patsig.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "patsig.h"


DWORD
IntPatternMatch(
    _In_ const BYTE *Buffer,
    _In_ DWORD SigCount,
    _In_ const PATTERN_SIGNATURE *Sigs
    )
{
    if (Buffer == NULL || Sigs == NULL)
    {
        return SIG_NOT_FOUND;
    }

    for (DWORD i = 0; i < SigCount; i++)
    {
        BOOLEAN matched = TRUE;

        for (DWORD j = 0; j < Sigs[i].Length; j++)
        {
            if (Sigs[i].Pattern[j] != 0x100 &&
                Sigs[i].Pattern[j] != Buffer[Sigs[i].Offset + j])
            {
                matched = FALSE;
                break;
            }
        }

        if (matched)
        {
            return i;
        }
    }

    return SIG_NOT_FOUND;
}


DWORD
IntPatternMatchAllOffsets(
    _In_ const BYTE *Buffer,
    _In_ const DWORD BufferSize,
    _In_ DWORD SigCount,
    _In_ const PATTERN_SIGNATURE *Sigs
    )
{
    if (Buffer == NULL || Sigs == NULL)
    {
        return SIG_NOT_FOUND;
    }

    for (DWORD i = 0; i < SigCount; i++)
    {
        // check at each offset of buffer
        for (DWORD bufferOffset = 0; bufferOffset + Sigs[i].Length <= BufferSize; bufferOffset++)
        {
            DWORD foundSigId = IntPatternMatch(Buffer + bufferOffset, 1, &Sigs[i]);
            if (0 == foundSigId) // only one element, can be SIG_NOT_FOUND or 0
            {
                return i;
            }
        }
    }

    return SIG_NOT_FOUND;
}