1

I've been experimenting with reading/writing to memory of another process in C++ on Os X.

The issue I've been having is that I get a pointer (e.g. server.dylib+0x123AB) but I can't seem to find a way to get the memory address/base address of server.dylib dynamically in c++. Are there any methods that would be recommended to try to find it. It's probably my skill level but I've found that trying to tinker with memory on OsX has been an uphill struggle (there's very little documentation around).

Any advice would be appreciated.

Jon
  • 49
  • 7

2 Answers2

2

Merlin's answer is somewhat inaccurate. ASLR is not meant to prevent you from getting addresses in runtime - it's meant to prevent you from relying on FIXED addresses (i.e. when code injection). If you can already execute code, you can definitely get addresses (heck, GDB does, why can't you?)

DYLD exposes a very rich API (, and dyld_images.h) which enables you to easily get a list of all the images loaded into a process address space either from within the process or from outside of it. You can also get the "slide" , which is the ASLR offset used. This is, however, assuming you're already running code on that machine - i.e. it won't work when injecting code.

Andrew Barber
  • 39,603
  • 20
  • 94
  • 123
Technologeeks
  • 7,674
  • 25
  • 36
  • Thanks a lot, sorry I just noticed this now - That example shows pretty much what I was looking for. – Jon Jun 21 '13 at 12:44
  • @Technologeeks, I never stated that ASLR is meant to prevent obtaining addresses in runtime - I said it was a prevention against malware exploitation, which includes relying on fixed addresses and code injection! Also note that I linked to an article to how gdb works with ASLR, so your comment of 'GDB does, why can't you' is somewhat irrelevant! – TheDarkKnight Jul 03 '13 at 13:55
0

Part of OSX security is a technique known as ASLR (Address Space Layout Randomisation). This ensures that images are loaded into random areas of a process's address space to try to prevent malware exploitation. It is present in both the kernel and user space processes.

You can read more about it ASLR here

If you search google, you'll be able to find more information relevant to OSX, such as this article

If as you say, you're just experimenting, run the target process with gdb and you'll be able to find out the memory address of the dylib, after it has been loaded, which you can then use in your test program.

TheDarkKnight
  • 27,181
  • 6
  • 55
  • 85
  • Thanks for the reply. Sorry if I am missing something here but would it not be possible to work out the address of server.dylib at run time - I am able to sample the process (though activity monitor) which gives me the correct address but it does change between each launch. – Jon Jun 07 '13 at 10:43
  • I'm not saying it's not possible, just that it's not going to be easy. The answers to this question should help you: http://stackoverflow.com/questions/4309117/determining-programmatically-what-modules-are-loaded-in-another-process-os-x – TheDarkKnight Jun 07 '13 at 12:25
  • Thanks for the link. I've got a summer to kill before I'm back at Uni so I'll try to get it done at some point - It will be a learning experience. – Jon Jun 07 '13 at 13:37