From a6b5f94bf5a5de2b90685ba47e9890fdb20cd8d5 Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Wed, 21 Jun 2017 01:29:38 -0700 Subject: [PATCH] initial commit --- .gitignore | 7 + LICENSE.md | 651 +++++++++++++++++++++++++++++++++++++++++++ MANIFEST.in | 2 + README.md | 111 ++++++++ mem_edit/__init__.py | 28 ++ mem_edit/abstract.py | 296 ++++++++++++++++++++ mem_edit/linux.py | 127 +++++++++ mem_edit/utils.py | 63 +++++ mem_edit/windows.py | 256 +++++++++++++++++ setup.py | 52 ++++ 10 files changed, 1593 insertions(+) create mode 100644 .gitignore create mode 100644 LICENSE.md create mode 100644 MANIFEST.in create mode 100644 README.md create mode 100644 mem_edit/__init__.py create mode 100644 mem_edit/abstract.py create mode 100644 mem_edit/linux.py create mode 100644 mem_edit/utils.py create mode 100644 mem_edit/windows.py create mode 100644 setup.py diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..79a8109 --- /dev/null +++ b/.gitignore @@ -0,0 +1,7 @@ +.idea/ + +__pycache__ +*.pyc + +*.egg-info/ +dist/ diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 0000000..4ef32f0 --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,651 @@ +GNU Affero General Public License +================================= + +_Version 3, 19 November 2007_ +_Copyright © 2007 Free Software Foundation, Inc. <>_ + +Everyone is permitted to copy and distribute verbatim copies +of this license document, but changing it is not allowed. + +## Preamble + +The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + +The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + +When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + +Developers that use our General Public Licenses protect your rights +with two steps: **(1)** assert copyright on the software, and **(2)** offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + +A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + +The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + +An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + +The precise terms and conditions for copying, distribution and +modification follow. + +## TERMS AND CONDITIONS + +### 0. Definitions + +“This License” refers to version 3 of the GNU Affero General Public License. + +“Copyright” also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + +“The Program” refers to any copyrightable work licensed under this +License. Each licensee is addressed as “you”. “Licensees” and +“recipients” may be individuals or organizations. + +To “modify” a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a “modified version” of the +earlier work or a work “based on” the earlier work. + +A “covered work” means either the unmodified Program or a work based +on the Program. + +To “propagate” a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + +To “convey” a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + +An interactive user interface displays “Appropriate Legal Notices” +to the extent that it includes a convenient and prominently visible +feature that **(1)** displays an appropriate copyright notice, and **(2)** +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + +### 1. Source Code + +The “source code” for a work means the preferred form of the work +for making modifications to it. “Object code” means any non-source +form of a work. + +A “Standard Interface” means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + +The “System Libraries” of an executable work include anything, other +than the work as a whole, that **(a)** is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and **(b)** serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +“Major Component”, in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + +The “Corresponding Source” for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + +The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + +The Corresponding Source for a work in source code form is that +same work. + +### 2. Basic Permissions + +All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + +You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + +Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + +### 3. Protecting Users' Legal Rights From Anti-Circumvention Law + +No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + +When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + +### 4. Conveying Verbatim Copies + +You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + +You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + +### 5. Conveying Modified Source Versions + +You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + +* **a)** The work must carry prominent notices stating that you modified +it, and giving a relevant date. +* **b)** The work must carry prominent notices stating that it is +released under this License and any conditions added under section 7. +This requirement modifies the requirement in section 4 to +“keep intact all notices”. +* **c)** You must license the entire work, as a whole, under this +License to anyone who comes into possession of a copy. This +License will therefore apply, along with any applicable section 7 +additional terms, to the whole of the work, and all its parts, +regardless of how