le-o-n/cython-virtual-memory-toolkit

The Cython Virtual Memory Toolkit is designed to provide Cython header files (*.pxd) for various functionalities, enabling Cython to interact with the virtual memory of a target process. This toolkit includes features for reading, writing, allocating, and freeing virtual memory.

Hey there! Welcome to my profile!

                                           

About Me

• ⚡ Studying Computer Science (MEng) at the University of Warwick.
• 🐍 Reverse engineering games and writing code injections.
• 🔭 Building Neural Networks on stock return prediction using LSTM-based Encoder-Decoder models.
• 📙 Building a framework to develop and test trading strategies using Monte Carlo Simulations on historical data.

cython-virtual-memory-toolkit's Issues

Add Python bindings

add python bindings for all the functionalities

Fix the project structure to reflect the standard src folder

Currently the source folder is

ROOT/VirtualMemoryToolkit/..."

And this would be cleaner if this was just

ROOT/src/...

Read and write to offsets of CVirtualAddress to make indexing arrays easier

Write to an offset

bint CVirtualAddress_write_float32_offset(CVirtualAddress* address, intx write_int): ...

And allow moving the address around via an offset

bint CVirtualAddress_offset(CVirtualAddress* address, long long offset): ...

Move testing to a separate ROOT/test/ directory

Currently testing is contained within the source code of the project in

ROOT/VirtualMemoryToolkit/tests

This should be moved to

ROOT/test

CVirtualAddress_from_aob should use const unsigned char* for the bytes param

Allow aob scan to return ALL the found results

windows_defs.PrivilegedSearchMemoryBytes currently has a race condition to return one of the found addresses, currently this isn't an issue since the use case is for when there is only ever a single matching AOB anyway but could be improved in the future to have all addresses returned.

Specifically the AOB scan will return one of the matching addresses within the first block it encounters the match.

Move over to using the "Nt..." windows api functions

Example is using the undocumented NtVirtualQueryEx, unofficial documentation found here, rather than VirtualQueryEx. A speed test should be done to compare how much quicker Nt... is compared with the public facing

Extract out defined labels from within the process modules

One funciton that could help is SymLoadModuleEx

Create a install.bat script

Have a script that can install via the github repo. The steps should be:

• Build the source distribution
• python -m pip install ./path/to/*tar.gz

Read and write with int64, int32, int16, int8, int4, int2

intx CVirtualAddress_read_intx(CVirtualAddress* address): ...
bint CVirtualAddress_write_intx(CVirtualAddress* address, intx write_int): ...

Update all the functions to be const params

Lots of functions are passed an CAppHandle* but should be passed a const CAppHandle* for example

Add Markdown

Add markdown for instructions on:

• How to install
• How to use
• How to pip install
• How to compile
• How to build from source
• ...

Make all the submodules consistent in naming conventions and implementation

Inconsistant naming convention for init functions

Should move to all be init as convention since this would be in line with python

CModule_init
CProcess_new

Sometimes the base init function will take in all the parameters such as CModule_init:

cdef inline CModule* CModule_init(CAppHandle* app_handle, char* name, void* base_address, size_t size) nogil: ...

Other times it takes in nothing and creates a blank structure such as CMemoryRegionNode_init:

Should make all init functions take in parameters since this would ensure that the constructed structure should be valid.

cdef inline CMemoryRegionNode* CMemoryRegionNode_init() nogil: ...

nogil --> nogil noexcept

having exceptions whilst nogil still requires gil!

Move shell scripts to shell folder and remove from the root directory

Before

ROOT/build.bat
ROOT/build_sdist.bat
ROOT/install_build_globally.bat
...

After

ROOT/shell/build.bat
ROOT/shell/build_sdist.bat
ROOT/shell/install_build_globally.bat
...

Optimise CVirtualAddress_from_aob(...)

https://cython.readthedocs.io/en/latest/src/userguide/parallelism.html

Have AOB scans allow wildcards

Allow wildcard bytes in AOB scan to allow some bytes to be anything:

0x50, ??, 0x90, ??, ??, ??, 0x10, 0x10, ...

This could be done by having a new CBytes struct that potentially is just a map of indexes to values.

0x5, 0x6, ??, 0x7, 0x8 

{0: 0x5, 1: 0x6, 3: 0x7, 4: 0x8}

Make CModule struct include the end address

void* end_address 

This can be simply created using CModule.base_address + CModule.size but would make using this much cleaner due to the conversion between types

Reduce the number of heap allocations

Most of the structs are being heap allocated but are static in size, this is slow and using stack allocation is much faster.

Convert from heap to stack allocations where possible