c++ - 我可以做些什么来提高内存搜索速度？

Question

所以...我有这个功能来搜索内存中的字节模式，效果很好，但此时，它非常慢...有什么我可以做的让它更快(因为我仍在掌握 C++)？是否有可能比这更快地扫描内存？

BOOL MemoryManager::MemSearch(BYTE * bSearchData, int nSearchSize, DWORD_PTR dwStartAddr, DWORD_PTR dwEndAddr, BOOL bIsCurrProcess, int iSearchMode, std::vector<DWORD_PTR> &vRet) {
BYTE* pCurrMemoryData = NULL;
MEMORY_BASIC_INFORMATION    mbi;
std::vector<MEMORY_REGION> m_vMemoryRegion;
mbi.RegionSize = 0x1000;
DWORD dwAddress = dwStartAddr;

while (VirtualQueryEx(hProcess, (LPCVOID)dwAddress, &mbi, sizeof(mbi)) && (dwAddress < dwEndAddr) && ((dwAddress + mbi.RegionSize) > dwAddress)) {
    if ((mbi.State == MEM_COMMIT) && ((mbi.Protect & PAGE_GUARD) == 0) && (mbi.Protect != PAGE_NOACCESS) && ((mbi.AllocationProtect & PAGE_NOCACHE) != PAGE_NOCACHE)) {
        MEMORY_REGION mData = { 0 };
        mData.dwBaseAddr = (DWORD_PTR)mbi.BaseAddress;
        mData.dwMemorySize = mbi.RegionSize;
        m_vMemoryRegion.push_back(mData);
    }
    dwAddress = (DWORD)mbi.BaseAddress + mbi.RegionSize;
}

std::vector<MEMORY_REGION>::iterator it;
for (it = m_vMemoryRegion.begin(); it != m_vMemoryRegion.end(); it++) {
    MEMORY_REGION mData = *it;

    DWORD_PTR dwNumberOfBytesRead = 0;

    if (bIsCurrProcess) {           
        pCurrMemoryData = (BYTE*)mData.dwBaseAddr;
        dwNumberOfBytesRead = mData.dwMemorySize;
    } else {
        pCurrMemoryData = new BYTE[mData.dwMemorySize];
        ZeroMemory(pCurrMemoryData, mData.dwMemorySize);            
        ReadProcessMemory(hProcess, (LPCVOID)mData.dwBaseAddr, pCurrMemoryData, mData.dwMemorySize, &dwNumberOfBytesRead);                  

        if ((int)dwNumberOfBytesRead <= 0) {
            delete[] pCurrMemoryData;
            continue;
        }
    }
    if (iSearchMode == 0) {
        DWORD_PTR dwOffset = 0;
        int iOffset = MemFind(pCurrMemoryData, dwNumberOfBytesRead, bSearchData, nSearchSize);
        while (iOffset != -1) {
            dwOffset += iOffset;
            vRet.push_back(dwOffset + mData.dwBaseAddr);
            dwOffset += nSearchSize;
            iOffset = MemFind(pCurrMemoryData + dwOffset, dwNumberOfBytesRead - dwOffset - nSearchSize, bSearchData, nSearchSize);
        }
    } else if (iSearchMode == 1) {
        DWORD_PTR dwOffset = 0;
        int iOffset = SundaySearch(pCurrMemoryData, dwNumberOfBytesRead, bSearchData, nSearchSize);

        while (iOffset != -1) {
            dwOffset += iOffset;
            vRet.push_back(dwOffset + mData.dwBaseAddr);
            dwOffset += nSearchSize;
            iOffset = MemFind(pCurrMemoryData + dwOffset, dwNumberOfBytesRead - dwOffset - nSearchSize, bSearchData, nSearchSize);
        }
    }

    if (!bIsCurrProcess && (pCurrMemoryData != NULL)) {
        delete[] pCurrMemoryData;
        pCurrMemoryData = NULL;
    }
}
return TRUE;
}

编辑:添加 MemSearch 和 SundaySearch 以供引用:

int MemFind(BYTE *buffer, int dwBufferSize, BYTE *bstr, DWORD dwStrLen)
{
if (dwBufferSize <0)
{
    return -1;
}
DWORD  i, j;
for (i = 0; i < dwBufferSize; i++)
{
    for (j = 0; j < dwStrLen; j++)
    {
        if (buffer[i + j] != bstr[j] && bstr[j] != '?')
            break;
    }
    if (j == dwStrLen)
        return i;
}
return -1;
}

int SundaySearch(BYTE* bStartAddr, int dwSize, BYTE* bSearchData, DWORD      dwSearchSize)
{
if (dwSize < 0)
{
    return -1;
}
int iIndex[256] = { 0 };
int i, j;
DWORD k;

for (i = 0; i < 256; i++)
{
    iIndex[i] = -1;
}

j = 0;
for (i = dwSearchSize - 1; i >= 0; i--)
{
    if (iIndex[bSearchData[i]] == -1)
    {
        iIndex[bSearchData[i]] = dwSearchSize - i;
        if (++j == 256)
            break;
    }
}
i = 0;
BOOL bFind = FALSE;
j = dwSize - dwSearchSize + 1;
while (i < j)
{
    for (k = 0; k < dwSearchSize; k++)
    {
        if (bStartAddr[i + k] != bSearchData[k])
            break;
    }
    if (k == dwSearchSize)
    {
        bFind = TRUE;
        break;
    }
    if (i + dwSearchSize >= dwSize)
    {

        return -1;
    }
    k = iIndex[bStartAddr[i + dwSearchSize]];
    if (k == -1)
        i = i + dwSearchSize + 1;
    else
        i = i + k;
}
if (bFind)
{
    return i;
}
else
    return -1;

}

在本例中，我使用的是 SundaySearch

谢谢!

Answer 1

我相信这是可能的。但为什么不对代码进行基准测试、找到热路径并看看您可以合理地优化它呢？除此之外，只是一些想法，因为我只是浏览了代码。

• 你能预分配一次内存而不是在循环中分配吗？请参阅 rMemoryData = new BYTE[mData.dwMemorySize];

• 归零真的有必要吗？参见 ZeroMemory(pCurrMemoryData, mData.dwMemorySize);

• vector::reserve() 可以为您的 vRet 提供一些元素吗？还是不可预测的并且您宁愿冒险在 push_back() 上进行分配？

• 您确定您的搜索算法很好吗？参见 MemFind() 和 SundaySearch() ?