shokerplz/mem_edit
1
0
Fork 0
forked from jan/mem_edit
Code Issues Pull Requests Releases Wiki Activity

cosmetic and typing-related changes

Browse Source
This commit is contained in:
Jan Petykiewicz 2020-11-01 20:16:46 -08:00
parent 9759645f92
commit 6913f73db4
5 changed files with 256 additions and 199 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

184
mem_edit/abstract.py
View File

@ -2,7 +2,7 @@
Abstract class for cross-platform memory editing. Abstract class for cross-platform memory editing.
""" """
from typing import List, Tuple from typing import List, Tuple, Optional, Union, Generator
from abc import ABCMeta, abstractmethod from abc import ABCMeta, abstractmethod
from contextlib import contextmanager from contextlib import contextmanager
import copy import copy
@ -23,8 +23,8 @@ class Process(metaclass=ABCMeta):
(i.e., by reading from or writing to the memory used by a given process). (i.e., by reading from or writing to the memory used by a given process).
The static methods The static methods
Process.list_available_pids() `Process.list_available_pids()`
Process.get_pid_by_name(executable_filename) `Process.get_pid_by_name(executable_filename)`
can be used to help find the process id (pid) of the target process. They are can be used to help find the process id (pid) of the target process. They are
provided for convenience only; it is probably better to use the tools built provided for convenience only; it is probably better to use the tools built
in to your operating system to discover the pid of the specific process you in to your operating system to discover the pid of the specific process you
@ -32,18 +32,19 @@ class Process(metaclass=ABCMeta):
Once you have found the pid, you are ready to construct an instance of Process Once you have found the pid, you are ready to construct an instance of Process
and use it to read and write to memory. Once you are done with the process, and use it to read and write to memory. Once you are done with the process,
use .close() to free up the process for access by other debuggers etc. use `.close()` to free up the process for access by other debuggers etc.
```
p = Process(1239) p = Process(1239)
p.close() p.close()
```
To read/write to memory, first create a buffer using ctypes: To read/write to memory, first create a buffer using ctypes:
```
buffer0 = (ctypes.c_byte * 5)(39, 50, 03, 40, 30) buffer0 = (ctypes.c_byte * 5)(39, 50, 03, 40, 30)
buffer1 = ctypes.c_ulong() buffer1 = ctypes.c_ulong()
```
and then use and then use
```
p.write_memory(0x2fe, buffer0) p.write_memory(0x2fe, buffer0)
val0 = p.read_memory(0x220, buffer0)[:] val0 = p.read_memory(0x220, buffer0)[:]
@ -51,52 +52,52 @@ class Process(metaclass=ABCMeta):
val1a = p.read_memory(0x149, buffer1).value val1a = p.read_memory(0x149, buffer1).value
val2b = buffer1.value val2b = buffer1.value
assert(val1a == val2b) assert(val1a == val2b)
```
Searching for a value can be done in a number of ways: Searching for a value can be done in a number of ways:
Search a list of addresses: Search a list of addresses:
found_addresses = p.search_addresses([0x1020, 0x1030], buffer0) `found_addresses = p.search_addresses([0x1020, 0x1030], buffer0)`
Search the entire memory space: Search the entire memory space:
found_addresses = p.search_all_memory(buffer0, writeable_only=False) `found_addresses = p.search_all_memory(buffer0, writeable_only=False)`
You can also get a list of which regions in memory are mapped (readable): You can also get a list of which regions in memory are mapped (readable):
regions = p.list_mapped_regions(writeable_only=False) `regions = p.list_mapped_regions(writeable_only=False)`
which can be used along with search_buffer(...) to re-create .search_all_memory(...):
which can be used along with search_buffer(...) to re-create .search_all_memory(...): ```
found = [] found = []
for region_start, region_stop in regions: for region_start, region_stop in regions:
region_buffer = (ctypes.c_byte * (region_stop - region_start))() region_buffer = (ctypes.c_byte * (region_stop - region_start))()
p.read_memory(region_start, region_buffer) p.read_memory(region_start, region_buffer)
found += utils.search_buffer(ctypes.c_ulong(123456790), region_buffer) found += utils.search_buffer(ctypes.c_ulong(123456790), region_buffer)
```
Other useful methods include the context manager, implemented as a static method: Other useful methods include the context manager, implemented as a static method:
```
with Process.open_process(pid) as p: with Process.open_process(pid) as p:
# use p here, no need to call p.close() # use p here, no need to call p.close()
```
.get_path(), which reports the path of the executable file which was used .get_path(), which reports the path of the executable file which was used
to start the process: to start the process:
```
