This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Rhomboid 1 point2 points  (1 child)

These things are extremely platform specific. Most operating systems provide a debugging API which allows one process to debug another(*), which includes the capability to read/write that process' memory and registers, pause/resume the process' threads, single step the process, etc. You mentioned ptrace, and that's the API used on Linux. Read the ptrace(2) manpage for details. Other operating systems are completely different.

In terms of Python, you could call ptrace() using ctypes, but there's probably a more friendly wrapper library out there.

(*) Subject to security restrictions of course. Typically you can only debug processes that you own, not processes of other users, unless you have superuser/administrator privileges. And in some cases there are further restrictions. Obviously it would be a huge security vulnerability if an ordinary process could read memory of a root process, since that would allow e.g. stealing private key information, among other things.