Process

Base

class memobj.process.base.Process

Bases: object

A connected process

property process_id: int

The process id

property process_64_bit: bool

If this process is 64 bit

property python_64_bit: bool

If the current python is 64 bit

property system_64_bit: bool

If the system is 64 bit

property executable_path: Path

Path to the process’s executable

property pointer_format_string: str

property pointer_type: Type

property pointer_size: int

classmethod from_name(name: str) → Self

Open a process by name

Parameters:

name – The name of the process to open

Returns: The opened process

classmethod from_id(pid: int) → Self

Open a process by id

Parameters:

pid – The id of the process to open

Returns: The opened process

allocate_memory(size: int, *, preferred_start: int | None = None) → int

Allocate <size> amount of memory in the process

Parameters:

• size – The amount of memory to allocate

• preferred_start – The preferred start address of the allocation

Returns: The start address of the allocated memory

free_memory(address: int)

Free some memory in the process

Parameters:

address – The start address of the area to free

read_memory(address: int, size: int) → bytes

Read bytes from memory

Parameters:

• address – The address to read from

• size – The number of bytes to read

Returns: The bytes read

write_memory(address: int, value: bytes)

Write bytes to memory

Parameters:

• address – The address to write to

• value – The bytes to write to that address

scan_memory(pattern: Pattern[bytes] | bytes, *, module: str | None = None) → list[int]

Scan memory for a regex pattern

Parameters:

• pattern – A regex.Pattern[bytes] or a byte pattern

• module – Name of a module to exclusively search

Returns: A list of addresses that matched

scan_one(pattern: Pattern[bytes] | bytes, *, module: str | None = None) → int

Scan memory for a regex pattern and error if one address was not found

Parameters:

• pattern – A regex.Pattern[bytes] or a byte pattern

• module – Name of a module to exclusively search

Returns: Address found

read_formatted(address: int, format_string: str) → tuple[Any] | Any

Read formatted bytes from memory, format_string is passed directly to struct.unpack

Parameters:

• address – The address to read from

• format_string – The format string to pass to struct.unpack

Returns: The formatted data (the corresponding python type/tuple of)

read_typed(address: int, read_type: Type, *, endianness: ProcessEndianness = ProcessEndianness.native) → Any

Read a single typed value from memory using utils.Type and optional endianness

Parameters:

• address – The address to read from

• read_type – The Type enumeration indicating the value to read (e.g., Type.s4)

• endianness – The endianness to use when reading (defaults to native “=”)

Returns:

The formatted value as the corresponding Python type

write_formatted(address: int, format_string: str, value: tuple[Any] | Any)

Write formatted bytes to memory, format_string is passed directly to struct.pack

Parameters:

• address – The address to write to

• format_string – The format string to pass to struct.pack

• value – The data to pass to struct.pack

write_typed(address: int, write_type: Type, value: Any, *, endianness: ProcessEndianness = ProcessEndianness.native) → None

Write a value to memory using a Type enum member to determine the struct format.

Parameters:

• address – The address to write to

• write_type – The Type enum member describing the data format (e.g. Type.signed4, Type.float)

• value – The value to write

• endianness – Byte order to use when packing; defaults to native

scan_formatted(format_string: str, value: tuple[Any] | Any, *, module: str | None = None) → list[int]

Scan memory for a value packed using a struct format string.

Parameters:

• format_string – The format string to pass to struct.pack

• value – The value to search for

• module – Name of a module to exclusively search

Returns: A list of addresses that matched

Module

class memobj.process.module.Module(name: str, base_address: int, executable_path: str, size: int, process: memobj.process.base.Process)

Bases: object

name: str

base_address: int

executable_path: str

size: int

process: Process

get_symbols() → dict[str, int]

Get the module’s symbols

Returns:

A mapping of module symbol to address

Return type:

dict[str, int]

Windows (platform-specific)

class memobj.process.windows.process.WindowsProcess(process_handle: int)

Bases: Process

property process_id: int

The process id

property process_64_bit: bool

If this process is 64 bit

property executable_path: Path

Path to the process’s executable

classmethod from_name(name: str, *, require_debug: bool = True, ignore_case: bool = True) → Self

Open a process by name

Parameters:

name – The name of the process to open

Returns: The opened process

classmethod from_id(pid: int, *, require_debug: bool = True) → Self

Open a process by id

Parameters:

pid – The id of the process to open

Returns: The opened process

create_allocator() → Allocator

allocate_memory(size: int, *, preferred_start: int | None = None) → int

Allocate <size> amount of memory in the process

Parameters:

• size – The amount of memory to allocate

• preferred_start – The preferred start address of the allocation

Returns: The start address of the allocated memory

free_memory(address: int)

Free some memory in the process

Parameters:

address – The start address of the area to free

read_memory(address: int, size: int) → bytes

Read bytes from memory

Parameters:

• address – The address to read from

• size – The number of bytes to read

Returns: The bytes read

write_memory(address: int, value: bytes)

Write bytes to memory

Parameters:

• address – The address to write to

• value – The bytes to write to that address

scan_memory(pattern: Pattern[bytes] | bytes, *, module: str | WindowsModule | bool | None = None) → list[int]

Scan memory for a regex pattern

Parameters:

• pattern – A regex.Pattern[bytes] or a byte pattern

• module – Name of a module to exclusively search or a module to search for

• module) ((True is a shortcut for base)

Returns: A list of addresses that matched

virtual_query(address: int = 0) → WindowsMemoryBasicInformation

Get information about a memory region in the process

see https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualqueryex for more information

Parameters:

• address – The base address of the page region, passing 0 (the default)

• region. (gives info on the first)

Returns: A WindowsMemoryBasicInformation about the region

get_modules(base_only: Literal[False] = False) → list[WindowsModule]

get_modules(base_only: Literal[True]) → WindowsModule

get_module_named(name: str) → WindowsModule

create_remote_thread(address: int, *, param_pointer: c_void_p | None = None, thread_wait_time: int = 0) → int

Create a remote thread in the process

Parameters:

• address (int) – Address to call

• param_pointer (ctypes.c_void_p | None, optional) – Pointer to param to pass (must be allocated in process). Defaults to None.

• thread_wait_time (int, optional) – Amount of time to wait for thread to finish in milliseconds (pass -1 to wait forever). Defaults to 0.

Raises:

• ValueError – If CreateRemoteThread

• TimeoutError – If waiting for the thread times out

Returns:

A handle to the thread

Return type:

int

inject_dll(path: Path | str) → WindowsModule

Inject a dll into process

Parameters:

path (Path | str) – Filepath to the dll to inject

Returns:

The injected module

Return type:

WindowsModule

class memobj.process.windows.module.WindowsModule(name: str, base_address: int, executable_path: str, size: int, process: Process)

Bases: Module

classmethod from_name(process: WindowsProcess, name: str, *, ignore_case: bool = True) → Self

classmethod get_all_modules(process: WindowsProcess) → list[Self]

get_symbol_with_name(name: str) → int

get_symbols() → dict[str, int]

Get the module’s symbols

Returns:

A mapping of module symbol to address

Return type:

dict[str, int]