| View previous topic :: View next topic |
| Author |
Message |
Longhuo
How do I cheat?
![]() Reputation: 0
Joined: 22 Nov 2015
Posts: 4
|
 Posted: Sun Nov 22, 2015 9:34 am Post subject: python read process memory |
 |
|
Hello, everybody !
I've got some difficulties to understand how can i use the function readprocessmemory() in python. I've got one address i want to read in memory, and i used CE to find it. I understood it's a static address. here is my code :
| Code: | from ctypes import *
from ctypes.wintypes import *
from subprocess import check_output
OpenProcess = windll.kernel32.OpenProcess
ReadProcessMemory = windll.kernel32.ReadProcessMemory
CloseHandle = windll.kernel32.CloseHandle
PROCESS_ALL_ACCESS = 0x1F0FFF
PROCESS_VM_READ = 0x0010
process_name = "ePSXe.exe"
def get_pid():
l = check_output('tasklist /fi "Imagename eq ePSXe.exe"').split()
return int(l[18])
pid = get_pid()
address = 0x00B00BF4
buffer = c_char_p("blabla")
bufferSize = len(buffer.value)
bytesRead = c_ulong(0)
processHandle = OpenProcess(PROCESS_VM_READ, False, pid)
if ReadProcessMemory(processHandle, address, buffer, bufferSize, byref(bytesRead)):
print "Success:", buffer.value
else:
print "Failed."
CloseHandle(processHandle)
|
This scripts prints : "Success:"
Do you know how can i find the reel value of my address ?
(I'm french, and i'm still learning english. I'm sorry for the mistakes...)
|
|
| Back to top |
|
 |
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sun Nov 22, 2015 1:43 pm Post subject: |
|
|
I assume by "real value" you mean the full game string?
You'll have to go through byte by byte until you find the null terminator (0x00) byte.
Keep looping and appending the bytes to a secondary buffer until you've got the full string.
|
|
| Back to top |
|
|
hollow87
Cheater
![]() Reputation: 0
Joined: 07 Feb 2015
Posts: 28
|
| Posted: Sun Nov 22, 2015 3:28 pm Post subject: |
|
|
| Looking through python docs and stackoverflow it seems you should not use c_char_p if the pointer is to be mutable memory as python strings are immutable. In which case you should use create_string_buffer instead of c_char_p
|
|
| Back to top |
|
|
Longhuo
How do I cheat?
![]() Reputation: 0
Joined: 22 Nov 2015
Posts: 4
|
| Posted: Sun Nov 22, 2015 3:49 pm Post subject: |
|
|
@Zanzer What do you mean by "full game string" ?
@Hollow87, well i still have an empty string as a result
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
 Reputation: 152
Joined: 06 Jul 2014
Posts: 4709
|
| Posted: Sun Nov 22, 2015 4:19 pm Post subject: |
|
|
What type of data is supposed to be stored at that address (e.g. int, float, double, string)? If it's not a string, reading this might help.
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
Longhuo
How do I cheat?
![]() Reputation: 0
Joined: 22 Nov 2015
Posts: 4
|
| Posted: Sun Nov 22, 2015 4:37 pm Post subject: python read process memory |
|
|
| The datas supposed to be stored at that addres are integer. But even by considering their changings, i've got an empty value each time.
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 152
Joined: 06 Jul 2014
Posts: 4709
|
| Posted: Sun Nov 22, 2015 4:50 pm Post subject: |
|
|
Could be luck. If an integer of a multiple of 256 is stored there, then the first byte would be 00, the null terminator for a string. It might also mess up if it sees a byte it can't properly decode into text, so it just spits out nothing.
Did you try the solution in that post I linked to?
It should look something like this:
| Code: | pid = get_pid()
address = 0x00B00BF4
buffer = c_char_p("blabla")
val = c_int()
bufferSize = len(buffer.value)
bytesRead = c_ulong(0)
processHandle = OpenProcess(PROCESS_VM_READ, False, pid)
if ReadProcessMemory(processHandle, address, buffer, bufferSize, byref(bytesRead)):
memmove(ctypes.byref(val), buffer, ctypes.sizeof(val))
print("Success:" + str(val.value))
else:
print("Failed.") |
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
Longhuo
How do I cheat?
![]() Reputation: 0
Joined: 22 Nov 2015
Posts: 4
|
| Posted: Sun Nov 22, 2015 4:55 pm Post subject: |
|
|
| Code: | buffer = c_char_p(b"blabla")
value = c_int()
bufferSize = len(buffer.value)
bytesRead = c_ulong(10)
processHandle = OpenProcess(PROCESS_VM_READ, False, pid)
if ReadProcessMemory(processHandle, address, buffer, bufferSize, byref(bytesRead)):
memmove(byref(value), buffer, sizeof(value))
print (value)
else:
print "Failed."
CloseHandle(processHandle) |
Here's my current code
And this is what i got :
c_long(0)
Where does it come from !!!?
|
|
| Back to top |
|
|
ParkourPenguin
I post too much
Reputation: 152
Joined: 06 Jul 2014
Posts: 4709
|
| Posted: Sun Nov 22, 2015 5:40 pm Post subject: |
|
|
It's kind of awkward with the name of the variable, but you have to type "value.value" if you want to access the value of that int. Also c_long and c_int are the same AFAIK. This page might be of some help:
https://docs.python.org/3/library/ctypes.html
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
