Skip to content

Instantly share code, notes, and snippets.

@0x0dea
Created April 26, 2015 23:08
Show Gist options
  • Star 12 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save 0x0dea/cf3b434458bd92c31583 to your computer and use it in GitHub Desktop.
Save 0x0dea/cf3b434458bd92c31583 to your computer and use it in GitHub Desktop.
Process.gsub lets you search and replace within your process's live memory!
def Process.gsub pat, sub
mem = File.open('/proc/self/mem', 'r+')
maps = File.open('/proc/self/maps')
maps.each do |map|
from, to, perms, offset = map.scan(/(\h+)-(\h+) (\S+) (\h+)/)[0]
if perms['rw']
from, to = [from, to].map { |addr| addr.hex + offset.hex }
data = mem.tap { |m| m.seek from }.read(to - from) rescue next
i = -1
while i = data.index(pat, i + 1)
match = data[pat]
mem.seek(from + i)
mem << data[i, match.size].sub(pat, sub)
end
end
break if map[/\[heap\]$/]
end
mem.close
maps.close
end
def foo
puts 'This is strange.'
puts 'This is foolish.'
end
foo
Process.gsub(/(This is) [a-z]+\./, '\1 amazing!')
foo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment