Memobs is a Cheat Engine like tool for Linux.

• Select what memory pages are going to be included in your scans.
• Scan the selected memory for changed, unchanged and literal values.
• Find out where the instructions are that write to a selected address.

Memobs uses GTK4. You can install GTK4 with sudo apt install libgtk-4-dev.

• Run make to build Memobs.

Memobs expects the pid of the targeted process as a command line parameter. You can for example run it like this: sudo ./memobs $(pidof <target_process_name>). You need to launch the application as super user, since it reads the targeted processes memory and attaches a debugger to it.

The most left section is a table like structure, that displays the scanned memory addresses and their current and previous values. This view is updated every time the Scan button is pressed.

The most right section contains all the virtual memory pages of the targeted process. By checking the check box, you can include this page into the scanning process.

New Scan/Init Scan: This should be done whenever you want to initialize a new scan. For example if you changed the scan type or selected different memory pages for scanning.

Scan: After you initialized a new scan, you can iteratively scan the targeted processes memory. The scan is based on what you set in the Scan Type and Scan Option drop down menu. After the initial scan, the Scan Type option should not be changed. If the scan option value was selected, you need to provide a value in the Scan Value field. Every scan iteration, the current values are compared to the ones of the previous scan. If the values don't match the scan settings, the memory addresses will be removed from future scans. This allows you to reduce the scanned addresses over time.

What writes to selected address: This function will figure out the memory address of the instructions that write to the selected address. An address can be selected by left clicking a row in the Scan memory view. The addresses of the instructions and the amounts of memory writes will be displayed in the table below.