/grindel

A Windows process hacking library in Zig with symbolic address resolution.

Primary LanguageZig

Grindel

A Windows process hacking library in Zig with symbolic address resolution.

Features

  • Open a handle to processes by executable or window name for reading and writing memory.
  • Construct symbolic addresses at compile time to resolve in a process at runtime.

Symbolic Address Syntax

  • Supports +, -, *, and / operators and parenthesis ().
  • Dereference memory addresses using [].
  • Get the base address of a module by wrapping its name in "".
  • All numeric constants are hexadecimal numbers.
  • Whitespace is skipped.

Example

const max_health: u32 = 100;
const health_address_sym = try Address.comptimeParse(
    \\ [["game.exe"+1FC]+48]-4
);

const process = try Process.attach("game.exe");
defer process.detach();

const health_address = health_address_sym.resolve(&process);

std.log.info("current health = {}", .{try process.read(u32, health_address)});
try process.write(max_health, health_address);