executable_path = p.get_path() executable_path = p.get_path()
```
and deref_struct_pointer, which takes a pointer to a struct and reads out the struct members: and deref_struct_pointer, which takes a pointer to a struct and reads out the struct members:
```
# struct is a list of (offset, buffer) pairs # struct is a list of (offset, buffer) pairs
struct_defintion = [(0x0, ctypes.c_ulong()), struct_defintion = [(0x0, ctypes.c_ulong()),
(0x20, ctypes.c_byte())] (0x20, ctypes.c_byte())]
values = p.deref_struct_pointer(0x0feab4, struct_defintion) values = p.deref_struct_pointer(0x0feab4, struct_defintion)
```
which is shorthand for which is shorthand for
```
struct_addr = p.read_memory(0x0feab4, ctypes.c_void_p()) struct_addr = p.read_memory(0x0feab4, ctypes.c_void_p())
values = [p.read_memory(struct_addr + 0x0, ctypes.c_ulong()), values = [p.read_memory(struct_addr + 0x0, ctypes.c_ulong()),
p.read_memory(struct_addr + 0x20, ctypes.c_byte())] p.read_memory(struct_addr + 0x20, ctypes.c_byte())]
```
================= =================
Putting all this together, a simple program which alters a magic number in the only running Putting all this together, a simple program which alters a magic number in the only running
instance of 'magic.exe' might look like this: instance of 'magic.exe' might look like this:
```
import ctypes import ctypes
from mem_edit import Process from mem_edit import Process
@ -107,9 +108,9 @@ class Process(metaclass=ABCMeta):
addrs = p.search_all_memory(magic_number) addrs = p.search_all_memory(magic_number)
assert(len(addrs) == 1) assert(len(addrs) == 1)
p.write_memory(addrs[0], ctypes.c_ulong(42)) p.write_memory(addrs[0], ctypes.c_ulong(42))
```
Searching for a value which changes: Searching for a value which changes:
```
pid = Process.get_pid_by_name('monitor_me.exe') pid = Process.get_pid_by_name('monitor_me.exe')
with Process.open_process(pid) as p: with Process.open_process(pid) as p:
addrs = p.search_all_memory(ctypes.c_int(40)) addrs = p.search_all_memory(ctypes.c_int(40))
@ -118,18 +119,19 @@ class Process(metaclass=ABCMeta):
print('Found addresses:') print('Found addresses:')
for addr in filtered_addrs: for addr in filtered_addrs:
print(hex(addr)) print(hex(addr))
```
""" """
@abstractmethod @abstractmethod
def __init__(self, process_id: int): def __init__(self, process_id: int):
""" """
Constructing a Process object prepares the process with specified process_id for Constructing a Process object prepares the process with specified process_id for
memory editing. Finding the process_id for the process you want to edit is often memory editing. Finding the `process_id` for the process you want to edit is often
easiest using os-specific tools (or by launching the process yourself, e.g. with easiest using os-specific tools (or by launching the process yourself, e.g. with
subprocess.Popen(...)). `subprocess.Popen(...)`).
:param process_id: Process id (pid) of the target process Args:
process_id: Process id (pid) of the target process
""" """
pass pass
@ -140,7 +142,7 @@ class Process(metaclass=ABCMeta):
letting other debuggers attach to it instead. letting other debuggers attach to it instead.
This function should be called after you are done working with the process This function should be called after you are done working with the process
and will no longer need it. See the Process.open_process(...) context and will no longer need it. See the `Process.open_process(...)` context
manager to avoid having to call this function yourself. manager to avoid having to call this function yourself.
""" """
pass pass
@ -148,38 +150,45 @@ class Process(metaclass=ABCMeta):
@abstractmethod @abstractmethod
def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t): def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t):
""" """
Write the given buffer to the process's address space, starting at base_address. Write the given buffer to the process's address space, starting at `base_address`.
:param base_address: The address to write at, in the process's address space. Args:
:param write_buffer: A ctypes object, for example, ctypes.c_ulong(48), base_address: The address to write at, in the process's address space.
(ctypes.c_byte * 3)(43, 21, 0xff), or a subclass of ctypes.Structure, write_buffer: A ctypes object, for example, `ctypes.c_ulong(48)`,
which will be written into memory starting at base_address. `(ctypes.c_byte * 3)(43, 21, 0xff)`, or a subclass of `ctypes.Structure`,
which will be written into memory starting at `base_address`.
""" """
pass pass
@abstractmethod @abstractmethod
def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t: def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t:
""" """
Read into the given buffer from the process's address space, starting at base_address. Read into the given buffer from the process's address space, starting at `base_address`.
