├── YASS ├── YASS.vcxproj.filters ├── main.cpp ├── yass.h └── YASS.vcxproj ├── YASS.sln ├── README.md └── .gitignore /YASS/YASS.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /YASS/main.cpp: -------------------------------------------------------------------------------- 1 | #include "yass.h" 2 | #include 3 | 4 | bool testYASS(PatternScan::YASS scanner, char* buffer, int size) 5 | { 6 | return scanner.Scan((uintptr_t)buffer, size); 7 | } 8 | 9 | int main() 10 | { 11 | // Permutations of "MyNameIsScimmy" 12 | char test1[] = { 0x4d, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x49, 0x73, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 }; 13 | char test2[] = { 0x4d, 0x79, 0x49, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 }; 14 | char test3[] = { 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x79, 0x49, 0x73, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 }; 15 | char test4[] = { 0x4e, 0x61, 0x6d, 0x65, 0x49, 0x73, 0x4d, 0x79, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 }; 16 | char test5[] = { 0x49, 0x73, 0x4d, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 }; 17 | char test6[] = { 0x49, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x79, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 }; 18 | char test7[] = "ThisWillFail"; 19 | 20 | PatternScan::YASS yass({ "\x4d\x79", "\x4e\x61\x6d\x65", "\x49\x73" }, { "xx", "x??x", "xx" }); 21 | 22 | assert(testYASS(yass, test1, sizeof(test1))); 23 | assert(testYASS(yass, test2, sizeof(test2))); 24 | assert(testYASS(yass, test3, sizeof(test3))); 25 | assert(testYASS(yass, test4, sizeof(test4))); 26 | assert(testYASS(yass, test5, sizeof(test5))); 27 | assert(testYASS(yass, test6, sizeof(test6))); 28 | assert(!testYASS(yass, test7, sizeof(test7))); 29 | 30 | std::cout << "All tests passed!" << std::endl; 31 | system("pause"); 32 | } -------------------------------------------------------------------------------- /YASS.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.27130.2010 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "YASS", "YASS\YASS.vcxproj", "{EFFD7159-9126-47D3-B503-C90C00E27F0D}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x64.ActiveCfg = Debug|x64 17 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x64.Build.0 = Debug|x64 18 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x86.ActiveCfg = Debug|Win32 19 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x86.Build.0 = Debug|Win32 20 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x64.ActiveCfg = Release|x64 21 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x64.Build.0 = Release|x64 22 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x86.ActiveCfg = Release|Win32 23 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {935689BF-E5C5-4DC8-B5A5-B0758CA004D4} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # YASS - Yet Another Sig Scanner 2 | 3 | 4 | Original thread: https://www.unknowncheats.me/forum/anti-cheat-bypass/284848-yass-sig-scanner.html 5 | 6 | Traditional sigscanning relies on static compiled code (same registers, same order of operations, etc) which can become unreliable when programs begin to add randomization, but retain the same code semantics. 7 | 8 | Example 1: 9 | ``` 10 | mov rdx, 0x1 11 | mov rcx, 0x2 12 | add rdx, rcx 13 | ``` 14 | Example 2: 15 | ``` 16 | mov rcx, 0x2 17 | mov rdx, 0x1 18 | add rdx, rcx 19 | ``` 20 | If you were to make a signature for Example 1, it would look something like this: 21 | ``` 22 | "\x48\xC7\xC2\x01\x00\x00\x00\x48\xC7\xC1\x02\x00\x00\x00\x48\x01\xCA", "xxxx????xxxx????xxx" 23 | ``` 24 | Unfortunately, this would fail on Example 2, since the actual assembly instructions are swapped. Semantically, the two examples have the same functionality though. 25 | 26 | **Initial solution**: Create all permutations of a particular signature, and scan for every permutation until you find a non-null address.
27 | **Analysis**: Given a string of size N, there would be N! permutations of that string. Even a string of size 16 would result in pretty large number of permutations...2.092279e+13 to be exact. Yeah...not good. 28 | 29 | **YASS solution**: Create all permutations of instructions of a particular signature, and scan for every permutation until you find a non-null address.
30 | **Analysis**: Most signatures won't be longer than a few instructions, so this brings the number of permutations down by a lot. I think this is valid reasoning since any sane person would expect long signatures to break easily. 31 | 32 | **Possible Improvements**
33 | Sometimes we are interested in grabbing an actual offset that is used within the instruction, but since the order of the instructions may change, the number of bytes to ignore changes as well. 34 | 35 | Example: 36 | ``` 37 | mov rcx, 0x10 38 | mov rbx, [rsp + 0x48] 39 | ``` 40 | Let's say we are interested in the offset 0x48 bytes from the stack pointer. In this simple assembly stub, that offset would live at the 12th byte. If the game were swap these two instructions, the offset would live at the 4th byte. You would have to add additional logic to figure out the correct number of bytes to ignore for a particular permutation. 41 | 42 | **Caveats**
43 | It's possible that a particular permutation may bring you to an incorrect address if there exists some code that matches your permutation's opcodes. 44 | 45 | ## How to use this library 46 | 1. Find the instructions that you are interested in pattern matching 47 | 2. Split the instructions into a vector where each element in the vector represents an individual instruction.
48 | Using Example 1:
49 | ``` 50 | { "\x48\xC7\xC2\x01\x00\x00\x00", "\x48\xC7\xC1\x02\x00\x00\x00", "\x48\x01\xCA" } 51 | ``` 52 | 3. Split the masks as well.
53 | Using Example 1:
54 | ``` 55 | { "xxxx????", "xxxx????", "xxx" } 56 | ``` 57 | 4. Construct a YASS object, and call Scan. The return value is non NULL if succeeded, NULL if failed 58 | ``` 59 | PatternScan::YASS yass({ "\x48\xC7\xC2\x01\x00\x00\x00", "\x48\xC7\xC1\x02\x00\x00\x00", "\x48\x01\xCA" }, { "xxxx????", "xxxx????", "xxx" }); 60 | yass.Scan(buffer, size); // buffer is the target byte array, size is the size of the buffer 61 | ``` 62 | -------------------------------------------------------------------------------- /YASS/yass.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | namespace PatternScan 9 | { 10 | class Pattern 11 | { 12 | public: 13 | std::string opcodes; 14 | std::string mask; 15 | 16 | Pattern(std::string opcodes, std::string mask) : opcodes(opcodes), mask(mask) {} 17 | 18 | std::string ToString() 19 | { 20 | std::string result; 21 | result += opcodes + ", " + mask; 22 | return result; 23 | } 24 | }; 25 | 26 | class YASS 27 | { 28 | public: 29 | bool CompareBytes(const unsigned char* address, const unsigned char* opcodes, const char* mask) 30 | { 31 | while (*mask) 32 | { 33 | if (*mask == 'x' && *address != *opcodes) 34 | return false; 35 | 36 | ++mask; 37 | ++address; 38 | ++opcodes; 39 | } 40 | return true; 41 | } 42 | 43 | uintptr_t FindPattern(uintptr_t startAddress, size_t length, const unsigned char* opcodes, const char* mask, int ignore) 44 | { 45 | int ignoreCount = 0; 46 | uintptr_t offset = 0; 47 | 48 | while (ignoreCount <= ignore) 49 | { 50 | if (CompareBytes((unsigned char*)(startAddress + offset++), opcodes, mask)) 51 | ++ignoreCount; 52 | else if (offset >= length) 53 | return 0; 54 | } 55 | 56 | return startAddress + offset - 1; 57 | } 58 | 59 | void PermuteVectorHelper(std::vector &orig, std::vector &perm, std::vector &output) 60 | { 61 | if (orig.empty()) 62 | { 