├── YASS
├── YASS.vcxproj.filters
├── main.cpp
├── yass.h
└── YASS.vcxproj
├── YASS.sln
├── README.md
└── .gitignore
/YASS/YASS.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
23 |
24 | Header Files
25 |
26 |
27 |
--------------------------------------------------------------------------------
/YASS/main.cpp:
--------------------------------------------------------------------------------
1 | #include "yass.h"
2 | #include
3 |
4 | bool testYASS(PatternScan::YASS scanner, char* buffer, int size)
5 | {
6 | return scanner.Scan((uintptr_t)buffer, size);
7 | }
8 |
9 | int main()
10 | {
11 | // Permutations of "MyNameIsScimmy"
12 | char test1[] = { 0x4d, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x49, 0x73, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 };
13 | char test2[] = { 0x4d, 0x79, 0x49, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 };
14 | char test3[] = { 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x79, 0x49, 0x73, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 };
15 | char test4[] = { 0x4e, 0x61, 0x6d, 0x65, 0x49, 0x73, 0x4d, 0x79, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 };
16 | char test5[] = { 0x49, 0x73, 0x4d, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 };
17 | char test6[] = { 0x49, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x4d, 0x79, 0x53, 0x63, 0x69, 0x6d, 0x6d, 0x79 };
18 | char test7[] = "ThisWillFail";
19 |
20 | PatternScan::YASS yass({ "\x4d\x79", "\x4e\x61\x6d\x65", "\x49\x73" }, { "xx", "x??x", "xx" });
21 |
22 | assert(testYASS(yass, test1, sizeof(test1)));
23 | assert(testYASS(yass, test2, sizeof(test2)));
24 | assert(testYASS(yass, test3, sizeof(test3)));
25 | assert(testYASS(yass, test4, sizeof(test4)));
26 | assert(testYASS(yass, test5, sizeof(test5)));
27 | assert(testYASS(yass, test6, sizeof(test6)));
28 | assert(!testYASS(yass, test7, sizeof(test7)));
29 |
30 | std::cout << "All tests passed!" << std::endl;
31 | system("pause");
32 | }
--------------------------------------------------------------------------------
/YASS.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 15
4 | VisualStudioVersion = 15.0.27130.2010
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "YASS", "YASS\YASS.vcxproj", "{EFFD7159-9126-47D3-B503-C90C00E27F0D}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x64.ActiveCfg = Debug|x64
17 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x64.Build.0 = Debug|x64
18 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x86.ActiveCfg = Debug|Win32
19 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Debug|x86.Build.0 = Debug|Win32
20 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x64.ActiveCfg = Release|x64
21 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x64.Build.0 = Release|x64
22 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x86.ActiveCfg = Release|Win32
23 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {935689BF-E5C5-4DC8-B5A5-B0758CA004D4}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # YASS - Yet Another Sig Scanner
2 |
3 |
4 | Original thread: https://www.unknowncheats.me/forum/anti-cheat-bypass/284848-yass-sig-scanner.html
5 |
6 | Traditional sigscanning relies on static compiled code (same registers, same order of operations, etc) which can become unreliable when programs begin to add randomization, but retain the same code semantics.
7 |
8 | Example 1:
9 | ```
10 | mov rdx, 0x1
11 | mov rcx, 0x2
12 | add rdx, rcx
13 | ```
14 | Example 2:
15 | ```
16 | mov rcx, 0x2
17 | mov rdx, 0x1
18 | add rdx, rcx
19 | ```
20 | If you were to make a signature for Example 1, it would look something like this:
21 | ```
22 | "\x48\xC7\xC2\x01\x00\x00\x00\x48\xC7\xC1\x02\x00\x00\x00\x48\x01\xCA", "xxxx????xxxx????xxx"
23 | ```
24 | Unfortunately, this would fail on Example 2, since the actual assembly instructions are swapped. Semantically, the two examples have the same functionality though.
25 |
26 | **Initial solution**: Create all permutations of a particular signature, and scan for every permutation until you find a non-null address.
27 | **Analysis**: Given a string of size N, there would be N! permutations of that string. Even a string of size 16 would result in pretty large number of permutations...2.092279e+13 to be exact. Yeah...not good.