:param base_address: The address to read from, in the process's address space. Args:
:param read_buffer: A ctypes object, for example. ctypes.c_ulong(), base_address: The address to read from, in the process's address space.
(ctypes.c_byte * 3)(), or a subclass of ctypes.Structure, which will be read_buffer: A `ctypes` object, for example. `ctypes.c_ulong()`,
overwritten with the contents of the process's memory starting at base_address. `(ctypes.c_byte * 3)()`, or a subclass of `ctypes.Structure`, which will be
:returns: read_buffer is returned as well as being overwritten. overwritten with the contents of the process's memory starting at `base_address`.
Returns:
`read_buffer` is returned as well as being overwritten.
""" """
pass pass
@abstractmethod @abstractmethod
def list_mapped_regions(self, writeable_only=True) -> List[Tuple[int, int]]: def list_mapped_regions(self, writeable_only=True) -> List[Tuple[int, int]]:
""" """
Return a list of (start_address, stop_address) for the regions of the address space Return a list of `(start_address, stop_address)` for the regions of the address space
accessible to (readable and possibly writable by) the process. accessible to (readable and possibly writable by) the process.
By default, this function does not return non-writeable regions. By default, this function does not return non-writeable regions.
:param writeable_only: If True, only return regions which are also writeable. Args:
Default true. writeable_only: If `True`, only return regions which are also writeable.
:return: List of (start_address, stop_address) for each accessible memory region. Default `True`.
Returns:
List of `(start_address, stop_address)` for each accessible memory region.
""" """
pass pass
@ -188,7 +197,8 @@ class Process(metaclass=ABCMeta):
""" """
Return the path to the executable file which was run to start this process. Return the path to the executable file which was run to start this process.
:return: A string containing the path. Returns:
A string containing the path.
""" """
pass pass
@ -198,13 +208,14 @@ class Process(metaclass=ABCMeta):
""" """
Return a list of all process ids (pids) accessible on this system. Return a list of all process ids (pids) accessible on this system.
:return: List of running process ids. Returns:
List of running process ids.
""" """
pass pass
@staticmethod @staticmethod
@abstractmethod @abstractmethod
def get_pid_by_name(target_name: str) -> int or None: def get_pid_by_name(target_name: str) -> Optional[int]:
""" """
Attempt to return the process id (pid) of a process which was run with an executable Attempt to return the process id (pid) of a process which was run with an executable
file with the provided name. If no process is found, return None. file with the provided name. If no process is found, return None.
@ -215,7 +226,12 @@ class Process(metaclass=ABCMeta):
Don't rely on this method if you can possibly avoid it, since it makes no Don't rely on this method if you can possibly avoid it, since it makes no
attempt to confirm that it found a unique process and breaks trivially (e.g. if the attempt to confirm that it found a unique process and breaks trivially (e.g. if the
executable file is renamed). executable file is renamed).
:return: Process id (pid) of a process with the provided name, or None.
Args:
target_name: Name of the process to find the PID for
Returns:
Process id (pid) of a process with the provided name, or `None`.
""" """
pass pass
@ -225,34 +241,48 @@ class Process(metaclass=ABCMeta):
) -> List[ctypes_buffer_t]: ) -> List[ctypes_buffer_t]:
""" """
Take a pointer to a struct and read out the struct members: Take a pointer to a struct and read out the struct members:
```
struct_defintion = [(0x0, ctypes.c_ulong()), struct_defintion = [(0x0, ctypes.c_ulong()),
(0x20, ctypes.c_byte())] (0x20, ctypes.c_byte())]
values = p.deref_struct_pointer(0x0feab4, struct_defintion) values = p.deref_struct_pointer(0x0feab4, struct_defintion)
```
which is shorthand for which is shorthand for
```
struct_addr = p.read_memory(0x0feab4, ctypes.c_void_p()) struct_addr = p.read_memory(0x0feab4, ctypes.c_void_p())
values = [p.read_memory(struct_addr + 0x0, ctypes.c_ulong()), values = [p.read_memory(struct_addr + 0x0, ctypes.c_ulong()),
p.read_memory(struct_addr + 0x20, ctypes.c_byte())] p.read_memory(struct_addr + 0x20, ctypes.c_byte())]
```
:param base_address: Address at which the struct pointer is located. Args:
:param targets: List of (offset, read_buffer) pairs which will be read from the struct. base_address: Address at which the struct pointer is located.
:return: List of read values corresponding to the provided targets. targets: List of `(offset, read_buffer)` pairs which will be read from the struct.
Return:
List of read values corresponding to the provided targets.
