Pattern Scanning

Pattern scanning (also called signature scanning) is essential for locating functions and data structures in memory when addresses change between versions or sessions.

Signature Scanning

Signature scanning allows you to search for byte patterns with wildcards, making it perfect for finding functions even after game updates.

Godmode Example

This real-world example from the README demonstrates scanning for a function signature and patching it to implement godmode in a game:

use libmem::*;

fn godmode() -> Option<()> {
    let game_process = find_process("game_linux64")?;
    let client_module = find_module_ex(&game_process, "libclient.so")?;

    let fn_update_health = sig_scan_ex(
        &game_process,
        "55 48 89 E5 66 B8 ?? ?? 48 8B 5D FC",
        client_module.base,
        client_module.size,
    )?;
    println!(
        "[*] Signature scan result for 'update_health' function: {}",
        fn_update_health
    );

    let shellcode = assemble_ex("mov rbx, 1337; mov [rdi], rbx; ret", Arch::X64, 0)?;
    write_memory_ex(&game_process, fn_update_health + 8, &shellcode.as_slice())?;
    println!("[*] Patched 'update_health' function to always set health to 1337!");

    Some(())
}

fn main() {
    godmode();
}

How It Works

Find the Target Process

Use find_process to locate the running game process by name.

Locate the Module

Find the specific module (DLL/SO) that contains the function you’re looking for using find_module_ex.

Scan for the Signature

Use sig_scan_ex with a byte pattern. The ?? wildcards match any byte, allowing the pattern to work even if some bytes vary between versions.

Patch the Function

Once found, assemble custom shellcode and write it to the function, effectively modifying its behavior.

Pattern Syntax

Signature Format

Signatures use hexadecimal bytes separated by spaces:

55 48 89 E5 - Exact bytes that must match
?? - Wildcard that matches any byte
Example: "DE AD ?? ?? 13 37" matches DE AD followed by any 2 bytes, then 13 37

Data Scanning

For scanning exact data without wildcards, use LM_DataScan or LM_DataScanEx:

lm_byte_t pattern[] = {0xDE, 0xAD, 0xBE, 0xEF};
lm_address_t result = LM_DataScan(pattern, sizeof(pattern), start_addr, scan_size);