Header-only layout, arch-aware patterns, IDA plugin

[scizzydo]

Summary

Header-only layout, SIMD scanning, target-architecture-aware patterns, and an IDA 9.x plugin that searches databases with the same pattern syntax.

-Pattern.hpp  RuntimePattern.hpp  CompileTimePattern.hpp  XORPattern.hpp  ArmPattern.hpp
+CMakeLists.txt                    # INTERFACE target PatternScanner::PatternScanner (C++17)
+include/PatternScanner/
+├── Pattern.hpp                   # SSE2/NEON scan, find_all, match()/resolve(), patterns::arch
+├── RuntimePattern.hpp            # + target arch argument
+├── CompileTimePattern.hpp
+├── XORPattern.hpp                # masks XOR'd too, unmask()
+├── ArmPattern.hpp                # now builds as C++17
+├── ArmXORPattern.hpp             # new
+└── RuntimeArmPattern.hpp         # new: arm64 assembly parsed at runtime
+tests/                            # separate CMake project
+plugins/ida/                      # IDA plugin, builds against the user's SDK + ida-cmake

Consumers: #include <PatternScanner/XORPattern.hpp> with include/ on the include path, or target_link_libraries(app PRIVATE PatternScanner::PatternScanner) via add_subdirectory / FetchContent.

Per-pattern target architecture replaces the #ifdef PATTERNS_ARM64 branches, so /d /r, X<len> and /a follow the code being scanned rather than the compiler target:

RuntimePattern(text, arch = host_arch)   # x86 | x64 | arm64
ArmPattern / ArmXORPattern / RuntimeArmPattern -> always arm64
resolve(match, end, &is_value)           # address vs value read from the code

Parsing is shared: one byte-pattern parser (detail::parse_bytes) and one arm64 parser (detail::parse_arm) behind all pattern classes.

IDA plugin (plugins/ida): Shift-Alt-B searches next/previous from the cursor or lists all matches with their /d /r results; Ctrl-Shift-B repeats. Byte patterns follow the database's architecture.

search (dialog) / repeat
  pscan::parse(text, kind)          # RuntimePattern(db_arch) | RuntimeArmPattern
  pscan::for_each_match(seg by seg, loaded runs only)
    buffer at the segment's 4KB page offset   # /a and ADRP page math
    Pattern::match -> resolve -> map back to ea

Evidence

• Before: master has no tests. ArmPattern.hpp didn't compile as C++17 despite the documented macros; on an arm64 host, byte-pattern /d decoded ADRP even for x86 code (and vice versa).
  After (Linux, clang 19 and gcc 14, fresh build dirs):

  tests/       clang 19/19 passed, gcc 19/19 passed
               test_patterns (+ PATTERNS_NO_SIMD), test_cpp17, test_arm, example_usage,
               test_artifacts_cpp{17,20}_{O0,O1,O2,O3,Os,O2_lto,O3_lto}
  plugins/ida  test_search (idalib, IDA 9.3) on x64 / x86 / arm64 ELF fixtures: passed
               plugin loads in headless idat and registers both actions
  

• test_artifacts: no pattern text from any compile-time type, no XOR plaintext bytes/words/masks, across optimization levels and LTO. Checked that it catches leaks by breaking the library on purpose:

  XOR decode without volatile  -> fails all 4 XOR types on clang (O2, O3, LTO) and gcc (O2, O3)
  macros built at runtime      -> fails COMPILETIME/ARM/XOR_PATTERN on clang C++17, every level
  

  A 40-pattern signature file (one function, like real usage): 0/40 leak on either compiler at any level or with LTO.
• idalib test catches a scan buffer at the wrong page offset (ADRP result) and the wrong /a step (x86 vs x64 database).

Merge Danger

Door: two-way

Plain revert; nothing persistent changes.

Blast Radius: consumers

• Header paths moved: #include "Pattern.hpp" from the repo root becomes #include <PatternScanner/Pattern.hpp> with include/ on the include path.
• Pattern::find(bytes, size) is no longer virtual; subclasses override match() instead. Pattern's destructor is protected (deleting through Pattern* no longer compiles).
• XORPattern::mask() now returns XOR'd bytes; use unmask() for the original.
• On arm64 hosts, behaviour for existing code is unchanged (the default arch is still the compile target).
• Byte patterns: ?8 was a whole-byte wildcard and is now a nibble (4? / ?8 are new). arm64: ADD/SUB immediates, SP register forms, shifted ORR/EOR/TST, and LDP/STP [Rn] now encode the way assemblers do, so patterns that silently never matched (or matched too much) now match exactly.
• /a aligns to the absolute address, not to the start of the buffer passed in.
• CI runs the library tests on Linux, Windows (MSVC) and macOS. Not tested: the plugin build on Windows / macOS. The plugin UI (dialog, chooser, menu, hotkeys) was only checked headless.

🤖 Generated with Claude Code