PyMem - Python process memory editing menu

Shout-Out

User Tag List

Results 1 to 6 of 6
  1. #1
    nopz's Avatar Active Member
    Reputation
    67
    Join Date
    Aug 2009
    Posts
    56
    Thanks G/R
    1/3
    Trade Feedback
    0 (0%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)

    PyMem - Python process memory editing

    Hello,

    I'm here to present my current memory editing project.
    This project is a python library for windows, providing the needed functions to start working on your own with memory editing.

    This project is released under THE BEER-WARE LICENSE 6):.


    What's have be done :

    [+] Listing any process and map each process to the windows structure
    [+] Open a Process and enter into debug mod
    [+] Read memory from a debugged process
    [+] Write memory to a debugged process ( need to work more on that part )
    [+] List process Thread
    [+] Get main thread from a process
    [+] Suspend/Resume/Terminate Thread
    [+] Get/Set Thread context ( Registers Eax, Ebp... )
    [+] List process Modules
    [+] Api Hooking
    [+] DLL Injection
    [+] Pattern research

    Code exemple :

    Code:
    if __name__ == '__main__':
    pymem = Pymem()
    if pymem.openProcessFromName("Wow"):
      # at this step we can read and write to the process
      playerBase = pymem.readOffset([0xB366D0, 0x34, 0x24], 'uint')
      player_x = pymem.readOffset(playerBase + 0x798, 'float')
      print "Player float x: %s" % player_x
    else:
      print "Could not open process"
    Hook :

    Code:
    #First we set our hook somewhere in our code
    @Hooked(func='OpenProcess',module='kernel32.dll',exit=None,params=0)
    def my_openProcess(dbg, args):
    	print 'Hooked explorer OpenProcess !'
    	return 0x00010002
    
    #then we just run all Hooks.
    h = Hook()
    pymem = Pymem()
    pymem.openProcessFromName("explorer")
    h.launch(pymem.pid) #Run all hooks.
    DLL Injection:

    Code:
    if __name__ == '__main__':
      pymem = Pymem()
      if pymem.openProcessFromName("Wow"):
        if pymem.injectDLL("d:/OpenProcessHook.dll"):
          print 'Dll injected !'
    Pattern research:

    Code:
    if __name__ == '__main__':
      pymem = Pymem()
      if pymem.openProcessFromName("Wow"):
      pymem.addPattern("Dostring", "\x55\x8B\xEC\x51\x83\x05\xCC\x74\x32\x01\x01\xA1\xC8\x74\x32\x01\x89\x45\xFC\x74\x12\x83\x3D\xD0\x74\x32\x01\x00", "xxxxxx????xx????xxxxxxx????x")
      pymem.findPatterns()
      print pymem.getPattern('Dostring')['address']
    Public repository :

    At Bittbucket: PyMem

    I will update this thread as soon as i get more time to implement new functionalities.
    Feel free to flame, comment, troll :=)

    Changelog :
    - 07/03/2010: Added Threading functionalities ( suspend / resume )
    - 07/03/2010: Added Threading functionalities ( terminate, exit_code, context, change_context )
    - 08/03/2010: Api Hooking success with pyDbg
    - 10/03/2010: Added Hook API
    - 10/04/2010: Added Python for Windows Extensions to the projet so you don't need to install it anymore
    - 10/04/2010: Total library refactoring, optimization, decorators...
    - 11/04/2010: Re-implemented Thread access.
    - 25/04/2010: Added Module listing
    - 25/04/2010: Added DLL Injection
    - 09/05/2010: Added Pattern research


    This project is currently in a development process so any suggestion is available.
    Last edited by nopz; 05-09-2010 at 04:57 AM. Reason: added pattern
    My blog: https://pimpmykitty.wordpress.com
    PyFasm: https://github.com/srounet/pyfasm
    Pymem: https://github.com/srounet/pymem

    PyMem - Python process memory editing
  2. #2
    Viano's Avatar Active Member
    Reputation
    37
    Join Date
    May 2008
    Posts
    172
    Thanks G/R
    0/1
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    You have to love python. I mean going all the way and not using C# and C++ resources lying around in here for free and creating your own library
    Viano

  3. #3
    mnbvc's Avatar Banned
    Reputation
    120
    Join Date
    Jul 2009
    Posts
    273
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    sounds nice, i really like python, keep up the work! (sadly can't rep you )

  4. #4
    nopz's Avatar Active Member
    Reputation
    67
    Join Date
    Aug 2009
    Posts
    56
    Thanks G/R
    1/3
    Trade Feedback
    0 (0%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    Updated the library.

    I'm now using python decorators, you don't need to go in the routine of opening a process in debug mode, then create a memory class ect...
    You just have to call one method and it's done.

    I will work on the hooking part and provide an easier way to implement custom hooks.

    Exemple:

    Code:
    if __name__ == '__main__':
      pymem = Pymem()
      if pymem.openProcessFromName("Wow"):
        # at this step we can read and write to the process
        playerBase = pymem.readOffset([0xB366D0, 0x34, 0x24], 'uint')
        player_x = pymem.readOffset(playerBase + 0x798, 'float')
        print "Player float x: %s" % player_x
      else:
        print "Could not open process"
    My blog: https://pimpmykitty.wordpress.com
    PyFasm: https://github.com/srounet/pyfasm
    Pymem: https://github.com/srounet/pymem

  5. #5
    nopz's Avatar Active Member
    Reputation
    67
    Join Date
    Aug 2009
    Posts
    56
    Thanks G/R
    1/3
    Trade Feedback
    0 (0%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    Updated the library again.

    You can now inject a DLL into any process and list loaded modules ( dll's ... ). As always it's easy just few lines ( as the library will do all the dirty win32 things ).

    Exemple :

    Code:
    if __name__ == '__main__':
      pymem = Pymem()
      if pymem.openProcessFromName("Wow"):
        if pymem.injectDLL("d:/OpenProcessHook.dll"):
          print 'Dll injected !'
    Btw here is a snipet on how to implement api hooking :

    main.py
    Code:
    from hook import Hook, Hooked
    from pymem import Pymem
    
    @Hooked(func='OpenProcess',module='kernel32.dll',exit=None,params=0)
    def my_openProcess_hook(dbg, args):
      print 'Hooked explorer OpenProcess !'
      print args
      return 0x00010002
    
    if __name__ == '__main__':
      h = Hook()
      pymem = Pymem()
      pymem.openProcessFromName("explorer")
      h.launch(pymem.pid)
    My blog: https://pimpmykitty.wordpress.com
    PyFasm: https://github.com/srounet/pyfasm
    Pymem: https://github.com/srounet/pymem

  6. #6
    nopz's Avatar Active Member
    Reputation
    67
    Join Date
    Aug 2009
    Posts
    56
    Thanks G/R
    1/3
    Trade Feedback
    0 (0%)
    Mentioned
    1 Post(s)
    Tagged
    0 Thread(s)
    Updated the library and added Pattern research and module listing.

    Pattern

    Code:
    if __name__ == '__main__':
      pymem = Pymem()
      if pymem.openProcessFromName("Wow"):
      pymem.addPattern("Dostring", "\x55\x8B\xEC\x51\x83\x05\xCC\x74\x32\x01\x01\xA1\xC8\x74\x32\x01\x89\x45\xFC\x74\x12\x83\x3D\xD0\x74\x32\x01\x00", "xxxxxx????xx????xxxxxxx????x")
      pymem.findPatterns()
      print pymem.getPattern('Dostring')['address']
    Module listing

    Code:
    if __name__ == '__main__':
      pymem = Pymem()
      pymem.openProcessFromName("Wow")
      l = pymem.listModules()
    My blog: https://pimpmykitty.wordpress.com
    PyFasm: https://github.com/srounet/pyfasm
    Pymem: https://github.com/srounet/pymem

Similar Threads

  1. [Release] [Release][Python]Pymem - Python memory library
    By nopz in forum WoW Memory Editing
    Replies: 7
    Last Post: 05-28-2021, 11:05 AM
  2. PyMem Memory Editing Example[VIDEO]
    By nurik040404 in forum Programming
    Replies: 0
    Last Post: 01-09-2016, 04:50 AM
  3. In Process vs. Out of Process memory editing
    By motodrizzle in forum Programming
    Replies: 2
    Last Post: 07-16-2013, 08:23 AM
  4. PyMem - Python process memory editing
    By nopz in forum Programming
    Replies: 5
    Last Post: 03-25-2010, 03:47 AM
  5. [Help] Memory editing a process, wow wont show...
    By Motivation69 in forum WoW Memory Editing
    Replies: 1
    Last Post: 03-04-2009, 07:04 PM
All times are GMT -5. The time now is 09:44 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2025 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Google Authenticator verification provided by Two-Factor Authentication (Free) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search