Finding and replacing pattern in memory - c++

Question

I've been struggling with this for the better part of a day, rewriting every which way and referencing documentation and even other people's code, but no matter what I do, I can't seem to get my code to work.
A thread in my process is attempting to search the memory of another thread. I'm looking to fix something in a specific module, but I'm furthermore not sure how to or if it's worth narrowing down my search, so right now it's just searching the entire process--and possibly itself? Who knows?
Whenever I latch on a debugger, I can find this set of bytes just fine (equivalent to mov rsi, rax; test dil, 1; jz short loc_...), but for the life of me I can't at all seem to find it.
I found that I did rarely find it, which definitely means that for some reason my search appears to be accessing... well, irrelevant things, and probably finding this purely by chance. I've absorbed so many names and concepts in a single day I think it just isn't sitting right in my head. What's going wrong here?
Addon.cpp
#include <iostream>
#include "Addon.h"
#include <sstream>
#include <vector>
int pattern[] = { 0x48, 0x8B, 0xF0, 0x40, 0xF6, 0xC7, 0x01, 0x74, 0x3E };
int replace[] = { 0x48, 0x8B, 0xF0, 0x40, 0xF6, 0xC7, 0x00, 0x75, 0x3E };
DWORD WINAPI background(LPVOID lpParam)
{
HANDLE h = GetCurrentProcess();
while (true) //for now
{
MEMORY_BASIC_INFORMATION mbi;
unsigned char* p = NULL;
for (p = NULL; VirtualQueryEx(h, p, &mbi, sizeof(mbi)) == sizeof(mbi); p += mbi.RegionSize)
{
std::vector<char> buffer;
if (mbi.State == MEM_COMMIT && mbi.Type == MEM_MAPPED || mbi.Type == MEM_PRIVATE)
{
SIZE_T bytes_read;
buffer.resize(mbi.RegionSize);
ReadProcessMemory(h, p, &buffer[0], mbi.RegionSize, &bytes_read);
buffer.resize(bytes_read);
}
std::vector<char> new_tail(buffer.end() - 9, buffer.end());
for (char t : old_tail)
buffer.push_back(t);
old_tail = new_tail;
if (std::search(buffer.begin(), buffer.end(), std::begin(pattern), std::end(pattern) != buffer.end())
{
MessageBoxA(NULL, "Found", "Found", NULL);
}
}
}
return 0;
}
Added other files on request.
Addon.h
#pragma once
#include <iostream>
#include "windows.h"
#ifdef ADDON_EXPORTS
#define ADDON_API __declspec(dllexport)
#else
#define ADDON_API __declspec(dllimport)
#endif
DWORD WINAPI background(LPVOID lpParam);
dllmain.cpp
#include "windows.h"
#include <string>
#include <tchar.h>
#include "Addon.h"
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
DWORD thread;
CreateThread(NULL, 0, background, 0, 0, &thread);
if (thread == NULL)
{
MessageBoxA(NULL, "Failed to start crash fix", "Error", MB_ICONERROR);
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

Answer 1

The problem was in the definition of pattern (and replace). It was defined as int, whereas it should be char. As Ted Lyngmo said, 'sometimes the answer stares you right in the good eye.'