28 |
29 | **YASS solution**: Create all permutations of instructions of a particular signature, and scan for every permutation until you find a non-null address.
30 | **Analysis**: Most signatures won't be longer than a few instructions, so this brings the number of permutations down by a lot. I think this is valid reasoning since any sane person would expect long signatures to break easily.
31 |
32 | **Possible Improvements**
33 | Sometimes we are interested in grabbing an actual offset that is used within the instruction, but since the order of the instructions may change, the number of bytes to ignore changes as well.
34 |
35 | Example:
36 | ```
37 | mov rcx, 0x10
38 | mov rbx, [rsp + 0x48]
39 | ```
40 | Let's say we are interested in the offset 0x48 bytes from the stack pointer. In this simple assembly stub, that offset would live at the 12th byte. If the game were swap these two instructions, the offset would live at the 4th byte. You would have to add additional logic to figure out the correct number of bytes to ignore for a particular permutation.
41 |
42 | **Caveats**
43 | It's possible that a particular permutation may bring you to an incorrect address if there exists some code that matches your permutation's opcodes.
44 |
45 | ## How to use this library
46 | 1. Find the instructions that you are interested in pattern matching
47 | 2. Split the instructions into a vector where each element in the vector represents an individual instruction.
48 | Using Example 1:
49 | ```
50 | { "\x48\xC7\xC2\x01\x00\x00\x00", "\x48\xC7\xC1\x02\x00\x00\x00", "\x48\x01\xCA" }
51 | ```
52 | 3. Split the masks as well.
53 | Using Example 1:
54 | ```
55 | { "xxxx????", "xxxx????", "xxx" }
56 | ```
57 | 4. Construct a YASS object, and call Scan. The return value is non NULL if succeeded, NULL if failed
58 | ```
59 | PatternScan::YASS yass({ "\x48\xC7\xC2\x01\x00\x00\x00", "\x48\xC7\xC1\x02\x00\x00\x00", "\x48\x01\xCA" }, { "xxxx????", "xxxx????", "xxx" });
60 | yass.Scan(buffer, size); // buffer is the target byte array, size is the size of the buffer
61 | ```
62 |
--------------------------------------------------------------------------------
/YASS/yass.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 |
3 | #include
4 | #include
5 | #include
6 | #include
7 |
8 | namespace PatternScan
9 | {
10 | class Pattern
11 | {
12 | public:
13 | std::string opcodes;
14 | std::string mask;
15 |
16 | Pattern(std::string opcodes, std::string mask) : opcodes(opcodes), mask(mask) {}
17 |
18 | std::string ToString()
19 | {
20 | std::string result;
21 | result += opcodes + ", " + mask;
22 | return result;
23 | }
24 | };
25 |
26 | class YASS
27 | {
28 | public:
29 | bool CompareBytes(const unsigned char* address, const unsigned char* opcodes, const char* mask)
30 | {
31 | while (*mask)
32 | {
33 | if (*mask == 'x' && *address != *opcodes)
34 | return false;
35 |
36 | ++mask;
37 | ++address;
38 | ++opcodes;
39 | }
40 | return true;
41 | }
42 |
43 | uintptr_t FindPattern(uintptr_t startAddress, size_t length, const unsigned char* opcodes, const char* mask, int ignore)
44 | {
45 | int ignoreCount = 0;
46 | uintptr_t offset = 0;
47 |
48 | while (ignoreCount <= ignore)
49 | {
