Difference between revisions of "Auto Assembler:aobScanModule"
Jump to navigation
Jump to search
(→Related Commands) |
|||
| Line 3: | Line 3: | ||
Scans the memory of a specific module for the given array of byte and sets the result to the symbol name. | Scans the memory of a specific module for the given array of byte and sets the result to the symbol name. | ||
| − | '?' and '*' are seen as a wildcard. | + | 'x', '?', and '*' are seen as a wildcard. |
Note: Wildcards can be written as one per byte or one per character of byte. | Note: Wildcards can be written as one per byte or one per character of byte. | ||
| − | :i.e.: ? or * or ?? or ** | + | :i.e.: x or xx ? or * or ?? or ** |
:If not separated by spaces the wildcard will be interpreted as a byte. | :If not separated by spaces the wildcard will be interpreted as a byte. | ||
| Line 31: | Line 31: | ||
== Examples == | == Examples == | ||
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 53 48 8D 64 24 E0) | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 53 48 8D 64 24 E0) | ||
| + | |||
| + | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 xx xx 8D 64 24 E0) | ||
| + | |||
| + | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 x x 8D 64 24 E0) | ||
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ** ** 8D 64 24 E0) | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ** ** 8D 64 24 E0) | ||
| Line 39: | Line 43: | ||
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ? ? 8D 64 24 E0) | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ? ? 8D 64 24 E0) | ||
| + | |||
| + | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00xx8D6424E0) | ||
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00**8D6424E0) | aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00**8D6424E0) | ||
Revision as of 22:36, 4 January 2018
Auto Assembler aobScanModule(SymbolName, ModuleName, AOBString)
Scans the memory of a specific module for the given array of byte and sets the result to the symbol name. 'x', '?', and '*' are seen as a wildcard.
Note: Wildcards can be written as one per byte or one per character of byte.
- i.e.: x or xx ? or * or ?? or **
- If not separated by spaces the wildcard will be interpreted as a byte.
Command Parameters
| Parameter | Type | Description |
|---|---|---|
| SymbolName | string | The symbol name to use if aob is found |
| ModuleName | string | The name of the module to scan in |
| AOBString | string | The string of bytes, as hex, to scan for |
Examples
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 53 48 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 xx xx 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 x x 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ** ** 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 * * 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ?? ?? 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00 ? ? 8D 64 24 E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00xx8D6424E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00**8D6424E0)
aobScanModule(SomeSymbol, Tutorial-x86_64.exe, 00??8D6424E0)
