如何在运行的wine应用程序的内存中查找和读取特定值?

逆向工程 葡萄酒
2021-06-11 04:31:50

如何在运行 WINE 应用程序的内存中查找和读取特定值?

我正在尝试使用文本编辑器,编写一些字符串并尝试在堆内存中找到它并使用 python 脚本更改它。

我尝试使用此代码查找和修改在 Linux 上运行的本机 Leafpad(文本编辑器)程序的内存中的值。它可以工作(堆中的值发生了变化)。但是,当我尝试在 WINE 应用程序 (notepad.exe) 上使用该脚本时,它无法找到该值。

为什么 WINE 和本机 Linux 应用程序之间存在差异?

我需要更改什么才能使脚本与 WINE 应用程序一起使用?

这是用于定位和修改值的脚本:

#!/usr/bin/env python3

from sys import argv, exit


def print_usage():
    """Print the usage string if script was used improperly"""
    print('Usage: \
        \t$ {} <pid> <string to read> <string to write>'.format(argv[0]))
    exit(1)


def read_write_heap(pid, read_str, write_str):
    """Find @read_str in the heap of @pid and replace it with @write_str"""
    try:
        maps_file = open("/proc/{}/maps".format(pid), 'r')
    except IOError as e:
        print("Can't open file /proc/{}/maps: IOError: {}".format(pid, e))
        exit(1)
    heap_info = None
    for line in maps_file:
        if 'heap' in line:
            heap_info = line.split()
            print("HEAP: ", line)
    maps_file.close()
    if 'heap' == None:
        print('No heap found!')
        exit(1)
    addr = heap_info[0].split('-')
    perms = heap_info[1]
    if 'r' not in perms or 'w' not in perms:
        print('Heap does not have read and/or write permission')
        exit(0)
    try:
        mem_file = open("/proc/{}/mem".format(pid), 'rb+')
    except IOError as e:
        print("Can't open file /proc/{}/maps: IOError: {}".format(pid, e))
        exit(1)
    heap_start = int(addr[0], 16)
    heap_end = int(addr[1], 16)
    mem_file.seek(heap_start)
    heap = mem_file.read(heap_end - heap_start)

    str_offset = heap.find(bytes(read_str, "ASCII"))
    if str_offset < 0:
        print("Can't find {} in /proc/{}/mem".format(read_str, pid))
        exit(1)
    mem_file.seek(heap_start + str_offset)

    mem_file.write(bytes(write_str + '\0', "ASCII"))


if (len(argv) == 4):
    pid = argv[1]
    search_str = argv[2]
    replace_str = argv[3]
    read_write_heap(pid, search_str, replace_str)
else:
    print_usage()
0个回答
没有发现任何回复~