I want to search the memory of a running Linux process for a known UTF-16 string and report the address where it appears. I can already read the process's memory ranges from /proc/PID/maps, but I'm unsure how to dump those readable regions, search for the UTF-16 byte pattern, and convert a match in the dump back into the process's actual address. I'm doing this for game modding, where the text is stored in encrypted and proprietary formats, so inspecting the live process is more practical than searching the files. Is Bash suitable for this, or would a small C or C++ utility be more appropriate?
3 Answers
The usual approach is to inspect /proc/PID/maps, select the regions with suitable read permissions, and read those ranges from /proc/PID/mem. Search for the exact UTF-16 byte sequence, taking endianness into account. If the match is at offset N within a mapping that starts at address S, the process address is S + N. Access normally requires that you own the process or have the appropriate ptrace or administrator permissions. Bash can orchestrate tools, but a small C, C++, or Python program will be much less error-prone for binary data, large regions, and address calculations.
The strings utility is mainly useful for extracting printable text and generally won’t directly solve this problem or provide the address. You can create a UTF-16 pattern yourself, scan each readable mapping as binary data, and record the mapping start plus the match offset. Be careful not to treat the memory as ordinary text: embedded NUL bytes, page boundaries, inaccessible mappings, and both little-endian and big-endian UTF-16 can all matter.
Confirming that the text is UTF-16 from one observation is helpful, but the in-memory representation can differ from the file representation. The program might use UTF-8, UTF-16, a native wide-character format, or a transformed buffer after decoding. If possible, inspect the process or its source to verify the encoding. For a quick offline search, a core dump can be scanned, while /proc/PID/mem is the better choice when you need to observe changes in real time.
A core dump can also be searched, but it is a snapshot. It won’t show later changes, and you must associate the match’s file offset with the original memory mapping if you want the live virtual address.