osx memory read

mem.py

# https://github.com/n1nj4sec/memorpy/blob/master/memorpy/OSXProcess.py

import ctypes
import ctypes.util

ctypes.cdll.LoadLibrary('/usr/lib/libc.dylib')
libc = ctypes.CDLL('/usr/lib/libc.dylib')

class MemoryOSX():
    def __init__(self, pid):
        self.task = ctypes.c_uint32()
        self.mytask = libc.mach_task_self()

        ret = libc.task_for_pid(self.mytask, ctypes.c_int(pid), ctypes.pointer(self.task))

        if ret != 0:
            raise Exception("task_for_pid error: %s"%ret)

    def read_bytes(self, address, bytes):
        pdata = ctypes.c_void_p(0)
        data_n = ctypes.c_uint32(0)
        
        ret = libc.mach_vm_read(self.task, ctypes.c_ulonglong(address), ctypes.c_longlong(bytes), ctypes.pointer(pdata), ctypes.pointer(data_n))

        if ret != 0:
            raise Exception("mach_vm_read error : %s"%ret)

        buf = ctypes.string_at(pdata.value, data_n.value)
        libc.vm_deallocate(self.mytask, pdata, data_n)

        return buf