#process-memory #read-memory #another #pid

bin+lib read-process-memory

Read memory from another process

7 releases

0.1.6 Mar 15, 2023
0.1.5 Oct 2, 2022
0.1.4 Jan 1, 2022
0.1.3 Nov 1, 2021
0.1.0 Oct 12, 2016

#219 in Unix APIs

Download history 889/week @ 2024-03-14 981/week @ 2024-03-21 583/week @ 2024-03-28 917/week @ 2024-04-04 1063/week @ 2024-04-11 1083/week @ 2024-04-18 2197/week @ 2024-04-25 1517/week @ 2024-05-02 1403/week @ 2024-05-09 1653/week @ 2024-05-16 1481/week @ 2024-05-23 1527/week @ 2024-05-30 1823/week @ 2024-06-06 2062/week @ 2024-06-13 1547/week @ 2024-06-20 1303/week @ 2024-06-27

6,930 downloads per month
Used in 17 crates (2 directly)

MIT license

24KB
404 lines

GitHub Actions Build status Cirrus CI Build status crates.io

A crate to read memory from another process. Code originally taken from the rbspy project. This crate has now returned home to the rbspy GitHub organization. :)

Example

This example re-executes itself as a child process in order to have a separate process to use for demonstration purposes. If you need to read memory from a process that you are spawning, your usage should look very similar to this:

use std::convert::TryInto;
use std::env;
use std::io::{self, BufReader, BufRead, Read, Result};
use std::process::{Command, Stdio};

use read_process_memory::{
  Pid,
  ProcessHandle,
  CopyAddress,
  copy_address,
};

fn main() -> Result<()> {
    if env::args_os().len() > 1 {
      // We are the child.
      return in_child();
    }
    // Run this executable again so we have a child process to read.
    let mut child = Command::new(env::current_exe()?)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .arg("child")
        .spawn()?;

    // Get a ProcessHandle to work with.
    let handle: ProcessHandle = (&child).try_into().unwrap();

    // The child process will print the address to read from on stdout.
    let mut stdout = BufReader::new(child.stdout.take().unwrap());
    let mut addr_string = String::new();
    stdout.read_line(&mut addr_string)?;
    let address = usize::from_str_radix(addr_string.trim(), 16).unwrap();

    // Try to read 10 bytes from that address
    let bytes = copy_address(address, 10, &handle)?;
    println!("Read: {:?}", bytes);

    // Tell the child to exit by closing its stdin.
    drop(child.stdin.take());
    // And wait for it to exit.
    child.wait()?;
    Ok(())
}

fn in_child() -> Result<()> {
    // Allocate a 10-byte Vec for the parent to read.
    let readable_bytes: Vec<u8> = vec![
        0xc0, 0x72, 0x80, 0x79, 0xeb, 0xf1, 0xbc, 0x87, 0x06, 0x14,
    ];
    // Print the address of the Vec to stdout so the parent can find it.
    println!("{:x}", readable_bytes.as_ptr() as usize);
    // Now wait to exit until the parent closes our stdin, to give
    // it time to read the memory.
    let mut buf = Vec::new();
    // We don't care if this succeeds.
    drop(io::stdin().read_to_end(&mut buf));
    Ok(())
}

Dependencies

~46–320KB