Memmut

scanmem alternative with concurrent memory scanning

A little CLI utility that helps you find memory addresses, and write values into that address.

How to use

First start the program whose address you wanna muck about with, an example program exists in the source which can be started like this:

$ cargo run --example=simple
Memory Scanner Target - Press ENTER for new values, Ctrl+C to quit
Current values:
Index 0: 5
Index 1: 7
Index 2: 6
Index 3: 4
Index 4: 1
Index 5: 9
Index 6: 2
Index 7: 3
Index 8: 7
Index 9: 9

Press ENTER to generate new values...

Everytime you hit enter, the values will change. Each belonging to a memory address.

Then to run the actual scanner:

$ cargo build && sudo ./target/release/memmut "target/debug/examples/simple"
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.03s
[sudo] password for user:
# Scanning for process "target/debug/examples/simple" like how pgrep -f works
Process found with PID: 833569
Successfully attached to process. Found 34 readable memory regions.
Please enter current value, or "help" for other commands.
>

This is run with sudo because reading/writing to arbitrary memory addresses obviously require root privileges. The passed argument to the program is the target name of the process we want to attach to. Once found, it’ll drop you into a REPL.

Basic idea is that you write what the number currently is, and everytime it changes to something new, which eventually narrows down the list of addresses to (ideally) 1. Once you know the specific address, you can use set $index $new-value to write whatever value you want to that address.

Successfully attached to process. Found 34 readable memory regions.
Please enter current value, or "help" for other commands.
> 8
01/034 searching 59ac4bb56000 - 59ac4bb79000...
02/034 searching 59ac4bb79000 - 59ac4bc0a000...
03/034 searching 59ac4bc0a000 - 59ac4bc10000...
26/034 searching 77c95d401000 - 77c95d403000...
22/034 searching 77c95d3f9000 - 77c95d3fa000...
09/034 searching 77c95d187000 - 77c95d1ab000...
04/034 searching 59ac4bc10000 - 59ac4bc11000...
30/034 searching 77c95d42f000 - 77c95d43a000...
........ok
29/034 searching 77c95d406000 - 77c95d42f000...
20/034 searching 77c95d3f6000 - 77c95d3f8000...
........ok
12/034 searching 77c95d36b000 - 77c95d36f000...
........ok
21/034 searching 77c95d3f8000 - 77c95d3f9000...
........ok
........ok
06/034 searching 77c958000000 - 77c958021000...
13/034 searching 77c95d36f000 - 77c95d371000...
15/034 searching 77c95d379000 - 77c95d37d000...
........ok
........ok
16/034 searching 77c95d37d000 - 77c95d3a1000...
........ok
17/034 searching 77c95d3a1000 - 77c95d3a5000...
10/034 searching 77c95d1ab000 - 77c95d31c000...
........ok
27/034 searching 77c95d403000 - 77c95d405000...
07/034 searching 77c95cf84000 - 77c95d184000...
........ok
08/034 searching 77c95d184000 - 77c95d187000...
18/034 searching 77c95d3a5000 - 77c95d3a6000...
........ok
19/034 searching 77c95d3a6000 - 77c95d3a7000...
24/034 searching 77c95d3fd000 - 77c95d3ff000...
25/034 searching 77c95d3ff000 - 77c95d401000...
........ok
........ok
........ok
31/034 searching 77c95d43a000 - 77c95d43c000...
32/034 searching 77c95d43c000 - 77c95d43d000...
........ok
28/034 searching 77c95d405000 - 77c95d406000...
33/034 searching 77c95d43d000 - 77c95d43e000...
34/034 searching 7fff41040000 - 7fff41062000...
11/034 searching 77c95d31c000 - 77c95d36b000...
........ok
05/034 searching 59ac69d8f000 - 59ac69db0000...
23/034 searching 77c95d3fb000 - 77c95d3fd000...
........ok
........ok
........ok
14/034 searching 77c95d371000 - 77c95d379000...
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
........ok
2393> 1
..........ok
13> 1
..........ok
2> 9
..........ok
2> 5
..........ok
1> set 0 1000

Once the set command is run, the other process should now have been reading the new value.