mistdumper
A configurable pattern finder for static analysis written in Dart.
It is meant to retrieve offsets from file on disk without running them.
This project has been inspired by hazedumper which is a runtime signature finder.
Usage
mistdumper.exe [options] <executablePath>
options :
-c, --config=<path> (mandatory) Path of the config file
-f, --format=<format> (mandatory) The output format
--[no-]versioned Should the version be appended to file name
executablePath Path of the executable to parse
Formatters
Mistdumper can format to multiple output formats.
Currently implemented output formats are :
- Dart
- C++
- CSharp
JSON configuration
Full structure :
{
"name": "ExampleApp Signature List",
"appname": "ExampleApp",
"version": "0.0.0.1",
"author": "Midi12",
"signatures" : [
{
"name": "s_globalPtr",
"relative": true,
"dereference": false,
"dereference_size": 0,
"offset": 3,
"extra": 12,
"pattern": "DE AD BE ?? ?? ?? ?? EF DE AD C0 DE ?? ?? ?? ??",
"namespace": "Statics"
}
]
}
- name : mandatory
- pattern : mandatory
- namespace : mandatory
- dereference : optional (default value :
false) - dereference_size : optional (default value :
4) - relative : optional (default value :
false) - offset : optional (default value :
0) - extra : optional (default value :
0)
Full example of JSON configuration:
{
"name": "ExampleApp Signature List",
"appname": "ExampleApp",
"version": "0.0.0.1",
"author": "Midi12",
"signatures" : [
{
"name": "s_globalPtr",
"relative": true,
"offset": 3,
"pattern": "DE AD BE ?? ?? ?? ?? EF DE AD C0 DE ?? ?? ?? ??",
"namespace": "Statics"
},
{
"name": "s_globalPtr__pOffset",
"dereference": true,
"dereference_size": 4,
"offset": 8,
"pattern": "DE AD BE ?? ?? ?? ?? EF DE AD C0 DE ?? ?? ?? ??",
"namespace": "Offsets"
},
{
"name": "ExampleFunction",
"extra": 12,
"pattern": "DE AD BE ?? ?? ?? ?? EF DE AD C0 DE ?? ?? ?? ??",
"namespace": "Functions"
}
]
}
Example outputs
Dart :
library mistdumper;
class Functions {
static const int ExampleFunction = 0xdeadc0de;
}
class Offsets {
static const int s_globalPtr__pOffset = 0xc0ffee;
}
class Statics {
static const int s_globalPtr = 0xdeadbeef;
}
C++ :
#pragma once
#include <cstdint>
namespace mistdumper {
namespace Functions {
constexpr ptrdiff_t ExampleFunction = 0xdeadc0de;
}
namespace Offsets {
constexpr ptrdiff_t s_globalPtr__pOffset = 0xc0ffee;
}
namespace Statics {
constexpr ptrdiff_t s_globalPtr = 0xdeadbeef;
}
}
CSharp :
using System;
namespace MistDumper
{
public static class Functions {
public static readonly UIntPtr ExampleFunction = 0xdeadc0de;
}
public static class Offsets {
public static readonly UIntPtr s_globalPtr__pOffset = 0xc0ffee;
}
public static class Statics {
public static readonly UIntPtr s_globalPtr = 0xdeadbeef;
}
}
Building from the source
You need Dart SDK 2.12.0 at least (https://dart.dev/get-dart).
In case you modified the JSON class you need to run dart run build_runner build.
Run dart compile exe .\bin\mistdumper.dart -o .\build\mistdumper.exe.