""" """
base = self.read_memory(base_address, ctypes.c_void_p()).value base = self.read_memory(base_address, ctypes.c_void_p()).value
values = [self.read_memory(base + offset, buffer) for offset, buffer in targets] values = [self.read_memory(base + offset, buffer) for offset, buffer in targets]
return values return values
def search_addresses(self, addresses: List[int], needle_buffer: ctypes_buffer_t, verbatim: bool=True) -> List[int]: def search_addresses(self,
addresses: List[int],
needle_buffer: ctypes_buffer_t,
verbatim: bool = True,
) -> List[int]:
""" """
Search for the provided value at each of the provided addresses, and return the addresses Search for the provided value at each of the provided addresses, and return the addresses
where it is found. where it is found.
:param addresses: List of addresses which should be probed. Args:
:param needle_buffer: The value to search for. This should be a ctypes object of the same addresses: List of addresses which should be probed.
sorts as used by .read_memory(...), which will be compared to the contents of needle_buffer: The value to search for. This should be a `ctypes` object of the same
sorts as used by `.read_memory(...)`, which will be compared to the contents of
memory at each of the given addresses. memory at each of the given addresses.
:param verbatim: If True, perform bitwise comparison when searching for needle_buffer. verbatim: If `True`, perform bitwise comparison when searching for `needle_buffer`.
If False, perform utils.ctypes_equal-based comparison. Default True. If `False`, perform `utils.ctypes_equal`-based comparison. Default `True`.
:return: List of addresses where the needle_buffer was found.
Returns:
List of addresses where the `needle_buffer` was found.
""" """
found = [] found = []
read_buffer = copy.copy(needle_buffer) read_buffer = copy.copy(needle_buffer)
@ -269,18 +299,25 @@ class Process(metaclass=ABCMeta):
found.append(address) found.append(address)
return found return found
def search_all_memory(self, needle_buffer: ctypes_buffer_t, writeable_only: bool=True, verbatim: bool=True) -> List[int]: def search_all_memory(self,
needle_buffer: ctypes_buffer_t,
writeable_only: bool = True,
verbatim: bool = True,
) -> List[int]:
""" """
Search the entire memory space accessible to the process for the provided value. Search the entire memory space accessible to the process for the provided value.
:param needle_buffer: The value to search for. This should be a ctypes object of the same Args:
sorts as used by .read_memory(...), which will be compared to the contents of needle_buffer: The value to search for. This should be a ctypes object of the same
sorts as used by `.read_memory(...)`, which will be compared to the contents of
memory at each accessible address. memory at each accessible address.
:param writeable_only: If True, only search regions where the process has write access. writeable_only: If `True`, only search regions where the process has write access.
Default True. Default `True`.
:param verbatim: If True, perform bitwise comparison when searching for needle_buffer. verbatim: If `True`, perform bitwise comparison when searching for `needle_buffer`.
If False, perform utils.ctypes_equal-based comparison. Default True. If `False`, perform `utils.ctypes_equal-based` comparison. Default `True`.
:return: List of addresses where the needle_buffer was found.
Returns:
List of addresses where the `needle_buffer` was found.
""" """
found = [] found = []
if verbatim: if verbatim:
@ -299,15 +336,20 @@ class Process(metaclass=ABCMeta):
@classmethod @classmethod
@contextmanager @contextmanager
def open_process(cls, process_id: int) -> 'Process': def open_process(cls, process_id: int) -> Generator['Process', None, None]:
""" """
Context manager which automatically closes the constructed Process: Context manager which automatically closes the constructed Process:
```
with Process.open_process(2394) as p: with Process.open_process(2394) as p:
# use p here # use p here
# no need to run p.close() # no need to run p.close()
```
:param process_id: Process id (pid), passed to the Process constructor. Args:
:return: Constructed Process object. process_id: Process id (pid), passed to the Process constructor.
Returns:
Constructed Process object.
