VM read

Virtual Memory

Reading Integral Types

• vm.readInt8(memoryAddress)
• vm.readUInt8(memoryAddress)
• vm.readInt16(memoryAddress)
• vm.readUInt16(memoryAddress)
• vm.readInt32(memoryAddress)
• vm.readUInt32(memoryAddress)
• vm.readInt64(memoryAddress)
• vm.readUInt64(memoryAddress)
• vm.readPointer(memoryAddress)

Reads and returns an integer or pointer from memory at a particular memoryAddress. 'U' means Unsigned.

Raises bitslicer.VirtualMemoryError if unable to read the number of required bytes at memoryAddress.

Reading Fractional Types

• vm.readFloat(memoryAddress)
• vm.readDouble(memoryAddress)

Reads and returns a float or double from memoryAddress. Be sure to use epsilons when making floating-point comparisons.

Raises bitslicer.VirtualMemoryError if unable to read the number of required bytes at memoryAddress.

Reading String Types

• vm.readString8(memoryAddress, encoding='utf-8')
• vm.readString16(memoryAddress, encoding='utf-16')

Reads a NULL terminated string (8 or 16 bit) at memoryAddress, decodes it using the specified encoding, and returns the string. The encoding argument is optional and defaults to utf-8 and utf-16 for vm.readString8 and vm.readString16 respectively.

Raises bitslicer.VirtualMemoryError if unable to read the number of required bytes at memoryAddress or convert the bytes into the specified encoding.

Example

myString = vm.readString8(0x134FB424)
myString2 = vm.readString8(0x134FB444, 'ascii')

Reading Bytes

• vm.readBytes(memoryAddress, numberOfBytes)

vm.readBytes reads and returns a contiguous buffer from memoryAddress with size numberOfBytes.

vm.readBytes raises bitslicer.VirtualMemoryError if unable to read numberOfBytes at memoryAddress.

Note: If you are reading and writing instructions, use debug.readBytes instead.