sigscan

Name: sigscan
Author: Heath Howren

Byte-signature scanner library and CLI

Price

Free

Version

1.0.0

Platform

Windows

License

MIT

Free & Open Source Signature Scanning Header-Only Library C++20 32 & 64-bit

A signature is only useful if something can find it again. Each tool writes one its own way: x64dbg spells a wildcard byte ??, IDA spells it ?, and code-style scanners want a byte string and a mask. sigscan reads all of those, plus a Cheat Engine or Pointer Lab aobscanmodule line, and finds the pattern. It searches a byte buffer, a PE file on disk, or a module in a running process. A pattern it cannot read is refused with a reason, not reported as “not found”. The library is one C++20 header with no dependencies, and sigscan.exe puts it on the command line. It reads every form Signature Lab writes. It is also the pattern scanner behind the signature-scanning chapter of The Game Hacker’s Handbook.

Free

sigscan.exe and the single header, in an x64 or an x86 zip

↓ Download from GitHub View Source on GitHub

Developer

Game Reversal Club

Open Source Software

See all software from this developer

What You Get

Run sigscan --file with an executable and a pattern, and this is what it prints. This is real output. The signature is the one Signature Lab made for a function in the tutorial that ships with Pointer Lab, and the file is a local build of that tutorial.

pattern 48 89 5C 24 08 57 48 83 EC 20 48 8B 05 ?? ?? ?? ?? 48 8B D9  (20 bytes, 4 wildcards)
file    PointerLabTutorial.exe (PE32+, 7 sections)
backend AVX2
match   RVA 0x00001670  file offset 0x00000A70  .text
1 match

The RVA is the same one Signature Lab reported for this function inside x64dbg, pointerlabtutorial.exe+0x1670. The file offset is where those bytes sit in the file itself. You can check a signature against the file before the program is running.

How It Works

Every common form
x64dbg patterns with ??, 4? nibble wildcards or no separators, IDA patterns with ?, code-style bytes with an x/? or 0b mask, C++ arrays, and aobscanmodule(...) lines. Every form round-trips against the bytes Signature Lab writes.
Bad input is an error
A mask whose length does not match its bytes, a lone hex digit, a three-digit array value or a stray character is refused with a reason. A mask mismatch that was quietly ignored would show up as “not found” and leave you to guess why.
SSE2, AVX2 or scalar
The scan backend is chosen at run time from the CPU. find returns the first match and findAll returns every match. A pattern with no fixed byte falls back to the scalar path.
Page by page
The region scanner reads a process or image one page at a time and carries a tail between windows, so a match that straddles a boundary is found once. A page that cannot be read ends the current run. Scanning starts again past it, and no match is reported across the gap.
Files and live processes
scanPeFile reports each match by file offset and, where a section or the headers back it, by RVA. scanProcessModule opens the process read-only, finds the module by name, and reports each match by virtual address and RVA.
From a match to an address
The resolve helpers turn a match back into the address it refers to: a RIP-relative displacement, a near call or jump target, or an absolute 32- or 64-bit field. readRipRelative follows a [rip+disp] operand and reads the pointer there. The arithmetic matches Signature Lab’s resolve line.

Item Specifics

Name

sigscan

Author

Heath Howren (“Cyborg Elf”)

Version

1.0.0 (2026)

Type

Byte-signature scanner: single-header C++ library and command-line tool

Platform

Windows, x64 and x86. The header is portable C++20; the build is set up for MSVC

License

MIT License

Price

Free

Language

C++20

Dependencies

None. The header includes only the standard library, and windows.h for the live-process code. The tests use Catch2 3.5.2

Distribution

sigscan-v1.0.0-windows-x64.zip and sigscan-v1.0.0-windows-x86.zip, each with sigscan.exe and include/sigscan/sigscan.hpp

Requirements

Nothing to run the tool: the C runtime is linked statically. To build: Visual Studio 2022 with the C++ workload and CMake 3.28 or newer

Tests

34 unit tests (Catch2), run in CI on x64 and x86, Debug and Release

Source Code

github.com/HeathHowren/sigscan

Features

x64dbg patterns with ??

Nibble wildcards such as 4?

Patterns with no separators

IDA patterns with ?

Code-style bytes with an x/? mask

0b bitmasks

C++ arrays with a mask

Cheat Engine aobscanmodule lines

Pointer Lab aobscanmodule lines

Malformed patterns refused with a reason

Mask-length check

SSE2 and AVX2 scanners

Scalar fallback

First match or all matches

Page-aware region scanner

On-disk PE scanning

RVA and file offset per match

Live process module scanning

Resolve a match to its target

One header, no dependencies

x64 and x86 builds

34 unit tests, run in CI

Before You Download

Intended use. sigscan is for studying software you own or are authorized to analyze: your own programs, single-player games, CTF binaries, and the Handbook’s lab targets. Reading the memory of online or competitive games will very likely trip anti-cheat software and get the account banned, and analyzing software you do not have permission to analyze may be illegal where you live. This is a research tool.

Match the target. To scan a live process, run as the same user as the target and match its bitness. The 32-bit sigscan.exe reads 32-bit processes, and the 64-bit one reads 64-bit processes. A process owned by another user, or an elevated one, needs the matching privileges.

Using the header in your own code. scanProcessModule and findModule are defined only in the file that defines SIGSCAN_IMPLEMENTATION before it includes the header. Define it in one .cpp, so windows.h is pulled in once.

The binaries are unsigned. Antivirus software may flag a tool that reads another process’s memory. Build it from source if you would rather not take a binary on trust.