[Help Request] Mac OS X

[shalzuth]

So, I just transferred to Mac OS X a couple days ago. But I don't know how to read/write to the memory. FML. Any help here, or do I need to do my stuff from scratch?


P.S., I have made successful programs for WC3 and WoW alike with protection, so I'm not going in blindly.

Thanks.

[BoogieManTM]

Might want to check out PocketGnome pocketgnome - Project Hosting on Google Code - it's an open source bot for OSX. I'm sure it's got all the memory read/write stuff you need.

More specifically, check out task_for_pid, also ptrace() might have limited functionality for reading memory at least.

[enteleky]

task_for_pid()
vm_read_overwrite()

Using those two things allows you to read all the memory you want. Remember you need to be root or be a part of the procmod group if you want those to work.

[Tanaris4]

Check out the MemoryAccess file. Or the findObjectList within Controller.m (this has the vm_region and other functions that actually pulls data from memory).

Also, of course, your program has to run as root or you will never get data :-)

[flukes1]

You'll need these:

vm_read_overwrite
vm_write
vm_region

You also need to use task_for_pid in mach_traps.h which gives you a "port" for the given PID, but you need to be root or add your account to the procmod group, as others have said.

There's an app called iHaxGamez which is good for scanning memory for ints and strings. Beyond that you're probably better off writing your own basic memory viewer, or use the one in Pocket Gnome (although it is rather limited). IDA can also be hooked up to OS X and works rather well, although you do need to run the GUI in a Windows virtual machine. The command line tool vmmap is also useful.

If you want a starting point for accessing the object list on OS X, have a look at this thread.

[Tanaris4]

You'll need these:

vm_read_overwrite
vm_write
vm_region

You also need to use task_for_pid in mach_traps.h which gives you a "port" for the given PID, but you need to be root or add your account to the procmod group, as others have said.

There's an app called iHaxGamez which is good for scanning memory for ints and strings. Beyond that you're probably better off writing your own basic memory viewer, or use the one in Pocket Gnome (although it is rather limited). IDA can also be hooked up to OS X and works rather well, although you do need to run the GUI in a Windows virtual machine. The command line tool vmmap is also useful.

If you want a starting point for accessing the object list on OS X, have a look at this thread.

Are you saying IDA can hook into WoW while it's running? Or just read the binary?

[flukes1]

Are you saying IDA can hook into WoW while it's running? Or just read the binary?

It can attach to WoW. In a terminal window, cd into the IDA directory and run

sudo ./mac_server

Then fire up VMware or Parallels or whatever (or a real Windows box on your LAN) and start IDA. Go to Debugger > Attach > Remote Mac OS X debugger. Enter the IP and press OK, select the WoW process and it'll attach as if it were running locally.

[pqs]

POCKET GNOME FTW! All you will ever need :P

[Bobnovak]

Great thread guys, just bumping this for others who have made the switch to mac. I did some C# stuff like a year or two ago for WoW - checking the memory editing on the MacOS side now.