50 | if (CompareBytes((unsigned char*)(startAddress + offset++), opcodes, mask))
51 | ++ignoreCount;
52 | else if (offset >= length)
53 | return 0;
54 | }
55 |
56 | return startAddress + offset - 1;
57 | }
58 |
59 | void PermuteVectorHelper(std::vector &orig, std::vector &perm, std::vector &output)
60 | {
61 | if (orig.empty())
62 | {
63 | std::string permutation;
64 | for (int i = 0; i < perm.size(); i++)
65 | permutation += perm[i];
66 |
67 | output.push_back(permutation);
68 | return;
69 | }
70 |
71 | for (int i = 0; i < orig.size(); ++i)
72 | {
73 | std::vector origCopy(orig);
74 | origCopy.erase(std::find(origCopy.begin(), origCopy.end(), origCopy.at(i)));
75 | std::vector permCopy(perm);
76 | permCopy.push_back(orig.at(i));
77 | PermuteVectorHelper(origCopy, permCopy, output);
78 | }
79 | }
80 |
81 | void PermuteVector(std::vector &orig, std::vector &output)
82 | {
83 | std::vector perm;
84 | PermuteVectorHelper(orig, perm, output);
85 | }
86 |
87 | std::vector GeneratePermutations()
88 | {
89 | PermuteVector(instructions, instructionPermutations);
90 | PermuteVector(masks, maskPermutations);
91 |
92 | std::vector permutations;
93 | for (int i = 0; i < instructionPermutations.size(); i++)
94 | permutations.push_back({ instructionPermutations[i], maskPermutations[i] });
95 |
96 | return permutations;
97 | }
98 |
99 | std::vector instructions;
100 | std::vector masks;
101 | std::vector instructionPermutations;
102 | std::vector maskPermutations;
103 |
104 | public:
105 | YASS(std::vector instructions, std::vector masks) : instructions(instructions), masks(masks)
106 | {
107 | assert(instructions.size() > 0 && masks.size() > 0);
108 | assert(instructions.size() == masks.size());
109 | }
110 |
111 | uintptr_t Scan(uintptr_t startAddress, size_t length)
112 | {
113 | std::vector patterns = GeneratePermutations();
114 |
115 | for (Pattern pattern : patterns)
116 | {
117 | uintptr_t result = FindPattern(startAddress, length, (unsigned char*)pattern.opcodes.c_str(), pattern.mask.c_str(), 0);
118 | if (result)
119 | return result;
120 | }
121 |
122 | return 0;
123 | }
124 | };
125 | }
--------------------------------------------------------------------------------
/YASS/YASS.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 15.0
23 | {EFFD7159-9126-47D3-B503-C90C00E27F0D}
24 | YASS
25 | 10.0.16299.0
26 |
27 |
28 |
29 | Application
30 | true
31 | v141
32 | MultiByte
33 |
34 |
35 | Application
36 | false
37 | v141
38 | true
39 | MultiByte
40 |
41 |
42 | Application
43 | true
44 | v141
45 | MultiByte
46 |
47 |
48 | Application
49 | false
50 | v141
51 | true
52 | MultiByte
53 |
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 | Level3
76 | Disabled
77 | true
78 | true
79 |
80 |
81 |
82 |
83 | Level3
84 | Disabled
85 | true
86 | true
87 |
88 |
89 |
90 |
91 | Level3
92 | MaxSpeed
93 | true
94 | true
95 | true
96 | true
97 |
98 |
99 | true
100 | true
101 |
102 |
103 |
104 |
105 | Level3
106 | MaxSpeed
107 | true
108 | true
109 | true
110 | true
111 |
112 |
113 | true
114 | true
115 |
116 |
117 |
118 |
119 |
120 |
121 |
122 |
123 |
124 |
125 |
126 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | ## Ignore Visual Studio temporary files, build results, and
2 | ## files generated by popular Visual Studio add-ons.
