fix: resolve signature collision using body pattern and backtracking

[rbtt]

Summary

This pull request resolves an issue where the patcher fails to apply correctly due to pattern collisions in the latest game update.

The original 7-byte signature (31 c0 48 85 f6 0f 84 — corresponding to the prologue xor eax, eax; test rsi, rsi; je ...) is a common compiler-generated instruction sequence. In the current version of the binary, this sequence matches multiple locations in the executable segment of libclient.so, causing the patcher to target an incorrect function.

Proposed Changes

To address the pattern collisions, this change introduces a two-stage lookup mechanism:

1. Unique Signature Match: The scanning pattern is updated to search for a unique 11-byte sequence inside the function body: c7 45 d4 ff ff ff ff c7 45 d8 (mov DWORD PTR [rbp-0x2c], 0xffffffff; mov DWORD PTR [rbp-0x28], 0xffffffff).
2. Backtracking: Once this unique sequence is located, the patcher scans backward byte-by-byte to find the start of the function prologue (31 c0 48 85 f6 0f 84).
3. Patching: The target byte is modified at the resolved start address.

Modified Files

• main.s:
  • Updated PATTERN_LEN and pattern_bytes to use the new unique 11-byte sequence.
  • Added a backwards_loop assembly block under found_match to backtrack to the function entry point before writing the patch byte.

Verification and Testing

• Verified the binary compiles successfully via build.sh.
• Tested on a running process to confirm it correctly resolves the function address and applies the modification to the correct memory location.

[rbtt]

Addresses issue #7