https://discord.com/invite/Qw8jsPD99X
This project is licensed under the GNU AGPLv3.0
(no later versions)
Read LICENSE
for more information
NOTE: Submodules and external dependencies might have their own licenses! Check for other LICENSE
files as well.
- Cross Platform (Windows/Linux/FreeBSD)
- Cross Architecture (x86/x64/ARM/ARM64)
libmem
can:
- Find Processes
- Find Modules
- Find Symbols
- Read/Write/Set Memory
- Allocate/Protect Memory
- Scan Memory by Pattern/Signature
- Resolve pointer scans/pointer maps
- Hook/Unhook Functions
- Assemble/Dissassemble Code (JIT)
- Do VMT Hooking/Unhooking
- Load/Unload Modules
- Get Page Information
- Enumerate Process Threads
And much more!
For the API manual, access the documentation
For more examples, access the examples directory
#include <libmem/libmem.h>
int main()
{
lm_module_t mod;
lm_address_t main_sym;
LM_FindModule("mygamemodule.so", &mod);
main_sym = LM_FindSymbolAddress(&mod, "main");
printf("[*] Module Name: %s\n", mod.name);
printf("[*] Module Path: %s\n", mod.path);
printf("[*] Module Base: %p\n", mod.base);
printf("[*] Module Size: %p\n", mod.size);
printf("[*] Module End: %p\n", mod.end);
printf("[*] Main Addr: %p\n"), main_sym);
return 0;
}
use libmem::*;
fn some_function() {
// ...
}
fn hk_some_function() {
// ...
}
unsafe fn test() {
// reading/writing memory
let number : i32 = 0;
let number_addr = &number as *const i32 as lm_address_t;
let value : i32 = 1337;
LM_WriteMemory(number_addr, &value).unwrap(); // write 1337 to number
let read_number : i32 = LM_ReadMemory(number_addr).unwrap();
println!("[*] Number Value: {}", read_number); // it will show 1337
// hooking/detouring functions
let func_addr = some_function as *const () as lm_address_t;
let hk_addr = hk_some_function as *const () as lm_address_t;
println!("[*] Hooking 'some_function'");
println!("[*] Original Address: {:#x}", func_addr);
let trampoline = LM_HookCode(func_addr, hk_addr).unwrap();
println!("[*] Trampoline: {:#x?}", trampoline);
some_function(); // this will call 'hk_some_function'
// restore the original code from 'some_function'
LM_UnhookCode(some_function_addr, trampoline).unwrap();
println!("[*] Unhooked 'some_function'");
some_function(); // call 'some_function' to see if it has been unhooked
}
fn main() {
unsafe {
test();
}
}
from libmem import *
# Assemble/Disassemble code
print("[*] Assembly")
inst = LM_Assemble("mov eax, ebx")
print(f"{code} : {inst.bytes}")
print("[*] Disassembly:")
inst = LM_Disassemble(bytearray(b"\x55"))
print(f"{inst.bytes} : {inst.mnemonic} {inst.op_str}")
These bindings are done by the community/third-parties and are not affiliated with the libmem project or its author.
Their code can have their own licenses as well, diverging from libmem's.
Add the following commands to your CMakeLists.txt
.
They will fetch libmem-config.cmake
from the root of this repository, which will download libmem binaries for your system and include libmem in your CMake project.
include(FetchContent)
# Download and set up libmem
FetchContent_Declare(libmem-config URL "https://raw.githubusercontent.com/rdbo/libmem/config-v1/libmem-config.cmake" DOWNLOAD_NO_EXTRACT TRUE)
FetchContent_MakeAvailable(libmem-config)
set(CMAKE_PREFIX_PATH "${libmem-config_SOURCE_DIR}" "${CMAKE_PREFIX_PATH}")
set(LIBMEM_DOWNLOAD_VERSION "4.4.0")
# Find libmem package
find_package(libmem CONFIG REQUIRED)
Use the following to link against libmem (NOTE: it might be necessary to link against other dependencies - go to the Dependencies
section for more information):
# Link against libmem
target_link_libraries(<YOUR_TARGET_NAME> PRIVATE libmem::libmem)
Note: If you download a binary version of libmem in the GitHub releases, you only need to install the Windows SDK. Building is not necessary, just add libmem/include
to your project's include directories and link it against the binary you downloaded.
-
Install the Windows SDK: Windows 7 - Windows 10/11
-
Install Python 3 (Check the option to add Python to PATH) (Use Python 3.8.9 for Windows 7)
-
Install Visual Studio 2022 or newer (with C++ support and CMake) (older versions might work, but they were not tested). NOTE: You can install only the Visual Studio Build Tools if you don't want the whole IDE.
