scanmem(1) General Commands Manual scanmem(1) (NAME) scanmem - (SYNOPSIS) scanmem [] [target-program-pid] (DESCRIPTION) scanmem . scanmem ( ) . scanmem read/write (regions) . ( ) -- -- . scanmem . scanmem "pokefinder" scanmem . (USAGE) scanmem (PID) . scanmem . help > scanmem . target-program-pid C ( 0x 0 ). -p, --pid=pid target-program-pid. -c, --command=cmd1[;cmd2][;...] ( <<;>>) . -v, --version . -h, --help . -d, --debug (debug) . -e, --errexit . (COMMANDS) scanmem > . . "int" . option . n n scanmem n . scanmem ( ) . n..m n scanmem n m . >, <, +, -, =, != ( ) . : > n < n = n != n. > [n] n n . . < [n] n n . . + [n] n n . ( >). - [n] n n . ( <). = [n] n n ( n). . != [n] n n . . snapshot . > < + - = != . " text "string" text . update . list scanmem > < = . . list [max_to_print] max_to_print (: 10k) (region id) (match offset) . (match id) delete . ELF . (ASLR) . delete match-id_set match-id_set. (match-ids) list . : [!][..a](,b..c | d, ...)[e..]. reset . dregion . (match-ids) ..TP watch match-id match-id . ^C . set [match-id_set=]value[/delay] [...] value match-id_set value . value C . match-id list . match-id_set = . : [!][..a](,b..c | d, ...)[e..]. / . set ^C scanmem . . () . . write value_type address value . value_type scanmem `help write` . dump address length [filename] address length . filename stdout . pid [new-pid] (PID) new-pid . reset . lregions dregion . region-id dregion . ( ) . . : . "exe" () "code" () "heap" "stack" "misc" ( ). ELF (exe/lib) . ELF . ELF . dregion region-id_set region-id_set . : [!][..a](,b..c | d, ...)[e..]. region-id lregions . option name value (scan) . / `help option` . shell shell-command shell-command /bin/sh . show info info - `help show` . version scanmem . help . exit ..SH " (EXAMPLES)" nethack nethack sgid . : scanmem (root) . (KNOWN ISSUES) . $ sudo scanmem `pgrep nethack` info: maps file located at /proc/14658/maps opened. info: 9 suitable regions found. Please enter current value, or "help" for other commands. > ( ) scanmem . > 58 01/09 searching 0x79f000 - 0x7b0000..........ok 02/09 searching 0x7b0000 - 0x7cc000..........ok 03/09 searching 0x24d2000 - 0x24f3000..........ok 04/09 searching 0x7fcc04baa000 - 0x7fcc04bae000..........ok 05/09 searching 0x7fcc04de1000 - 0x7fcc04de2000..........ok 06/09 searching 0x7fcc051f7000 - 0x7fcc051fb000..........ok 07/09 searching 0x7fcc05227000 - 0x7fcc0522a000..........ok 08/09 searching 0x7fcc0522c000 - 0x7fcc0522d000..........ok 09/09 searching 0x7ffc8c113000 - 0x7ffc8c134000..........ok info: we currently have 16 matches. 16> list [ 0] 7b09e0, 1 + 3b09e0, exe, 58, [I64 I32 I16 I8 ] [ 1] 7b907a, 1 + 3b907a, exe, 58, [I8 ] [ 2] 24d4b6c, 2 + 2b6c, heap, 58, [I16 I8 ] [ 3] 24d567e, 2 + 367e, heap, 58, [I16 I8 ] [ 4] 24d5740, 2 + 3740, heap, 58, [I8 ] [ 5] 7fcc05229951, 6 + 2951, misc, 58, [I8 ] [ 6] 7ffc8c12ee28, 8 + 1be28, stack, 58, [I16 I8 ] [ 7] 7ffc8c132381, 8 + 1f381, stack, 58, [I8 ] [ 8] 7ffc8c132389, 8 + 1f389, stack, 58, [I8 ] [ 9] 7ffc8c132391, 8 + 1f391, stack, 58, [I8 ] [10] 7ffc8c132399, 8 + 1f399, stack, 58, [I8 ] [11] 7ffc8c1323a1, 8 + 1f3a1, stack, 58, [I8 ] [12] 7ffc8c1323a9, 8 + 1f3a9, stack, 58, [I8 ] [13] 7ffc8c1331a3, 8 + 201a3, stack, 58, [I8 ] [14] 7ffc8c13325f, 8 + 2025f, stack, 58, [I8 ] [15] 7ffc8c133264, 8 + 20264, stack, 58, [I8 ] 16> . . (stack) . heap . scanmem delete scanmem . scanmem . 16> 83 ..........info: we currently have 1 matches. info: match identified, use "set" to modify value. info: enter "help" for other commands. 1> list [ 0] 7b09e0, 1 + 3b09e0, exe, 83, [I64 I32 I16 I8 ] . . 1> set 10000 info: setting *0x7b09e0 to 0x2710... 1> nethack: Dlvl:1 $:10000 HP:15(15) Pw:2(2) AC:7 Exp:1 : I32 0x7b09e0 . (id 1) . (PIE) . (load address) . 1> lregions [ 0] 79f000, 69632 bytes, exe, 400000, rw-, /usr/lib/nethack/nethack.tty [ 1] 7b0000, 114688 bytes, exe, 400000, rw-, unassociated [ 2] 24d2000, 135168 bytes, heap, 24d2000, rw-, [heap] [ 3] 7fcc04baa000, 16384 bytes, misc, 7fcc04baa000, rw-, unassociated [ 4] 7fcc04de1000, 4096 bytes, misc, 7fcc04de1000, rw-, unassociated [ 5] 7fcc051f7000, 16384 bytes, misc, 7fcc051f7000, rw-, unassociated [ 6] 7fcc05227000, 12288 bytes, misc, 7fcc05227000, rw-, unassociated [ 7] 7fcc0522c000, 4096 bytes, misc, 7fcc0522c000, rw-, unassociated [ 8] 7ffc8c113000, 135168 bytes, stack, 7ffc8c113000, rw-, [stack] x86_64 0x400000 . PIE 0x7b09e0 . (game trainer) GameConqueror . PIE ( 0x3b09e0) PIE ..SH " (NOTES)" scanmem quake3 linux . scanmem ARM 0.16 Android . scanmem . set . (ASLR) (PIE) (PIC) (heap) . ugtrain . (KNOWN ISSUES) scanmem ptrace(2) (root) ()ptrace . x86 x86_64 Yama /proc/sys/kernel/yama/ptrace_scope. . 3.4 . "1" ()ptrace . scanmem . . scanmem (root) . . (aligned) . . snapshot . (HOMEPAGE) https://github.com/scanmem/scanmem (AUTHORS) Tavis Ormandy http://taviso.decsystem.org Eli Dupree WANG Lu Sebastian Parschauer Andrea Stacchiotti . (SEE ALSO) gameconqueror(1) ptrace(2) proc(5) nethack(6) pidof(8) scanmem-0.17 2017-10-11 scanmem(1)