python脚本扫描win系统中运行程序内存值并修改

用于修改运行中程序的内存值

#!encoding=utf8import os
import json
import psutil
import shutil
import threading
import ctypes
import win32api 
import win32process
from win32con import PROCESS_ALL_ACCESS class MemScan:'''注：一定要以系统管理员身份运行脚本(管理员身份运行cmd) windows系统 根据 进程号 pid 进行扫描内存中的数据, 最终定位到需要修改的内存地址并设置新值, 已知内存地址可以跳过扫描步骤定位内存地址的方法：一、精确查找1、在目标程序页面找到需要修改的值 对该值进行首次扫描2、在目标程序中改变这个值, 用新值进行二次扫描(扫描内存地址范围为上一次扫描结果)3、如果还是没办法确定准确的内存地址, 则重复第 2 步 逐步缩小范围4、根据内存地址设置新值'''def __init__(self, pid):self.scan_data = os.path.join(os.path.abspath(os.path.dirname(__file__)), 'scan_data.json')self.tmp_dir = os.path.join(os.path.abspath(os.path.dirname(__file__)), 'tmp')self.hProcess = win32api.OpenProcess(PROCESS_ALL_ACCESS, False, pid)  # 获取进程句柄# 根据进程号来获取进程的内存大小process = psutil.Process(pid)mem_info = process.memory_info()print("内存总量：", mem_info.rss)  #  resident set size, 常驻内存集大小print("内存占用的峰值：", mem_info.vms)  # virtual memory size, 虚拟内存大小self.base_addr = win32process.EnumProcessModules(self.hProcess)[0]self.end_addr =  mem_info.vms + self.base_addrprint(f'pid:{pid} 的进程基址:{self.base_addr}  内存结束地址:{self.end_addr}')def read(self, mem_address, data_len=4, data_type=''):'''读取内存中的值'''if data_type == 'int':addr = ctypes.c_int32()elif data_type == 'float':addr = ctypes.c_float()elif data_type == 'double':addr = ctypes.c_double()data_len = 8else:addr = ctypes.c_ulong()# 句柄，地址，返回值，长度ctypes.windll.kernel32.ReadProcessMemory(int(self.hProcess), ctypes.c_void_p(int(mem_address)), ctypes.byref(addr), data_len, None)# print(addr)return addr.valuedef write(self, mem_address, num, data_len=4, data_type=''):'''根据内存地址写入值'''if data_type == 'int':addr = ctypes.c_int32()elif data_type == 'float':addr = ctypes.c_float()elif data_type == 'double':addr = ctypes.c_double()data_len = 8else:addr = ctypes.c_ulong()addr.value = num# 句柄，地址，写入值，长度return ctypes.windll.kernel32.WriteProcessMemory(int(self.hProcess), ctypes.c_void_p(int(mem_address)), ctypes.byref(addr), data_len, None)def _scan(self, target_value, scan_addrs, data_len=4, data_type=''):'''target_value: 目标值scan_addrs: 待扫描的地址列表data_len: 数据长度data_type: 数据类型'''current_thread = threading.current_thread()thread_id = current_thread.ident# print(f'当前线程ID：{thread_id}')current_save_path = os.path.join(self.tmp_dir, f'scan_data_{thread_id}.json')if data_type == 'int':addr = ctypes.c_int32()elif data_type == 'float':addr = ctypes.c_float()elif data_type == 'double':addr = ctypes.c_double()data_len = 8else:addr = ctypes.c_ulong()new_scan_data = {}for mem_addr in scan_addrs:value = self.read(mem_addr, data_len, data_type)if value == target_value:print(f'内存地址：{mem_addr}, 值为：{value}')mem_data = {'first_value': value, 'last_value': None ,'current_value': value}new_scan_data[mem_addr] = mem_dataif new_scan_data:# print(f'扫描结果保存路径：{current_save_path}')json.dump(new_scan_data, open(current_save_path, 'w', encoding='utf8'))def scan(self, target_value, data_len=4, data_type='', is_first_scan=False, thread_num=10):'''target_value: 目标值data_len: 数据长度data_type: 数据类型is_first_scan: 是否是第一次扫描thread_num: 线程数量'''if os.path.exists(self.tmp_dir):shutil.rmtree(self.tmp_dir)os.makedirs(self.tmp_dir)old_scan_data = {}mem_addrs = []if is_first_scan:mem_addrs = list(range(self.base_addr, self.end_addr, data_len))else:try:old_scan_data = json.load(open(self.scan_data, 'r', encoding='utf8'))mem_addrs = list(old_scan_data.keys())except:print(f'获取上一次扫描结果失败，请确认是否存在上一次扫描结果，或开启首次扫描')step = int(len(mem_addrs)/thread_num)step = step if step > 0 else 1sub_mem_addrs = [mem_addrs[i:i+step] for i in range(0, len(mem_addrs), step)]threads = []for sub_mem_addrs in sub_mem_addrs:t = threading.Thread(target=self._scan, args=(target_value, sub_mem_addrs, data_len, data_type))threads.append(t)t.start()for t in threads:t.join()new_scan_data = {}for filename in os.listdir(self.tmp_dir):filepath = os.path.join(self.tmp_dir, filename)new_scan_data.update(json.load(open(filepath, 'r', encoding='utf8')))for k, v in new_scan_data.items():old_v = old_scan_data.get(k, None)if old_v is not None:v['last_value'] = old_v['current_value']v['first_value'] = old_v['first_value']print(f'扫描结果保存路径：{self.scan_data}')json.dump(new_scan_data, open(self.scan_data, 'w', encoding='utf8'))def set_value_by_mem_addr(self, mem_addr, value, data_len=4, data_type=''):'''根据内存地址写入值mem_addr: 内存地址  10进制内存地址value: 写入的值data_len: 数据长度data_type: 数据类型'''if data_type == 'double':data_len = 8src = self.read(mem_addr, data_len, data_type)self.write(mem_addr, value, data_len, data_type)dst = self.read(mem_addr, data_len, data_type)print(f'目标地址：{mem_addr}, 原始值：{src}, 新值：{value}, 写入后值：{dst}')if __name__ == '__main__':# 替换为目标进程的PID , 可通过 任务管理器-详细信息 查看pid = 3960  # 扫描的数据长度     int, float 是4字节，double 是8字节data_len = 4# 扫描的数据类型    int, float 是4字节，double 是8字节data_type = 'int'# 扫描并发数量thread_num = 100ms = MemScan(pid)# 第一次扫描target_value = 1092ms.scan(target_value, data_len, data_type, thread_num=thread_num, is_first_scan=True)# 第N次扫描# target_value = 1090# ms.scan(target_value, data_len, data_type, thread_num=thread_num)# 内存地址设置值# target_value = 1090# mem_addr = 27366160# ms.set_value_by_mem_addr(mem_addr, target_value, data_len, data_type)

寻找PID