PyMemoryEditor 1.0.3__tar.gz → 1.1.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PKG-INFO +1 -1
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/__init__.py +15 -10
- PyMemoryEditor-1.1.1/PyMemoryEditor/win32/enum.py +216 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor.egg-info/PKG-INFO +1 -1
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor.egg-info/SOURCES.txt +1 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/LICENSE +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/process/__init__.py +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/process/errors.py +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/process/util.py +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/win32/constants.py +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/win32/functions.py +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor/win32/util.py +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor.egg-info/dependency_links.txt +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor.egg-info/requires.txt +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/PyMemoryEditor.egg-info/top_level.txt +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/README.md +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/setup.cfg +0 -0
- {PyMemoryEditor-1.0.3 → PyMemoryEditor-1.1.1}/setup.py +0 -0
|
@@ -6,20 +6,17 @@ reading and writing values in the process memory.
|
|
|
6
6
|
"""
|
|
7
7
|
|
|
8
8
|
__author__ = "Jean Loui Bernard Silva de Jesus"
|
|
9
|
-
__version__ = "1.
|
|
9
|
+
__version__ = "1.1.1"
|
|
10
10
|
|
|
11
11
|
from .process import Process
|
|
12
|
-
from .win32.
|
|
12
|
+
from .win32.enum import ProcessOperations
|
|
13
13
|
from .win32.functions import CloseHandle, GetProcessHandle, ReadProcessMemory, WriteProcessMemory
|
|
14
14
|
|
|
15
15
|
from typing import Optional, Type, Union
|
|
16
16
|
|
|
17
17
|
__all__ = (
|
|
18
18
|
"OpenProcess",
|
|
19
|
-
"
|
|
20
|
-
"PROCESS_VM_OPERATION",
|
|
21
|
-
"PROCESS_VM_READ",
|
|
22
|
-
"PROCESS_VM_WRITE"
|
|
19
|
+
"ProcessOperations"
|
|
23
20
|
)
|
|
24
21
|
|
|
25
22
|
|
|
@@ -38,7 +35,7 @@ class OpenProcess(object):
|
|
|
38
35
|
window_title: Optional[str] = None,
|
|
39
36
|
process_name: Optional[str] = None,
|
|
40
37
|
pid: Optional[int] = None,
|
|
41
|
-
permission:
|
|
38
|
+
permission: ProcessOperations = ProcessOperations.PROCESS_ALL_ACCESS
|
|
42
39
|
):
|
|
43
40
|
"""
|
|
44
41
|
:param window_title: window title of the target program.
|
|
@@ -66,7 +63,7 @@ class OpenProcess(object):
|
|
|
66
63
|
raise TypeError("You must pass an argument to one of these parameters (window_title, process_name, pid).")
|
|
67
64
|
|
|
68
65
|
# Get the process handle.
|
|
69
|
-
self.__process_handle = GetProcessHandle(
|
|
66
|
+
self.__process_handle = GetProcessHandle(self.__permission.value, False, self.__process.pid)
|
|
70
67
|
|
|
71
68
|
def close(self):
|
|
72
69
|
"""
|
|
@@ -87,7 +84,11 @@ class OpenProcess(object):
|
|
|
87
84
|
:param pytype: type of the value to be received (str, int or float).
|
|
88
85
|
:param bufflength: value size in bytes (1, 2, 4, 8).
|
|
89
86
|
"""
|
|
90
|
-
|
|
87
|
+
valid_permissions = [
|
|
88
|
+
ProcessOperations.PROCESS_ALL_ACCESS.value,
|
|
89
|
+
ProcessOperations.PROCESS_VM_READ.value
|
|
90
|
+
]
|
|
91
|
+
if self.__permission.value not in valid_permissions:
|
|
91
92
|
raise PermissionError("The handle does not have permission to read the process memory.")
|
|
92
93
|
|
|
93
94
|
return win32.functions.ReadProcessMemory(self.__process_handle, address, pytype, bufflength)
|
|
@@ -107,7 +108,11 @@ class OpenProcess(object):
|
|
|
107
108
|
:param bufflength: value size in bytes (1, 2, 4, 8).
|
|
108
109
|
:param value: value to be written (str, int or float).
|
|
109
110
|
"""
|
|
110
|
-
|
|
111
|
+
valid_permissions = [
|
|
112
|
+
ProcessOperations.PROCESS_ALL_ACCESS.value,
|
|
113
|
+
ProcessOperations.PROCESS_VM_OPERATION.value | ProcessOperations.PROCESS_VM_WRITE.value
|
|
114
|
+
]
|
|
115
|
+
if self.__permission.value not in valid_permissions:
|
|
111
116
|
raise PermissionError("The handle does not have permission to write to the process memory.")
