130 lines
4.0 kB
1
# Memmut
2
> scanmem alternative with concurrent memory scanning
3
4
A little CLI utility that helps you find memory addresses, and write values into that address.
5
6
## How to use
7
8
First start the program whose address you wanna muck about with, an example program exists in the source which can be started like this:
9
10
```
11
$ cargo run --example=simple
12
Memory Scanner Target - Press ENTER for new values, Ctrl+C to quit
13
Current values:
14
Index 0: 5
15
Index 1: 7
16
Index 2: 6
17
Index 3: 4
18
Index 4: 1
19
Index 5: 9
20
Index 6: 2
21
Index 7: 3
22
Index 8: 7
23
Index 9: 9
24
25
Press ENTER to generate new values...
26
```
27
28
Everytime you hit enter, the values will change. Each belonging to a memory address.
29
30
Then to run the actual scanner:
31
32
```
33
$ cargo build && sudo ./target/release/memmut "target/debug/examples/simple"
34
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.03s
35
[sudo] password for user:
36
# Scanning for process "target/debug/examples/simple" like how pgrep -f works
37
Process found with PID: 833569
38
Successfully attached to process. Found 34 readable memory regions.
39
Please enter current value, or "help" for other commands.
40
>
41
```
42
43
This is run with `sudo` because reading/writing to arbitrary memory addresses obviously require `root` privileges. The passed argument to the program is the target name of the process we want to attach to. Once found, it'll drop you into a REPL.
44
45
Basic idea is that you write what the number currently is, and everytime it changes to something new, which eventually narrows down the list of addresses to (ideally) 1. Once you know the specific address, you can use `set $index $new-value` to write whatever value you want to that address.
46
47
```
48
Successfully attached to process. Found 34 readable memory regions.
49
Please enter current value, or "help" for other commands.
50
> 8
51
01/034 searching 59ac4bb56000 - 59ac4bb79000...
52
02/034 searching 59ac4bb79000 - 59ac4bc0a000...
53
03/034 searching 59ac4bc0a000 - 59ac4bc10000...
54
26/034 searching 77c95d401000 - 77c95d403000...
55
22/034 searching 77c95d3f9000 - 77c95d3fa000...
56
09/034 searching 77c95d187000 - 77c95d1ab000...
57
04/034 searching 59ac4bc10000 - 59ac4bc11000...
58
30/034 searching 77c95d42f000 - 77c95d43a000...
59
........ok
60
29/034 searching 77c95d406000 - 77c95d42f000...
61
20/034 searching 77c95d3f6000 - 77c95d3f8000...
62
........ok
63
12/034 searching 77c95d36b000 - 77c95d36f000...
64
........ok
65
21/034 searching 77c95d3f8000 - 77c95d3f9000...
66
........ok
67
........ok
68
06/034 searching 77c958000000 - 77c958021000...
69
13/034 searching 77c95d36f000 - 77c95d371000...
70
15/034 searching 77c95d379000 - 77c95d37d000...
71
........ok
72
........ok
73
16/034 searching 77c95d37d000 - 77c95d3a1000...
74
........ok
75
17/034 searching 77c95d3a1000 - 77c95d3a5000...
76
10/034 searching 77c95d1ab000 - 77c95d31c000...
77
........ok
78
27/034 searching 77c95d403000 - 77c95d405000...
79
07/034 searching 77c95cf84000 - 77c95d184000...
80
........ok
81
08/034 searching 77c95d184000 - 77c95d187000...
82
18/034 searching 77c95d3a5000 - 77c95d3a6000...
83
........ok
84
19/034 searching 77c95d3a6000 - 77c95d3a7000...
85
24/034 searching 77c95d3fd000 - 77c95d3ff000...
86
25/034 searching 77c95d3ff000 - 77c95d401000...
87
........ok
88
........ok
89
........ok
90
31/034 searching 77c95d43a000 - 77c95d43c000...
91
32/034 searching 77c95d43c000 - 77c95d43d000...
92
........ok
93
28/034 searching 77c95d405000 - 77c95d406000...
94
33/034 searching 77c95d43d000 - 77c95d43e000...
95
34/034 searching 7fff41040000 - 7fff41062000...
96
11/034 searching 77c95d31c000 - 77c95d36b000...
97
........ok
98
05/034 searching 59ac69d8f000 - 59ac69db0000...
99
23/034 searching 77c95d3fb000 - 77c95d3fd000...
100
........ok
101
........ok
102
........ok
103
14/034 searching 77c95d371000 - 77c95d379000...
104
........ok
105
........ok
106
........ok
107
........ok
108
........ok
109
........ok
110
........ok
111
........ok
112
........ok
113
........ok
114
........ok
115
........ok
116
........ok
117
........ok
118
........ok
119
2393> 1
120
..........ok
121
13> 1
122
..........ok
123
2> 9
124
..........ok
125
2> 5
126
..........ok
127
1> set 0 1000
128
```
129
130
Once the `set` command is run, the other process should now have been reading the new value.
131