LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 03-07-2008, 09:12 AM   #1
nullmind
LQ Newbie
 
Registered: Mar 2008
Posts: 9

Rep: Reputation: 0
Read process memory (short novel inside)


Hi! I run games in Wine. I also enjoy hacking games. One of the problems I have when hacking games is that windows makes it rather difficult to hook the program and make your hacks more sneaky, and to do so you must (from my knowledge) create a kernel module: Windows kernel module coding is suicide.

I read up on wine a while ago and found that it actually maps the process memory very similar (if not identical) to how other processes in linux do. My goal was now to write the hack in linux and completely circumvent the win32 api all together. This will work wonders for reading data, which is all I want to do, and I'll leave writing data, breakpoints, etc. for a later time.

I am currently using ptrace (man ptrace(2)) to peek/poke memory. This is rather unfortunate because my hack exists in a separate address space, and communicating between the two seems dumb. I wish to somehow use another process's memory map in some way, hopefully by remapping some segment of my process. Is this possible, or is there a better way(tm)?

Some ideas I had where to investigate or use /proc/<pid>/map or /proc/<pid>/mem in some way.

Cheers,
Kris
 
Old 03-07-2008, 02:06 PM   #2
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 78
Quote:
Originally Posted by nullmind View Post
Some ideas I had where to investigate or use /proc/<pid>/map or /proc/<pid>/mem in some way.
Once you start to ptrace a process, you are granted permission to use /proc/$PID/mem directly. You can even mmap() it and have access to matching structs and classes through your own variables.
 
Old 03-08-2008, 12:00 AM   #3
nullmind
LQ Newbie
 
Registered: Mar 2008
Posts: 9

Original Poster
Rep: Reputation: 0
Thanks, I'll be sure to look into using mmap. Does anyone know much about using shared libraries to attach to a process, similar to DLL injection on win32? I've read about dlopen, libdl, and injectso, but seems rather poorly documented (especially the stuff about the lib entry point) and obscure.

Cheers,
Kris
 
Old 03-08-2008, 12:11 PM   #4
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 78
Quote:
Originally Posted by nullmind View Post
Does anyone know much about using shared libraries to attach to a process, similar to DLL injection on win32?
I think the closes thing we have to that is LD_PRELOAD, which lets you specify libraries which override default libraries when looking up symbols (e.g., if you have the symbol fopen, and the C library has the symbol fopen, yours will be given precedence when the target application tries to resolve the symbol, effectively giving you control). The library itself still has the ability to use the C library functions however.
 
Old 03-08-2008, 04:21 PM   #5
dive
Senior Member
 
Registered: Aug 2003
Location: UK
Distribution: Slackware
Posts: 3,467

Rep: Reputation: Disabled
Interesting topic. Would you mind sharing which games you have hacked, and which you want to work on under wine/linux?
 
Old 03-08-2008, 08:59 PM   #6
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 78
Quote:
Originally Posted by osor View Post
The library itself still has the ability to use the C library functions however.
Actually, I was not clear on this, the library must dlopen the C library, and explicitly use dlsym to obtain the desired symbol.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Raid disk problem : Attempt to read block from filesystem resulted in short read ElmPie Linux - General 5 08-26-2008 05:21 AM
My computer's short term memory sucks BlackmanOne Linux - General 6 08-14-2005 01:58 AM
fsck error (read from fs resulted in short read) NeoKaiserSigma Linux - General 0 04-05-2005 06:24 PM
Help Configuring the Memory Used by a Process in RedHat? (Cache Memory on CPU) geogecko Linux - General 3 02-23-2005 03:32 PM
fsck Short Read Xzanron Linux - Hardware 1 02-11-2005 08:09 AM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 08:54 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration