A Python library developed with ctypes to manipulate Windows processes (32 bits and 64 bits),
reading and writing values in the process memory.
pip3 install PyMemoryEditor
Import PyMemoryEditor
and open a process using the OpenProcess
class, passing a window title, process name
or PID as an argument. You can use the context manager to do this.
from PyMemoryEditor import OpenProcess
with OpenProcess(process_name = "example.exe") as process:
# Do something...
After that, use the methods read_process_memory
and write_process_memory
to manipulate the process
memory, passing in the function call the memory address, data type and its size. See the example below:
from PyMemoryEditor import OpenProcess
title = "Window title of an example program"
address = 0x0005000C
with OpenProcess(window_title = title) as process:
# Getting value from the process memory.
value = process.read_process_memory(address, int, 4)
# Writing to the process memory.
process.write_process_memory(address, int, 4, value + 7)
You can look up a value in memory and get the address of all matches, like this:
for address process.search_by_value(int, 4, target_value):
print("Found address:", address)
There are many options to scan the memory. Check all available options in ScanTypesEnum
.
The default option is EXACT_VALUE
, but you can change it at scan_type
parameter:
for address process.search_by_value(int, 4, target_value, scan_type = ScanTypesEnum.BIGGER_THAN):
print("Found address:", address)
This method also has the progress_information
parameter that returns a dictionary containing search progress information.
for address, info process.search_by_value(int, 4, target_value, progress_information = True):
template = "Address: 0x{:<10X} | Progress: {:.1f}%"
progress = info["progress"] * 100
print(template.format(address, progress))