""" """
process = cls(process_id) process = cls(process_id)
yield process yield process

18
mem_edit/linux.py
View File

@ -2,7 +2,7 @@
Implementation of Process class for Linux Implementation of Process class for Linux
""" """
from typing import List, Tuple from typing import List, Tuple, Optional
from os import strerror from os import strerror
import os import os
import os.path import os.path
@ -20,13 +20,13 @@ logger = logging.getLogger(__name__)
ptrace_commands = { ptrace_commands = {
'PTRACE_GETREGS': 12, 'PTRACE_GETREGS': 12,
'PTRACE_SETREGS': 13, 'PTRACE_SETREGS': 13,
'PTRACE_ATTACH': 16, 'PTRACE_ATTACH': 16,
'PTRACE_DETACH': 17, 'PTRACE_DETACH': 17,
'PTRACE_SYSCALL': 24, 'PTRACE_SYSCALL': 24,
'PTRACE_SEIZE': 16902, 'PTRACE_SEIZE': 16902,
} }
# import ptrace() from libc # import ptrace() from libc
@ -91,7 +91,7 @@ class Process(AbstractProcess):
return pids return pids
@staticmethod @staticmethod
def get_pid_by_name(target_name: str) -> int or None: def get_pid_by_name(target_name: str) -> Optional[int]:
for pid in Process.list_available_pids(): for pid in Process.list_available_pids():
try: try:
logger.info('Checking name for pid {}'.format(pid)) logger.info('Checking name for pid {}'.format(pid))

38
mem_edit/utils.py
View File

@ -12,24 +12,29 @@ Utility functions and types:
ctypes_equal(a, b) ctypes_equal(a, b)
""" """
from typing import List from typing import List, Union
import ctypes import ctypes
ctypes_buffer_t = ctypes._SimpleCData or ctypes.Array or ctypes.Structure or ctypes.Union ctypes_buffer_t = Union[ctypes._SimpleCData, ctypes.Array, ctypes.Structure, ctypes.Union]
class MemEditError(Exception): class MemEditError(Exception):
pass pass
def search_buffer_verbatim(needle_buffer: ctypes_buffer_t, haystack_buffer: ctypes_buffer_t) -> List[int]: def search_buffer_verbatim(needle_buffer: ctypes_buffer_t,
haystack_buffer: ctypes_buffer_t,
) -> List[int]:
""" """
Search for a buffer inside another buffer, using a direct (bitwise) comparison Search for a buffer inside another buffer, using a direct (bitwise) comparison
:param needle_buffer: Buffer to search for. Args:
:param haystack_buffer: Buffer to search in. needle_buffer: Buffer to search for.
:return: List of offsets where the needle_buffer was found. haystack_buffer: Buffer to search in.
Returns:
List of offsets where the `needle_buffer` was found.
""" """
found = [] found = []
@ -45,14 +50,19 @@ def search_buffer_verbatim(needle_buffer: ctypes_buffer_t, haystack_buffer: ctyp
return found return found
def search_buffer(needle_buffer: ctypes_buffer_t, haystack_buffer: ctypes_buffer_t) -> List[int]: def search_buffer(needle_buffer: ctypes_buffer_t,
haystack_buffer: ctypes_buffer_t,
) -> List[int]:
""" """
Search for a buffer inside another buffer, using ctypes_equal for comparison. Search for a buffer inside another buffer, using `ctypes_equal` for comparison.
Much slower than search_buffer_verbatim. Much slower than `search_buffer_verbatim`.
:param needle_buffer: Buffer to search for. Args:
:param haystack_buffer: Buffer to search in. needle_buffer: Buffer to search for.
:return: List of offsets where the needle_buffer was found. haystack_buffer: Buffer to search in.
Returns:
List of offsets where the needle_buffer was found.
""" """
found = [] found = []
read_type = type(needle_buffer) read_type = type(needle_buffer)
@ -63,7 +73,9 @@ def search_buffer(needle_buffer: ctypes_buffer_t, haystack_buffer: ctypes_buffer
return found return found
def ctypes_equal(a: ctypes_buffer_t, b: ctypes_buffer_t) -> bool: def ctypes_equal(a: ctypes_buffer_t,
b: ctypes_buffer_t,
) -> bool:
""" """
Check if the values stored inside two ctypes buffers are equal. Check if the values stored inside two ctypes buffers are equal.