|
|
112
117
|
|
|
113
118
|
return WriteProcessMemory(self.__process_handle, address, pytype, bufflength, value)
|
|
@@ -0,0 +1,216 @@
|
|
|
1
|
+
# -*- coding: utf-8 -*-
|
|
2
|
+
from enum import Enum
|
|
3
|
+
|
|
4
|
+
|
|
5
|
+
class ProcessOperations(Enum):
|
|
6
|
+
"""
|
|
7
|
+
Enum with permissions and operations you can do to a process.
|
|
8
|
+
"""
|
|
9
|
+
# Allocates memory charges (from the overall size of memory and the paging files on disk) for the specified reserved
|
|
10
|
+
# memory pages. The function also guarantees that when the caller later initially accesses the memory, the contents will
|
|
11
|
+
# be zero. Actual physical pages are not allocated unless/until the virtual addresses are actually accessed. To reserve
|
|
12
|
+
# and commit pages in one step, call VirtualAllocEx with MEM_COMMIT | MEM_RESERVE. Attempting to commit a specific
|
|
13
|
+
# address range by specifying MEM_COMMIT without MEM_RESERVE and a non-NULL lpAddress fails unless the entire range has
|
|
14
|
+
# already been reserved. The resulting error code is ERROR_INVALID_ADDRESS. An attempt to commit a page that is already
|
|
15
|
+
# committed does not cause the function to fail. This means that you can commit pages without first determining the
|
|
16
|
+
# current commitment state of each page.
|
|
17
|
+
# If lpAddress specifies an address within an enclave, flAllocationType must be MEM_COMMIT.
|
|
18
|
+
MEM_COMMIT = 0x00001000
|
|
19
|
+
|
|
20
|
+
# Reserves a range of the process's virtual address space without allocating any actual physical storage in memory or in
|
|
21
|
+
# the paging file on disk. You commit reserved pages by calling VirtualAllocEx again with MEM_COMMIT. To reserve and
|
|
22
|
+
# commit pages in one step, call VirtualAllocEx with MEM_COMMIT | MEM_RESERVE. Other memory allocation functions, such
|
|
23
|
+
# as malloc and LocalAlloc, cannot use reserved memory until it has been released.
|
|
24
|
+
MEM_RESERVE = 0x00002000
|
|
25
|
+
|
|
26
|
+
# Indicates that data in the memory range specified by lpAddress and dwSize is no longer of interest. The pages should
|
|
27
|
+
# not be read from or written to the paging file. However, the memory block will be used again later, so it should not be
|
|
28
|
+
# decommitted. This value cannot be used with any other value. Using this value does not guarantee that the range operated
|
|
29
|
+
# on with MEM_RESET will contain zeros. If you want the range to contain zeros, decommit the memory and then recommit it.
|
|
30
|
+
# When you use MEM_RESET, the VirtualAllocEx function ignores the value of fProtect. However, you must still set fProtect
|
|
31
|
+
# to a valid protection value, such as PAGE_NOACCESS. VirtualAllocEx returns an error if you use MEM_RESET and the range
|
|
32
|
+
# of memory is mapped to a file. A shared view is only acceptable if it is mapped to a paging file.
|
|
33
|
+
MEM_RESET = 0x00080000
|
|
34
|
+
|
|
35
|
+
# MEM_RESET_UNDO should only be called on an address range to which MEM_RESET was successfully applied earlier. It
|
|
36
|
+
# indicates that the data in the specified memory range specified by lpAddress and dwSize is of interest to the caller
|
|
37
|
+
# and attempts to reverse the effects of MEM_RESET. If the function succeeds, that means all data in the specified address
|
|
38
|
+
# range is intact. If the function fails, at least some of the data in the address range has been replaced with zeroes.
|
|
39
|
+
# This value cannot be used with any other value. If MEM_RESET_UNDO is called on an address range which was not MEM_RESET
