Memory scanner & analyzer with REST API.
Jailbreaking of iphone is required.
Place your PC and iphone in the same network.
Place memory_server and Entitlements.plist in /usr/bin.
Connect to the iphone via ssh.
cd /usr/bin
ldid -SEntitlements.plist memory_server
./memory_serverThe httpserver starts at port 3030.
sample.py
URL enumeration in memory and simple memory analysis
This API provides endpoints to interact with the memory and processes in the system.
| Attribute | Value |
|---|---|
| Endpoint | /enumprocess |
| Method | GET |
| Parameters | None |
| Returns | A list of process IDs |
Retrieve a list of running processes on the system.
GET /enumprocess
| Attribute | Value |
|---|---|
| Endpoint | /openprocess |
| Method | POST |
| Parameters | pid (int) |
| Returns | A handle to the process |
Open a handle to a process for reading and writing memory.
POST /openprocess
{
"pid": 1234
}| Attribute | Value |
|---|---|
| Endpoint | /enumregion |
| Method | GET |
| Parameters | None |
| Returns | A list of memory regions with information such as start address, size, and protection |
Retrieve information about the memory regions of a process.
GET /enumregion
| Attribute | Value |
|---|---|
| Endpoint | /readmemory |
| Method | POST |
| Parameters | address (int), size (int) |
| Returns | Binary data representing the memory contents |
Retrieve the contents of a specific memory address in a process.
POST /readmemory
{
"address": 0x7ffee000,
"size": 128
}| Attribute | Value |
|---|---|
| Endpoint | /memoryscan |
| Method | POST |
| Parameters | pattern(string), address_ranges(list as [int,int]), is_regex(bool), return_as_json(bool) |
| Returns | A list of memory addresses where the pattern is found |
Scan the memory of a process for specific values or patterns.
POST /memoryscan
{
"pattern": "64000000",
"address_ranges": [
[
0x7ffee000,
0x7ffff000
]...
],
"is_regex": false,
"return_as_json": true
}| Attribute | Value |
|---|---|
| Endpoint | /memoryfilter |
| Method | POST |
| Parameters | pattern(string), is_regex(bool), return_as_json(bool) |
| Returns | A list of memory addresses that match the filter criteria |
Filter the memory of a process based on address patterns.
POST /memoryfilter
{
"pattern": "deadbeaf",
"is_regex": false,
"return_as_json": true
}