they are packaged. This License gives no +permission to license the work in any other way, but it does not +invalidate such permission if you have separately received it. +* **d)** If the work has interactive user interfaces, each must display +Appropriate Legal Notices; however, if the Program has interactive +interfaces that do not display Appropriate Legal Notices, your +work need not make them do so. + +A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +“aggregate” if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + +### 6. Conveying Non-Source Forms + +You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + +* **a)** Convey the object code in, or embodied in, a physical product +(including a physical distribution medium), accompanied by the +Corresponding Source fixed on a durable physical medium +customarily used for software interchange. +* **b)** Convey the object code in, or embodied in, a physical product +(including a physical distribution medium), accompanied by a +written offer, valid for at least three years and valid for as +long as you offer spare parts or customer support for that product +model, to give anyone who possesses the object code either **(1)** a +copy of the Corresponding Source for all the software in the +product that is covered by this License, on a durable physical +medium customarily used for software interchange, for a price no +more than your reasonable cost of physically performing this +conveying of source, or **(2)** access to copy the +Corresponding Source from a network server at no charge. +* **c)** Convey individual copies of the object code with a copy of the +written offer to provide the Corresponding Source. This +alternative is allowed only occasionally and noncommercially, and +only if you received the object code with such an offer, in accord +with subsection 6b. +* **d)** Convey the object code by offering access from a designated +place (gratis or for a charge), and offer equivalent access to the +Corresponding Source in the same way through the same place at no +further charge. You need not require recipients to copy the +Corresponding Source along with the object code. If the place to +copy the object code is a network server, the Corresponding Source +may be on a different server (operated by you or a third party) +that supports equivalent copying facilities, provided you maintain +clear directions next to the object code saying where to find the +Corresponding Source. Regardless of what server hosts the +Corresponding Source, you remain obligated to ensure that it is +available for as long as needed to satisfy these requirements. +* **e)** Convey the object code using peer-to-peer transmission, provided +you inform other peers where the object code and Corresponding +Source of the work are being offered to the general public at no +charge under subsection 6d. + +A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + +A “User Product” is either **(1)** a “consumer product”, which means any +tangible personal property which is normally used for personal, family, +or household purposes, or **(2)** anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, “normally used” refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + +“Installation Information” for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + +If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + +The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + +Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + +### 7. Additional Terms + +“Additional permissions” are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + +When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + +Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + +* **a)** Disclaiming warranty or limiting liability differently from the +terms of sections 15 and 16 of this License; or +* **b)** Requiring preservation of specified reasonable legal notices or +author attributions in that material or in the Appropriate Legal +Notices displayed by works containing it; or +* **c)** Prohibiting misrepresentation of the origin of that material, or +requiring that modified versions of such material be marked in +reasonable ways as different from the original version; or +* **d)** Limiting the use for publicity purposes of names of licensors or +authors of the material; or +* **e)** Declining to grant rights under trademark law for use of some +trade names, trademarks, or service marks; or +* **f)** Requiring indemnification of licensors and authors of that +material by anyone who conveys the material (or modified versions of +it) with contractual assumptions of liability to the recipient, for +any liability that these contractual assumptions directly impose on +those licensors and authors. + +All other non-permissive additional terms are considered “further +restrictions” within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + +If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + +Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + +### 8. Termination + +You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + +However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated **(a)** +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and **(b)** permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + +Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + +Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + +### 9. Acceptance Not Required for Having Copies + +You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + +### 10. Automatic Licensing of Downstream Recipients + +Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + +An “entity transaction” is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + +You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + +### 11. Patents + +A “contributor” is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's “contributor version”. + +A contributor's “essential patent claims” are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, “control” includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + +Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + +In the following three paragraphs, a “patent license” is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To “grant” such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + +If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either **(1)** cause the Corresponding Source to be so +available, or **(2)** arrange to deprive yourself of the benefit of the +patent license for this particular work, or **(3)** arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. “Knowingly relying” means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + +If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + +A patent license is “discriminatory” if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license **(a)** in connection with copies of the covered work +conveyed by you (or copies made from those copies), or **(b)** primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + +Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + +### 12. No Surrender of Others' Freedom + +If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + +### 13. Remote Network Interaction; Use with the GNU General Public License + +Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + +Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + +### 14. Revised Versions of this License + +The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License “or any later version” applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + +If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + +Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + +### 15. Disclaimer of Warranty + +THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + +### 16. Limitation of Liability + +IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + +### 17. Interpretation of Sections 15 and 16 + +If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + +_END OF TERMS AND CONDITIONS_ + +## How to Apply These Terms to Your New Programs + +If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + +To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the “copyright” line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + +If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a “Source” link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + +You should also get your employer (if you work as a programmer) or school, +if any, to sign a “copyright disclaimer” for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +<>. diff --git a/MANIFEST.in b/MANIFEST.in new file mode 100644 index 0000000..c28ab72 --- /dev/null +++ b/MANIFEST.in @@ -0,0 +1,2 @@ +include README.md +include LICENSE.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..d6af12c --- /dev/null +++ b/README.md @@ -0,0 +1,111 @@ +# mem_edit + +**mem_edit** is a multiplatform memory editing library written in Python. + + +**Capabilities:** +* Scan all readable memory used by a process. + * Optionally restrict searches to regions with read + write permissions. + * Report on address space allocation +* Read/write using ctypes objects + * Basic types, e.g. ```ctypes.c_ulong()``` + * Arrays, e.g. ```(ctypes.c_byte * 4)()``` + * Instances of ```ctypes.Structure or ctypes.Union``` and subclasses. +* Run on Windows and Linux + + +## Installation + +**Dependencies:** +* python 3 (written and tested with 3.5) +* ctypes +* typing (for type annotations) + + +Install with pip, from pypi (preferred): +```bash +pip install mem_edit +``` + +Install with pip from git repository +```bash +pip install git+https://mpxd.net/gogs/jan/mem_edit.git@release +``` + + +## Documentation + +Most functions and classes are documented inline. +To read the inline help, +```python3 +import mem_edit +help(mem_edit.Process) +``` + +## Examples + +Increment a magic number (unsigned long 1234567890) found in 'magic.exe': +```python3 + import ctypes + from mem_edit import Process + + magic_number = ctypes.ulong(1234567890) + + pid = Process.get_pid_by_name('magic.exe') + with Process.open_process(pid) as p: + addrs = p.search_all_memory(magic_number) + + # We don't want to edit if there's more than one result... + assert(len(addrs) == 1) + + # We don't actually have to read the value here, but let's do so anyways... + num_ulong = p.read_memory(addrs[0], ctypes.c_ulong()) + num = num_ulong.value + + p.write_memory(addrs[0], ctypes.c_ulong(num + 1)) +``` + +Narrow down a search after a value changes: +```python3 + import ctypes + from mem_edit import Process + + initial_value = 40 + final_value = 55 + + pid = Process.get_pid_by_name('monitor_me.exe') + with Process.open_process(pid) as p: + addrs = p.search_all_memory(ctypes.c_int(initial_value)) + + input('Press enter when value has changed to ' + str(final_value)) + + filtered_addrs = p.search_addresses(addrs, ctypes.c_int(final_value)) + + print('Found addresses:') + for addr in filtered_addrs: + print(hex(addr)) +``` + +Read and alter a structure: +```python3 + import ctypes + from mem_edit import Process + + class MyStruct(ctypes.Structure): + _fields_ = [ + ('first_member', ctypes.c_ulong), + ('second_member', ctypes.c_void_p), + ] + + pid = Process.get_pid_by_name('something.exe') + + with Process.open_process(pid) as p: + s = MyStruct() + s.first_member = 1234567890 + s.second_member = 0x1234 + + addrs = p.search_all_memory(s) + print(addrs) + + p.write_memory(0xafbfe0, s) +``` diff --git a/mem_edit/__init__.py b/mem_edit/__init__.py new file mode 100644 index 0000000..f67cb19 --- /dev/null +++ b/mem_edit/__init__.py @@ -0,0 +1,28 @@ +""" +mem_edit + +mem_edit is a multiplatform (Windows and Linux) python package for + reading, writing, and searching in the working memory of running + programs. + +To get started, try: + + from mem_edit import Process + help(Process) + +""" +__author__ = 'Jan Petykiewicz' + + +import platform + +from .utils import MemEditError + + +system = platform.system() +if system == 'Windows': + from .windows import Process +elif system == 'Linux': + from .linux import Process +else: + raise MemEditError('Only Linux and Windows are currently supported.') diff --git a/mem_edit/abstract.py b/mem_edit/abstract.py new file mode 100644 index 0000000..05b6ceb --- /dev/null +++ b/mem_edit/abstract.py @@ -0,0 +1,296 @@ +""" +Abstract class for cross-platform memory editing. +""" + +from typing import List, Tuple +from abc import ABCMeta, abstractmethod +from contextlib import contextmanager +import copy +import ctypes +import logging + +from .utils import ctypes_buffer_t, search_buffer + + +logging.basicConfig(level=logging.INFO) +logger = logging.getLogger(__name__) + + +class Process(metaclass=ABCMeta): + """ + This class is used to interact with processes running on the system + (i.e., by reading from or writing to the memory used by a given process). + + The static methods + Process.list_available_pids() + Process.get_pid_by_name(executable_filename) + can be used to help find the process id (pid) of the target process. They are + provided for convenience only; it is probably better to use the tools built + in to your operating system to discover the pid of the specific process you + would like to edit. + + Once you have found the pid, you are ready to construct an instance of Process + and use it to read and write to memory. Once you are done with the process, + use .close() to free up the process for access by other debuggers etc. + + p = Process.open(1239) + p.close() + + To read/write to memory, first create a buffer using ctypes: + + buffer0 = (ctypes.c_byte * 5)(39, 50, 03, 40, 30) + buffer1 = ctypes.c_ulong() + + and then use + + p.write_memory(0x2fe, buffer0) + + val0 = p.read_memory(0x220, buffer0)[:] + + val1a = p.read_memory(0x149, buffer1).value + val2b = buffer1.value + assert(val1a == val2b) + + Searching for a value can be done in a number of ways: + Search a list of addresses: + found_addresses = p.search_addresses([0x1020, 0x1030], buffer0) + Search the entire memory space: + found_addresses = p.search_all_memory(buffer0, writeable_only=False) + + You can also get a list of which regions in memory are mapped (readable): + regions = p.list_mapped_regions(writeable_only=False) + + which can be used along with search_buffer(...) to re-create .search_all_memory(...): + + found = [] + for region_start, region_stop in regions: + region_buffer = (ctypes.c_byte * (region_stop - region_start))() + p.read_memory(region_start, region_buffer) + found += utils.search_buffer(ctypes.c_ulong(123456790), region_buffer) + + Other useful methods include the context manager, implemented as a static method: + + with Process.open_process(pid) as p: + # use p here, no need to call p.close() + + .get_path(), which reports the path of the executable file which was used + to start the process: + + executable_path = p.get_path() + + and deref_struct_pointer, which takes a pointer to a struct and reads out the struct members: + + # struct is a list of (offset, buffer) pairs + struct_defintion = [(0x0, ctypes.c_ulong()), + (0x20, ctypes.c_byte())] + values = p.deref_struct_pointer(0x0feab4, struct_defintion) + + which is shorthand for + + struct_addr = p.read_memory(0x0feab4, ctypes.c_void_p()) + values = [p.read_memory(struct_addr + 0x0, ctypes.c_ulong()), + p.read_memory(struct_addr + 0x20, ctypes.c_byte())] + + ================= + + Putting all this together, a simple program which alters a magic number in the only running + instance of 'magic.exe' might look like this: + + import ctypes + from mem_edit import