|
merlin
are you sure about your intention? And do you know exactly what you are doing?
Your original request was about a method to "find a pattern in a RUNNING file".
This means that your file:
1) is executable
2) is already mapped in memory
3) could be compressed.
then
1) you must forget about offsets and start thinking in Virtual Addresses terms
2) you don't need any procedure that reads or writes a file
and this because a running file is no more a file; it's part of a process
As previosly recommended, and subsequently stressed by snaker, the easiest way to access the addressing space of a process is, in Win32, the use of the debug API supplied by Windows itself; otherwise, you'll have to write a R0 module.
If you're learning ASM just now, trying to write your program in ASM simply will make your life more difficult; it isn't impossible, only unadvisable. If you'll try to accomplish your task by a C program, your life will be undoubtely easier. You'll be able to call directly API functions; on the other hand, in C a buffer is simply a variable, and so on.
You've mentioned Procdump; open its Import Table, and you'll find that it (obviously) imports ReadProcessMemory and WriteProcessMemory.
As stated by snaker, the search routine is the least of your problems; you can use the Boyer Moore Algoritm, the Tuned Boyer Moore Algoritm, or whatever you want: there are millions of string search algorithms.
Search on the Web 'EXACT STRING MATCHING ALGORITHMS'; it's a text in HTML format that contains the description of several algorithms, and the related C code.
Regards
|