Scanner.cpp

#include "Scanner.hpp"
#include <iostream>
#include <fstream>
#include <sstream>
#include <iomanip>
#include <map>
#include <psapi.h>

#pragma comment(lib, "psapi.lib")

using namespace std;

Scanner::Scanner() {
    scanStart = 0;
    scanEnd = 0;
}

// --- PE PARSER HELPERS ---
uint32_t Scanner::readU32(size_t offset) {
    if (offset + 4 > targetBuffer.size()) return 0;
    return targetBuffer[offset] | (targetBuffer[offset + 1] << 8) |
        (targetBuffer[offset + 2] << 16) | (targetBuffer[offset + 3] << 24);
}

uint16_t Scanner::readU16(size_t offset) {
    if (offset + 2 > targetBuffer.size()) return 0;
    return targetBuffer[offset] | (targetBuffer[offset + 1] << 8);
}

bool Scanner::parsePE() {
    if (targetBuffer.size() < 64) return false;

    // VERIFY  MZ SIGNATURE
    if (targetBuffer[0] != 0x4D || targetBuffer[1] != 0x5A) return false;

    uint32_t peOffset = readU32(0x3C);
    if (peOffset + 24 > targetBuffer.size()) return false;

    // VERIFY PE SIGNATURE
    if (targetBuffer[peOffset] != 'P' || targetBuffer[peOffset + 1] != 'E' ||
        targetBuffer[peOffset + 2] != 0 || targetBuffer[peOffset + 3] != 0) return false;

    cout << "[+] Valid Windows PE File detected. Mapping all sections..." << endl;

    uint16_t numSections = readU16(peOffset + 6);
    uint16_t optHeaderSize = readU16(peOffset + 20);
    uint32_t sectionOffset = peOffset + 24 + optHeaderSize;

    foundSections.clear();

    // WE MAP THE HEADER AS FIRST SECTION
    foundSections.push_back({ "HEADER", 0, peOffset + 24 });

    for (int i = 0; i < numSections; ++i) {
        if (sectionOffset + 40 > targetBuffer.size()) break;

        string secName = "";
        for (int j = 0; j < 8; ++j) {
            char c = targetBuffer[sectionOffset + j];
            if (c == 0) break;
            secName += c;
        }

        uint32_t rawSize = readU32(sectionOffset + 16);
        uint32_t rawPointer = readU32(sectionOffset + 20);

        // CHECK IF THE MAPPING THERE IS A SPACE IN MEMORY
        if (rawSize > 0 && rawPointer > 0) {
            foundSections.push_back({ secName, rawPointer, rawPointer + rawSize });
            cout << "  [>] Section: " << left << setw(8) << secName 
                 << " | Offset: 0x" << hex << uppercase << rawPointer 
                 << " | Size: " << dec << rawSize << " bytes" << endl;
        }
        sectionOffset += 40;
    }

    return true;
}

// --- SCANNER MODES (STATIC & DYNAMIC) ---
bool Scanner::scanProcess(DWORD pid, std::string outputFile) {
    HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
    if (!hProcess) {
        cerr << "[-] Failed to open process. Error: " << GetLastError() << endl;
        return false;
    }

    HMODULE hMod;
    DWORD cbNeeded;
    if (EnumProcessModules(hProcess, &hMod, sizeof(hMod), &cbNeeded)) {
        MODULEINFO modInfo;
        if (GetModuleInformation(hProcess, hMod, &modInfo, sizeof(modInfo))) {
            size_t bufferSize = modInfo.SizeOfImage;
            targetBuffer.resize(bufferSize);
            SIZE_T bytesRead;

            if (ReadProcessMemory(hProcess, modInfo.lpBaseOfDll, targetBuffer.data(), bufferSize, &bytesRead)) {
                cout << "[+] Successfully read " << bytesRead << " bytes from live RAM (PID: " << pid << ")" << endl;
                
                // Em memória, escaneamos a imagem inteira carregada
                foundSections.clear();
                SectionRange fullImage = { "RAM_IMG", 0, (uint32_t)bufferSize };
                foundSections.push_back(fullImage);

                this->run(outputFile);
            }
        }
    }

    CloseHandle(hProcess);
    return true;
}

// LOAD THE TARGET FILE
bool Scanner::loadTarget(const string& filename) {
    ifstream file(filename, ios::binary | ios::ate);
    if (!file.is_open()) return false;

    streamsize size = file.tellg();
    file.seekg(0, ios::beg);

    targetBuffer.resize(size);
    if (file.read(reinterpret_cast<char*>(targetBuffer.data()), size)) {
        if (!parsePE()) {
            foundSections.clear();
            SectionRange fullFile = { "RAW_DATA", 0, (uint32_t)targetBuffer.size() };
            foundSections.push_back(fullFile);
        }
        return true;
    }
    return false;
}

