feat(scanner): add data-section AOB scanning

[tkhquang]

Summary by CodeRabbit

• New Features

  • Added scan_readable_regions() to scan committed readable memory regions (e.g., .rdata, .data), complementing existing executable region scanning.
  • Introduced ScannerKind enum to control whether pattern candidates resolve via executable or readable scanning.
  • Updated resolve_cascade() to accept optional ScannerKind parameter (defaults to executable).

• Documentation

  • Expanded documentation with guidance on scanning readable regions, RTTI vtable resolution, and ScannerKind usage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5df40482-3d5e-4056-b7eb-14db63403ad2

📥 Commits

Reviewing files that changed from the base of the PR and between 6509be1 and 092c32e.

📒 Files selected for processing (7)

• AGENTS.md
• README.md
• docs/misc/aob-signatures.md
• docs/misc/rtti-walker.md
• include/DetourModKit/scanner.hpp
• src/scanner.cpp
• tests/test_scanner.cpp

---

📝 Walkthrough

Walkthrough

This PR extends DetourModKit's AOB pattern scanner with support for searching readable (data) memory regions. It introduces a ScannerKind enum to select between executable and readable scanning, implements scan_readable_regions() alongside the existing executable scanner, and updates cascade resolution to route candidate searches based on the chosen kind.

Changes

Readable Memory Region Scanning

Layer / File(s)	Summary
API Contracts: ScannerKind and Readable Scanning include/DetourModKit/scanner.hpp	New ScannerKind enum with Executable and Readable variants; scan_readable_regions(pattern, occurrence) function declaration; resolve_cascade(candidates, label, kind=Executable) signature updated with optional ScannerKind parameter.
Readable Region Scanning Implementation src/scanner.cpp	scan_regions_filtered() helper walks process memory, filters committed regions by protection masks, excludes guard/no-access pages, scans via find_pattern_raw, applies pattern.offset, and prevents self-matching. Both scan_executable_regions() and scan_readable_regions() delegate to this helper with different accept masks for executable vs readable protections.
Cascade Resolution Integration src/scanner.cpp	scan_candidates() updated to accept ScannerKind and route to appropriate scanner; resolve_cascade() passes kind through to scan_candidates(); resolve_cascade_with_prologue_fallback() explicitly uses ScannerKind::Executable to constrain prologue scanning to executable regions only.
Test Coverage: Readable Regions and Cascade Selection tests/test_scanner.cpp	Comprehensive tests for scan_readable_regions() covering read-only/read-write regions, nth-occurrence enumeration, pattern.offset application, guard/no-access exclusion, and empty/zero-occurrence cases; ScannerCascade test validates ScannerKind::Readable resolves PAGE_READONLY candidates while ScannerKind::Executable cannot.
User Documentation Updates AGENTS.md, README.md, docs/misc/aob-signatures.md, docs/misc/rtti-walker.md	Project structure, module overview, and API documentation updated to describe readable region scanning, ScannerKind enum, updated resolve_cascade() parameter, and new RTTI vtable reverse-lookup workflow.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• tkhquang/DetourModKit#45: Introduced the foundational process-wide scanner API that this PR extends with readable-region support and ScannerKind routing.
• tkhquang/DetourModKit#55: Modified scan_executable_regions() implementation; this PR refactors it to delegate through a shared scan_regions_filtered() helper, creating direct code overlap in the executable scanner path.
• tkhquang/DetourModKit#67: Hardened scan_executable_regions() and find_pattern_raw() semantics; this PR's internal region-walking and offset handling overlaps with those improvements.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(scanner): add data-section AOB scanning' accurately summarizes the main change: introducing a new capability to scan readable/data regions (in addition to executable regions) using AOB (Array of Bytes) pattern matching.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}