// OrbisHookah, Copyright @2026 apfelteesaft #pragma once #include #include namespace Hookah { // --------------------------------------------------------------------------- // Pattern scanner // // Two complementary APIs are provided: // // ScanPattern – human-readable hex string: "48 8B ?? ?? ?? 4C" // where "??" (or "?") is a wildcard byte. // // ScanPatternMask – raw byte array + a parallel mask string in which // 'x' means "must match" and '?' means "wildcard". // Compatible with the style used in many MinHook examples. // --------------------------------------------------------------------------- // Parse a space-delimited hex-byte pattern string into parallel byte / mask // arrays. Wildcards may be written as "?" or "??". // // pattern – e.g. "48 8B 05 ?? ?? ?? ??" // outBytes – receives the parsed byte values (wildcard slots hold 0x00) // outMask – receives true where the byte must match, false for wildcards // maxLen – maximum number of bytes to parse (size of outBytes / outMask) // // Returns the number of bytes in the pattern, or 0 on a parse error. int ParsePattern(const char* pattern, uint8_t* outBytes, bool* outMask, int maxLen); // Scan the memory range [base, base+size) for the first occurrence of the // pattern described by 'bytes' and 'mask'. // mask[i] == true → mem[i] must equal bytes[i] // mask[i] == false → any byte is accepted (wildcard) // Returns a pointer to the match, or nullptr if not found. void* FindPattern(uintptr_t base, size_t size, const uint8_t* bytes, const bool* mask, int patternLen); // Convenience wrapper: parse 'pattern' then call FindPattern. // pattern – "48 8B ?? ?? ?? 4C 8B ??", ?? = wildcard void* ScanPattern(uintptr_t base, size_t size, const char* pattern); // Raw-bytes + mask-string variant. // bytes – raw byte values (char* for convenience, reinterpreted as uint8_t*) // mask – parallel string, 'x' = must match, '?' = wildcard // patternLen – number of bytes / mask characters void* ScanPatternMask(uintptr_t base, size_t size, const char* bytes, const char* mask, size_t patternLen); } // namespace Hookah