""" """

212
mem_edit/windows.py
View File

@ -2,7 +2,7 @@
Implementation of Process class for Windows Implementation of Process class for Windows
""" """
from typing import List, Tuple from typing import List, Tuple, Optional
from math import floor from math import floor
from os import strerror from os import strerror
import os.path import os.path
@ -20,77 +20,77 @@ logger = logging.getLogger(__name__)
# Process handle privileges # Process handle privileges
privileges = { privileges = {
'PROCESS_QUERY_INFORMATION': 0x0400, 'PROCESS_QUERY_INFORMATION': 0x0400,
'PROCESS_VM_OPERATION': 0x0008, 'PROCESS_VM_OPERATION': 0x0008,
'PROCESS_VM_READ': 0x0010, 'PROCESS_VM_READ': 0x0010,
'PROCESS_VM_WRITE': 0x0020, 'PROCESS_VM_WRITE': 0x0020,
} }
privileges['PROCESS_RW'] = ( privileges['PROCESS_RW'] = (
privileges['PROCESS_QUERY_INFORMATION'] | privileges['PROCESS_QUERY_INFORMATION'] |
privileges['PROCESS_VM_OPERATION'] | privileges['PROCESS_VM_OPERATION'] |
privileges['PROCESS_VM_READ'] | privileges['PROCESS_VM_READ'] |
privileges['PROCESS_VM_WRITE'] privileges['PROCESS_VM_WRITE']
) )
# Memory region states # Memory region states
mem_states = { mem_states = {
'MEM_COMMIT': 0x1000, 'MEM_COMMIT': 0x1000,
'MEM_FREE': 0x10000, 'MEM_FREE': 0x10000,
'MEM_RESERVE': 0x2000, 'MEM_RESERVE': 0x2000,
} }
# Memory region permissions # Memory region permissions
page_protections = { page_protections = {
'PAGE_EXECUTE': 0x10, 'PAGE_EXECUTE': 0x10,
'PAGE_EXECUTE_READ': 0x20, 'PAGE_EXECUTE_READ': 0x20,
'PAGE_EXECUTE_READWRITE': 0x40, 'PAGE_EXECUTE_READWRITE': 0x40,
'PAGE_EXECUTE_WRITECOPY': 0x80, 'PAGE_EXECUTE_WRITECOPY': 0x80,
'PAGE_NOACCESS': 0x01, 'PAGE_NOACCESS': 0x01,
'PAGE_READWRITE': 0x04, 'PAGE_READWRITE': 0x04,
'PAGE_WRITECOPY': 0x08, 'PAGE_WRITECOPY': 0x08,
} }
# Custom (combined) permissions # Custom (combined) permissions
page_protections['PAGE_READABLE'] = ( page_protections['PAGE_READABLE'] = (
page_protections['PAGE_EXECUTE_READ'] | page_protections['PAGE_EXECUTE_READ'] |
page_protections['PAGE_EXECUTE_READWRITE'] | page_protections['PAGE_EXECUTE_READWRITE'] |
page_protections['PAGE_READWRITE'] page_protections['PAGE_READWRITE']
) )
page_protections['PAGE_READWRITEABLE'] = ( page_protections['PAGE_READWRITEABLE'] = (
page_protections['PAGE_EXECUTE_READWRITE'] | page_protections['PAGE_EXECUTE_READWRITE'] |
page_protections['PAGE_READWRITE'] page_protections['PAGE_READWRITE']
) )
# Memory types # Memory types
mem_types = { mem_types = {
'MEM_IMAGE': 0x1000000, 'MEM_IMAGE': 0x1000000,
'MEM_MAPPED': 0x40000, 'MEM_MAPPED': 0x40000,
'MEM_PRIVATE': 0x20000, 'MEM_PRIVATE': 0x20000,
} }
# C struct for VirtualQueryEx # C struct for VirtualQueryEx
class MEMORY_BASIC_INFORMATION32(ctypes.Structure): class MEMORY_BASIC_INFORMATION32(ctypes.Structure):
_fields_ = [ _fields_ = [
('BaseAddress', ctypes.wintypes.DWORD), ('BaseAddress', ctypes.wintypes.DWORD),
('AllocationBase', ctypes.wintypes.DWORD), ('AllocationBase', ctypes.wintypes.DWORD),
('AllocationProtect', ctypes.wintypes.DWORD), ('AllocationProtect', ctypes.wintypes.DWORD),
('RegionSize', ctypes.wintypes.DWORD), ('RegionSize', ctypes.wintypes.DWORD),
('State', ctypes.wintypes.DWORD), ('State', ctypes.wintypes.DWORD),
('Protect', ctypes.wintypes.DWORD), ('Protect', ctypes.wintypes.DWORD),
('Type', ctypes.wintypes.DWORD), ('Type', ctypes.wintypes.DWORD),
] ]
class MEMORY_BASIC_INFORMATION64(ctypes.Structure): class MEMORY_BASIC_INFORMATION64(ctypes.Structure):
_fields_ = [ _fields_ = [
('BaseAddress', ctypes.c_ulonglong), ('BaseAddress', ctypes.c_ulonglong),
('AllocationBase', ctypes.c_ulonglong), ('AllocationBase', ctypes.c_ulonglong),
('AllocationProtect', ctypes.wintypes.DWORD), ('AllocationProtect', ctypes.wintypes.DWORD),
('__alignment1', ctypes.wintypes.DWORD), ('__alignment1', ctypes.wintypes.DWORD),
