SPF Ghidra Pattern Helper

Ghidra pattern helper for generating and searching byte signatures, with optional SPF-style template support.

---

Table of Contents

• Overview
• SPF Framework Integration
• Installation
• Launch Methods
• Pattern Generator Tab
  • Output Fields Reference
• Pattern Finder Tab
• Search Syntax Reference
• How to Use
  • Generate a Pattern
  • Search a Pattern
  • Optional Auto-Verify
• Troubleshooting & Tips
• Notes
• Support the Project

---

Overview

SPF Ghidra Pattern Helper is a Ghidra script for creating and testing byte patterns.

The script was created to make pattern work faster, cleaner, and less manual:

• generate patterns directly from selected instructions
• search with flexible byte syntax
• quickly move between generated output and search results
• avoid copying patterns by hand between tabs and tools

Tip

For best results, select stable instruction sequences (3+ instructions) rather than tiny or highly repeated fragments. A single-instruction pattern often matches too many locations.

Tip

If you generate a pattern that matches hundreds of results, try adding more instructions to the selection. The auto-verify feature will warn you when a match count seems too high.

---

SPF Framework Integration

This script was created for SPF Framework to make plugin development faster and less manual.

For SPF-Framework, it supports compact template-style signatures like:

[MOV [r64+off8], r32] [XOR r32, r32] [CALL rel32] [MOVSS [r64+off8], xmm] [LEA r64, [r64+off8]] ...

This makes it easier to work with the simplified signature style used by SPF-based plugins.

Note

Template signatures are converted to raw patterns internally. If no template matches an instruction, the generator falls back to automatic displacement masking — the output still works with SPF-Framework's PatternFinder.

---

Installation

Script Directory

1. Copy GhidraPatternHelper.java into a Ghidra script folder.
2. Open Ghidra.
3. Go to Window -> Script Manager.
4. Open Script Directories.
5. Add the folder that contains GhidraPatternHelper.java.
6. Refresh the script list.
7. Run GhidraPatternHelper.

One-Time Run from Script Manager

If the script is already in a configured Ghidra script directory:

1. Open Window -> Script Manager.
2. Find GhidraPatternHelper.
3. Run it directly from the list.

---

Launch Methods

The script can be started in two ways:

Menu

• Tools -> SPF Pattern Helper

Hotkey

• Ctrl + Alt + P

Tip

The hotkey only works while the Script Manager is open at least once per session. After that, Ghidra remembers the key binding.

---

Pattern Generator Tab

The generator produces up to four forms of the same pattern from your selection:

Exemple for:

* /--- Ghidra: ---/
* 140fb5e27  40 38 38                      CMP byte ptr [RAX],DIL
* 140fb5e2a  75 2C                         JNZ 0x140fb5e58
* 140fb5e2c  48 8B 16                      MOV RDX,qword ptr [RSI]
* 140fb5e2f  48 8D 0D 0A 9B 15 01          LEA RCX,[0x14210f940]
* 140fb5e36  48 8B 92 38 06 00 00          MOV RDX,qword ptr [RDX + 0x638]

40 [CMP [r64], r8] [JNE rel8] [MOV r64, [r64]] [LEA r64, [rip+off32]] [MOV r64, [r64+off32]]

40 38 38 75 ? 48 8B 16 48 8D 0D ? ? ? ? 48 8B 92 ? ? ? ?

40 38 [00-3f] [SIB?] 75 ? 48 8b [00-3f] [SIB?] 4[8-f] 8d [05|0d|15|1d|25|2d|35|3d] ? ? ? ? 48 8b [80-bf] [SIB?] ? ? ? ?

40 38 38 75 2C 48 8B 16 48 8D 0D 0A 9B 15 01 48 8B 92 38 06 00 00

Output Fields Reference

Field	Description	When to Use
SPF Pattern	Compact template names like [CMP r64, [r64+off32]] separated by spaces. Each instruction is replaced by a named template if one matches.	Readable signatures for SPF-Framework PatternFinder. Ideal for use in SPF-Framework..
Extended Signature	Template raw patterns (same ranges as PatternTemplates.hpp) joined together. Shows the actual masked pattern like 4[8-f] 3b [80-bf] [SIB?] ? ? ? ?. REX prefix is emitted explicitly when needed.	When you want to see (or tweak) the exact range-based pattern before using it. Fully compatible with SPF-Framework.
Raw Pattern (Masked Hex)	Specific hex bytes with ? for masked values. Example: 48 3B 98 ? ? ? ? 0F 83 ? ? ? ?. Uses the instruction's actual REX byte.	Quick copy-paste for most workflows. Balances readability with precision.
Raw Bytes (Pure Hex)	Exact hex bytes with no masking. Example: 48 3B 98 80 00 00 00 0F 83 0A 02 00 00.	Debugging, diffing, or when you need the literal instruction bytes.
Comment	Formatted block with addresses and disassembly for documentation.	Pasting into code as a reference comment above a signature.

Warning

An Extended Signature may include a variable REX prefix (4[8-f]) while the Raw Pattern uses the literal REX byte from the selection. Both are valid — the extended form is broader, the raw form is more specific to the original instruction.

---

Pattern Finder Tab

• searches the loaded program for a pattern
• supports searching in all executable sections
• supports searching in the selected memory block
• supports limited searches from the current cursor position
• shows match results directly inside Ghidra

Example of the finder UI:

---

Search Syntax Reference

The finder supports a richer byte pattern syntax than the standard Ghidra pattern search.

Syntax	Description	Examples
48 8B CF	Exact bytes — match only these exact byte values in order.	48 8B CF matches only 48 8B CF.
? or ??	Wildcard — match any single byte.	? = one byte, ?? = same meaning.
[1-5?]	Length wildcard — match 1 to 5 bytes of any value.	[1-5?] can cover 1, 2, 3, 4, or 5 unknown bytes.
45?	Optional exact byte — byte 45 may be present or omitted.	40 45? 50 matches 40 50 and 40 45 50.
[40-4C]	Byte range — match any byte between 0x40 and 0x4C inclusive.	[80|BF] matches 80 or BF. [80|BF|C0] matches 80, BF, or C0. [80|BF|C0-C5] matches 80, BF, or any byte from C0 to C5.
[4-7]8	Nibble range (high) — high nibble varies, low nibble fixed to 8.	[4-7]8 matches 48, 58, 68, 78.
[4-7][8-B]	Nibble range (both) — both nibbles vary.	[4-7][8-B] matches 48..4B, 58..5B, 68..6B, 78..7B.
[SIB?]	Optional SIB byte — 0 or 1 byte after ModRM when R/M=100.	Used internally by templates to cover both SIB and no-SIB forms.

Important

The [0-1?] syntax means "zero or one byte", not "a byte in range 0x00-0x01". This is a length wildcard, not a value range.

---

How to Use

Generate a Pattern

1. Open a program in Ghidra.
2. Select one or more instructions in the Listing view.
3. Open SPF Pattern Helper.
4. Go to the Pattern Generator tab.
5. Click Generate from Selection.

Tip

Select 3-5 instructions for a good balance between uniqueness and stability across game updates.

Search a Pattern

1. Go to the Pattern Finder tab.
2. Paste or type the pattern.
3. Choose the search scope.
4. Click Find Pattern.

Tip

Use "Search in current block" for faster results when you know which section contains the code. Use "All executable sections" for exhaustive searches.

Optional Auto-Verify

1. Enable Automatically verify signature.
2. Generate a pattern from the selection.
3. The script will automatically search the program.
4. The result line under the button will show the outcome.
5. If needed, use More info to jump to Pattern Finder.

---

Notes

• The script is designed to simplify the development and testing of patterns in American Truck Simulator / Euro Truck Simulator 2 using the SPF Framework. It serves as a basic tool for rapid prototyping of signature search during mod development.
• Further updates and additional features may or may not appear.
• If you have suggestions for improving the functionality, leave them in the repository or join our Discord chat channel.

---

Support the Project

If you enjoy this plugin and want to support the development of future projects, consider supporting us on Patreon.

► Support on Patreon