. Next step is to discover which byte of 0-0xFF is not used in pattern, and use it as a wildcard. When that is figured out - bytes in WORD array are copied to BYTE array, and wildcard 0?3F3F WORD is replaced with previously discovered wildcard byte. This function has one flaw tho - it comes from and engine itself. If you happen to use all 256 possible bytes in pattern you will run out of possible candidates for wildcard, then 0?00 will be used as a wildcard and 0?00 will not be matched in pattern. But hey, who makes patterns that long and difficult? I doubt anyone does? So this is a flaw in theory only i guess.

Replace function Find in UnpackerEngine.cpp with:

Code:

__declspec(dllexport) long long __stdcall Find(LPVOID MemoryStart, DWORD MemorySize, LPCSTR SearchPattern){

DWORD PatternSize = (strlen(SearchPattern) + 1) / 3;
BYTE WildCard = 0;
WORD* WordPattern = new WORD[PatternSize];
BYTE* BytePattern = new BYTE[PatternSize];

for (DWORD i = 0; i < PatternSize; i++)
{
PCHAR Num = (PCHAR)(SearchPattern + i * 3);

if(*(PWORD)Num == (WORD)0x3F3F) // ??
WordPattern[i] = (WORD)0x3F3F;
else
WordPattern[i] = (WORD)strtol(Num, 0, 16);
}

for (BYTE i = 0; i <= 0xFF; i++)
{
for (DWORD j = 0; j < PatternSize; j++)
{
if (WordPattern[j] == i)
break;

if(j == PatternSize - 1)
WildCard = i;
}
}

for (DWORD i = 0; i < PatternSize; i++)
{
if(WordPattern[i] == 0x3F3F)
WordPattern[i] = WildCard;
else
BytePattern[i] = (BYTE)WordPattern[i];
}

delete[] WordPattern;

long long Return = FindEx(dbgProcessInformation.hProcess, MemoryStart, MemorySize, BytePattern, PatternSize, &WildCard);

delete[] BytePattern;

return Return;
}

Replace function declaration in SDK.h with:

Code:

__declspec(dllexport) long long __stdcall Find(LPVOID MemoryStart, DWORD MemorySize, LPCSTR SearchPattern);