('RegionSize', ctypes.c_ulonglong), ('RegionSize', ctypes.c_ulonglong),
('State', ctypes.wintypes.DWORD), ('State', ctypes.wintypes.DWORD),
('Protect', ctypes.wintypes.DWORD), ('Protect', ctypes.wintypes.DWORD),
('Type', ctypes.wintypes.DWORD), ('Type', ctypes.wintypes.DWORD),
('__alignment2', ctypes.wintypes.DWORD), ('__alignment2', ctypes.wintypes.DWORD),
] ]
PTR_SIZE = ctypes.sizeof(ctypes.c_void_p) PTR_SIZE = ctypes.sizeof(ctypes.c_void_p)
if PTR_SIZE == 8: # 64-bit python if PTR_SIZE == 8: # 64-bit python
@ -98,36 +98,39 @@ if PTR_SIZE == 8: # 64-bit python
elif PTR_SIZE == 4: # 32-bit python elif PTR_SIZE == 4: # 32-bit python
MEMORY_BASIC_INFORMATION = MEMORY_BASIC_INFORMATION32 MEMORY_BASIC_INFORMATION = MEMORY_BASIC_INFORMATION32
ctypes.windll.kernel32.VirtualQueryEx.argtypes = [ctypes.wintypes.HANDLE, ctypes.windll.kernel32.VirtualQueryEx.argtypes = [
ctypes.wintypes.LPCVOID, ctypes.wintypes.HANDLE,
ctypes.c_void_p, ctypes.wintypes.LPCVOID,
ctypes.c_size_t] ctypes.c_void_p,
ctypes.windll.kernel32.ReadProcessMemory.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_size_t]
ctypes.wintypes.LPCVOID, ctypes.windll.kernel32.ReadProcessMemory.argtypes = [
ctypes.c_void_p, ctypes.wintypes.HANDLE,
ctypes.c_size_t, ctypes.wintypes.LPCVOID,
ctypes.c_void_p] ctypes.c_void_p,
ctypes.windll.kernel32.WriteProcessMemory.argtypes = [ctypes.wintypes.HANDLE, ctypes.c_size_t,
ctypes.wintypes.LPCVOID, ctypes.c_void_p]
ctypes.c_void_p, ctypes.windll.kernel32.WriteProcessMemory.argtypes = [
ctypes.c_size_t, ctypes.wintypes.HANDLE,
ctypes.c_void_p] ctypes.wintypes.LPCVOID,
ctypes.c_void_p,
ctypes.c_size_t,
ctypes.c_void_p]
# C struct for GetSystemInfo # C struct for GetSystemInfo
class SYSTEM_INFO(ctypes.Structure): class SYSTEM_INFO(ctypes.Structure):
_fields_ = [ _fields_ = [
('wProcessorArchitecture', ctypes.wintypes.WORD), ('wProcessorArchitecture', ctypes.wintypes.WORD),
('wReserved', ctypes.wintypes.WORD), ('wReserved', ctypes.wintypes.WORD),
('dwPageSize', ctypes.wintypes.DWORD), ('dwPageSize', ctypes.wintypes.DWORD),
('lpMinimumApplicationAddress', ctypes.c_void_p), ('lpMinimumApplicationAddress', ctypes.c_void_p),
('lpMaximumApplicationAddress', ctypes.c_void_p), ('lpMaximumApplicationAddress', ctypes.c_void_p),
('dwActiveProcessorMask', ctypes.c_void_p), ('dwActiveProcessorMask', ctypes.c_void_p),
('dwNumberOfProcessors', ctypes.wintypes.DWORD), ('dwNumberOfProcessors', ctypes.wintypes.DWORD),
('dwProcessorType', ctypes.wintypes.DWORD), ('dwProcessorType', ctypes.wintypes.DWORD),
('dwAllocationGranularity', ctypes.wintypes.DWORD), ('dwAllocationGranularity', ctypes.wintypes.DWORD),
('wProcessorLevel', ctypes.wintypes.WORD), ('wProcessorLevel', ctypes.wintypes.WORD),
('wProcessorRevision', ctypes.wintypes.WORD), ('wProcessorRevision', ctypes.wintypes.WORD),
] ]
class Process(AbstractProcess): class Process(AbstractProcess):
@ -152,24 +155,24 @@ class Process(AbstractProcess):
def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t): def write_memory(self, base_address: int, write_buffer: ctypes_buffer_t):
try: try:
ctypes.windll.kernel32.WriteProcessMemory( ctypes.windll.kernel32.WriteProcessMemory(
self.process_handle, self.process_handle,
base_address, base_address,
ctypes.byref(write_buffer), ctypes.byref(write_buffer),
ctypes.sizeof(write_buffer), ctypes.sizeof(write_buffer),
None None
) )
except (BufferError, ValueError, TypeError): except (BufferError, ValueError, TypeError):
raise MemEditError('Error with handle {}: {}'.format(self.process_handle, self._get_last_error())) raise MemEditError('Error with handle {}: {}'.format(self.process_handle, self._get_last_error()))
def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t: def read_memory(self, base_address: int, read_buffer: ctypes_buffer_t) -> ctypes_buffer_t:
try: try:
ctypes.windll.kernel32.ReadProcessMemory( ctypes.windll.kernel32.ReadProcessMemory(