|
|
40
|
+
# earlier, the behavior is undefined. When you specify MEM_RESET, the VirtualAllocEx function ignores the value of
|
|
41
|
+
# flProtect. However, you must still set flProtect to a valid protection value, such as PAGE_NOACCESS.
|
|
42
|
+
# Windows Server 2008 R2, Windows 7, Windows Server 2008, Windows Vista, Windows Server 2003 and Windows XP:
|
|
43
|
+
# The MEM_RESET_UNDO flag is not supported until Windows 8 and Windows Server 2012.
|
|
44
|
+
MEM_RESET_UNDO = 0x1000000
|
|
45
|
+
|
|
46
|
+
# Allocates memory using large page support. The size and alignment must be a multiple of the large-page minimum. To
|
|
47
|
+
# obtain this value, use the GetLargePageMinimum function.
|
|
48
|
+
# If you specify this value, you must also specify MEM_RESERVE and MEM_COMMIT.
|
|
49
|
+
MEM_LARGE_PAGES = 0x20000000
|
|
50
|
+
|
|
51
|
+
# Reserves an address range that can be used to map Address Windowing Extensions (AWE) pages. This value must be used
|
|
52
|
+
# with MEM_RESERVE and no other values.
|
|
53
|
+
MEM_PHYSICAL = 0x00400000
|
|
54
|
+
|
|
55
|
+
# Allocates memory at the highest possible address. This can be slower than regular allocations, especially when there
|
|
56
|
+
# are many allocations.
|
|
57
|
+
MEM_TOP_DOWN = 0x00100000
|
|
58
|
+
|
|
59
|
+
# Enables execute access to the committed region of pages. An attempt to write to the committed
|
|
60
|
+
# region results in an access violation. This flag is not supported by the CreateFileMapping function.
|
|
61
|
+
PAGE_EXECUTE = 0x10
|
|
62
|
+
|
|
63
|
+
# Enables execute or read-only access to the committed region of pages. An attempt to write to the committed region
|
|
64
|
+
# results in an access violation. Windows Server 2003 and Windows XP: This attribute is not supported by the
|
|
65
|
+
# CreateFileMapping function until Windows XP with SP2 and Windows Server 2003 with SP1.
|
|
66
|
+
PAGE_EXECUTE_READ = 0x20
|
|
67
|
+
|
|
68
|
+
# Enables execute, read-only, or read/write access to the committed region of pages. Windows Server 2003 and
|
|
69
|
+
# Windows XP: This attribute is not supported by the CreateFileMapping function until Windows XP with SP2
|
|
70
|
+
# and Windows Server 2003 with SP1.
|
|
71
|
+
PAGE_EXECUTE_READWRITE = 0x40
|
|
72
|
+
|
|
73
|
+
# Enables execute, read-only, or copy-on-write access to a mapped view of a file mapping object. An attempt to
|
|
74
|
+
# write to a committed copy-on-write page results in a private copy of the page being made for the process. The
|
|
75
|
+
# private page is marked as PAGE_EXECUTE_READWRITE, and the change is written to the new page. This flag is not
|
|
76
|
+
# supported by the VirtualAlloc or VirtualAllocEx functions. Windows Vista, Windows Server 2003 and Windows XP:
|
|
77
|
+
# This attribute is not supported by the CreateFileMapping function until Windows Vista with SP1 and Windows Server 2008.
|
|
78
|
+
PAGE_EXECUTE_WRITECOPY = 0x80
|
|
79
|
+
|
|
80
|
+
# Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed
|
|
81
|
+
# region results in an access violation. This flag is not supported by the CreateFileMapping function.
|
|
82
|
+
PAGE_NOACCESS = 0x01
|
|
83
|
+
|
|
84
|
+
# Enables read-only access to the committed region of pages. An attempt to write to the committed region results in
|
|
85
|
+
# an access violation. If Data Execution Prevention is enabled, an attempt to execute code in the committed region
|
|
86
|
+
# results in an access violation.
|
|
87
|
+
PAGE_READONLY = 0x02
|
|
88
|
+
|
|
89
|
+
# Enables read-only or read/write access to the committed region of pages. If Data Execution Prevention is enabled,
|
|
90
|
+
# attempting to execute code in the committed region results in an access violation.
|
|
91
|
+
PAGE_READWRITE = 0x04
|
|
92
|
+
|
|
93
|
+
# Enables read-only or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a
|
|
94
|
+
# committed copy-on-write page results in a private copy of the page being made for the process. The private page
|
|
95
|
+
# is marked as PAGE_READWRITE, and the change is written to the new page. If Data Execution Prevention is enabled,
|
|
96
|
+
# attempting to execute code in the committed region results in an access violation. This flag is not supported by
|
|
97
|
+
# the VirtualAlloc or VirtualAllocEx functions.
|
|
98
|
+
PAGE_WRITECOPY = 0x08
|
|
99
|
+
|
|
100
|
+
# Sets all locations in the pages as invalid targets for CFG. Used along with any execute page protection like
|
|
101
|
+
# PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE and PAGE_EXECUTE_WRITECOPY. Any indirect call to locations
|
|
102
|
+
# in those pages will fail CFG checks and the process will be terminated. The default behavior for executable pages
|
|
103
|
+
# allocated is to be marked valid call targets for CFG. This flag is not supported by the VirtualProtect or
|
|
104
|
+
# CreateFileMapping functions.
|
|
105
|
+
PAGE_TARGETS_INVALID = 0x40000000
|
|
106
|
+
|
|
107
|
+
# Pages in the region will not have their CFG information updated while the protection changes for VirtualProtect.
|
|
108
|
+
# For example, if the pages in the region was allocated using PAGE_TARGETS_INVALID, then the invalid information
|
|
109
|
+
# will be maintained while the page protection changes. This flag is only valid when the protection changes to an
|
|
110
|
+
# executable type like PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE and PAGE_EXECUTE_WRITECOPY. The default
|
|
111
|
+
# behavior for VirtualProtect protection change to executable is to mark all locations as valid call targets for CFG.
|
|
112
|
+
PAGE_TARGETS_NO_UPDATE = 0x40000000
|
|
113
|
+
|
|
114
|
+
# Pages in the region become guard pages. Any attempt to access a guard page causes the system to raise a
|
|
115
|
+
# STATUS_GUARD_PAGE_VIOLATION exception and turn off the guard page status. Guard pages thus act as a one-time access
|
|
116
|
+
# alarm. For more information, see Creating Guard Pages. When an access attempt leads the system to turn off guard page
|
|
117
|
+
# status, the underlying page protection takes over. If a guard page exception occurs during a system service, the
|
|
118
|
+
# service typically returns a failure status indicator. This value cannot be used with PAGE_NOACCESS. This flag is not
|
|
119
|
+
# supported by the CreateFileMapping function.
|
|
120
|
+
PAGE_GUARD = 0x100
|
|
121
|
+
|
|
122
|
+
# Sets all pages to be non-cachable. Applications should not use this attribute except when explicitly required for a
|
|
123
|
+
# device. Using the interlocked functions with memory that is mapped with SEC_NOCACHE can result in an
|
|
124
|
+
# EXCEPTION_ILLEGAL_INSTRUCTION exception. The PAGE_NOCACHE flag cannot be used with the PAGE_GUARD, PAGE_NOACCESS, or
|
|
125
|
+
# PAGE_WRITECOMBINE flags. The PAGE_NOCACHE flag can be used only when allocating private memory with the VirtualAlloc,
|
|
126
|
+
# VirtualAllocEx, or VirtualAllocExNuma functions. To enable non-cached memory access for shared memory, specify the
|
|
127
|
+
# SEC_NOCACHE flag when calling the CreateFileMapping function.
|
|
128
|
+
PAGE_NOCACHE = 0x200
|
|
129
|
+
|
|
130
|
+
# Sets all pages to be write-combined. Applications should not use this attribute except when explicitly required for a
|
|
131
|
+
# device. Using the interlocked functions with memory that is mapped as write-combined can result in an
|
|
132
|
+
# EXCEPTION_ILLEGAL_INSTRUCTION exception. The PAGE_WRITECOMBINE flag cannot be specified with the PAGE_NOACCESS,
|
|
133
|
+
# PAGE_GUARD, and PAGE_NOCACHE flags. The PAGE_WRITECOMBINE flag can be used only when allocating private memory with
|
|
134
|
+
# the VirtualAlloc, VirtualAllocEx, or VirtualAllocExNuma functions. To enable write-combined memory access for shared
|
|
135
|
+
# memory, specify the SEC_WRITECOMBINE flag when calling the CreateFileMapping function. Windows Server 2003 and
|
|
136
|
+
# Windows XP: This flag is not supported until Windows Server 2003 with SP1.
|
|
137
|
+
PAGE_WRITECOMBINE = 0x400
|
|
138
|
+
|
|
139
|
+
# Required to delete the object.
|
|
140
|
+
DELETE = 0x00010000
|
|
141
|
+
|
|
142
|
+
# Required to read information in the security descriptor for the object, not including the
|
|
143
|
+
# information in the SACL. To read or write the SACL, you must request the ACCESS_SYSTEM_SECURITY
|
|
144
|
+
# access right. For more information, see SACL Access Right.
|
|
145
|
+
READ_CONTROL = 0x00020000
|
|
146
|
+
|
|
147
|
+
# The right to use the object for synchronization. This enables a thread to wait until the object
|
|
148
|
+
# is in the signaled state.
|
|
149
|
+
SYNCHRONIZE = 0x00100000
|
|
150
|
+
|
|
151
|
+
# Required to modify the DACL in the security descriptor for the object.
|
|
152
|
+
WRITE_DAC = 0x00040000
|
|
153
|
+
|
|
154
|
+
# Required to change the owner in the security descriptor for the object.
|
|
155
|
+
WRITE_OWNER = 0x00080000
|
|
156
|
+
|
|
157
|
+
# All possible access rights for a process object.Windows Server 2003 and Windows XP: The size of
|
|
158
|
+
# the PROCESS_ALL_ACCESS flag increased on Windows Server 2008 and Windows Vista. If an application
|
|
159
|
+
# compiled for Windows Server 2008 and Windows Vista is run on Windows Server 2003 or Windows XP,
|
|
160
|
+
# the PROCESS_ALL_ACCESS flag is too large and the function specifying this flag fails with
|
|
161
|
+
# ERROR_ACCESS_DENIED. To avoid this problem, specify the minimum set of access rights required for
|
|
162
|
+
# the operation. If PROCESS_ALL_ACCESS must be used, set _WIN32_WINNT to the minimum operating
|
|
163
|
+
# system targeted by your application (for example, #define _WIN32_WINNT _WIN32_WINNT_WINXP). For
|
|
164
|
+
# more information, see Using the Windows Headers.
|
|
165
|
+
PROCESS_ALL_ACCESS = 0x1f0fff
|
|
166
|
+
|
|
167
|
+
# Required to create a process.
|
|
168
|
+
PROCESS_CREATE_PROCESS = 0x0080
|
|
169
|
+
|
|
170
|
+
# Required to create a thread.
|
|
171
|
+
PROCESS_CREATE_THREAD = 0x0002
|
|
172
|
+
|
|
173
|
+
# Required to duplicate a handle using DuplicateHandle.
|
|
174
|
+
PROCESS_DUP_HANDLE = 0x0040
|
|
175
|
+
|
|
176
|
+
# Required to retrieve certain information about a process, such as its token, exit code, and priority
|
|
177
|
+
# class (see OpenProcessToken).
|
|
178
|
+
PROCESS_QUERY_INFORMATION = 0x0400
|
|
179
|
+
|
|
180
|
+
# Required to retrieve certain information about a process (see GetExitCodeProcess, GetPriorityClass,
|
|
181
|
+
# IsProcessInJob, QueryFullProcessImageName). A handle that has the PROCESS_QUERY_INFORMATION access right
|
|
182
|
+
# is automatically granted PROCESS_QUERY_LIMITED_INFORMATION.Windows Server 2003 and Windows XP: This
|
|
183
|
+
# access right is not supported.
|
|
184
|
+
PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
|
|
185
|
+
|
|
186
|
+
# Required to set certain information about a process, such as its priority class (see SetPriorityClass).
|
|
187
|
+
PROCESS_SET_INFORMATION = 0x0200
|
|
188
|
+
PROCESS_SET_LIMITED_INFORMATION = 0x2000
|
|
189
|
+
|
|
190
|
+
# Required to set memory limits using SetProcessWorkingSetSize.
|
|
191
|
+
PROCESS_SET_QUOTA = 0x0100
|
|
192
|
+
|
|
193
|
+
# Required to suspend or resume a process.
|
|
194
|
+
PROCESS_SUSPEND_RESUME = 0x0800
|
|
195
|
+
|
|
196
|
+
# Required to terminate a process using TerminateProcess.
|
|
197
|
+
PROCESS_TERMINATE = 0x0800
|
|
198
|
+
|
|
199
|
+
# Required to perform an operation on the address space of a process (see VirtualProtectEx and WriteProcessMemory).
|
|
200
|
+
PROCESS_VM_OPERATION = 0x0008
|
|
201
|
+
|
|
202
|
+
# Required to read memory in a process using ReadProcessMemory.
|
|
203
|
+
PROCESS_VM_READ = 0x0010
|
|
204
|
+
|
|
205
|
+
# Required to write to memory in a process using WriteProcessMemory.
|
|
206
|
+
PROCESS_VM_WRITE = 0x0020
|
|
207
|
+
|
|
208
|
+
# The thread runs immediately after creation.
|
|
209
|
+
EXECUTE_IMMEDIATELY = 0x00000000
|
|
210
|
+
|
|
211
|
+
# The thread is created in a suspended state, and does not run until the ResumeThread function is called.
|
|
212
|
+
CREATE_SUSPENDED = 0x00000004
|
|
213
|
+
|
|
214
|
+
# The dwStackSize parameter specifies the initial reserve size of the stack.
|
|
215
|
+
# If this flag is not specified, dwStackSize specifies the commit size.
|
|
216
|
+
STACK_SIZE_PARAM_IS_A_RESERVATION = 0x00010000
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|