ValueError: invalid literal for int() with base 10: '1f'

[jagernicolas]

running the example from the readme,
https://github.com/danielfvm/memmod#examples
where I replaced supertux2 by a.out (see below)

by invoking the following command,
python3 test1.py
returns,

Traceback (most recent call last):
  File "/home/user/myenv/test1.py", line 7, in <module>
    puts = proc.get_libc_function("puts")
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 333, in get_libc_function
    func_addr = self.get_libc_function_addr(name)
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 325, in get_libc_function_addr
    libc = self.get_libc()
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 315, in get_libc
    self._libc = self._libc or self.find_module('libc.so') or self.find_module('libc-')
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 255, in find_module
    for m in self.modules:
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 89, in modules
    self.load_modules()
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 193, in load_modules
    minor = int(device[1]),
ValueError: invalid literal for int() with base 10: '1f'

I'm interested by your pointer scanner. I tried a random test and got the same ValueError: invalid literal for int() with base 10: '1f'

about a.out, this is my dummy program I run to test memory hacking. I don't know if it's matter with the error above, so here the code (not clean or whatsoever),

#include <iostream>
#include <ctime>
#include <cstdlib>
#include <thread>
#include <chrono>

class Gold {
public:
    int player1;

    Gold() : player1(0) {}
};

class Wood {
public:
    int player1;

    Wood() : player1(0) {}
};

class Resources {
public:
    Gold* gold;
    Wood* wood;

    Resources() : gold(new Gold()), wood(new Wood()) {}

    ~Resources() {
        delete gold;
        delete wood;
    }

    void sellWood(int value)
    {
        std::cout << "selling " << value << " units of wood." << std::endl;
        if(wood->player1 < value)
            return;

        wood -= value;
        gold += value;
    }
};

class World {
public:
    Resources* resources;

    World() : resources(new Resources()) {}

    ~World() {
        delete resources;
    }
};

int main() {
    // Seed the random number generator
    std::srand(std::time(nullptr)); // Removed static_cast<unsigned int>

    World world;

    while (true) {
        int goldIncrement = std::rand() % 1000;
        int woodIncrement = std::rand() % 1000;
        int woodToSell = std::rand() % 100;
        
        if (world.resources->wood->player1 < woodToSell && woodToSell < 50)
             world.resources->sellWood(woodToSell);

        world.resources->gold->player1 += goldIncrement;
        world.resources->wood->player1 += woodIncrement;

        if (world.resources->wood->player1 > 500) {
            world.resources->wood->player1 = 10;
        }

        if (world.resources->gold->player1 > 10000) {
            world.resources->gold->player1 = 0;
        }

        std::cout << "Gold: " << world.resources->gold->player1 << ", Wood: " << world.resources->wood->player1 << std::endl;

        std::this_thread::sleep_for(std::chrono::seconds(5));
    }

    return 0;
}

[danielfvm]

Looks like the minor and major number under /proc/PID/maps is a hexadecimal number. I updated the code in the master branch. Could you please confirm that the latest version works for you?

To test the changes I ran the following code on your C++ program and it worked fine.

from memmod import Process

proc = Process(name="a.out")
puts = proc.get_libc_function("puts")
puts("Hello World!")

sudo -E python test.py

and output as expected looks like:

Gold: 4394, Wood: 10
selling 30 units of wood.
Gold: 4610, Wood: 192
Gold: 5345, Wood: 10
Hello World!
Gold: 5996, Wood: 10

If it still doesn't work for you, could you send me a dump of your /proc/PID/maps file? You can get it by running for example following command (uses pgrep to get the PID of a.out):

cat /proc/$(pgrep a.out)/maps

[danielfvm]

Another thing to mention is that your example program has no static pointers.

Changing your program to the following:

...
static World world; // moved this out of main()

int main() {
    // Seed the random number generator
    std::srand(std::time(nullptr)); // Removed static_cast<unsigned int>
...

