Hook

For worked examples see Hooks.

class memobj.hook.Hook(process: Process)

Bases: object

pre_hook()

Called before the hook is activated

post_hook()

Called after the hook is activated

hook() → Any

Called when the hook is activated

unhook()

Called when the hook is deactivated

property active: bool

Whether the hook is active

get_code() → list[Instruction]

Called when the hook is activated to get the code to put in the hook

allocate_variable(name: str, size: int, *, preferred_start: int | None = None) → Allocation

Allocate a variable of the specified size for use in the hook, retrievable with get_variable.

Parameters:

• name – str The name of the variable to allocate.

• size – int The size of the memory block to allocate.

• preferred_start – The preferred start address of the allocation

Returns:

Allocation

An Allocation object representing the allocated memory block.

Raises:

ValueError – If a variable with the specified name has already been allocated.

get_variable(name: str) → Allocation

Retrieves the allocated variable by its name.

This method attempts to fetch the variable associated with the provided name from the internal allocation storage. If the requested variable does not exist, an error is raised to indicate that it has not been allocated.

Parameters:

name (str) – The name of the variable to retrieve.

Returns:

The allocated variable corresponding to the given name.

Return type:

Allocation

Raises:

ValueError – If the variable with the specified name does not exist.

wait_variable_non_zero(name: str, *, timeout: float | None = None) → int

Waits for a variable to be non-zero

Parameters:

• name (str) – The name of the variable

• timeout (float | None, optional) – How long to wait for it to be non-zero. Defaults to None.

Returns:

The value of the variable

Return type:

int

activate() → dict[str, Allocation]

Activate the hook

deactivate(*, close_allocator: bool = True)

Deactivate the hook

class memobj.hook.JmpHook(process: Process, *, special_deallocate: bool = True, delayed_close_allocator_seconds: float | None = 0.5)

Bases: Hook

Initializes an instance of the specified class with provided parameters.

Parameters:

• process (Process) – The process to hook.

• special_deallocate (bool) – If we should remove the entry jump before deallocating. Default is True.

• delayed_close_allocator_seconds (float | None) – How many seconds to delay the deallocating. Default is 0.5.

PATTERN: ClassVar[Pattern[bytes] | bytes | None] = None

MODULE: ClassVar[str | None] = None

PRESERVE_RAX: ClassVar[bool] = True

activate() → dict[str, Allocation]

Activate the hook

deactivate(*, close_allocator: bool = True)

Deactivates the hook

hook()

Called when the hook is activated

unhook()

Called when the hook is deactivated

get_hook_head() → list[Instruction]

get_hook_tail(jump_address: int) → tuple[list[Instruction], int]

get_jump_code(hook_address: int, noops_needed: int) → list[Instruction]

get_code() → list[Instruction]

Called when the hook is activated to get the code to put in the hook

memobj.hook.create_capture_hook(pattern: Pattern[bytes] | bytes, module: str, bitness: Literal[32, 64], *, register_captures: list[RegisterCaptureSettings]) → type[JmpHook]

Create a capture hook class

Parameters:

• pattern (regex.Pattern[bytes] | bytes) – Pattern to hook at

• module (str) – Module to search in

• bitness (int) – What bitness of hook to create

• register_captures (list[RegisterCaptureSettings]) – Registers to capture

Returns:

The created capture hook

Return type:

type[JmpHook]

class memobj.hook.RegisterCaptureSettings(register: iced_x86._iced_x86_py.Register, derefference: bool = False, offset: int = 0)

Bases: object