3 | ##
4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
5 |
6 | # User-specific files
7 | *.suo
8 | *.user
9 | *.userosscache
10 | *.sln.docstates
11 |
12 | # User-specific files (MonoDevelop/Xamarin Studio)
13 | *.userprefs
14 |
15 | # Build results
16 | [Dd]ebug/
17 | [Dd]ebugPublic/
18 | [Rr]elease/
19 | [Rr]eleases/
20 | x64/
21 | x86/
22 | bld/
23 | [Bb]in/
24 | [Oo]bj/
25 | [Ll]og/
26 |
27 | # Visual Studio 2015/2017 cache/options directory
28 | .vs/
29 | # Uncomment if you have tasks that create the project's static files in wwwroot
30 | #wwwroot/
31 |
32 | # Visual Studio 2017 auto generated files
33 | Generated\ Files/
34 |
35 | # MSTest test Results
36 | [Tt]est[Rr]esult*/
37 | [Bb]uild[Ll]og.*
38 |
39 | # NUNIT
40 | *.VisualState.xml
41 | TestResult.xml
42 |
43 | # Build Results of an ATL Project
44 | [Dd]ebugPS/
45 | [Rr]eleasePS/
46 | dlldata.c
47 |
48 | # Benchmark Results
49 | BenchmarkDotNet.Artifacts/
50 |
51 | # .NET Core
52 | project.lock.json
53 | project.fragment.lock.json
54 | artifacts/
55 | **/Properties/launchSettings.json
56 |
57 | # StyleCop
58 | StyleCopReport.xml
59 |
60 | # Files built by Visual Studio
61 | *_i.c
62 | *_p.c
63 | *_i.h
64 | *.ilk
65 | *.meta
66 | *.obj
67 | *.iobj
68 | *.pch
69 | *.pdb
70 | *.ipdb
71 | *.pgc
72 | *.pgd
73 | *.rsp
74 | *.sbr
75 | *.tlb
76 | *.tli
77 | *.tlh
78 | *.tmp
79 | *.tmp_proj
80 | *.log
81 | *.vspscc
82 | *.vssscc
83 | .builds
84 | *.pidb
85 | *.svclog
86 | *.scc
87 |
88 | # Chutzpah Test files
89 | _Chutzpah*
90 |
91 | # Visual C++ cache files
92 | ipch/
93 | *.aps
94 | *.ncb
95 | *.opendb
96 | *.opensdf
97 | *.sdf
98 | *.cachefile
99 | *.VC.db
100 | *.VC.VC.opendb
101 |
102 | # Visual Studio profiler
103 | *.psess
104 | *.vsp
105 | *.vspx
106 | *.sap
107 |
108 | # Visual Studio Trace Files
109 | *.e2e
110 |
111 | # TFS 2012 Local Workspace
112 | $tf/
113 |
114 | # Guidance Automation Toolkit
115 | *.gpState
116 |
117 | # ReSharper is a .NET coding add-in
118 | _ReSharper*/
119 | *.[Rr]e[Ss]harper
120 | *.DotSettings.user
121 |
122 | # JustCode is a .NET coding add-in
123 | .JustCode
124 |
125 | # TeamCity is a build add-in
126 | _TeamCity*
127 |
128 | # DotCover is a Code Coverage Tool
129 | *.dotCover
130 |
131 | # AxoCover is a Code Coverage Tool
132 | .axoCover/*
133 | !.axoCover/settings.json
134 |
135 | # Visual Studio code coverage results
136 | *.coverage
137 | *.coveragexml
138 |
139 | # NCrunch
140 | _NCrunch_*
141 | .*crunch*.local.xml
142 | nCrunchTemp_*
143 |
144 | # MightyMoose
145 | *.mm.*
146 | AutoTest.Net/
147 |
148 | # Web workbench (sass)
149 | .sass-cache/
150 |
151 | # Installshield output folder
152 | [Ee]xpress/
153 |
154 | # DocProject is a documentation generator add-in
155 | DocProject/buildhelp/
156 | DocProject/Help/*.HxT
157 | DocProject/Help/*.HxC
158 | DocProject/Help/*.hhc
159 | DocProject/Help/*.hhk
160 | DocProject/Help/*.hhp
161 | DocProject/Help/Html2
162 | DocProject/Help/html
163 |
164 | # Click-Once directory
165 | publish/
166 |
167 | # Publish Web Output
168 | *.[Pp]ublish.xml
169 | *.azurePubxml
170 | # Note: Comment the next line if you want to checkin your web deploy settings,
171 | # but database connection strings (with potential passwords) will be unencrypted
172 | *.pubxml
173 | *.publishproj
174 |
175 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
176 | # checkin your Azure Web App publish settings, but sensitive information contained
177 | # in these scripts will be unencrypted
178 | PublishScripts/
179 |
180 | # NuGet Packages
181 | *.nupkg
182 | # The packages folder can be ignored because of Package Restore
183 | **/[Pp]ackages/*
184 | # except build/, which is used as an MSBuild target.