Allows the pointerscanner to find pointers leading to the address of the gold (found the address using GameConqueror):

And now changing the code to the following allows me to find the address and the the value of the gold:

from memmod import Process

# opens a process with the name "a.out" 
proc = Process(name="a.out")

# get the puts function and execute it inside the process
puts = proc.get_libc_function("puts")
puts("Hello World!")

base_addr = proc.find_module("a.out")
assert base_addr != None

# this value is from the pointerscanner
gold_offset = 0x4198

# follow pointer chain using the values from the pointerscanner
gold_addr = proc.resolve_pointer_chain(base_addr.start+gold_offset, [0, 0])
assert gold_addr != 0

print("Found gold address at: " + hex(gold_addr))
print("Gold value is: " + str(int.from_bytes(proc.read(gold_addr, 4), "little")))

[jagernicolas]

Hi @danielfvm ,
thx for the answer I appreciate it.

I isntalled the version from github,
pip install git+https://github.com/danielfvm/memmod.git

I checked the modifications are installed. when I run,

from memmod import Process

proc = Process(name="a.out")
puts = proc.get_libc_function("puts")
puts("Hello World!")

I got,

Traceback (most recent call last):
  File "/home/user/myenv/test2.py", line 1, in <module>
    from memmod import Process
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/__init__.py", line 1, in <module>
    from .process import Process, ScanMode, ScanResult, HookMode, Hook
  File "/home/user/myenv/lib/python3.10/site-packages/memmod/process.py", line 5, in <module>
    from .memscan import memscan
ModuleNotFoundError: No module named 'memmod.memscan'

don't think it is related, but if you are curious I give you the ouput of cat /proc/$(pgrep a.out)/maps,
dump to avoid the post to be unreadable

also you mentioned something interesting about using static World world; to be honest I thought doing World world; will create a pointer into the stack and put an instance into. Then I was expecting this pointer to be always found at the same offset from the base address. Please tell me if I am wrong.

[danielfvm]

I tried installing this project with pip install git+https://github.com/danielfvm/memmod.git on a separate machine and it worked fine. Have you tried to fully uninstall the old project? You could also try to install it using poetry.

Install poetry with:

pip install poetry

And the project with:

git clone https://github.com/danielfvm/memmod
cd memmod
poetry install
poetry build   # should create the whl file that can be installed with pip
pip install dist/libmemmod-0.0.6-cp311-cp311-manylinux_2_38_x86_64.whl 

also you mentioned something interesting about using static World world; to be honest I thought doing World world; will create a pointer into the stack and put an instance into. Then I was expecting this pointer to be always found at the same offset from the base address.

As far as I know (mostly from trying and looking at the assembly), it's not about the keyword static but about the scope the variable is in. If i write World world; (with or without static keyword) outside of the main function in a global scope there will be a pointer. Another thing to add is that this pointer does not point to the stack but to a rw section that can be found when looking into the /maps file. Here a graphic that shows the disassembled program code and how to calculate the address to the world instance.

[jagernicolas]

concerning the scope of the variable thank you for your comment, I lack of practice to look into the memory. I make assumptions that required to be verified. In c++ I'm not very keen to use a global variable, usually at least I put variables inside namespace. Also I wonder if looking for static pointer against the example I put in the first comment, it would return a static pointer to the main function. But this something for another time, let's talk about the current issue.

Have you tried to fully uninstall the old project?

it seems it was done during the process, I didn't have to take action.

I made a new env, I did the steps you put in your last comment and still got the same error. Here a copy of my console,

$ python -m venv myenv2
$ cd myenv2
(myenv2)$ source bin/activate
(myenv2)$ pip install poetry

output

(myenv2)$ git clone https://github.com/danielfvm/memmod
Cloning into 'memmod'...
remote: Enumerating objects: 164, done.
remote: Counting objects: 100% (164/164), done.
remote: Compressing objects: 100% (118/118), done.
remote: Total 164 (delta 78), reused 119 (delta 42), pack-reused 0
Receiving objects: 100% (164/164), 4.50 MiB | 2.03 MiB/s, done.
Resolving deltas: 100% (78/78), done.

