Package: libmemmod
memmodA library to modify another program's memory on linux x64. The goal of this library is to provide easy
functions to modify the memory of another application externaly. Additionaly creating a program likeCheatEnginethat runs natively on Linux with many features that CheatEngine provides.ExamplesA basic example on how to use memmod, for more examples lookhere.frommemmodimportProcess# opens a process with the name "supertux2"proc=Process(name="supertux2")# get the puts function and execute it inside the processputs=proc.get_libc_function("puts")puts("Hello World!")# Find a module by namemodulebase=proc.find_module(proc.name)assertmodulebase!=None,"Failed to find module base"# Search ingame coin address by resolving a pointer chainstatic_ptr=modulebase.start+0x6CBC40coin_ptr_addr=proc.resolve_pointer_chain(static_ptr,[0x28,0x20,0x0])# Write to address a numberproc.write(coin_ptr_addr,9999)InstallationYou can find the uploaded libraryhereand install it with:pip3 install libmemmodTogether with the library you can also use the variousscriptsthat have been installed.
Here an example of their usage:sudo -E loadshared -n supertux2 mysharedlib.so
sudo -E accessanalyzer -n supertux2 -a 0x559c7b55330e
sudo -E pointerscanner -n supertux2 -a 0x558599fb6fe0 -r 0x1ff
sudo -E timerhack -n supertux2 -f 2.0Featuresread/write to a processinject breakpoints and listen to themexecute functions within the target processfind modules from/proc/pid/mapsby name, mode, offset or addressinject.sointo target process withload_shaderd_library()create function detours with an optional trampolinebindings for ptraceget path to binary file withget_path_to_executable()search pattern in a module with a signatureresolve a pointerchain to find addresses, can be used with thePointer Scanner.supports mono specific calls,see herefind symbol and relocation offsets within a moduleget X11 window id withget_x11_window()send key presses to the processsend_key()search for data or addresses in a specified range withscan()How it worksFinding processes and reading/writing to themWe use the/proc/folder that "stores" all processes in separate folders with their Process-ID (pid) as the folder name.
Each process has a/proc/pid/statusfile that contains the process name, a/proc/pid/mapsfile with all the memory regions
listed, a/proc/pid/mem"file" in which we can read/write in to the memory of the process (with the necessary permissions).
For reading and writting use the functionsread()andwrite(), searching for a module can be done by using the functionsfind_module()andfind_module_with_address().DebuggingFor debugging we use the ptrace systemcall that allows us to stop a process, read its registers and continue until it reaches
a breakpoint. A breakpoint in x64 linux is the hex number 0xCC and we can simply write this byte into the process as explained
in the previous section. To use the debugger with this library runwith proc.ptrace() as ptrace:, when running this, it will
automatically attach to the process and stops, after that it will NOT detach, but instead just continue! If you want it to detach
you will need todo it manually withptrace.detach().
For easier handling with debugging and breakpoints you can useadd_breakpoint(), it will take anaddressand ahandlerthat
is being executed as soon as the target process reaches the breakpoint. Optionaly you can provide it with data that can be used
int the handler. The handler will receive the registers and the data if provided. The handler must return a boolean, if it returnsFalsethe breakpoint will be removed, to keep the breakpoint returnTrue. But to start listening to the breakpoints you will
need to run thelisten()function. Note that the breakpoints are not being written into the memory byadd_breakpoint()but bylisten(). Listen will stop when all breakpoints have been deleted or the user interrupts it with ctrl+c, which will lead to the
automatic removal of all breakpoints. Lookherefor examples on how to use it.Function executionWe use ptrace to stop the application and write thecall raxinstruction at the currentriplocation and a breakpoint after
that. We load into theraxregister the address to the function we want to execute and the other register are being set to the
arguments we want to pass to the function. After setting the registers, we continue the process flow and will reset the registers
and the overwritten binary as soon as we reach the breakpoint. To use this feature use the functionrun_function().
For more information seethisarticle.ScriptsTo show the capabilities of this library I programmed a few scripts that can be helpful when searching for addresses and are
also being installed when installing this library. These scripts where inspired by the functionalities ofCheatEngine.Access AnalyzerSearches for asm instruction accessing addressPointer ScannerSearches for pointers pointing to an addressLoad Shared LibraryLoads a.sofile to a processTimer hackSpeeds up the clock by a defined factor (x64 only)ResourcesHere are some useful links to websites that helped me making this library and the scripts.Guided Hacking - Read / Write to memoryLinux-InjectELF-StructureInjecting Code with PtraceBananaBot - CSGO hackingC++ vtablesLD_PRELOAD and SymbolsGuided Hacking - Function hookingGuided Hacking - Unity / MonoMono API DocumentationSendkeys (X11)ToolsSome tools and programs that I used when testing and debugging the library and it's scripts.readelf (read symbols from binary file)objdump (assembler code of binary file)gdb (for debugging the target process)monodisonline-86-assembler