goblin-sigscan

goblin-sigscan provides pelite-style pattern parsing and scanner behavior over goblin-backed PE/ELF/Mach binaries.

Workspace crates

• crates/goblin-sigscan-pattern: pattern parser and atom model
• crates/goblin-sigscan: scanner/runtime API and format wrappers
• crates/goblin-sigscan-macros: pattern! compile-time parsing macro
• crates/goblin-sigscan-cli: small CLI for pelite-style signature scanning

Quick start

use goblin_sigscan::pattern;

let atoms = pattern::parse("48 8B ? ? ? ? 48 89")?;
let save_slots = pattern::save_len(&atoms);
assert!(save_slots >= 1);
# Ok::<(), goblin_sigscan::pattern::ParsePatError>(())

Before scanning, ensure the save buffer has enough capacity for at least pattern::save_len(&atoms) elements (or PreparedPattern::required_slots()). Slot 0 always holds the match base address.

For syntax onboarding, see the public docs on goblin_sigscan::pattern and goblin_sigscan_pattern::parse.

Docs.rs navigation shortcuts:

• crate tutorial: https://docs.rs/goblin-sigscan/latest/goblin_sigscan/
• pattern module: https://docs.rs/goblin-sigscan/latest/goblin_sigscan/pattern/
• parser crate: https://docs.rs/goblin-sigscan-pattern/latest/goblin_sigscan_pattern/

Benchmarks

See scripts/README.md for benchmark workflows, A/B comparisons, and guidance for reducing run-to-run noise.

Credits

This project borrows heavily from the original pelite pattern model and syntax. Huge thanks to CasualX and his pelite project:

• https://github.com/CasualX/pelite
• https://docs.rs/pelite/latest/pelite/pattern/

License

Licensed under the MIT License. See LICENSE for details.