SarOum
Memory hacking library for windows.
Instalation
# Latest version
[dependencies]
saroum = "0.5.0"
# Development version
[dependencies.faithe]
git = "https://github.com/sarawahibdev/SarOum"
Opening processes
use faithe::types::access_rights::PROCESS_ALL_ACCESS;
use faithe::process as ps;
let process = ps::Processes::new()?
.find(|p| p.sz_exe_file == "Process name.exe")
.unwrap()
.open(false, PROCESS_ALL_ACCESS)?;
Modules iterating
let process = get_process();
process
.modules()?
.for_each(|m| dbg!(m));
Reading / Writing memory
let process = get_process();
let mut value = process.read_process_memory::<u32>(0xFF)?;
value += 100;
process.write_process_memory(0xFF, value)?;
Allocating / Freeing / Protecting / Querying memory
use saroum::types::protection_flags::{PAGE_EXECUTE_READWRITE, PAGE_READONLY};
use saroum::types::allocation_types::{MEM_COMMIT, MEM_RESERVE};
use saroum::types::free_types::MEM_RELEASE;
let process = get_process();
let mut chunk = process.virtual_allocate(
0,
1000,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE
)?;
let info = process.virtual_query(chunk)?;
process.virtual_protect(chunk, 1000, PAGE_READONLY)?;
process.virtual_free(chunk, 0, MEM_RELEASE)?;
Searching for patterns
use saroum::pattern::Pattern;
let process = get_process();
let address = process.find_pattern(
"Something.exe",
// Available styles: IDA, Code, PiDB
Pattern::from_ida_style("48 89 85 F0 00 00 00 4C 8B ? ? ? ? ? 48 8D")
)?;
Macros
i32 = 0;
extern "C" fn set_health(new: i32) = 1;
}
}
/*
class CPlayer {
virtual int get_health() = 0;
virtual void set_health(int new_value) = 0;
};
*/
// Creates struct with explicitly defined offsets.
xstruct! {
// STRUCT HAS SIZE OF ZERO.
struct Foo {
0x0 @ a: u32,
0x16 @ b: bool
}
// STRUCT HAS SIZE 20.
struct Bar(20) {
0x0 @ a: u32,
0x16 @ b: bool
}
}
// Creates a function with explicitly defined RVA relative to some module.
function! {
// Explicitly defined RVA offset relative to `01-hello` module.
extern FUNC: extern "C" fn(a: i32) = "01-hello.exe"@0x1900;
}
FUNC.call(5);">
use saroum::{interface, xstruct}; // Creates a trait that will emulate behavior of virtual functions in C++. struct CPlayer; interface! { trait IEntity(CPlayer) { extern "C" fn get_health() -> i32 = 0; extern "C" fn set_health(new: i32) = 1; } } /* class CPlayer { virtual int get_health() = 0; virtual void set_health(int new_value) = 0; }; */ // Creates struct with explicitly defined offsets. xstruct! { // STRUCT HAS SIZE OF ZERO. struct Foo { 0x0 @ a: u32, 0x16 @ b: bool } // STRUCT HAS SIZE 20. struct Bar(20) { 0x0 @ a: u32, 0x16 @ b: bool } } // Creates a function with explicitly defined RVA relative to some module. function! { // Explicitly defined RVA offset relative to `01-hello` module. extern FUNC: extern "C" fn(a: i32) = "01-hello.exe"@0x1900; } FUNC.call(5);
294 Dec 23, 2022
0 Nov 29, 2022
160 Dec 29, 2022
16 Dec 18, 2022
1.1k Jan 3, 2023
274 Dec 29, 2022
1 Dec 27, 2022
3 Aug 24, 2022
13 Aug 26, 2022
4 May 13, 2023
6 Jun 23, 2023
98 Jun 21, 2023
2 Jul 4, 2023
9 Aug 29, 2022
7.7k Dec 30, 2022
172 Dec 10, 2022
6 Jan 31, 2023
6 May 21, 2023
3 Sep 24, 2023
26 Nov 7, 2022
1 Jan 13, 2022
4 Mar 8, 2022
31 Dec 6, 2022
26 Oct 11, 2022
7 Aug 16, 2021
19 Oct 23, 2022
21 Dec 15, 2022
214 Dec 29, 2022
4 Apr 11, 2022