-
Install Git Bash
-
Run a Visual Studio
Developer Command Prompt
(orx64 Native Tools Command Prompt for VS 2022
for 64 bits) as Administrator -
Run the following command to append libmem's destination directory to your
%PATH%
user variable (WARNING - watch for your%PATH%
size limit!):setx PATH "%PATH%;%ProgramFiles%\libmem\include;%ProgramFiles%\libmem\lib"
-
Continue reading at
Build and Install
Note: The following commands are for Debian/Ubuntu based distributions. Make sure to find the appropriate commands for your Linux distribution.
-
Open a terminal
-
Install GCC, G++, Git, CMake, Make, Python 3, and the Linux headers:
sudo apt install gcc g++ git cmake make python3 linux-headers
-
Continue reading at
Build and Install
-
Add a mountpoint for the
procfs
filesystem in your/etc/fstab
by appending the following line:proc /proc procfs rw 0 0
-
Manually mount the
procfs
. This will only be necessary if you don't reboot. If you reboot, it will be automatically mounted because of the line at/etc/fstab
. Run the following command (as root):mount -t procfs proc /proc
-
Install Git, CMake and Python3 (run as root) (clang, clang++ and make should already be installed):
pkg install git cmake python3
-
Continue reading at
Build and Install
Note: Run the following commands on Git Bash (Windows) or a terminal (Linux/FreeBSD).
Clone the repository:
git clone --recursive --depth 1 https://github.com/rdbo/libmem
Generate the CMake cache:
mkdir build
cd build
cmake .. -DCMAKE_BUILD_TYPE=Release
Compile libmem:
Windows: nmake
Unix-like: make -j 4
Install libmem (run as root or as Administrator):
Windows: nmake install
Unix-like: make install
After installing, follow the the proper Usage
section for your programming language
Add #include <libmem/libmem.h>
(C/C++) or #include <libmem/libmem.hpp>
(C++) to your source code.
Link the generated libmem library against your binary (liblibmem.so
for Unix-like or libmem.dll
for Windows).
For GCC-like compilers: add the flag -llibmem
to your compiler and it should link it.
#include <libmem/libmem.h> /* C/C++ */
#include <libmem/libmem.hpp> /* Force C++ */
Add the following line to your Cargo.toml
under [dependencies]
:
libmem = "4"
Import libmem in your Rust source code:
use libmem::*;
Make sure to have Python >= 3.6 active
Either install the libmem
package from PyPi by running the following command:
pip install --upgrade libmem
Or build and install it yourself by running the following commands:
cd libmem-py
python configure.py
python setup.py install
Now to import libmem, just do the following in your Python code:
from libmem import *
All:
- capstone (included in root project)
- keystone (included in root project)
- LIEF (included in root project)
- libstdc++ (used in keystone, LIEF and LLVM)
- libmath (used in keystone)
Windows:
- Windows SDK (-luser32, -lpsapi, -lntdll)
Linux/Android:
- libdl (-ldl)
BSD:
- libdl (-ldl)
- libkvm (-lkvm)
- libprocstat (-lprocstat)
- libelf (-lelf)
LM_EnumProcesses
LM_GetProcess
LM_GetProcessEx
LM_FindProcess
LM_IsProcessAlive
LM_GetSystemBits
LM_EnumThreads
LM_EnumThreadsEx
LM_GetThread
LM_GetThreadEx
LM_GetThreadProcess
LM_EnumModules
LM_EnumModulesEx
LM_FindModule
LM_FindModuleEx
LM_LoadModule
LM_LoadModuleEx
LM_UnloadModule
LM_UnloadModuleEx
LM_EnumSymbols
LM_FindSymbolAddress
LM_DemangleSymbol
LM_FreeDemangleSymbol
LM_EnumSymbolsDemangled
LM_FindSymbolAddressDemangled
LM_EnumPages
LM_EnumPagesEx
LM_GetPage
LM_GetPageEx
LM_ReadMemory
LM_ReadMemoryEx
LM_WriteMemory
LM_WriteMemoryEx
LM_SetMemory
LM_SetMemoryEx
LM_ProtMemory
LM_ProtMemoryEx
LM_AllocMemory
LM_AllocMemoryEx
LM_FreeMemory
LM_FreeMemoryEx
LM_DeepPointer
LM_DeepPointerEx
LM_DataScan
LM_DataScanEx
LM_PatternScan
LM_PatternScanEx
LM_SigScan
LM_SigScanEx
LM_HookCode
LM_HookCodeEx
LM_UnhookCode
LM_UnhookCodeEx
LM_Assemble
LM_AssembleEx
LM_FreeCodeBuffer
LM_Disassemble
LM_DisassembleEx
LM_FreeInstructions
LM_CodeLength
LM_CodeLengthEx
LM_VmtNew
LM_VmtHook
LM_VmtUnhook
LM_VmtGetOriginal
LM_VmtReset
LM_VmtFree
Read the file CONTRIBUTING.md
in the root directory of this repository
Made with libmem: