vykt / ptrscan

Pointer chain scanner for Linux.

ptrscan

ABOUT:

Ptrscan is an implementation of a pointer scanner following the ideas of Cheat Engine's own pointer scanner implementation. Ptrscan was written from scratch to run natively on Linux - no more running CE through wine.

What is a pointer scanner?

---

DEPENDENES:

Ptrscan dynamically links libpwu. Release 0.1.4 is required. Visit the page and follow installation instructions.

---

INSTALLAON:

Fetch the repo:

$ git clone https://github.com/vykt/ptrscan

Generate build files:

$ cd ptrscan && ./buildgen.sh

Build the release:

$ cd build && make scan

Check the install script & install:

$ cd .. && sudo ./install.sh

---

EXAMPLES:

Using ptrscan is covered in the ptrscan manpage:

$ man ptrscan

1. Pointer scan process example_proc for address 0x55134a90f080 (-a) and save the results to first_map.pscan (-w):

ptrscan -a 0x55134a90f080 -w first_map.pscan example_proc

2. Verify the pointer chains (-x) in first_map.pscan (-r) to check that they arrive at address 0x55431bea1080 (-a). Output the new results to second_map.pscan (-w).

ptrscan -x -a 0x55431bea1080 -r first_map.pscan -w second_map.pscan example_proc

3. Using the default terminal interface (-c), carry out an aligned (-q) pointer scan with 0x500 lookback (-p) and the depth of 4 levels (-l). Use 4 threads (-t). Report on the progress of the scan (-v). Output pointer chains to the third_map.pscan file. Carry out the scan on the example_proc process.

ptrscan -c -v -q -p 0x500 -l 4 -t 4 -a 0x7fffba434000 -w third_map.pscan example_proc

---

FUTURE CONSIDERATIONS:

An alternative ncurses interface is planned. For any other feature requests or bugs please open an issue.

ptrscan's Issues

thread -> get_next_buffer_smart: memory read into buffer failed.thread

$ sudo ptrscan -a 0x10a4d750 -w first_map.pscan client
thread -> get_next_buffer_smart: memory read into buffer failed.thread -> get_next_buffer_smart: failsafe memory read into buffer failed.

Got all privileges; process is able to be proceed. I waited for couple of minutes after this error occured but nothing happened, so seems like EOL without shutdown. Any description on the error would be nice.

Verification fails due to

Affected versions: v0.1.0+

Pointer chain verification fails because memory segments without backing files ('pathname' field in 'man 5 proc') derive their name from their starting address. Because of ASLR, across execution instances these names become invalid, leading to error in interpreting and verifying saved scans.

This bug was introduced in v0.1.0, which changed the names of backing files from '<NO_PATHNAME>' to their starting address, for regions which lack a backing file.

The solution is probably to treat such segments as belonging to the closest previous segment with a backing file. This approach will detect pointer chains where a pointer chain arrives to a segment that consistently follows some shared object.

make scan fail

OS - Ubuntu 23.10. CMake - 3.27.4. GNU - 13.2.0.

$ make scan
[  8%] Building CXX object CMakeFiles/scan.dir/ptrscan/main.cpp.o
[ 16%] Building CXX object CMakeFiles/scan.dir/ptrscan/args.cpp.o
[ 25%] Building CXX object CMakeFiles/scan.dir/ptrscan/proc_mem.cpp.o
[ 33%] Building CXX object CMakeFiles/scan.dir/ptrscan/ui_base.cpp.o
[ 41%] Building CXX object CMakeFiles/scan.dir/ptrscan/ui_term.cpp.o
[ 50%] Building CXX object CMakeFiles/scan.dir/ptrscan/debug.cpp.o
[ 58%] Building CXX object CMakeFiles/scan.dir/ptrscan/mem_tree.cpp.o
[ 66%] Building CXX object CMakeFiles/scan.dir/ptrscan/thread_ctrl.cpp.o
[ 75%] Building CXX object CMakeFiles/scan.dir/ptrscan/thread.cpp.o
[ 83%] Building CXX object CMakeFiles/scan.dir/ptrscan/serialise.cpp.o
[ 91%] Building CXX object CMakeFiles/scan.dir/ptrscan/verify.cpp.o
[100%] Linking CXX executable scan
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/proc_mem.cpp.o: in function `proc_mem::fetch_pid(args_struct*, ui_base*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:29:(.text+0x80): undefined reference to `new_name_pid'
/usr/bin/ld: /home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:35:(.text+0xf7): undefined reference to `pid_by_name'
/usr/bin/ld: /home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:50:(.text+0x20e): undefined reference to `del_name_pid'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/proc_mem.cpp.o: in function `proc_mem::maps_init(maps_data*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:67:(.text+0x310): undefined reference to `new_maps_data'
/usr/bin/ld: /home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:73:(.text+0x37c): undefined reference to `read_maps'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/proc_mem.cpp.o: in function `proc_mem::populate_regions(args_struct*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:134:(.text+0x5de): undefined reference to `vector_get_ref'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/proc_mem.cpp.o: in function `proc_mem::init_proc_mem(args_struct*, ui_base*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/proc_mem.cpp:181:(.text+0x846): undefined reference to `open_memory'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/ui_base.cpp.o: in function `match_maps_obj(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, void*, maps_obj**)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/ui_base.cpp:30:(.text+0x61): undefined reference to `vector_get_ref'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/ui_term.cpp.o: in function `ui_term::clarify_pid(name_pid*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/ui_term.cpp:193:(.text+0xab): undefined reference to `vector_get_ref'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/thread_ctrl.cpp.o: in function `thread_ctrl::init(args_struct*, proc_mem*, mem_tree*, ui_base*, int)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/thread_ctrl.cpp:196:(.text+0x599): undefined reference to `open_memory'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/thread_ctrl.cpp.o: in function `thread_ctrl::prepare_level(args_struct*, proc_mem*, mem_tree*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/thread_ctrl.cpp:279:(.text+0xa53): undefined reference to `get_region_by_addr'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/serialise.cpp.o: in function `serialise::recurse_node(args_struct*, mem_node*, proc_mem*, unsigned int)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/serialise.cpp:141:(.text+0x190): undefined reference to `vector_get_ref'
/usr/bin/ld: /home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/serialise.cpp:146:(.text+0x204): undefined reference to `vector_get'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/verify.cpp.o: in function `verify_chain(args_struct*, proc_mem*, ui_base*, serial_entry*, maps_obj*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/verify.cpp:37:(.text+0x70): undefined reference to `vector_get'
/usr/bin/ld: CMakeFiles/scan.dir/ptrscan/verify.cpp.o: in function `verify(args_struct*, proc_mem*, ui_base*, serialise*)':
/home/mexikanoz/Desktop/qtz/ptrscan/src/ptrscan/verify.cpp:104:(.text+0x3a8): undefined reference to `get_obj_by_basename'
collect2: error: ld returned 1 exit status
make[3]: *** [CMakeFiles/scan.dir/build.make:257: scan] Error 1
make[2]: *** [CMakeFiles/Makefile2:148: CMakeFiles/scan.dir/all] Error 2
make[1]: *** [CMakeFiles/Makefile2:155: CMakeFiles/scan.dir/rule] Error 2
make: *** [Makefile:137: scan] Error 2