Process + + magic_number = ctypes.ulong(1234567890) + + pid = Process.get_pid_by_name('magic.exe') + with Process.open_process(pid) as p: + addrs = p.search_all_memory(magic_number) + assert(len(addrs) == 1) + p.write_memory(addrs[0], ctypes.c_ulong(42)) + + Searching for a value which changes: + + pid = Process.get_pid_by_name('monitor_me.exe') + with Process.open_process(pid) as p: + addrs = p.search_all_memory(ctypes.c_int(40)) + input('Press enter when value has changed to 55') + filtered_addrs = p.search_addresses(addrs, ctypes.c_int(55)) + print('Found addresses:') + for addr in filtered_addrs: + print(hex(addr)) + + """ + + @abstractmethod + def __init__(self, process_id: int): + """ + Constructing a Process object prepares the process with specified process_id for + memory editing. Finding the process_id for the process you want to edit is often + easiest using os-specific tools (or by launching the process yourself, e.g. with + subprocess.Popen(...)). + + :param process_id: Process id (pid) of the target process + """ + pass + + @abstractmethod + def close(self): + """ + Detach from the process, removing our ability to edit it and + letting other debuggers attach to it instead. + + This function should be called after you are done working with the process + and will no longer need it. See the Process.open_process(...) context + manager to avoid having to call this function yourself. + """ + pass + + @abstractmethod + def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t): + """ + Write the given buffer to the process's address space, starting at base_address. + + :param base_address: The address to write at, in the process's address space. + :param write_buffer: A ctypes object, for example, ctypes.c_ulong(48), + (ctypes.c_byte * 3)(43, 21, 0xff), or a subclass of ctypes.Structure, + which will be written into memory starting at base_address. + """ + pass + + @abstractmethod + def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t: + """ + Read into the given buffer from the process's address space, starting at base_address. + + :param base_address: The address to read from, in the process's address space. + :param read_buffer: A ctypes object, for example. ctypes.c_ulong(), + (ctypes.c_byte * 3)(), or a subclass of ctypes.Structure, which will be + overwritten with the contents of the process's memory starting at base_address. + :returns: read_buffer is returned as well as being overwritten. + """ + pass + + @abstractmethod + def list_mapped_regions(self, writeable_only=True) -> List[Tuple[int, int]]: + """ + Return a list of (start_address, stop_address) for the regions of the address space + accessible to (readable and possibly writable by) the process. + By default, this function does not return non-writeable regions. + + :param writeable_only: If True, only return regions which are also writeable. + Default true. + :return: List of (start_address, stop_address) for each accessible memory region. + """ + pass + + @abstractmethod + def get_path(self) -> str: + """ + Return the path to the executable file which was run to start this process. + + :return: A string containing the path. + """ + pass + + @staticmethod + @abstractmethod + def list_available_pids() -> List[int]: + """ + Return a list of all process ids (pids) accessible on this system. + + :return: List of running process ids. + """ + pass + + @staticmethod + @abstractmethod + def get_pid_by_name(target_name: str) -> int or None: + """ + Attempt to return the process id (pid) of a process which was run with an executable + file with the provided name. + + This is a convenience method for quickly finding a process which is already known + to be unique and has a well-defined executable name. + + Don't rely on this method if you can possibly avoid it, since it makes no + attempt to confirm that it found a unique process and breaks trivially (e.g. if the + executable file is renamed). + """ + pass + + def deref_struct_pointer(self, + base_address: int, + targets: List[Tuple[int, ctypes_buffer_t]], + ) -> List[ctypes_buffer_t]: + """ + Take a pointer to a struct and read out the struct members: + struct_defintion = [(0x0, ctypes.c_ulong()), + (0x20, ctypes.c_byte())] + values = p.deref_struct_pointer(0x0feab4, struct_defintion) + which is shorthand for + struct_addr = p.read_memory(0x0feab4, ctypes.c_void_p()) + values = [p.read_memory(struct_addr + 0x0, ctypes.c_ulong()), + p.read_memory(struct_addr + 0x20, ctypes.c_byte())] + + :param base_address: Address at which the struct pointer is located. + :param targets: List of (offset, read_buffer) pairs which will be read from the struct. + :return: List of read values corresponding to the provided targets. + """ + base = self.read_memory(base_address, ctypes.c_void_p()) + vals = [self.read_memory(base + offset, buffer) for offset, buffer in targets] + return vals + + def search_addresses(self, addresses: List[int], needle_buffer: ctypes_buffer_t) -> List[int]: + """ + Search for the provided value at each of the provided addresses, and return the addresses + where it is found. + + :param addresses: List of addresses which should be probed. + :param needle_buffer: The value to search for. This should be a ctypes object of the same + sorts as used by .read_memory(...), which will be compared to the contents of + memory at each of the given addresses. + :return: List of addresses where the needle_buffer was found. + """ + found = [] + read_buffer = copy.copy(needle_buffer) + + for addr in addresses: + read = self.read_memory(addr, read_buffer) + if ctypes_equal(needle_buffer, read): + found.append(addr) + return found + + def search_all_memory(self, needle_buffer, writeable_only=True) -> List[int]: + """ + Search the entire memory space accessible to the process for the provided value. + + :param needle_buffer: The value to search for. This should be a ctypes object of the same + sorts as used by .read_memory(...), which will be compared to the contents of + memory at each acessible address. + :param writeable_only: If True, only search regions where the process has write access. + :return: List of addresses where the needle_buffer was found. + """ + found = [] + for start, stop in self.list_mapped_regions(writeable_only): + try: + region_buffer = (ctypes.c_byte * (stop - start))() + self.read_memory(start, region_buffer) + found += [offset + start for offset in search_buffer(needle_buffer, region_buffer)] + except OSError: + logger.error('Failed to read in range 0x{} - 0x{}'.format(start, stop)) + return found + + @classmethod + @contextmanager + def open_process(cls, process_id: int) -> 'Process': + """ + Context manager which automatically closes the constructed Process: + with Process.open_process(2394) as p: + # use p here + # no need to run p.close() + + :param process_id: Process id (pid), passed to the Process constructor. + :return: Constructed Process object. + """ + process = cls(process_id) + yield process + process.close() diff --git a/mem_edit/linux.py b/mem_edit/linux.py new file mode 100644 index 0000000..acf2998 --- /dev/null +++ b/mem_edit/linux.py @@ -0,0 +1,127 @@ +""" +Implementation of Process class for Linux +""" + +from typing import List, Tuple +from os import strerror +import os +import os.path +import signal +import ctypes +import ctypes.util +import logging + +from .abstract import Process as AbstractProcess +from .utils import ctypes_buffer_t, MemEditError + + +logging.basicConfig(level=logging.INFO) +logger = logging.getLogger(__name__) + + +ptrace_commands = { + 'PTRACE_GETREGS': 12, + 'PTRACE_SETREGS': 13, + 'PTRACE_ATTACH': 16, + 'PTRACE_DETACH': 17, + 'PTRACE_SYSCALL': 24, + 'PTRACE_SEIZE': 16902, + } + + +# import ptrace() from libc +_libc = ctypes.CDLL(ctypes.util.find_library('c'), use_errno=True) +_ptrace = _libc.ptrace +_ptrace.argtypes = (ctypes.c_ulong,) * 4 +_ptrace.restype = ctypes.c_long + + +def ptrace(command: int, pid: int = 0, arg1: int = 0, arg2: int = 0) -> int: + """ + Call ptrace() with the provided pid and arguments. See the ```man ptrace```. + """ + logger.debug('ptrace({}, {}, {}, {})'.format(command, pid, arg1, arg2)) + result = _ptrace(command, pid, arg1, arg2) + if result == -1: + errno = ctypes.get_errno() + if errno: + raise MemEditError('ptrace({}, {}, {}, {})'.format(command, pid, arg1, arg2) + + ' failed with error {}: {}'.format(errno, strerror(errno))) + return result + + +class Process(AbstractProcess): + pid = None + + def __init__(self, process_id: int): + ptrace(ptrace_commands['PTRACE_SEIZE'], process_id) + self.pid = process_id + + def close(self): + os.kill(self.pid, signal.SIGSTOP) + ptrace(ptrace_commands['PTRACE_DETACH'], self.pid, 0, 0) + self.pid = None + + def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t): + with open('/proc/{}/mem'.format(self.pid), 'rb+') as mem: + mem.seek(base_address) + mem.write(write_buffer) + + def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t: + with open('/proc/{}/mem'.format(self.pid), 'rb+') as mem: + mem.seek(base_address) + mem.readinto(read_buffer) + return read_buffer + + def get_path(self) -> str: + try: + with open('/proc/{}/cmdline', 'rb') as f: + return f.read().decode().split('\x00')[0] + except FileNotFoundError: + return '' + + @staticmethod + def list_available_pids() -> List[int]: + pids = [] + for pid_str in os.listdir('/proc'): + try: + pids.append(int(pid_str)) + except ValueError: + continue + return pids + + @staticmethod + def get_pid_by_name(target_name: str) -> int: + for pid in Process.list_available_pids(): + try: + logger.info('Checking name for pid {}'.format(pid)) + with open('/proc/{}/cmdline'.format(pid), 'rb') as cmdline: + path = cmdline.read().decode().split('\x00')[0] + except FileNotFoundError: + continue + + name = os.path.basename(path) + logger.info('Name was "{}"'.format(name)) + if path is not None and name == target_name: + return pid + + logger.info('Found no process with name {}'.format(target_name)) + return None + + def list_mapped_regions(self, writeable_only: bool = True) -> List[Tuple[int, int]]: + regions = [] + with open('/proc/{}/maps'.format(self.pid), 'r') as maps: + for line in maps: + bounds, privileges = line.split()[0:2] + + if 'r' not in privileges: + continue + + if writeable_only and 'w' not in privileges: + continue + + start, stop = (int(bound, 16) for bound in bounds.split('-')) + regions.append((start, stop)) + return regions + + diff --git a/mem_edit/utils.py b/mem_edit/utils.py new file mode 100644 index 0000000..c2e691f --- /dev/null +++ b/mem_edit/utils.py @@ -0,0 +1,63 @@ +""" +Utility functions and types: + + Type definition for buffers: + ctypes_buffer_t + Custom exception type: + MemEditError + + Search for a buffer inside another buffer: + search_buffer(needle_buffer, haystack_buffer) + Check if two buffers (ctypes objects) store equal values: + ctypes_equal(a, b) +""" + +from typing import List +import ctypes + + +ctypes_buffer_t = ctypes._SimpleCData or ctypes.Array or ctypes.Structure or ctypes.Union + + +class MemEditError(Exception): + pass + + +def search_buffer(needle_buffer: ctypes_buffer_t, haystack_buffer: ctypes_buffer_t) -> List[int]: + """ + Search for a buffer inside another buffer. + + :param needle_buffer: Buffer to search for. + :param haystack_buffer: Buffer to search in. + :return: List of offsets where the needle_buffer was found. + """ + found = [] + read_type = type(needle_buffer) + for offset in range(0, len(haystack_buffer) - ctypes.sizeof(needle_buffer)): + v = read_type.from_buffer(haystack_buffer, offset) + if ctypes_equal(needle_buffer, v): + found.append(offset) + return found + + +def ctypes_equal(a: ctypes_buffer_t, b: ctypes_buffer_t) -> bool: + """ + Check if the values stored inside two ctypes buffers are equal. + """ + if not type(a) == type(b): + return False + + if isinstance(a, ctypes.Array): + return a[:] == b[:] + elif isinstance(a, ctypes.Structure) or isinstance(a, ctypes.Union): + for attr_name, attr_type in a._fields_: + a_attr, b_attr = (getattr(x, attr_name) for x in (a, b)) + if isinstance(a, ctypes_buffer_t): + if not ctypes_equal(a_attr, b_attr): + return False + elif not a_attr == b_attr: + return False + + return True + else: + return a.value == b.value diff --git a/mem_edit/windows.py b/mem_edit/windows.py new file mode 100644 index 0000000..4117d33 --- /dev/null +++ b/mem_edit/windows.py @@ -0,0 +1,256 @@ +""" +Implementation of Process class for Windows +""" + +from typing import List, Tuple +from math import floor +from os import strerror +import os.path +import ctypes +import ctypes.wintypes +import logging + +from .abstract import Process as AbstractProcess +from .utils import ctypes_buffer_t, MemEditError + + +logging.basicConfig(level=logging.INFO) +logger = logging.getLogger(__name__) + + +# Process handle privileges +privileges = { + 'PROCESS_QUERY_INFORMATION': 0x0400, + 'PROCESS_VM_OPERATION': 0x0008, + 'PROCESS_VM_READ': 0x0010, + 'PROCESS_VM_WRITE': 0x0020, + } +privileges['PROCESS_RW'] = ( + privileges['PROCESS_QUERY_INFORMATION'] | + privileges['PROCESS_VM_OPERATION'] | + privileges['PROCESS_VM_READ'] | + privileges['PROCESS_VM_WRITE'] + ) + +# Memory region states +mem_states = { + 'MEM_COMMIT': 0x1000, + 'MEM_FREE': 0x10000, + 'MEM_RESERVE': 0x2000, + } + +# Memory region permissions +page_protections = { + 'PAGE_EXECUTE': 0x10, + 'PAGE_EXECUTE_READ': 0x20, + 'PAGE_EXECUTE_READWRITE': 0x40, + 'PAGE_EXECUTE_WRITECOPY': 0x80, + 'PAGE_NOACCESS': 0x01, + 'PAGE_READWRITE': 0x04, + 'PAGE_WRITECOPY': 0x08, + } +# Custom (combined) permissions +page_protections['PAGE_READABLE'] = ( + page_protections['PAGE_EXECUTE_READ'] | + page_protections['PAGE_EXECUTE_READWRITE'] | + page_protections['PAGE_READWRITE'] + ) +page_protections['PAGE_READWRITEABLE'] = ( + page_protections['PAGE_EXECUTE_READWRITE'] | + page_protections['PAGE_READWRITE'] + ) + +# Memory types +mem_types = { + 'MEM_IMAGE': 0x1000000, + 'MEM_MAPPED': 0x40000, + 'MEM_PRIVATE': 0x20000, + } + + +# C struct for VirtualQueryEx +class MEMORY_BASIC_INFORMATION(ctypes.Structure): + _fields_ = [ + ('BaseAddress', ctypes.c_void_p), + ('AllocationBase', ctypes.c_void_p), + ('AllocationProtect', ctypes.wintypes.DWORD), + ('RegionSize', ctypes.wintypes.UINT), + ('State', ctypes.wintypes.DWORD), + ('Protect', ctypes.wintypes.DWORD), + ('Type', ctypes.wintypes.DWORD), + ] + +# C struct for GetSystemInfo +class SYSTEM_INFO(ctypes.Structure): + _fields_ = [ + ('wProcessorArchitecture', ctypes.wintypes.WORD), + ('wReserved', ctypes.wintypes.WORD), + ('dwPageSize', ctypes.wintypes.DWORD), + ('lpMinimumApplicationAddress', ctypes.c_void_p), + ('lpMaximumApplicationAddress', ctypes.c_void_p), + ('dwActiveProcessorMask', ctypes.wintypes.DWORD), + ('dwNumberOfProcessors', ctypes.wintypes.DWORD), + ('dwProcessorType', ctypes.wintypes.DWORD), + ('dwAllocationGranularity', ctypes.wintypes.DWORD), + ('wProcessorLevel', ctypes.wintypes.WORD), + ('wProcessorRevision', ctypes.wintypes.WORD), + ] + + +class Process(AbstractProcess): + process_handle = None + + def __init__(self, process_id: int): + process_handle = ctypes.windll.kernel32.OpenProcess( + privileges['PROCESS_RW'], + False, + process_id + ) + + if not process_handle: + raise MemEditError('Couldn\'t open process {}'.format(process_id)) + + self.process_handle = process_handle + + def close(self): + ctypes.windll.kernel32.CloseHandle(self.process_handle) + self.process_handle = None + + def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t): + try: + ctypes.windll.kernel32.WriteProcessMemory( + self.process_handle, + base_address, + ctypes.byref(write_buffer), + ctypes.sizeof(write_buffer), + None + ) + except (BufferError, ValueError, TypeError): + raise MemEditError('Error with handle {}: {}'.format(self.process_handle, self._get_last_error())) + + def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t: + try: + ctypes.windll.kernel32.ReadProcessMemory( + self.process_handle, + base_address, + ctypes.byref(read_buffer), + ctypes.sizeof(read_buffer), + None + ) + except (BufferError, ValueError, TypeError): + raise MemEditError('Error with handle {}: {}'.format(self.process_handle, self._get_last_error())) + + return read_buffer + + @staticmethod + def _get_last_error() -> Tuple[int, str]: + err = ctypes.windll.kernel32.GetLastError() + return err, strerror(err) + + def get_path(self) -> str: + max_path_len = 260 + name_buffer = (ctypes.c_char * max_path_len)() + rval = ctypes.windll.psapi.GetProcessImageFileNameA( + self.process_handle, + name_buffer, + max_path_len + ) + + if rval > 0: + return name_buffer.value.decode() + else: + return None + + @staticmethod + def list_available_pids() -> List[int]: + # According to EnumProcesses docs, you can't find out how many processes there are before + # fetching the list. As a result, we grab 100 on the first try, and if we get a full list + # of 100, repeatedly double the number until we get fewer than we asked for. + + n = 100 + num_returned = n + + returned_size = ctypes.wintypes.DWORD() + returned_size_ptr = ctypes.byref(returned_size) + + while True: + pids = (ctypes.wintypes.DWORD * n)() + size = ctypes.sizeof(pids) + pids_ptr = ctypes.byref(pids) + + success = ctypes.windll.Psapi.EnumProcesses(pids_ptr, size, returned_size_ptr) + if not success: + raise MemEditError('Failed to enumerate processes: n={}'.format(n)) + + num_returned = floor(returned_size.value / ctypes.sizeof(ctypes.wintypes.DWORD)) + + if n == num_returned: + n *= 2 + continue + else: + break + + return pids[:num_returned] + + @staticmethod + def get_pid_by_name(target_name: str) -> int: + for pid in Process.list_available_pids(): + try: + logger.info('Checking name for pid {}'.format(pid)) + with Process.open_process(pid) as process: + path = process.get_path() + + name = os.path.basename(path) + logger.info('Name was "{}"'.format(name)) + if path is not None and name == target_name: + return pid + except ValueError: + pass + + logger.info('Found no process with name {}'.format(target_name)) + return None + + def list_mapped_regions(self, writeable_only: bool = True) -> List[Tuple[int, int]]: + sysinfo = SYSTEM_INFO() + sysinfo_ptr = ctypes.byref(sysinfo) + ctypes.windll.kernel32.GetSystemInfo(sysinfo_ptr) + + start = sysinfo.lpMinimumApplicationAddress + stop = sysinfo.lpMaximumApplicationAddress + + def get_mem_info(address): + """ + Query the memory region starting at or before 'address' to get its size/type/state/permissions. + """ + mbi = MEMORY_BASIC_INFORMATION() + mbi_ptr = ctypes.byref(mbi) + mbi_size = ctypes.sizeof(mbi) + + success = ctypes.windll.kernel32.VirtualQueryEx( + self.process_handle, + address, + mbi_ptr, + mbi_size, + ) + + if success != mbi_size: + if success == 0: + raise MemEditError('Failed VirtualQueryEx with handle ' + + '{}: {}'.format(self.process_handle, self._get_last_error())) + else: + raise MemEditError('VirtualQueryEx output too short!') + + return mbi + + regions = [] + page_ptr = start + while page_ptr < stop: + page_info = get_mem_info(page_ptr) + if page_info.Type == mem_types['MEM_PRIVATE'] and \ + page_info.State == mem_states['MEM_COMMIT'] and \ + page_info.Protect & page_protections['PAGE_READABLE'] != 0 and \ + (page_info.Protect & page_protections['PAGE_READWRITEABLE'] != 0 or not writeable_only): + regions.append((page_ptr, page_ptr + page_info.RegionSize)) + page_ptr += page_info.RegionSize + + return regions diff --git a/setup.py b/setup.py new file mode 100644 index 0000000..c38b8b0 --- /dev/null +++ b/setup.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python + +from setuptools import setup, find_packages + +setup(name='mem_edit', + version='0.1', + description='Multiplatform library for memory editing', + author='Jan Petykiewicz', + author_email='anewusername@gmail.com', + url='https://mpxd.net/gogs/jan/mem_edit', + keywords = [ + 'memory', + 'edit', + 'editing', + 'ReadProcessMemory', + 'WriteProcessMemory', + 'proc', + 'mem', + 'ptrace', + 'multiplatform', + 'scan', + 'scanner', + 'search', + 'debug', + 'cheat', + 'trainer', + ], + classifiers = [ + 'Programming Language :: Python', + 'Programming Language :: Python :: 3', + 'Development Status :: 4 - Beta', + 'Environment :: Other Environment', + 'Intended Audience :: Developers', + 'License :: OSI Approved :: GNU Affero General Public License v3', + 'Operating System :: POSIX :: Linux', + 'Operating System :: Microsoft :: Windows', + 'Topic :: Software Development', + 'Topic :: Software Development :: Debuggers', + 'Topic :: Software Development :: Testing', + 'Topic :: System', + 'Topic :: Games/Entertainment', + 'Topic :: Utilities', + ], + packages=find_packages(), + install_requires=[ + 'ctypes', + 'typing', + ], + extras_require={ + }, + ) +