sigmatch

A memory signature search library for the Windows platform written in Rust.

Features

• 🧩 Fluent API: Clear, logical calls for complex search workflows.
• ✨ Ergonomic: Ready to use, supports multiple signature formats.
• 🛡️ Robust Errors: Based on thiserror, rich context, panic-free.
• 🧱 Safe Memory: Auto skips inaccessible regions for stable scans.
• 🚀 Extreme Performance: Fast and stable by design.
• 🧪 Optimized & Tested: Actively tested, continually improved.

Quick Use

Assuming you've obtained the signatures via IDA-Pro-SigMaker.

Signature type	Example preview
IDA Signature	E8 ? ? ? ? 45 33 F6 66 44 89 34 33
x64Dbg Signature	E8 ?? ?? ?? ?? 45 33 F6 66 44 89 34 33
C Byte Array Signature + String mask	\xE8\x00\x00\x00\x00\x45\x33\xF6\x66\x44\x89\x34\x33 x????xxxxxxxx
C Raw Bytes Signature + Bitmask	0xE8, 0x00, 0x00, 0x00, 0x00, 0x45, 0x33, 0xF6, 0x66, 0x44, 0x89, 0x34, 0x33 0b1111111100001

[dependencies]
sigmatch = "0.2"

use sigmatch::{Result, Seeker};

fn example() -> Result<()> {

    let sker = Seeker::with_name("main")?;

    // Searching: forward search (push+mov+mov eax...)
    let addr = sker
        .search("6A ?? 89 E0 B8 ?? ?? ?? ?? C1 C0 05 05 ?? ?? ?? 90 90 90")?
        .addr()?;

    // Reverse search from mov eax block
    let addr = sker
        .search("B8 ?? ?? ?? ?? C1 C0 05 05 ?? ?? ?? 90 90 90")?
        .reverse_search("6A ?? 89 E0")?
        .addr()?;

    // Complex range + limit + offset
    let addr = sker
        .search("B8 ?? ?? ?? ?? C1 C0 05 05 ?? ?? ?? 90 90 90")?
        .limit(8)
        .reverse_search("6A ?? 89 E0")?
        .offset(16)
        .limit(1)
        .debug()
        .search("90")?
        .debug()
        .addr()?;

    // Rebind to system module
    sker.bind("ntdll.dll")?;

    // IDA-style pattern
    let _ = sker
        .search("? ? ? B8 C0 00 00 00 F6 04 25 ? ? ? ? 01 75 ? 0F 05 C3")?
        .addr()?;

    // x64dbg-style pattern
    let _ = sker.search("?? ?? ?? B8 C0 00 00 00 F6 04 25")?.addr()?;

    // C-style raw + mask
    let _ = sker.raw_search(
        b"\x00\x00\x00\xB8\xC0\x00\x00\x00\xF6\x04\x25",
        "???xxxxxxxx",
    )?;

    // C-style raw + bitmap
    let _ = sker.raw_search_bitmap(
        b"\x00\x00\x00\xB8\xC0\x00\x00\x00\xF6\x04\x25",
        0b00011111111,
    )?;

    Ok(())
}

Recent

• Added support for method chaining
• Introduced section-based signature scanning
• Added limit() and offset() methods to control search behavior
• Improved unit test coverage
• Reorganized project structure for better clarity

Planned Features

• Support reference search
• Cross-platform support (Linux, macOS, etc.)
• Multi-threaded scanning for performance
• Expanded and more comprehensive test coverage

Examples & Issues

• See more examples in the examples directory.
• Report bugs or suggestions via issues.