如何在运行 WINE 应用程序的内存中查找和读取特定值?
我正在尝试使用文本编辑器,编写一些字符串并尝试在堆内存中找到它并使用 python 脚本更改它。
我尝试使用此代码查找和修改在 Linux 上运行的本机 Leafpad(文本编辑器)程序的内存中的值。它可以工作(堆中的值发生了变化)。但是,当我尝试在 WINE 应用程序 (notepad.exe) 上使用该脚本时,它无法找到该值。
为什么 WINE 和本机 Linux 应用程序之间存在差异?
我需要更改什么才能使脚本与 WINE 应用程序一起使用?
这是用于定位和修改值的脚本:
#!/usr/bin/env python3
from sys import argv, exit
def print_usage():
"""Print the usage string if script was used improperly"""
print('Usage: \
\t$ {} <pid> <string to read> <string to write>'.format(argv[0]))
exit(1)
def read_write_heap(pid, read_str, write_str):
"""Find @read_str in the heap of @pid and replace it with @write_str"""
try:
maps_file = open("/proc/{}/maps".format(pid), 'r')
except IOError as e:
print("Can't open file /proc/{}/maps: IOError: {}".format(pid, e))
exit(1)
heap_info = None
for line in maps_file:
if 'heap' in line:
heap_info = line.split()
print("HEAP: ", line)
maps_file.close()
if 'heap' == None:
print('No heap found!')
exit(1)
addr = heap_info[0].split('-')
perms = heap_info[1]
if 'r' not in perms or 'w' not in perms:
print('Heap does not have read and/or write permission')
exit(0)
try:
mem_file = open("/proc/{}/mem".format(pid), 'rb+')
except IOError as e:
print("Can't open file /proc/{}/maps: IOError: {}".format(pid, e))
exit(1)
heap_start = int(addr[0], 16)
heap_end = int(addr[1], 16)
mem_file.seek(heap_start)
heap = mem_file.read(heap_end - heap_start)
str_offset = heap.find(bytes(read_str, "ASCII"))
if str_offset < 0:
print("Can't find {} in /proc/{}/mem".format(read_str, pid))
exit(1)
mem_file.seek(heap_start + str_offset)
mem_file.write(bytes(write_str + '\0', "ASCII"))
if (len(argv) == 4):
pid = argv[1]
search_str = argv[2]
replace_str = argv[3]
read_write_heap(pid, search_str, replace_str)
else:
print_usage()