{"id":19293538,"url":"https://github.com/reloaded-project/reloaded.memory.sigscan","last_synced_at":"2025-04-07T06:11:18.149Z","repository":{"id":37385053,"uuid":"201014935","full_name":"Reloaded-Project/Reloaded.Memory.SigScan","owner":"Reloaded-Project","description":"Simple good performance byte pattern/PE signature scanner, allowing upwards of 5000MB/s per core (30000+MB/s with AVX) on modern hardware.","archived":false,"fork":false,"pushed_at":"2025-03-23T23:05:07.000Z","size":4222,"stargazers_count":87,"open_issues_count":4,"forks_count":16,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-31T04:08:21.456Z","etag":null,"topics":["analysis","csharp","game-hacking","signature-detection","signature-scanner"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Reloaded-Project.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":"Sewer56"}},"created_at":"2019-08-07T09:11:13.000Z","updated_at":"2025-03-23T23:05:10.000Z","dependencies_parsed_at":"2023-01-20T20:15:10.085Z","dependency_job_id":"926c7665-dcad-4b99-8eb0-8e9a5923660e","html_url":"https://github.com/Reloaded-Project/Reloaded.Memory.SigScan","commit_stats":{"total_commits":116,"total_committers":3,"mean_commits":"38.666666666666664","dds":0.06034482758620685,"last_synced_commit":"9760d49f6b9c4c98eb1987f8e18206eb19d5c71f"},"previous_names":[],"tags_count":22,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Reloaded-Project%2FReloaded.Memory.SigScan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Reloaded-Project%2FReloaded.Memory.SigScan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Reloaded-Project%2FReloaded.Memory.SigScan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Reloaded-Project%2FReloaded.Memory.SigScan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Reloaded-Project","download_url":"https://codeload.github.com/Reloaded-Project/Reloaded.Memory.SigScan/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247601448,"owners_count":20964864,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis","csharp","game-hacking","signature-detection","signature-scanner"],"created_at":"2024-11-09T22:35:21.273Z","updated_at":"2025-04-07T06:11:18.118Z","avatar_url":"https://github.com/Reloaded-Project.png","language":"C#","readme":"\u003cdiv align=\"center\"\u003e\n\t\u003ch1\u003eProject Reloaded: Signature Scanning\u003c/h1\u003e\n\t\u003cimg src=\"https://i.imgur.com/BjPn7rU.png\" width=\"150\" align=\"center\" /\u003e\n\t\u003cbr/\u003e \u003cbr/\u003e\n\t\u003cstrong\u003e\u003ci\u003eIt's fast enough. I think...\u003c/i\u003e\u003c/strong\u003e\n\t\u003cbr/\u003e \u003cbr/\u003e\n\t\u003c!-- Coverage --\u003e\n\t\u003ca href=\"https://codecov.io/gh/Reloaded-Project/Reloaded.Memory.SigScan\"\u003e\n\t\t\u003cimg src=\"https://codecov.io/gh/Reloaded-Project/Reloaded.Memory.SigScan/branch/master/graph/badge.svg\" alt=\"Coverage\" /\u003e\n\t\u003c/a\u003e\n\t\u003c!-- NuGet --\u003e\n\t\u003ca href=\"https://www.nuget.org/packages/Reloaded.Memory.SigScan\"\u003e\n\t\t\u003cimg src=\"https://img.shields.io/nuget/v/Reloaded.Memory.SigScan.svg\" alt=\"NuGet\" /\u003e\n\t\u003c/a\u003e\n\t\u003c!-- Build Status --\u003e\n\t\u003ca href=\"https://github.com/Reloaded-Project/Reloaded.Memory.SigScan/actions/workflows/build-and-publish.yml\"\u003e\n\t\t\u003cimg src=\"https://img.shields.io/github/workflow/status/Reloaded-Project/Reloaded.Memory.SigScan/Build%20and%20Publish\" alt=\"Build Status\" /\u003e\n\t\u003c/a\u003e\n\u003c/div\u003e\n\n- [Introduction](#introduction)\n  - [Usage](#usage)\n  - [Reference Benchmarks](#reference-benchmarks)\n    - [Implementation Comparison](#implementation-comparison)\n    - [Small Data](#small-data)\n    - [Big Data](#big-data)\n    - [Other Benchmarks](#other-benchmarks)\n  - [Reloaded-II Shared Library](#reloaded-ii-shared-library)\n  - [Acknowledgements](#acknowledgements)\n\n# Introduction\n\n`Reloaded.Memory.SigScan`, is a pattern matching library for scanning byte signatures.  \n\nSignature scanning is often used in malware analysis (AV Software) and game hacking.  \nUsually both of those are the domain of native C/C++ code and at the time of writing this library, there existed very little on the managed .NET front that focuses on performance.  \n\n`Reloaded.Memory.SigScan` is biased towards ease of use and most importantly speed, achieving a staggering \u003e 5GB/s on a in non-vectorised searches and over 30GB/s on vectorised searches on a single thread.\n\n## Usage\n\nPatterns are specified as hex values, without prefix and delimited by spaces.  \n`??` represents a wildcard, i.e. any byte can be present in the place of the wildcard.  \n\n**Search the code of the current process**:\n```csharp\n// `FindPattern` will automatically use the most \n// efficient scanning method available on the current machine.  \nvar thisProcess = Process.GetCurrentProcess();\nvar scanner     = new Scanner(thisProcess, thisProcess.MainModule);\nint offset      = scanner.FindPattern(\"04 25 12 ?? ?? E5 E3\");\n```\n\n**Search an offset in a byte array:**\n```csharp\nvar scanner     = new Scanner(data);\nint offset      = scanner.FindPattern(\"02 11 25 AB\");\n```\n\n**Scan for multiple signatures (multithreaded)**\n```csharp\nvar scanner = new Scanner(data);\nvar multiplePatterns = new string[]\n{\n    \"7A BB\",\n    \"9F AB\",\n    \"7A BB\"\n};\n\n// Note: Use FindPatternsCached if your list of \n// patterns might contain duplicates.\nvar results = scanner.FindPatterns(multiplePatterns);\n```\n\n## Reference Benchmarks\n\nAll benchmarks were performed on a machine running:  \n- Core i7 4790k (4.4GHz OC)  \n- DDR3 1866MHz RAM (CL9 timings)  \n- .NET 5 Runtime  \n\nThe provided \"Speed\" column is an effective measure of pattern matching speed in MB/s.  \n\n- `NumItems`: Number of signatures scanned.  \n- `ST`: Single Threaded.  (baseline reference)\n- `MT`: Multi Threaded.  \n- `LB`: Load Balancing On.  \n- `Compiled`: Non-Vectorized implementation.  \n\n### Implementation Comparison\n\nScanning a small data (3MiB) with known signature at end of data.  \n\n```\n|   Method |       Mean |    Error |   StdDev | Ratio | RatioSD | Speed (MB/s) |\n|--------- |-----------:|---------:|---------:|------:|--------:|------------- |\n|      Avx |   232.4 us |  2.76 us |  2.58 us |  0.32 |    0.00 |     13535.33 |\n|      Sse |   284.7 us |  2.17 us |  2.03 us |  0.40 |    0.00 |     11049.62 |\n| Compiled |   715.7 us |  5.68 us |  5.03 us |  1.00 |    0.00 |      4395.52 |\n|   Simple | 3,098.3 us | 36.51 us | 34.15 us |  4.33 |    0.05 |      1015.31 |\n```\n\n### Small Data\n\nScanning a small data (3MiB) with random pre-selected 12 byte signatures.  \n\n```\n|         Method | NumItems | Speed (MB/s) |\n|--------------- |--------- |------------- |\n|      Random_ST |        1 |     13618.03 |\n| Random_MT_NoLB |        4 |     26394.96 |\n|   Random_MT_LB |        4 |     26326.17 |\n|   Random_MT_LB |       16 |     46032.68 |\n| Random_MT_NoLB |       16 |     50459.84 |\n|   Random_MT_LB |       64 |     56748.39 |\n| Random_MT_NoLB |       64 |     57970.04 |\n|   Random_MT_LB |      256 |     63418.04 |\n| Random_MT_NoLB |      256 |     63746.84 |\n```\n\n### Big Data\n\nScanning a random big data (200MiB) with random pre-selected 12 byte signatures.  \n\n```\n|             Method | NumItems | Speed (MB/s) |\n|------------------- |--------- |------------- |\n| Random_ST_Compiled |        1 |     10308.65 |\n|          Random_ST |        1 |     30025.36 |\n|     Random_MT_NoLB |        4 |     44669.77 |\n|       Random_MT_LB |        4 |     44572.28 |\n|       Random_MT_LB |       16 |     60354.57 |\n|     Random_MT_NoLB |       16 |     64928.73 |\n|       Random_MT_LB |       64 |     59824.99 |\n|     Random_MT_NoLB |       64 |     60502.48 |\n|     Random_MT_NoLB |      256 |     55931.01 |\n|       Random_MT_LB |      256 |     56763.69 |\n```\n\nSpeed loss in cases of \u003e16 items suggests increased cache misses.  \nMight be worth investigating in a future version.  \n\n### Other Benchmarks\nFor other benchmarks, please see the `Reloaded.Memory.Sigscan.Benchmark` project in this repository.\n\nTo run the benchmarks yourself, simply run `Reloaded.Memory.Sigscan.Benchmark` after compiling in `Release` mode.\n\n`Reloaded.Memory.Sigscan.Benchmark` is powered by [BenchmarkDotNet](https://github.com/dotnet/BenchmarkDotNet).\n\n## Reloaded-II Shared Library\n\nSee [Reloaded-II SigScan Shared Library](./External/Reloaded.Memory.SigScan.ReloadedII/README-RII.md).\n\n## Acknowledgements\n\nVectorised implementations of `Reloaded.Memory.Sigscan` are based off of a modified version of `LazySIMD` by [uberhalit](https://github.com/uberhalit).\n","funding_links":["https://github.com/sponsors/Sewer56"],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freloaded-project%2Freloaded.memory.sigscan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Freloaded-project%2Freloaded.memory.sigscan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Freloaded-project%2Freloaded.memory.sigscan/lists"}