mem_scan

KO | EN

gitlite — search

#javascript #python #hacktoberfest #llm #golang #machine-learning #linux #java #windows #kubernetes #awesome-list #pytorch #mcp #open-source

(★ 12)

POC memory editor that uses the mach_vm kernel calls to scan, read, and write integer memory regions.

mem_scan Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# mem_scan
![Reading memory screenshot](https://raw.githubusercontent.com/attilathedud/mem_scan/master/promos/promo.png)

### About
mem\_scan is a POC memory editor that uses the mach\_vm kernel calls to scan, read, and write integer memory regions of other userland processes. Included in the project is an example target that can be tested against.

It must be run as root to attach to userland processes.

### Options
- `-p` : The pid of the target process. Can be retrieved through ps.
- `-m` : Display a memory map of all active regions of the target process.
- `-u` : The upper limit of addresses to search.
- `-r` : Display all addresses that have the passed integer value.
- `-f` : Path to a file which contains a list of addresses generated by `-r`. Used to filter addresses successively.
- `-w` : Address to write.
- `-v` : Integer to write to address passed via the `-w` param.

### Example Usage
```bash
# Use ps to get the pid
$ ps
  PID TTY           TIME CMD
 0001 ttys000    0:00.12 -bash
 1234 ttys001    0:00.06 target

# Search for our desired value
$ ./mem_scan -p 1234 -r 56 > addresses

# Filter until we find our address
$ ./mem_scan -p 1234 -r 55 -f addresses > addresses

# Write to our found address
$ ./mem_scan -p 1234 -w 0xDEADBEEF -v 100
```

mem_scan

mem_scan Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

mem_scan

mem_scan Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README