[pywin32-bugs] [ pywin32-Feature Requests-1501429 ] would like to have ReadProcessMemory

[SourceForge.net <no...@so...>]

Feature Requests item #1501429, was opened at 2006-06-05 23:03
Message generated for change (Comment added) made by barnert
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=551957&aid=1501429&group_id=78018

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: win32
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Jason Currey (jpcurrey)
Assigned to: Nobody/Anonymous (nobody)
Summary: would like to have ReadProcessMemory

Initial Comment:
would like to see ReadProcessMemory added to the api.


----------------------------------------------------------------------

Comment By: Andrew Barnert (barnert)
Date: 2007-11-10 02:48

Message:
Logged In: YES 
user_id=1473180
Originator: NO

Until this is done, you can use ctypes to access these functions. I've
written a little game-cheat program in Python that does exactly that, and
it includes a module that wraps ReadProcessMemory and friends in a nice
Process class. 

Here's a stripped-down version of the key functions:

import ctypes
kernel = ctypes.windll.kernel32

class Process(object):
  def __init__(self, pid):
    self.pid = pid
    self.h = kernel.OpenProcess(0x0018, 0, pid)
  def close(self):
    if (self.h):
      kernel.CloseHandle(self.h)
    self.h = None
  def __del__(self):
    self.close()
  def read(self, addr, size):
    buf = ctypes.create_string_buffer(size)
    bytesread = ctypes.c_size_t()
    kernel.ReadProcessMemory(self.h, addr, buf,
                             ctypes.c_size_t(size),
                             ctypes.addressof(bytesread))
    return buf[:bytesread.value]

You can also use win32api for most of the work and only use ctypes for the
missing functions. For example, if you used the win32api.OpenProcess
function, h would be a PyHANDLE, so you'd have to pass self.h.handle to
ReadProcessMemory.


----------------------------------------------------------------------

Comment By: Jason Currey (jpcurrey)
Date: 2006-06-05 23:21

Message:
Logged In: YES 
user_id=543879

I guess also WriteProcessMemory would also be helpful. 
I notice these functions are in the perl equivalent.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=551957&aid=1501429&group_id=78018