{"id":15552127,"url":"https://github.com/sonodima/physpatch","last_synced_at":"2025-04-23T20:42:58.547Z","repository":{"id":159499167,"uuid":"634680398","full_name":"sonodima/physpatch","owner":"sonodima","description":"PhysPatch performs physical memory scanning and patching of the entire Windows Kernel using DMA","archived":false,"fork":false,"pushed_at":"2024-11-10T11:41:57.000Z","size":63,"stargazers_count":12,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-18T05:53:34.249Z","etag":null,"topics":["dma","kernel","memflow","memory","rust","virtual-machine","windows"],"latest_commit_sha":null,"homepage":"https://crates.io/crates/physpatch","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sonodima.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-04-30T22:32:34.000Z","updated_at":"2025-01-30T09:22:17.000Z","dependencies_parsed_at":"2024-01-02T08:09:52.403Z","dependency_job_id":"ab61ebba-8afb-4cee-ba35-9115b5ee42c8","html_url":"https://github.com/sonodima/physpatch","commit_stats":{"total_commits":12,"total_committers":3,"mean_commits":4.0,"dds":0.5,"last_synced_commit":"ae9005f70b100d8da3d6d57fca6bc4d610516e57"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sonodima%2Fphyspatch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sonodima%2Fphyspatch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sonodima%2Fphyspatch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sonodima%2Fphyspatch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sonodima","download_url":"https://codeload.github.com/sonodima/physpatch/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250513380,"owners_count":21443200,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dma","kernel","memflow","memory","rust","virtual-machine","windows"],"created_at":"2024-10-02T14:09:16.077Z","updated_at":"2025-04-23T20:42:58.530Z","avatar_url":"https://github.com/sonodima.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003ePhysPatch 🩹\u003c/h1\u003e\n\n\u003cdiv align=\"center\"\u003e\n  \u003ca href=\"https://crates.io/crates/physpatch\"\u003e\n    \u003cimg src=\"https://img.shields.io/crates/v/physpatch.svg\"/\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/sonodima/physpatch/actions?workflow=CI\"\u003e\n    \u003cimg src=\"https://github.com/sonodima/physpatch/workflows/CI/badge.svg\"/\u003e\n  \u003c/a\u003e\n  \u003cimg src=\"https://img.shields.io/badge/license-MIT-blue.svg\"/\u003e\n  \u003ca href=\"https://crates.io/crates/physpatch\"\u003e\n    \u003cimg src=\"https://img.shields.io/crates/d/physpatch?color=pink\"/\u003e\n  \u003c/a\u003e\n\u003c/div\u003e\n\n\u003cbr\u003e\n\nPhysPatch performs **physical memory** scans and patches of the entire **Windows kernel.**\n\n## Usage\n\nScan for \"488b??????????48\" in the virtual machine named \"TargetVM\" and write\n\"488b0000\" to all matches:\n\n```sh\nphyspatch -t \"TargetVM\" -p \"488b0000\" -- \"488b??????????48\"\n```\n\nScan for \"488b?????48\" in the first virtual machine found, without performing\nany patching:\n\n```sh\nphyspatch -- \"488b?????48\"\n```\n\nSee `physpatch --help` for all the available arguments and their descriptions.\n\n## Installation\n\n### 🦀 Cargo\n\nUsing Cargo is the easiest way to get started with PhysPatch:\n\n```sh\ncargo install physpatch\nsudo setcap \"CAP_SYS_PTRACE=ep\" $(which physpatch)\n```\n\nYou can now launch the program with the `physpatch` command.\n\n### 🔩 From Source\n\n```sh\ngit clone https://github.com/sonodima/physpatch \u0026\u0026 cd physpatch\n\ncargo build --release\nsudo setcap \"CAP_SYS_PTRACE=ep\" target/release/physpatch\n```\n\nThe compiled binary is located in `target/release/physpatch`\n\n## Requirements\n\n### ⚠️ THIS TOOL ONLY SUPPORTS X86_64 GUEST SYSTEMS\n\n__CAP_SYS_PTRACE__ is required to use this program without elevation:\n\n```sh\nsudo setcap \"CAP_SYS_PTRACE=ep\" physpatch\n```\n\nFor more information, refer to the documentation for [memflow_qemu](https://github.com/memflow/memflow-qemu)\n\n## Disclaimer\n\nPhysPatch is an extremely powerful tool, and incorrect usage can *(will)* lead to unintended consequences, including **system crashes** and **data corruption.**\n\nBefore using PhysPatch, ensure you fully understand its implications and effects. Proper knowledge of \nthe memory structures and patterns you are searching for is essential.\n\nThose associated with PhysPatch will not be held accountable for any damages, data losses, or system\ncorruptions that arise from the usage of this tool.\n\n## Notable Mentions\n\nThis project is heavily inspired by [Hygieia,](https://github.com/Deputation/hygieia) which is a scanning tool to find traces of vulnerable drivers.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonodima%2Fphyspatch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsonodima%2Fphyspatch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonodima%2Fphyspatch/lists"}