2010-11-18 Scan memory for variable
Somedays ago I was playing one game. And as I not so often playing
games. I would like to change some variables in memory like ammo quantity
or health. May be it is not very interesting to play game with "cheating"
but there is much more interest to play with program.
In such play can help scanmem
Here is example of programm that will help us to lern how to use scanmem:
#include <stdio.h> #include <stdlib.h> unsigned int secret_dw = 1000; //variable to search unsigned int tmp;//for input variable int main() { int i; while ( secret_dw != -1 ) { scanf("%u",&tmp); printf("secret_dw was %u \n",secret_dw); secret_dw = tmp; tmp = 0; // This is to prevent from detecting tmp variable position } printf("\bExit\n"); return 0; }
here only two variables one secret_dw for value that we will search
and second one tmp to save input. Also tmp will zeroed if not then we will
find tmp and secret_dw.
compile example with
make
and run
./example
And in paralel run
$ scanmem `pidof example` scanmem version 0.11 Copyright (C) 2009,2010 Tavis Ormandy, Eli Dupree, WANG Lu Copyright (C) 2006-2009 Tavis Ormandy scanmem comes with ABSOLUTELY NO WARRANTY; for details type `show warranty'. This is free software, and you are welcome to redistribute it under certain conditions; type `show copying' for details. info: maps file located at /proc/1801/maps opened. info: 5 suitable regions found. Please enter current value, or "help" for other commands.
As we searching 4 byte value of uint we defining it by setting up option
0> option scan_data_type int32
Now we ready to start our game. At begining we know our secret_dw value it is 1000 but we will not use it.
Type 1 in example
1
secret_dw was 1000
in scanmem
0> 1 info: 01/05 searching 0x8049000 - 0x804a000...........ok info: 02/05 searching 0xb763d000 - 0xb763e000...........ok info: 03/05 searching 0xb7787000 - 0xb778a000...........ok info: 04/05 searching 0xb77a7000 - 0xb77a9000...........ok info: 05/05 searching 0xbf9d4000 - 0xbf9f5000...........ok info: we currently have 58 matches.
As we can see 58 matches. WooHoo. Now type '1000'in example
1000
secret_dw was 1
in scanmem
58> 1000 ..........info: we currently have 2 matches.
only 2 now
scanmem has also many built in commands you can see them when type help.
One of them is 'list'. Use it.
2> list [ 0] 0x8049680, 1000, [I32 ] [ 1] 0xbf9f2dd8, 1000, [I32 ]
Here is list of matched variables. Number,address,value,size. By adress we see that
our variable is with number 0.
2> set 0=999 info: setting *0x8049680 to 0x3e7... 2> list [ 0] 0x8049680, 1000, [I32 ] [ 1] 0xbf9f2dd8, 1000, [I32 ]
Now our variable is with value 999. When you type list it may be little
bit confusing that values is the same. Go in example
12
secret_dw was 999
Yes. We have changed our variable. Our goal is completed.
Scanmem webpage scanmem[1]
Source contains programm outputs and example code.