Skip to content
Modifies running processes on Linux
Find file
Latest commit 6acf704 Chris will now work on arm too
Failed to load latest commit information.
Makefile makefile cleaned readme
main.c removed comment
procmodlib.c removed comment
procmodlib.h will now work on arm too
unicode.c Fixed bug with hex code
unicode.h Added hexadecimal support

ProcMod v0.1


Modifies running processes on linux.

  • Finds ASCII/UTF-16/binary and replaces it appropiately
  • Dumps processes to disk


Should compile fine on 32/64 bit architectures, simply by typing 'make'.


  • -p PROCID - Process ID to work on
  • -f - Text to find in the process
  • -r - Text to replace in the proces
  • -u - Convert find/replace parameters to UTF-16 (for JVM)
  • -d FILE - dumps process to file
  • -l NUM - Lower bound of search
  • -t NUM - Top bound of search
  • -h - Hexadecimal find/replace strings

Example usage

Search for the text HELLOWORLD in a firefox process, from the hex address 0x00007fef32000000.

./procmod -p pgrep firefox -f HELLOWORLD -l printf "%u" 0x00007fef32000000

Find the hexadecimal bytes 0xDEADBEEF in firefox.

./procmod -p pgrep firefox -f "DEADBEEF" -h


If you find it can't attach to a process, this could be because the process is running as a different user. The ptrace system call can only trace your own processes.

If you're running a Grsecurity kernel with "Configuration option: CONFIG_GRKERNSEC_PROC_MEMMAP" enabled then you will find that most of the addresses in /proc/PROCESSID/maps are null. This is because:

"If you say Y here, the /proc//maps and /proc//stat files will give no information about the addresses of its mappings if PaX features that rely on random addresses are enabled on the task. If you use PaX it is greatly recommended that you say Y here as it closes up a hole that makes the full ALSR useless for suid binaries."


Licenced under GPL v2

Something went wrong with that request. Please try again.