Python - how to get the value at a memory address?

Question

I am trying to make Python get the value/data from an address such as 0x101BFFDC, which I found by using a cheat engine for a game. I've done much research and believe that I need to use ReadProcessMemory. However, I have tried several examples without success.

For example, I found the following code:

from ctypes import *
from ctypes.wintypes import *
import struct

OpenProcess = windll.kernel32.OpenProcess
ReadProcessMemory = windll.kernel32.ReadProcessMemory
CloseHandle = windll.kernel32.CloseHandle

PROCESS_ALL_ACCESS = 0x1F0FFF

pid = 10684 # pid of the game
address = 0x101BFFDC # I put the address here

buffer = c_char_p(b"The data goes here")
val = c_int()
bufferSize = len(buffer.value)
bytesRead = c_ulong(0)

processHandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
if ReadProcessMemory(processHandle, address, buffer, bufferSize, byref(bytesRead)):
    memmove(ctypes.byref(val), buffer, ctypes.sizeof(val))
    print("Success:" + str(val.value))
else:
    print("Failed.")

CloseHandle(processHandle)

I expect it to give me the value 56, which is what I get from the cheat engine. However, it just prints "Failed." every time.

How can I get the value right?

tried this : https://stackoverflow.com/questions/8250625/access-memory-address-in-python ? — sharath, Jul 04 '17 at 09:19
@sharath that wouldn't work for reading memory from another process, only the Python process. — Mark Tolonen, Jul 04 '17 at 18:05

score 6 · Answer 1 · answered Jul 04 '17 at 15:59

Here's a ctypes wrapper for WinAPI ReadProcessMemory. It takes the process ID, base address, and size in bytes to read. It returns the byte string read from the target process.

If allow_partial is false, the entire address range must be readable, else it fails with the Windows error code ERROR_PARTIAL_COPY. If allow_partial is true, the returned byte string may be less the number of requested bytes.

ctypes definitions

import ctypes
from ctypes import wintypes

kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

ERROR_PARTIAL_COPY = 0x012B
PROCESS_VM_READ = 0x0010

SIZE_T = ctypes.c_size_t
PSIZE_T = ctypes.POINTER(SIZE_T)

def _check_zero(result, func, args):
    if not result:
        raise ctypes.WinError(ctypes.get_last_error())
    return args

kernel32.OpenProcess.errcheck = _check_zero
kernel32.OpenProcess.restype = wintypes.HANDLE
kernel32.OpenProcess.argtypes = (
    wintypes.DWORD, # _In_ dwDesiredAccess
    wintypes.BOOL,  # _In_ bInheritHandle
    wintypes.DWORD) # _In_ dwProcessId

kernel32.ReadProcessMemory.errcheck = _check_zero
kernel32.ReadProcessMemory.argtypes = (
    wintypes.HANDLE,  # _In_  hProcess
    wintypes.LPCVOID, # _In_  lpBaseAddress
    wintypes.LPVOID,  # _Out_ lpBuffer
    SIZE_T,           # _In_  nSize
    PSIZE_T)          # _Out_ lpNumberOfBytesRead

kernel32.CloseHandle.argtypes = (wintypes.HANDLE,)

function

def read_process_memory(pid, address, size, allow_partial=False):
    buf = (ctypes.c_char * size)()
    nread = SIZE_T()
    hProcess = kernel32.OpenProcess(PROCESS_VM_READ, False, pid)
    try:
        kernel32.ReadProcessMemory(hProcess, address, buf, size,
            ctypes.byref(nread))
    except WindowsError as e:
        if not allow_partial or e.winerror != ERROR_PARTIAL_COPY:
            raise
    finally:
        kernel32.CloseHandle(hProcess)
    return buf[:nread.value]

example

if __name__ == '__main__':
    import os

    buf = ctypes.create_string_buffer(b'eggs and spam')
    pid = os.getpid()
    address = ctypes.addressof(buf)
    size = len(buf.value)

    value = read_process_memory(pid, address, size)
    assert value == buf.value

Python - how to get the value at a memory address?

1 Answers1