// --- ENGINE LOGIC ---
vector<SigByte> Scanner::compilePattern(const string& hexStr) {
    vector<SigByte> result;
    stringstream ss(hexStr);
    string byteStr;

    while (ss >> byteStr) {
        SigByte b;
        if (byteStr == "??" || byteStr == "?") {
            b.isWildcard = true;
            b.value = 0x00;
        } else {
            b.isWildcard = false;
            b.value = static_cast<uint8_t>(stoi(byteStr, nullptr, 16));
        }
        result.push_back(b);
    }
    return result;
}

// LOAD THE SIGNATURES OF WORDLIST
bool Scanner::loadSignatures(const string& filename) {
    ifstream file(filename);
    string line;
    if (!file.is_open()) return false;

    signatures.clear();
    while (getline(file, line)) {
        if (line.empty() || line[0] == '#') continue;

        size_t firstPipe = line.find('|');
        size_t secondPipe = line.find('|', firstPipe + 1);

        if (firstPipe != string::npos && secondPipe != string::npos) {
            Signature sig;
            sig.category = line.substr(0, firstPipe);
            sig.originalPattern = line.substr(firstPipe + 1, secondPipe - firstPipe - 1);
            sig.description = line.substr(secondPipe + 1);
            sig.compiledPattern = compilePattern(sig.originalPattern);
            signatures.push_back(sig);
        }
    }
    return true;
}

// INITIALIZE SCANNER
bool Scanner::init(const string& sigFile, const string& targetFile) {
    if (!loadSignatures(sigFile)) {
        cerr << "[-] Error: Could not load signatures." << endl;
        return false;
    }
    cout << "[+] Loaded " << signatures.size() << " signatures from wordlist." << endl;

    if (!loadTarget(targetFile)) {
        cerr << "[-] Error: Could not load target." << endl;
        return false;
    }
    return true;
}

// RUN THE SCANNER
void Scanner::run(const string& outputFile) {
    cout << "[*] Starting Global Deep Scan (0x0 to 0x" << hex << uppercase << targetBuffer.size() << ")..." << endl;

    if (targetBuffer.empty() || signatures.empty()) {
        cout << "[-] No data to scan. Exiting." << endl;
        return;
    }

    int totalMatches = 0;
    map<string, vector<MatchRecord>> categorizedResults;

    // GLOBAL SCANNING
    for (size_t i = 0; i < targetBuffer.size(); ++i) {
        for (const auto& sig : signatures) {
            bool match = true;
            size_t sigSize = sig.compiledPattern.size();

            if (i + sigSize > targetBuffer.size()) continue;

            for (size_t j = 0; j < sigSize; ++j) {
                if (!sig.compiledPattern[j].isWildcard &&
                    targetBuffer[i + j] != sig.compiledPattern[j].value) {
                    match = false;
                    break;
                }
            }

            if (match) {
                totalMatches++;

                string location = "OVERLAY/UNKNOWN";
                for (const auto& sec : foundSections) {
                    if (i >= sec.start && i < sec.end) {
                        location = sec.name;
                        break;
                    }
                }

                MatchRecord record = { i, sig.originalPattern, sig.description + " [In: " + location + "]" };
                categorizedResults[sig.category].push_back(record);
            }
        }
    }

    // --- SHOW RESULTS ---
    cout << "\n=========================================" << endl;
    cout << "             SCAN RESULTS                " << endl;
    cout << "=========================================" << endl;

    if (categorizedResults.empty()) {
        cout << "[+] Binary looks clean. No signatures found." << endl;
    } else {
        for (const auto& categoryPair : categorizedResults) {
            const string& categoryName = categoryPair.first;
            const vector<MatchRecord>& matches = categoryPair.second;

            cout << "\n" << categoryName << " - Found " << matches.size() << " match(es):" << endl;
            cout << "-----------------------------------------" << endl;

            // Smart Trim for terminal
            size_t displayLimit = (matches.size() > 10) ? 5 : matches.size();

            for (size_t i = 0; i < displayLimit; ++i) {
                cout << "  [+] Offset: 0x" << uppercase << hex << setfill('0') << setw(8) << matches[i].offset << dec
                     << " | " << matches[i].description << endl;
            }

            if (matches.size() > 10) {
                cout << "  ... and " << (matches.size() - displayLimit) << " more hidden to prevent terminal flood." << endl;
            }
        }
    }

    cout << "\n[*] Scan complete. Total matches across all categories: " << totalMatches << endl;

    // --- EXPORTS LOG IF USER SET IT ---
    if (!outputFile.empty()) {
        ofstream outFile(outputFile);
        if (outFile.is_open()) {
            outFile << "SIGHUNTER DEEP SCAN REPORT\n==========================\n\n";
            for (const auto& cp : categorizedResults) {
                outFile << "[" << cp.first << "]\n";
                for (const auto& m : cp.second) {
                    outFile << "0x" << hex << uppercase << m.offset << " | " << m.description << "\n";
                }
                outFile << "\n";
            }
            outFile.close();
            cout << "[+] Full report exported to: " << outputFile << endl;
        }
    }
}