63 | std::string permutation; 64 | for (int i = 0; i < perm.size(); i++) 65 | permutation += perm[i]; 66 | 67 | output.push_back(permutation); 68 | return; 69 | } 70 | 71 | for (int i = 0; i < orig.size(); ++i) 72 | { 73 | std::vector origCopy(orig); 74 | origCopy.erase(std::find(origCopy.begin(), origCopy.end(), origCopy.at(i))); 75 | std::vector permCopy(perm); 76 | permCopy.push_back(orig.at(i)); 77 | PermuteVectorHelper(origCopy, permCopy, output); 78 | } 79 | } 80 | 81 | void PermuteVector(std::vector &orig, std::vector &output) 82 | { 83 | std::vector perm; 84 | PermuteVectorHelper(orig, perm, output); 85 | } 86 | 87 | std::vector GeneratePermutations() 88 | { 89 | PermuteVector(instructions, instructionPermutations); 90 | PermuteVector(masks, maskPermutations); 91 | 92 | std::vector permutations; 93 | for (int i = 0; i < instructionPermutations.size(); i++) 94 | permutations.push_back({ instructionPermutations[i], maskPermutations[i] }); 95 | 96 | return permutations; 97 | } 98 | 99 | std::vector instructions; 100 | std::vector masks; 101 | std::vector instructionPermutations; 102 | std::vector maskPermutations; 103 | 104 | public: 105 | YASS(std::vector instructions, std::vector masks) : instructions(instructions), masks(masks) 106 | { 107 | assert(instructions.size() > 0 && masks.size() > 0); 108 | assert(instructions.size() == masks.size()); 109 | } 110 | 111 | uintptr_t Scan(uintptr_t startAddress, size_t length) 112 | { 113 | std::vector patterns = GeneratePermutations(); 114 | 115 | for (Pattern pattern : patterns) 116 | { 117 | uintptr_t result = FindPattern(startAddress, length, (unsigned char*)pattern.opcodes.c_str(), pattern.mask.c_str(), 0); 118 | if (result) 119 | return result; 120 | } 121 | 122 | return 0; 123 | } 124 | }; 125 | } -------------------------------------------------------------------------------- /YASS/YASS.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 15.0 23 | {EFFD7159-9126-47D3-B503-C90C00E27F0D} 24 | YASS 25 | 10.0.16299.0 26 | 27 | 28 | 29 | Application 30 | true 31 | v141 32 | MultiByte 33 | 34 | 35 | Application 36 | false 37 | v141 38 | true 39 | MultiByte 40 | 41 | 42 | Application 43 | true 44 | v141 45 | MultiByte 46 | 47 | 48 | Application 49 | false 50 | v141 51 | true 52 | MultiByte 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | Disabled 77 | true 78 | true 79 | 80 | 81 | 82 | 83 | Level3 84 | Disabled 85 | true 86 | true 87 | 88 | 89 | 90 | 91 | Level3 92 | MaxSpeed 93 | true 94 | true 95 | true 96 | true 97 | 98 | 99 | true 100 | true 101 | 102 | 103 | 104 | 105 | Level3 106 | MaxSpeed 107 | true 108 | true 109 | true 110 | true 111 | 112 | 113 | true 114 | true 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | ## 4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 5 | 6 | # User-specific files 7 | *.suo 8 | *.user 9 | *.userosscache 10 | *.sln.docstates 11 | 12 | # User-specific files (MonoDevelop/Xamarin Studio) 13 | *.userprefs 14 | 15 | # Build results 16 | [Dd]ebug/ 17 | [Dd]ebugPublic/ 18 | [Rr]elease/ 19 | [Rr]eleases/ 20 | x64/ 21 | x86/ 22 | bld/ 23 | [Bb]in/ 24 | [Oo]bj/ 25 | [Ll]og/ 26 | 27 | # Visual Studio 2015/2017 cache/options directory 28 | .vs/ 29 | # Uncomment if you have tasks that create the project's static files in wwwroot 30 | #wwwroot/ 31 | 32 | # Visual Studio 2017 auto generated files 33 | Generated\ Files/ 34 | 35 | # MSTest test Results 36 | [Tt]est[Rr]esult*/ 37 | [Bb]uild[Ll]og.* 38 | 39 | # NUNIT 40 | *.VisualState.xml 41 | TestResult.xml 42 | 43 | # Build Results of an ATL Project 44 | [Dd]ebugPS/ 45 | [Rr]eleasePS/ 46 | dlldata.c 47 | 48 | # Benchmark Results 49 | BenchmarkDotNet.Artifacts/ 50 | 51 | # .NET Core 52 | project.lock.json 53 | project.fragment.lock.json 54 | artifacts/ 55 | **/Properties/launchSettings.json 56 | 57 | # StyleCop 58 | StyleCopReport.xml 59 | 60 | # Files built by Visual Studio 61 | *_i.c 62 | *_p.c 63 | *_i.h 64 | *.ilk 65 | *.meta 66 | *.obj 67 | *.iobj 68 | *.pch 69 | *.pdb 70 | *.ipdb 71 | *.pgc 72 | *.pgd 73 | *.rsp 74 | *.sbr 75 | *.tlb 76 | *.tli 77 | *.tlh 78 | *.tmp 79 | *.tmp_proj 80 | *.log 81 | *.vspscc 82 | *.vssscc 83 | .builds 84 | *.pidb 85 | *.svclog 86 | *.scc 87 | 88 | # Chutzpah Test files 89 | _Chutzpah* 90 | 91 | # Visual C++ cache files 92 | ipch/ 93 | *.aps 94 | *.ncb 95 | *.opendb 96 | *.opensdf 97 | *.sdf 98 | *.cachefile 99 | *.VC.db 100 | *.VC.VC.opendb 101 | 102 | # Visual Studio profiler 103 | *.psess 104 | *.vsp 105 | *.vspx 106 | *.sap 107 | 108 | # Visual Studio Trace Files 109 | *.e2e 110 | 111 | # TFS 2012 Local Workspace 112 | $tf/ 113 | 114 | # Guidance Automation Toolkit 115 | *.gpState 116 | 117 | # ReSharper is a .NET coding add-in 118 | _ReSharper*/ 119 | *.[Rr]e[Ss]harper 120 | *.DotSettings.user 121 | 122 | # JustCode is a .NET coding add-in 123 | .JustCode 124 | 125 | # TeamCity is a build add-in 126 | _TeamCity* 127 | 128 | # DotCover is a Code Coverage Tool 129 | *.dotCover 130 | 131 | # AxoCover is a Code Coverage Tool 132 | .axoCover/* 133 | !.axoCover/settings.json 134 | 135 | # Visual Studio code coverage results 136 | *.coverage 137 | *.coveragexml 138 | 139 | # NCrunch 140 | _NCrunch_* 141 | .*crunch*.local.xml 142 | nCrunchTemp_* 143 | 144 | # MightyMoose 145 | *.mm.* 146 | AutoTest.Net/ 147 | 148 | # Web workbench (sass) 149 | .sass-cache/ 150 | 151 | # Installshield output folder 152 | [Ee]xpress/ 153 | 154 | # DocProject is a documentation generator add-in 155 | DocProject/buildhelp/ 156 | DocProject/Help/*.HxT 157 | DocProject/Help/*.HxC 158 | DocProject/Help/*.hhc 159 | DocProject/Help/*.hhk 160 | DocProject/Help/*.hhp 161 | DocProject/Help/Html2 162 | DocProject/Help/html 163 | 164 | # Click-Once directory 165 | publish/ 166 | 167 | # Publish Web Output 168 | *.[Pp]ublish.xml 169 | *.azurePubxml 170 | # Note: Comment the next line if you want to checkin your web deploy settings, 171 | # but database connection strings (with potential passwords) will be unencrypted 172 | *.pubxml 173 | *.publishproj 174 | 175 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 176 | # checkin your Azure Web App publish settings, but sensitive information contained 177 | # in these scripts will be unencrypted 178 | PublishScripts/ 179 | 180 | # NuGet Packages 181 | *.nupkg 182 | # The packages folder can be ignored because of Package Restore 183 | **/[Pp]ackages/* 184 | # except build/, which is used as an MSBuild target. 185 | !**/[Pp]ackages/build/ 186 | # Uncomment if necessary however generally it will be regenerated when needed 187 | #!