self.process_handle, self.process_handle,
base_address, base_address,
ctypes.byref(read_buffer), ctypes.byref(read_buffer),
ctypes.sizeof(read_buffer), ctypes.sizeof(read_buffer),
None None
) )
except (BufferError, ValueError, TypeError): except (BufferError, ValueError, TypeError):
raise MemEditError('Error with handle {}: {}'.format(self.process_handle, self._get_last_error())) raise MemEditError('Error with handle {}: {}'.format(self.process_handle, self._get_last_error()))
@ -184,10 +187,9 @@ class Process(AbstractProcess):
max_path_len = 260 max_path_len = 260
name_buffer = (ctypes.c_char * max_path_len)() name_buffer = (ctypes.c_char * max_path_len)()
rval = ctypes.windll.psapi.GetProcessImageFileNameA( rval = ctypes.windll.psapi.GetProcessImageFileNameA(
self.process_handle, self.process_handle,
name_buffer, name_buffer,
max_path_len max_path_len)
)
if rval > 0: if rval > 0:
return name_buffer.value.decode() return name_buffer.value.decode()
@ -199,7 +201,7 @@ class Process(AbstractProcess):
# According to EnumProcesses docs, you can't find out how many processes there are before # According to EnumProcesses docs, you can't find out how many processes there are before
# fetching the list. As a result, we grab 100 on the first try, and if we get a full list # fetching the list. As a result, we grab 100 on the first try, and if we get a full list
# of 100, repeatedly double the number until we get fewer than we asked for. # of 100, repeatedly double the number until we get fewer than we asked for.
n = 100 n = 100
returned_size = ctypes.wintypes.DWORD() returned_size = ctypes.wintypes.DWORD()
returned_size_ptr = ctypes.byref(returned_size) returned_size_ptr = ctypes.byref(returned_size)
@ -224,7 +226,7 @@ class Process(AbstractProcess):
return pids[:num_returned] return pids[:num_returned]
@staticmethod @staticmethod
def get_pid_by_name(target_name: str) -> int or None: def get_pid_by_name(target_name: str) -> Optional[int]:
for pid in Process.list_available_pids(): for pid in Process.list_available_pids():
try: try:
logger.info('Checking name for pid {}'.format(pid)) logger.info('Checking name for pid {}'.format(pid))
@ -260,11 +262,10 @@ class Process(AbstractProcess):
mbi_size = ctypes.sizeof(mbi) mbi_size = ctypes.sizeof(mbi)
success = ctypes.windll.kernel32.VirtualQueryEx( success = ctypes.windll.kernel32.VirtualQueryEx(
self.process_handle, self.process_handle,
address, address,
mbi_ptr, mbi_ptr,
mbi_size, mbi_size)
)
if success != mbi_size: if success != mbi_size:
if success == 0: if success == 0:
@ -279,10 +280,11 @@ class Process(AbstractProcess):
page_ptr = start page_ptr = start
while page_ptr < stop: while page_ptr < stop:
page_info = get_mem_info(page_ptr) page_info = get_mem_info(page_ptr)
if page_info.Type == mem_types['MEM_PRIVATE'] and \ if (page_info.Type == mem_types['MEM_PRIVATE']
page_info.State == mem_states['MEM_COMMIT'] and \ and page_info.State == mem_states['MEM_COMMIT']
page_info.Protect & page_protections['PAGE_READABLE'] != 0 and \ and page_info.Protect & page_protections['PAGE_READABLE'] != 0
(page_info.Protect & page_protections['PAGE_READWRITEABLE'] != 0 or not writeable_only): and (page_info.Protect & page_protections['PAGE_READWRITEABLE'] != 0
or not writeable_only)):
regions.append((page_ptr, page_ptr + page_info.RegionSize)) regions.append((page_ptr, page_ptr + page_info.RegionSize))
page_ptr += page_info.RegionSize page_ptr += page_info.RegionSize

3
setup.py
View File

@ -2,7 +2,8 @@
from setuptools import setup, find_packages from setuptools import setup, find_packages
with open('README.md', 'r') as f:
with open('README.md', 'rt') as f:
long_description = f.read() long_description = f.read()
with open('mem_edit/VERSION.py', 'rt') as f: with open('mem_edit/VERSION.py', 'rt') as f: