Rob-- / memoryjs

Read and write process memory in Node.js (Windows API functions exposed via Node bindings)
MIT License
632 stars 86 forks source link

How do I read a UTF16 string from a program? #60

Open TreeOfSelf opened 4 years ago

TreeOfSelf commented 4 years ago

Can't seem to figure it out .

Rob-- commented 4 years ago

Currently this library only really supports UTF-8 (well, ASCII). You could take a look at the code if you want to give it a go yourself. Basically right now the library reads one byte at a time at the given memory address until it encounters a null terminator, and treats every byte it encounters as a char. If you know how UTF16 strings are stored in memory (specifically, what type of UTF16 you are targeting) you should be able to easily edit the method for how strings are read.

In JS the current method is basically just:

const chars = [];
let offset = 0x0;
while (true) {
  const char = readMemory(handle, address + offset);

  if (char === '\0') break; // null terminator, end of string

  chars.push(char);
  offset += 1; // size of 1 char
}

const string = chars.join('');

To read UTF16, it would most likely involve reading 2 bytes at a time instead of just one (but then processing those 2 bytes into 1 char, and it could be either little endian or big endian). I would happily implement support for more string types into the library, I am just not sure where to find a good resource as a basis (that defines all string types, how to determine the endianness, etc).

rs28083 commented 4 years ago

You can also use memoryjs.readBuffer to read a buffer if you know the size

ex


    var buff = memoryjs.readBuffer(handle, address, 8*2)
    var text = buff.toString("utf16le")
    console.log(text)

8 here is the length of the string, and its 2 bytes per character (8*2) you can switch utf16le with other supported formats

In my case there is a byte in memory I am also reading that contains the length of the string so this works great for me. If you don't know the length you can read in 2 bytes at a time until you hit the term code for the implementation the program you are reading from uses. In my case it has a 0x00 0x00 at the end of the string.