just806me/windowsmemoryscanner

Basic python library for scanning and reading process memory in Windows

WindowsMemoryScanner

Basic python library for scanning and reading process memory in Windows.

Usage

from WindowsMemoryScanner import Process

# Open a process by name
process = Process.from_name("notepad.exe")

# Open a process by PID
process = Process.from_pid(1234)

# Find a pattern in the process memory
process.detect_memory_regions() # First, we need to detect the memory regions in the process

pattern = b"\x68\x65\x00\x00\x6f" # Byte pattern to search for
mask    = b"\xFF\xFF\x00\x00\xFF" # Optional mask for the pattern: 0x00 = ignore byte, other = match byte
offset  = 8 # Optional offset to add to the address
address = process.find_pattern(pattern, mask, offset)

# Find pattern is designed to be called multiple times, reading the memory only once. To force a re-read, clear the cache:
process.clear_cache()

# Read n bytes at the address
data = process.read_bytes(address, 8)

# Read primitive values at the address, refer to the struct module for format characters
a, b = process.read_values(address, 'ld')