tr (trickster)

linux memory hacking library

To start using tr, clone this repository
and embed ./include/tr.hpp in source code of
your application or use this repository as
git submodule

Debugging

To verify library code execution and see error messages, compile
your program with -DTRICKSTER_DEBUG compiler flag. (g++)

Features

tr provides ability to:

• Get process id by name.
• Map process memory regions.
• Enumerate process modules.
• Manipulate process memory.
  • Write memory.
  • Read memory.
• Get callable address.

Example implementation:

#include <memory>
// Enable logging
#define TRICKSTER_DEBUG
#include <tr.hpp>

constexpr std::uintptr_t value_address = 0x7ffc85c71c04;

int main( ) {
  // Create process object
  auto ctx = std::make_unique<tr_process_t>( "trtest" );
  // Print its id
  printf( "PID: %i\n\n", ctx->get_id( ) );
  // Map memory regions
  ctx->map_memory_regions( );
  // Print modules loaded into process memory (without duplicate segments)
  for ( const auto & module : tr_get_modules_list( ctx->get_memory_regions( ) ) ) {
    printf( "%s\n", module.c_str( ) );
  }
  printf("\n");
  // Read integer value at 0x7ffc85c71c04
  const auto read_opt = ctx->read_memory<int>( value_address );
  if ( read_opt.has_value( ) ) {
    printf( "Value: %i\n\n", read_opt.value( ).data );
  }
  // Increment value at 0x7ffc85c71c04
  const auto write_opt = ctx->write_memory( value_address, read_opt.value( ).data + 10 );
  // Check if write was 100% successful.
  printf( "Write bytes requested: %lu\nWrite bytes result: %lu\nPartial write: %i (1 == true, 0 == false)\n",
          write_opt.value( ).bytes_requested,
          write_opt.value( ).bytes_written,
          write_opt.value( ).partial_write );
}

Licensing

tr is available under the MIT License.