feat: add find_one_pattern

Author: std-microblock

LLMDOCS.md

@@ -572,7 +572,19 @@ auto result = range.find_one(
     )
 );
 
-// 远程进程搜索（使用 ReadProcessMemory）
+// Pattern 字符串搜索（支持多种格式）
+auto result1 = range.find_one_pattern("aabbcc");
+auto result2 = range.find_one_pattern("aa bb cc");
+auto result3 = range.find_one_pattern("aa,bb,cc");
+auto result4 = range.find_one_pattern("0xaa, 0xbb, 0xcc");
+auto result5 = range.find_one_pattern("aa??12");  // 通配符
+
+// find_one 自动判断本地/远程搜索
+// 本地进程使用快速扫描器，远程进程使用迭代器
+auto result = range.find_one({0x90, 0x90, 0x90});
+
+// find_one_remote 已废弃，请使用 find_one
+[[deprecated]]
 auto result = range.find_one_remote({0x90, 0x90, 0x90});
 ```
 
@@ -1331,348 +1343,3 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD reason, LPVOID reserved) {
     return TRUE;
 }
 ```
-
-## 示例
-
-### 示例 1: 简单的函数钩子
-
-```cpp
-#include <blook/blook.h>
-#include <Windows.h>
-#include <iostream>
-
-int main() {
-    auto proc = blook::Process::self();
-    auto kernel32 = proc->module("kernel32.dll").value();
-    auto sleep_func = kernel32->exports("Sleep").value();
-
-    auto hook = sleep_func->inline_hook();
-
-    hook->install([=](DWORD ms) {
-        std::cout << "Sleep 被调用，参数: " << ms << "ms" << std::endl;
-
-        // 减少睡眠时间
-        hook->call_trampoline<void>(ms / 10);
-
-        std::cout << "实际只睡了 " << (ms / 10) << "ms" << std::endl;
-    });
-
-    // 测试
-    std::cout << "开始睡眠 1000ms..." << std::endl;
-    Sleep(1000);
-    std::cout << "睡眠结束" << std::endl;
-
-    hook->uninstall();
-    return 0;
-}
-```
-
-### 示例 2: 内存扫描和修改
-
-```cpp
-#include <blook/blook.h>
-#include <iostream>
-
-int main() {
-    auto proc = blook::Process::self();
-    auto mod = proc->module().value();
-
-    // 假设我们要找游戏中的生命值
-    int health = 100;
-
-    // 在内存中搜索
-    auto range = mod->memo();
-    auto result = range.find_one(
-        std::vector<uint8_t>(
-            (uint8_t*)&health,
-            (uint8_t*)&health + sizeof(health)
-        )
-    );
-
-    if (result.has_value()) {
-        std::cout << "找到生命值地址: " << result->data() << std::endl;
-
-        // 修改为 999
-        result->write_s32(999);
-
-        std::cout << "生命值已修改为: " << health << std::endl;
-    }
-
-    return 0;
-}
-```
-
-### 示例 3: 代码洞穴 (Code Cave)
-
-```cpp
-#include <blook/blook.h>
-
-int main() {
-    auto proc = blook::Process::self();
-    auto mod = proc->module().value();
-    auto text = mod->section(".text").value();
-
-    // 查找 NOP 洞穴（连续的 0x90）
-    auto cave = text.find_one({
-        0x90, 0x90, 0x90, 0x90, 0x90,
-        0x90, 0x90, 0x90, 0x90, 0x90
-    });
-
-    if (cave.has_value()) {
-        std::cout << "找到代码洞穴: " << cave->data() << std::endl;
-
-        // 在洞穴中写入自定义代码
-        auto patch = cave->reassembly([](zasm::x86::Assembler& a) {
-            a.push(zasm::x86::rax);
-            a.mov(zasm::x86::rax, zasm::Imm(0x12345678));
-            // ... 更多代码
-            a.pop(zasm::x86::rax);
-            a.ret();
-        });
-
-        patch.patch();
-    }
-
-    return 0;
-}
-```
-
-### 示例 4: 多级指针
-
-```cpp
-#include <blook/blook.h>
-#include <iostream>
-
-int main() {
-    auto proc = blook::Process::self();
-
-    // 假设游戏中的玩家数据结构
-    // PlayerManager -> Player -> Stats -> Health
-    blook::Pointer player_mgr = (void*)0x140000000;
-
-    // 偏移链: [0x10] -> [0x20] -> [0x30] -> health
-    auto health_ptr = player_mgr.offsets({0x10, 0x20, 0x30});
-
-    if (health_ptr.has_value()) {
-        int health = health_ptr->read_s32();
-        std::cout << "当前生命值: " << health << std::endl;
-
-        // 修改生命值
-        health_ptr->write_s32(999);
-        std::cout << "生命值已修改为 999" << std::endl;
-    }
-
-    return 0;
-}
-```
-
-
-### 示例 5: 反汇编和分析
-
-```cpp
-#include <blook/blook.h>
-#include <iostream>
-
-void analyze_function(void* func_addr) {
-    blook::Pointer ptr = func_addr;
-    auto range = ptr.range_size(200);
-
-    std::cout << "分析函数: " << func_addr << std::endl;
-    std::cout << "----------------------------------------" << std::endl;
-
-    auto disasm = range.disassembly();
-    int instr_count = 0;
-
-    for (const auto& instr : disasm) {
-        // 打印指令
-        std::cout << std::hex << instr.ptr().data() << ": "
-                  << instr.dump() << std::endl;
-
-        // 检查是否有交叉引用
-        auto xrefs = instr.xrefs();
-        for (const auto& xref : xrefs) {
-            std::cout << "  -> 引用: " << xref.data() << std::endl;
-        }
-
-        instr_count++;
-
-        // 遇到 ret 指令停止
-        if (instr->getMnemonic() == zasm::x86::Mnemonic::Ret) {
-            break;
-        }
-    }
-
-    std::cout << "总共 " << instr_count << " 条指令" << std::endl;
-}
-
-int main() {
-    auto proc = blook::Process::self();
-    auto kernel32 = proc->module("kernel32.dll").value();
-    auto sleep_func = kernel32->exports("Sleep").value();
-
-    analyze_function(sleep_func->data());
-
-    return 0;
-}
-```
-
-### 示例 6: VEH 钩子监控
-
-```cpp
-#include <blook/blook.h>
-#include <iostream>
-#include <vector>
-
-// 要监控的函数
-int sensitive_function(int a, int b) {
-    return a * b + 42;
-}
-
-int main() {
-    std::vector<std::pair<int, int>> call_log;
-
-    // 添加硬件断点
-    auto handler = blook::VEHHookManager::instance().add_breakpoint(
-        blook::VEHHookManager::HardwareBreakpoint{
-            .address = (void*)sensitive_function
-        },
-        [&](blook::VEHHookManager::VEHHookContext& ctx) {
-            // 记录调用参数（x64 calling convention）
-#ifdef BLOOK_ARCHITECTURE_X86_64
-            auto regs = (CONTEXT*)ctx.exception_info->ContextRecord;
-            int a = (int)regs->Rcx;
-            int b = (int)regs->Rdx;
-#else
-            // x86 需要从栈上读取
-            auto regs = (CONTEXT*)ctx.exception_info->ContextRecord;
-            int* stack = (int*)regs->Esp;
-            int a = stack[1];
-            int b = stack[2];
-#endif
-
-            call_log.push_back({a, b});
-            std::cout << "函数被调用: " << a << ", " << b << std::endl;
-        }
-    );
-
-    // 测试调用
-    sensitive_function(10, 20);
-    sensitive_function(5, 7);
-    sensitive_function(3, 4);
-
-    // 移除断点
-    blook::VEHHookManager::instance().remove_breakpoint(handler);
-
-    // 打印日志
-    std::cout << "\n调用日志:" << std::endl;
-    for (const auto& [a, b] : call_log) {
-        std::cout << "  (" << a << ", " << b << ")" << std::endl;
-    }
-
-    return 0;
-}
-```
-
-### 示例 7: 自动查找和钩住函数
-
-```cpp
-#include <blook/blook.h>
-#include <iostream>
-
-int main() {
-    auto proc = blook::Process::self();
-    auto mod = proc->module().value();
-
-    // 查找包含特定字符串的函数
-    auto rdata = mod->section(".rdata").value();
-    auto text = mod->section(".text").value();
-
-    // 查找错误消息字符串
-    auto error_msg = rdata.find_one("Critical Error:");
-
-    if (error_msg.has_value()) {
-        std::cout << "找到错误消息: " << error_msg->data() << std::endl;
-
-        // 查找引用这个字符串的代码
-        auto xref = text.find_xref(*error_msg);
-
-        if (xref.has_value()) {
-            std::cout << "找到引用: " << xref->data() << std::endl;
-
-            // 猜测函数起始地址
-            auto func = xref->guess_function();
-
-            if (func.has_value()) {
-                std::cout << "找到函数: " << func->data() << std::endl;
-
-                // 钩住这个函数
-                auto hook = func->inline_hook();
-
-                hook->install([=]() {
-                    std::cout << "错误处理函数被调用！" << std::endl;
-
-                    // 可以选择不调用原始函数，阻止错误
-                    // 或者调用原始函数
-                    hook->call_trampoline<void>();
-                });
-
-                std::cout << "已钩住错误处理函数" << std::endl;
-            }
-        }
-    }
-
-    return 0;
-}
-```
-
-### 示例 8: 内存分配器使用
-
-```cpp
-#include <blook/blook.h>
-#include <iostream>
-
-int main() {
-    auto proc = blook::Process::self();
-    auto& allocator = proc->allocator();
-
-    std::cout << "初始状态:" << std::endl;
-    std::cout << "  分配数: " << allocator.allocated_count() << std::endl;
-    std::cout << "  已分配: " << allocator.total_allocated_bytes() << " 字节" << std::endl;
-    std::cout << "  已保留: " << allocator.total_reserved_bytes() << " 字节" << std::endl;
-
-    // 分配多个小块
-    std::vector<blook::Pointer> ptrs;
-    for (int i = 0; i < 10; i++) {
-        auto ptr = allocator.allocate(512);
-        ptrs.push_back(ptr);
-
-        // 写入测试数据
-        std::vector<uint8_t> data(512, i);
-        ptr.write_bytearray(data);
-    }
-
-    std::cout << "\n分配 10 个块后:" << std::endl;
-    std::cout << "  分配数: " << allocator.allocated_count() << std::endl;
-    std::cout << "  已分配: " << allocator.total_allocated_bytes() << " 字节" << std::endl;
-    std::cout << "  已保留: " << allocator.total_reserved_bytes() << " 字节" << std::endl;
-
-    // 验证数据
-    for (size_t i = 0; i < ptrs.size(); i++) {
-        auto data = ptrs[i].read_bytearray(512);
-        bool valid = std::all_of(data.begin(), data.end(),
-                                 [i](uint8_t b) { return b == i; });
-        std::cout << "块 " << i << " 数据" << (valid ? "正确" : "错误") << std::endl;
-    }
-
-    // 释放所有块
-    for (auto& ptr : ptrs) {
-        allocator.deallocate(ptr);
-    }
-
-    std::cout << "\n释放后:" << std::endl;
-    std::cout << "  分配数: " << allocator.allocated_count() << std::endl;
-    std::cout << "  已分配: " << allocator.total_allocated_bytes() << " 字节" << std::endl;
-
-    return 0;
-}
-```