Databases
StackOverflow2013
Postsdbo
POWriteProcessMemory equivalent on OS X
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POWriteProcessMemory equivalent on OS X
    primarykey
    data
    text
    <p>I am using <a href="https://stackoverflow.com/questions/6905287/how-to-change-the-implementation-detour-of-an-externally-declared-function">method hooking/detour</a> in my library.</p> <p>What would be the solution for method hooking/detour on OS X since WriteProcessMemory/ReadProcessMemory are Windows API functions?</p> <p>Edit:</p> <p>Ok, let me put a bit more information here so it gets clearer why I am asking that question:</p> <p>In an upcoming feature in my <a href="http://code.google.com/p/delphisorcery/" rel="nofollow noreferrer">DSharp</a> library I have this code:</p> <pre><code>procedure FreeInstance(Self: TObject); begin ... Self.CleanupInstance; FreeMem(Pointer(Self)); end; var FreeInstanceBackup: TXRedirCode; initialization ... HookCode(@TObject.FreeInstance, @FreeInstance, FreeInstanceBackup); finalization UnhookCode(@TObject.FreeInstance, FreeInstanceBackup); ... end. </code></pre> <p>Fact is, I need to hook into the TObject.FreeInstance method to be notified of every object destruction (yes I know, it might not be called if someone decides to override it and does not call inherited).</p> <p>Another unit that uses the WriteProcessMemory is <a href="http://code.google.com/p/delphisorcery/source/browse/trunk/Source/Core/ReturnTypePatch.pas" rel="nofollow noreferrer">ReturnTypePatch.pas</a> which fixes <a href="http://qc.embarcadero.com/wc/qcmain.aspx?d=98687" rel="nofollow noreferrer">QC #98687</a> which is nessecary for Mocking libraries like mine and Delphi Mocks from Vincent Parrett (he basically had a user reporting that problem before we both were aware of that problem).</p> <p>Yet another use of WriteProcessMemory is in the AOP part of DSharp where I basically replace the VMT of a class with the proxy class VMT that is created from the TVirtualMethodInterceptor class from the RTTI. With TVirtualMethodInterceptor you can only proxify an existing object - my implementation does that for the whole class (so all existing and future objects, even if inherited).</p> <p>In all cases the memory cannot be written by using Move because they are protected (getting AV when replacing WriteProcessMemory with a call to CopyMemory).</p> <p>Hope that was enough information on what I am doing with these functions - and someone can point me to a solution that will work on OS X (unfortunately I don't have one so I cannot test anything).</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USStefan Glienke
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POWriteProcessMemory equivalent on OS X
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POWriteProcessMemory equivalent on OS X
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POWriteProcessMemory equivalent on OS X
      1. This table or related slice is empty.
      1. VTUpMod
    1. COCheck this out, maybe it helps: http://stackoverflow.com/questions/10668/reading-other-process-memory-in-os-x-bsd
      singulars
      1. POWriteProcessMemory equivalent on OS X
      1. USLars
    2. COAre you asking for the equivalent API function? Or are you asking how to hook functions? If you say "both," you have an XY problem; don't assume the the solution to X lies in knowing how to do Y. Ask two separate questions if you really think you need to know both. Also, note that the linked hooking code could probably have used plain old `Move` (`memcpy`, for C folks) since it's hooking code in the current process.
      singulars
      1. POWriteProcessMemory equivalent on OS X
      1. USRob Kennedy
    3. CO@Rob Well I basically need to know how I can rewrite memory of the running application. Like hooking, rewriting parts of the VMT and such.
      singulars
      1. POWriteProcessMemory equivalent on OS X
      1. USStefan Glienke
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload