Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Speed up signature scanning #44

Open
CryZe opened this issue Jul 6, 2023 · 0 comments
Open

Speed up signature scanning #44

CryZe opened this issue Jul 6, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@CryZe
Copy link
Collaborator

CryZe commented Jul 6, 2023

We currently use a highly efficient algorithm to match a signature against a specific position. The problem is however that making this fast isn't really helping all too much because the chance that the signature is not matching is very high, so no matter what you do, it'll be rejected very quickly anyway. So while a correct match is checked really quickly, that doesn't speed up all the cases where it doesn't match. Instead you really want to check many addresses in parallel at the same time. The standard approach is to splat a single byte into a SIMD vector and match 16 bytes (or whatever your SIMD vector width is) at the same time. The problem is of course that we don't just care about a single byte, but the whole signature. So you use this to quickly find good candidates to do the full signature match against. This is also exactly how Rust's hash map is that fast. In order to reduce false positives there's the idea to splat two separate bytes from the signatures into two simd vectors at the same time and only consider candidates where both bytes match. If the two bytes are also well chosen (you probably don't want 0x00 or 0xFF), then you should be able to very quickly skip through the memory. This algorithm is documented here: http://0x80.pl/articles/simd-strfind.html#algorithm

@CryZe CryZe added the enhancement New feature or request label Jul 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant