FastScan

[[Beatrice]]

old version

 Spoiler

Hey, I've seen UDFs that scan the memory for a pattern but they've been slow since they also try to scan inaccessible pages. I have no idea why this hasn't been posted yet but I wrote an edit of some public pattern scan function (credits? probably nomad) that skips pages with Free state and PAGE_NOACCESS using VirtualQueryEx.

FastScan
1.82 seconds

_MemoryScan
35.001 seconds

Obviously the difference probably will not be this tremendous in actual use, it depends on how your process maps pages and the address you're scanning; nevertheless it should be faster.

I rewrote somewhat the same code in C and used it as shellcode to achieve much faster scans.

Code:

 Spoiler

...
$dwInit = InitializeScanner()
$iResult = ScanPattern($dwInit,$hProcess,"8b??558bec83ec145633f657397508","x?xxxxxxxxxxxxx")

Func InitializeScanner()
	; Create structures
	Local $dwSearch = _MemVirtualAlloc(Null, 405, $MEM_COMMIT, $PAGE_EXECUTE_READWRITE)
	Local $dwScan_Memory = _MemVirtualAlloc(Null, 291, $MEM_COMMIT, $PAGE_EXECUTE_READWRITE)
	$struct_Search = DllStructCreate("Byte[405]",$dwSearch)
	$struct_Scan_Memory = DllStructCreate("Byte[291]",$dwScan_Memory)
	; Get external symbols
	$hUcrtbase = _WinAPI_GetModuleHandle("ucrtbase.dll")
	$hKernel32 = _WinAPI_GetModuleHandle("kernel32.dll")
	$dwStrlen = _WinAPI_GetProcAddress($hUcrtbase,"strlen")
	$dwStrtol = _WinAPI_GetProcAddress($hUcrtbase,"strtol")
	$dwmalloc = _WinAPI_GetProcAddress($hUcrtbase,"malloc")
	$dwfree = _WinAPI_GetProcAddress($hUcrtbase,"free")
	$dwGetSystemInfo = _WinAPI_GetProcAddress($hKernel32,"GetSystemInfo")
	$dwVirtualQueryEx = _WinAPI_GetProcAddress($hKernel32,"VirtualQueryEx")
	$dwReadProcessMemory = _WinAPI_GetProcAddress($hKernel32,"ReadProcessMemory")

	; Construct Scan_Memory - called by Search function
	$sBytes = Calculate($dwScan_Memory, _
	"0x558BEC83EC488B4518890424E8|" & $dwmalloc & "|8945E88D45E4894424108B45188944240C8B45E8894424088B450C894424048B4508890424B8-" & $dwReadProcessMemory _
	& "-FFD083EC1485C075190F1F40008B45E8890424E8|" & $dwfree _
	& "|B800000000E9C4000000C745F400000000E99C000000C745F001000000C745EC00000000EB560F1F008B55148B45EC01D00FB6003C7875330F1F40008B55F48B45EC01C28B45E801D00FB6108B4D108B45EC01C80FB60038C274100F1F4000C745F000000000EB240F1F008B55148B45EC01D00FB6003C3F8345EC018B4514890424E8|" & $dwStrlen _
	& "|3945EC729D837DF000741C0F1F40008B45E8890424E8|" & $dwfree & "|8B550C8B45F401D0EB230F1F008345F4018B45E43945F40F8258FFFFFF8B45E8890424E8|" & $dwfree & "|B800000000C9C3")
	DllStructSetData($struct_Scan_Memory,1,"0x" & $sBytes)

	; Construct Search - queries appropriate memory pages and passes arguments to Scan_Memory
	$sBytes = Calculate($dwSearch, _
	"0x558BEC5381EC940000008BC48BD88B4510890424E8|" & $dwStrlen _
	& "|8945E88B45E88BD083EA018955E4BA1000000083EA0101D0B910000000BA00000000F7F16BC01029C48D44241483C0008945E0C745F400000000EB530F1F008B45F401C08BD08B450C01D00FB6008845D68B45F401C08D50018B450C01D00FB6008845D7C744240810000000C7442404000000008D45D6890424E8|" _
	& $dwStrtol & "|8BC88B55E08B45F401D088088345F4018B45F43B45E872A88B45108945DC8D45B0890424B8-"& $dwGetSystemInfo _
	& "-FFD083EC048B45B88945F08B45BC8945D8E9A2000000C744240C1C0000008D4594894424088B45F0894424048B4508890424B8-" & $dwVirtualQueryEx _
	& "-FFD083EC1085C0750E0F1F4000B800000000E97F0000008B45948945F08B45A00145F08B45A43D0010000075540F1F40008B45A83D0001000074460F1F40008B45A83DFF00000077380F1F40008B55A08B4594895424108B55DC8954240C8B55E089542408894424048B4508890424E8|" _
	& $dwScan_Memory & "|8945EC837DEC0075150F1F40008B45F03B45D80F8252FFFFFFEB040F1F00908B45EC8BE38B5DFCC9C3")
	DllStructSetData($struct_Search,1,"0x" & $sBytes)
	; Return Search function base to call
	Return $dwSearch
EndFunc



Func ScanPattern($dwFuncAddress,$hHandle,$sPattern,$sMask)
	; Create structures
	$struct_DummyCall = DllStructCreate("Byte[29]")
	$dwDummyCall = DllStructGetPtr($struct_DummyCall)
	$struct_Pattern = DllStructCreate("char[" & StringLen($sPattern)+1 &"]") ; +1 in length to get null terminated string
	$struct_Mask = DllStructCreate("char[" & StringLen($sMask)+1 &"]")
	$struct_Result = DllStructCreate("long")
	DllStructSetData($struct_Pattern,1,$sPattern)
	DllStructSetData($struct_Mask,1,$sMask)

	; Construct a dummy call to avoid stack complications
	$sBytes = Calculate($dwDummyCall,"0x68-" & DllStructGetPtr($struct_Mask)  & "-68-" & DllStructGetPtr($struct_Pattern)  & "-68-" & Hex($hHandle,8) & "-E8|" & $dwFuncAddress & "|A3-" & DllStructGetPtr($struct_Result) & "-83C40CC3")
	DllStructSetData($struct_DummyCall,1,"0x" & $sBytes)
	; Create a thread on dummy function that calls Search function
	$hThread = CreateThread($dwDummyCall,Null)
	; Wait until thread returns
	_WinAPI_WaitForSingleObject($hThread)
	Return Hex(DllStructGetData($struct_Result,1),8)
EndFunc

You only need to get init one time, you can call many scans with the same return from InitializeScanner().

example/comparison attached
and please don't @ me for scanning LoadLibraryA i'm not retarded, it's just an example

[Fernando_Liro]

hello, how do i use em or app.exe? I didn't understand in the example how to do this, thanks and see you later.

[[Beatrice]]

Updated the code. Now script uses a shellcode written in C and it's even faster than previous version.