185 | !**/[Pp]ackages/build/
186 | # Uncomment if necessary however generally it will be regenerated when needed
187 | #!**/[Pp]ackages/repositories.config
188 | # NuGet v3's project.json files produces more ignorable files
189 | *.nuget.props
190 | *.nuget.targets
191 |
192 | # Microsoft Azure Build Output
193 | csx/
194 | *.build.csdef
195 |
196 | # Microsoft Azure Emulator
197 | ecf/
198 | rcf/
199 |
200 | # Windows Store app package directories and files
201 | AppPackages/
202 | BundleArtifacts/
203 | Package.StoreAssociation.xml
204 | _pkginfo.txt
205 | *.appx
206 |
207 | # Visual Studio cache files
208 | # files ending in .cache can be ignored
209 | *.[Cc]ache
210 | # but keep track of directories ending in .cache
211 | !*.[Cc]ache/
212 |
213 | # Others
214 | ClientBin/
215 | ~$*
216 | *~
217 | *.dbmdl
218 | *.dbproj.schemaview
219 | *.jfm
220 | *.pfx
221 | *.publishsettings
222 | orleans.codegen.cs
223 |
224 | # Including strong name files can present a security risk
225 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
226 | #*.snk
227 |
228 | # Since there are multiple workflows, uncomment next line to ignore bower_components
229 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
230 | #bower_components/
231 |
232 | # RIA/Silverlight projects
233 | Generated_Code/
234 |
235 | # Backup & report files from converting an old project file
236 | # to a newer Visual Studio version. Backup files are not needed,
237 | # because we have git ;-)
238 | _UpgradeReport_Files/
239 | Backup*/
240 | UpgradeLog*.XML
241 | UpgradeLog*.htm
242 | ServiceFabricBackup/
243 | *.rptproj.bak
244 |
245 | # SQL Server files
246 | *.mdf
247 | *.ldf
248 | *.ndf
249 |
250 | # Business Intelligence projects
251 | *.rdl.data
252 | *.bim.layout
253 | *.bim_*.settings
254 | *.rptproj.rsuser
255 |
256 | # Microsoft Fakes
257 | FakesAssemblies/
258 |
259 | # GhostDoc plugin setting file
260 | *.GhostDoc.xml
261 |
262 | # Node.js Tools for Visual Studio
263 | .ntvs_analysis.dat
264 | node_modules/
265 |
266 | # Visual Studio 6 build log
267 | *.plg
268 |
269 | # Visual Studio 6 workspace options file
270 | *.opt
271 |
272 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
273 | *.vbw
274 |
275 | # Visual Studio LightSwitch build output
276 | **/*.HTMLClient/GeneratedArtifacts
277 | **/*.DesktopClient/GeneratedArtifacts
278 | **/*.DesktopClient/ModelManifest.xml
279 | **/*.Server/GeneratedArtifacts
280 | **/*.Server/ModelManifest.xml
281 | _Pvt_Extensions
282 |
283 | # Paket dependency manager
284 | .paket/paket.exe
285 | paket-files/
286 |
287 | # FAKE - F# Make
288 | .fake/
289 |
290 | # JetBrains Rider
291 | .idea/
292 | *.sln.iml
293 |
294 | # CodeRush
295 | .cr/
296 |
297 | # Python Tools for Visual Studio (PTVS)
298 | __pycache__/
299 | *.pyc
300 |
301 | # Cake - Uncomment if you are using it
302 | # tools/**
303 | # !tools/packages.config
304 |
305 | # Tabs Studio
306 | *.tss
307 |
308 | # Telerik's JustMock configuration file
309 | *.jmconfig
310 |
311 | # BizTalk build output
312 | *.btp.cs
313 | *.btm.cs
314 | *.odx.cs
315 | *.xsd.cs
316 |
317 | # OpenCover UI analysis results
318 | OpenCover/
319 |
320 | # Azure Stream Analytics local run output
321 | ASALocalRun/
322 |
323 | # MSBuild Binary and Structured Log
324 | *.binlog
325 |
326 | # NVidia Nsight GPU debugger configuration file
327 | *.nvuser
328 |
329 | # MFractors (Xamarin productivity tool) working folder
330 | .mfractor/
331 |
--------------------------------------------------------------------------------