(myenv2)$ cd memmod
(myenv2)$ poetry install
Installing dependencies from lock file

Package operations: 6 installs, 1 update, 0 removals

  • Installing pycodestyle (2.11.1)
  • Installing six (1.16.0)
  • Installing autopep8 (2.0.4)
  • Installing capstone (4.0.2)
  • Installing pyelftools (0.28)
  • Updating setuptools (63.2.0 -> 68.2.2)
  • Installing xlib (0.21)

Installing the current project: libmemmod (0.0.6)

(memmod)$ poetry build
Preparing build environment with build-system requirements setuptools, poetry_core>=1.2.0
Building libmemmod (0.0.6)
running build
running build_py
running build_ext
building 'memmod.memscan' extension
gcc -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -march=x86-64 -mtune=generic -O3 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -g -ffile-prefix-map=/build/python/src=/usr/src/debug -flto=auto -ffat-lto-objects -march=x86-64 -mtune=generic -O3 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -g -ffile-prefix-map=/build/python/src=/usr/src/debug -flto=auto -march=x86-64 -mtune=generic -O3 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=2 -Wformat -Werror=format-security -fstack-clash-protection -fcf-protection -g -ffile-prefix-map=/build/python/src=/usr/src/debug -flto=auto -fPIC -I/tmp/tmpzyi5bbr_/.venv/include -I/usr/include/python3.10 -c memmod/memscan.c -o /home/user/test-1-memmod/myenv2/memmod/build/temp.linux-x86_64-cpython-310/memmod/memscan.o

(memmod)$ pip install dist/libmemmod-0.0.6-cp310-cp310-manylinux_2_36_x86_64.whl 
Processing ./dist/libmemmod-0.0.6-cp310-cp310-manylinux_2_36_x86_64.whl
Requirement already satisfied: autopep8<3.0.0,>=2.0.4 in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from libmemmod==0.0.6) (2.0.4)
Requirement already satisfied: capstone==4.0.2 in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from libmemmod==0.0.6) (4.0.2)
Requirement already satisfied: pyelftools<0.29,>=0.28 in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from libmemmod==0.0.6) (0.28)
Requirement already satisfied: xlib<0.22,>=0.21 in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from libmemmod==0.0.6) (0.21)
Requirement already satisfied: pycodestyle>=2.10.0 in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from autopep8<3.0.0,>=2.0.4->libmemmod==0.0.6) (2.11.1)
Requirement already satisfied: tomli in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from autopep8<3.0.0,>=2.0.4->libmemmod==0.0.6) (2.0.1)
Requirement already satisfied: six>=1.10.0 in /home/user/test-1-memmod/myenv2/lib/python3.10/site-packages (from xlib<0.22,>=0.21->libmemmod==0.0.6) (1.16.0)
Installing collected packages: libmemmod
  Attempting uninstall: libmemmod
    Found existing installation: libmemmod 0.0.6
    Uninstalling libmemmod-0.0.6:
      Successfully uninstalled libmemmod-0.0.6
Successfully installed libmemmod-0.0.6

(memmod)$ nano test.py
(memmod)$ cat test.py 
from memmod import Process

proc = Process(name="a.out")
puts = proc.get_libc_function("puts")
puts("Hello World!")

(memmod)$ sudo -E python test.py # a.out was started before
[sudo] password for user: 
Traceback (most recent call last):
  File "/home/user/test-1-memmod/myenv2/memmod/test.py", line 1, in <module>
    from memmod import Process
  File "/home/user/test-1-memmod/myenv2/memmod/memmod/__init__.py", line 1, in <module>
    from .process import Process, ScanMode, ScanResult, HookMode, Hook
  File "/home/user/test-1-memmod/myenv2/memmod/memmod/process.py", line 5, in <module>
    from .memscan import memscan
ModuleNotFoundError: No module named 'memmod.memscan'

[jagernicolas]

note, Found existing installation: libmemmod 0.0.6 I don't understand how . I tried a myenv3, exact same outputs.