python 内存读取

 配合cheat engine 找到基地址和偏移地址

import pymem

process = pymem.Pymem('Tutorial-x86_64.exe')
module = pymem.process.module_from_name(process.process_handle, 'Tutorial-x86_64.exe').lpBaseOfDll
print(hex(module))   # 0x100000000   基地址
print(hex(module + 0x325AD0))
root_addr = pymem.memory.read_int(process.process_handle, module + 0x325AD0)
print(hex(root_addr))  # 0x144840
root_addr = pymem.memory.read_int(process.process_handle, root_addr)
print(root_addr)  # 519

方案一

import win32gui
import win32process  # 进程模块
from win32con import PROCESS_ALL_ACCESS  # Opencress 权限
import win32api  # 调用系统模块
import ctypes  # C语言类型
from win32gui import FindWindow  # 界面


handle = win32gui.FindWindow(None, 'Tutorial-x86_64')
pid = win32process.GetWindowThreadProcessId(handle)[1]
print(pid)

process_handle = win32api.OpenProcess(0x1F0FFF, False, pid)
print(process_handle)

kernel32 = ctypes.windll.LoadLibrary(r'C:\Windows\System32\kernel32.dll')

data1 = ctypes.c_long()
kernel32.ReadProcessMemory(int(process_handle), 0x100325ad0, ctypes.byref(data1), 4, None)
print(data1.value)

存在问题：如果ce显示的基地址是进程名+16进制数字，不知道应该如何填写地址