FilesExpand file tree

master

/

ReadProcessMemory.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

22 lines (17 loc) · 673 Bytes

master

/

ReadProcessMemory.py

Copy path

Top

File metadata and controls

• Code
• Blame

22 lines (17 loc) · 673 Bytes

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

from ctypes import *

from ctypes.wintypes import *

PROCESS_ID = 9476 # From TaskManager for Notepad.exe

PROCESS_HEADER_ADDR = 0x7ff7b81e0000 # From SysInternals VMMap utility

# read from addresses

STRLEN = 255

PROCESS_VM_READ = 0x0010

k32 = WinDLL('kernel32')

k32.OpenProcess.argtypes = DWORD,BOOL,DWORD

k32.OpenProcess.restype = HANDLE

k32.ReadProcessMemory.argtypes = HANDLE,LPVOID,LPVOID,c_size_t,POINTER(c_size_t)

k32.ReadProcessMemory.restype = BOOL

process = k32.OpenProcess(PROCESS_VM_READ, 0, PROCESS_ID)

buf = create_string_buffer(STRLEN)

s = c_size_t()

if k32.ReadProcessMemory(process, PROCESS_HEADER_ADDR, buf, STRLEN, byref(s)):

print(s.value,buf.raw)