Signature scanning - Revision history

Nosoop: Add info on makesig

2018-08-16T12:14:35Z

Add info on makesig

2008-12-01T10:43:31Z

‎sigscan.h

2008-11-30T23:09:51Z

‎Finding the Signature of a Function

2007-10-06T04:59:08Z

2007-02-19T21:01:41Z

2006-03-24T07:56:09Z

‎See Also

2006-03-23T23:52:04Z

2006-03-18T05:05:48Z

2006-03-16T08:45:06Z

Changed calling sigscanned member functions to member function pointer syntax

2006-01-27T23:18:25Z

@@ Line 446: / Line 446: @@
 xxxxxxxxxxxxxxxxxxxxxxxxxx</pre>
 Now you have a nice signature and mask you can use for your sigscanner and it also gives you the length of the signature as well. Cheers!
 == Contributors ==

@@ Line 79: / Line 79: @@
      /* Public Functions */
-     CSigScan(void)sig_str(NULL), sig_mask(NULL), sig_len(0), sig_addr(NULL) {}
+     CSigScan(void): sig_str(NULL), sig_mask(NULL), sig_len(0), sig_addr(NULL) {}
      ~CSigScan(void);

@@ Line 289: / Line 289: @@
 To find a signature for a function, we need a Disassembler to disassemble the server module. Here are links to free Disassemblers that seem to work well:
-* [http://www.dirfile.com/ida_pro_freeware_version.htm IDA Pro Freeware Version (Windows)]
+* [http://www.hex-rays.com/idapro/idadownfreeware.htm IDA Pro Freeware Version (Windows)]
 * [http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html PEBrowse Professional (Windows)]
 * [http://pvdasm.reverse-engineering.net/index.php?Section=1 Proview “PVDasm” Disassembler (Windows)]

← Older revision		Revision as of 04:59, 6 October 2007
Line 1:		Line 1:
−	[[Category:~~Documentation (SourceMM)~~]]	+	[[Category:Metamod:Source Development]]

	== Introduction ==		== Introduction ==

@@ Line 289: / Line 289: @@
 To find a signature for a function, we need a Disassembler to disassemble the server module. Here are links to free Disassemblers that seem to work well:
-* [http://www.datarescue.com/idabase/idadown.htm IDA Pro Freeware Version (Windows)]
+* [http://www.dirfile.com/ida_pro_freeware_version.htm IDA Pro Freeware Version (Windows)]
 * [http://www.smidgeonsoft.prohosting.com/pebrowse-pro-file-viewer.html PEBrowse Professional (Windows)]
 * [http://pvdasm.reverse-engineering.net/index.php?Section=1 Proview “PVDasm” Disassembler (Windows)]

@@ Line 447: / Line 447: @@
 Now you have a nice signature and mask you can use for your sigscanner and it also gives you the length of the signature as well. Cheers!
-== Contributers ==
+== Contributors ==
 Thank you to those who contributed to this document directly and/or indirectly:
@@ Line 464: / Line 464: @@
 *<i>Introduction to Reverse Engineering Software</i> - http://www.acm.uiuc.edu/sigmil/RevEng/index.html
 *<i>The Art of Assembly Language Programming</i> - http://maven.smith.edu/~thiebaut/ArtOfAssembly/artofasm.html

← Older revision		Revision as of 05:05, 18 March 2006
Line 1:		Line 1:
−	[[Category:SourceMM]]	+	[[Category:Documentation (SourceMM)]]

	== Introduction ==		== Introduction ==

@@ Line 85: / Line 85: @@
      void Init(unsigned char *sig, char *mask, size_t len);
 };
 void InitSigs(void);
@@ Line 269: / Line 273: @@
          return ; // sigscan failed
-     #ifdef WIN32
+     union {
-    /* The first parameter takes a pointer to the object,
+        void (EmptyClass::*mfpnew)(float, bool, float, bool);
-       the second is just a (required) dummy parameter */
+        void* addr;
-    typedef void (__fastcall *func)(CBaseAnimating*, void*, float, bool, float, bool);
+     } u;
-    func thisfunc = (func)CBaseAnimating_Ignite_Sig.sig_addr; // Pointer to the function scanned from memory
+     u.addr = CBaseAnimating_Ignite_Sig.sig_addr;
-−
-    /* Pass "this" for the first parameter, and 0 for the second parameter */
+     (reinterpret_cast<EmptyClass*>(cba)->*u.mfpnew)(flFlameLifetime, (bool)bNPCOnly, flSize,
-    thisfunc(cba, 0, flFlameLifetime, (bool)bNPCOnly, flSize, (bool)bCalledByLevelDesigner);
+        (bool)bCalledByLevelDesigner);
-     return ;
+     return;
 }</cpp>
 This will find the signature of a function at runtime, however it is useless unless you already have or know how to find signatures for which it can scan.