**/[Pp]ackages/repositories.config 188 | # NuGet v3's project.json files produces more ignorable files 189 | *.nuget.props 190 | *.nuget.targets 191 | 192 | # Microsoft Azure Build Output 193 | csx/ 194 | *.build.csdef 195 | 196 | # Microsoft Azure Emulator 197 | ecf/ 198 | rcf/ 199 | 200 | # Windows Store app package directories and files 201 | AppPackages/ 202 | BundleArtifacts/ 203 | Package.StoreAssociation.xml 204 | _pkginfo.txt 205 | *.appx 206 | 207 | # Visual Studio cache files 208 | # files ending in .cache can be ignored 209 | *.[Cc]ache 210 | # but keep track of directories ending in .cache 211 | !*.[Cc]ache/ 212 | 213 | # Others 214 | ClientBin/ 215 | ~$* 216 | *~ 217 | *.dbmdl 218 | *.dbproj.schemaview 219 | *.jfm 220 | *.pfx 221 | *.publishsettings 222 | orleans.codegen.cs 223 | 224 | # Including strong name files can present a security risk 225 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 226 | #*.snk 227 | 228 | # Since there are multiple workflows, uncomment next line to ignore bower_components 229 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 230 | #bower_components/ 231 | 232 | # RIA/Silverlight projects 233 | Generated_Code/ 234 | 235 | # Backup & report files from converting an old project file 236 | # to a newer Visual Studio version. Backup files are not needed, 237 | # because we have git ;-) 238 | _UpgradeReport_Files/ 239 | Backup*/ 240 | UpgradeLog*.XML 241 | UpgradeLog*.htm 242 | ServiceFabricBackup/ 243 | *.rptproj.bak 244 | 245 | # SQL Server files 246 | *.mdf 247 | *.ldf 248 | *.ndf 249 | 250 | # Business Intelligence projects 251 | *.rdl.data 252 | *.bim.layout 253 | *.bim_*.settings 254 | *.rptproj.rsuser 255 | 256 | # Microsoft Fakes 257 | FakesAssemblies/ 258 | 259 | # GhostDoc plugin setting file 260 | *.GhostDoc.xml 261 | 262 | # Node.js Tools for Visual Studio 263 | .ntvs_analysis.dat 264 | node_modules/ 265 | 266 | # Visual Studio 6 build log 267 | *.plg 268 | 269 | # Visual Studio 6 workspace options file 270 | *.opt 271 | 272 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 273 | *.vbw 274 | 275 | # Visual Studio LightSwitch build output 276 | **/*.HTMLClient/GeneratedArtifacts 277 | **/*.DesktopClient/GeneratedArtifacts 278 | **/*.DesktopClient/ModelManifest.xml 279 | **/*.Server/GeneratedArtifacts 280 | **/*.Server/ModelManifest.xml 281 | _Pvt_Extensions 282 | 283 | # Paket dependency manager 284 | .paket/paket.exe 285 | paket-files/ 286 | 287 | # FAKE - F# Make 288 | .fake/ 289 | 290 | # JetBrains Rider 291 | .idea/ 292 | *.sln.iml 293 | 294 | # CodeRush 295 | .cr/ 296 | 297 | # Python Tools for Visual Studio (PTVS) 298 | __pycache__/ 299 | *.pyc 300 | 301 | # Cake - Uncomment if you are using it 302 | # tools/** 303 | # !tools/packages.config 304 | 305 | # Tabs Studio 306 | *.tss 307 | 308 | # Telerik's JustMock configuration file 309 | *.jmconfig 310 | 311 | # BizTalk build output 312 | *.btp.cs 313 | *.btm.cs 314 | *.odx.cs 315 | *.xsd.cs 316 | 317 | # OpenCover UI analysis results 318 | OpenCover/ 319 | 320 | # Azure Stream Analytics local run output 321 | ASALocalRun/ 322 | 323 | # MSBuild Binary and Structured Log 324 | *.binlog 325 | 326 | # NVidia Nsight GPU debugger configuration file 327 | *.nvuser 328 | 329 | # MFractors (Xamarin productivity tool) working folder 330 | .mfractor/ 331 | --------------------------------------------------------------------------------