Read Process Memory for dynamic pointer

88 views Asked by At

I am trying to read memory from a process (snes9x emulator) in Python using ReadProcessMemory. There is a memory viewer and I am supposed to get 16777216 at 0x01D27A3C (see picture). I tried to do everything correctly by adding reference in the ReadProcessMemory, but there might be some things that are wrong.

Searching here, I found another topic with a similar problem (https://stackoverflow.com/questions/74752251/read-process-memory-doesnt-seem-to-give-the-right-value) and it was resolved when the user found the static value of the memory pointer, using Cheat Engine.

It turns out that my pointer has a dynamic value and always receives a new value (in the case of the image, the value is 01D1B510) every time I restart the emulator, so his solution almost worked for me and now, I can't find it a way to find this dynamic value to run in my python script using "ReadProcessMemory".

How can I find this 01D1B510 pointer value in my python script every time I restart the emulator? enter image description here

My code:

import ctypes
import psutil

vba_process = next(p for p in psutil.process_iter(attrs=['pid', 'name']) if "snes9x" in p.info['name'])
pid = vba_process.info['pid']

process_handle = ctypes.windll.kernel32.OpenProcess(0x10, False, pid)
if not process_handle:
    print("Fail.")
    exit(1)

base_addr = 0x400000
static_addr_offset = 0x01D1B510
address = base_addr + static_addr_offset + 0xC52C

buffer_size = 4  # 4 bytes
buffer = ctypes.create_string_buffer(buffer_size)
bytes_read = ctypes.c_ulong(0)

if ctypes.windll.kernel32.ReadProcessMemory(process_handle, address, buffer, buffer_size, ctypes.byref(bytes_read)):
    data = int.from_bytes(buffer.raw, byteorder='little', signed=False)
    print(f"Value: 0x{data:X}")
else:
    print("Fail.")

ctypes.windll.kernel32.CloseHandle(process_handle)
0

There are 0 answers