Class MemoryOperations

Reads from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• nSize (int) - Number of bytes to read.

Returns: str

Bytes read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• lpBuffer (str) - Bytes to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a single unsigned integer from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a single unsigned integer to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedDword (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a single pointer value from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Pointer value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a single pointer value to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a single character to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.

Returns: int

Character value read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Writes a single character to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• char (int) - Character to write.

Raises:

• WindowsError - On error an exception is raised.

Reads a ctypes structure from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• stype (class ctypes.Structure or a subclass.) - Structure definition.

Returns: int

Structure instance filled in with data read from the process memory.

Raises:

• WindowsError - On error an exception is raised.

Reads an ASCII or Unicode string from the address space of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• nChars (int) - String length to read, in characters. Remember that Unicode strings have two byte characters.
• fUnicode (bool) - True is the string is expected to be Unicode, False if it's expected to be ANSI.

Returns: str, unicode

String read from the process memory space.

Raises:

• WindowsError - On error an exception is raised.

Reads the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• nSize (int) - Number of bytes to read.

Returns: str

Bytes read from the process memory. Returns an empty string on error.

Writes to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• lpBuffer (str) - Bytes to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a single unsigned integer from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Integer value read from the process memory. Returns zero on error.

Writes a single unsigned integer to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedDword (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a single pointer value from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Pointer value read from the process memory. Returns zero on error.

Writes a single pointer value to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• unpackedValue (int, long) - Value to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Reads a single character from the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.

Returns: int

Character read from the process memory. Returns zero on error.

Writes a single character to the memory of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin writing.
• char (str) - Character to write.

Returns: int

Number of bytes written. May be less than the number of bytes to write.

Tries to read an ASCII or Unicode string from the address space of the process.

Parameters:

• lpBaseAddress (int) - Memory address to begin reading.
• fUnicode (bool) - True is the string is expected to be Unicode, False if it's expected to be ANSI.
• dwMaxSize (int) - Maximum allowed string length to read, in bytes.

Returns: str, unicode

String read from the process memory space. It doesn't include the terminating null character. Returns an empty string on failure.

Allocates memory into the address space of the process.

Parameters:

• dwSize (int) - Number of bytes to allocate.
• lpAddress (int) - (Optional) Desired address for the newly allocated memory. This is only a hint, the memory could still be allocated somewhere else.

Returns: int

Address of the newly allocated memory.

Raises:

• WindowsError - On error an exception is raised.

Set memory protection in the address space of the process.

Parameters:

• lpAddress (int) - Address of memory to protect.
• dwSize (int) - Number of bytes to protect.
• flNewProtect (int) - New protect flags.

Returns: int

Old protect flags.

Raises:

• WindowsError - On error an exception is raised.

Query memory information from the address space of the process. Returns a win32.MemoryBasicInformation object.

Parameters:

• lpAddress (int) - Address of memory to query.

Returns: win32.MemoryBasicInformation

Memory region information.

Raises:

• WindowsError - On error an exception is raised.

Frees memory from the address space of the process.

Parameters:

• lpAddress (int) - Address of memory to free.
• dwSize (int) - (Optional) Number of bytes to free.

Raises:

• WindowsError - On error an exception is raised.

Determines if an address is a valid code or data pointer.

That is, the address must be valid and must point to code or data in the target process.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address is a valid code or data pointer.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address is a valid user mode address.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address is a valid user mode address.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a free page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a free page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a reserved page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a reserved page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a guard page.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a guard page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited and readable page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited and readable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited and writeable page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited and writeable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited, copy-on-write page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited, copy-on-write page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited and executable page. The page may or may not have additional permissions.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited and executable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if an address belongs to a commited, writeable and executable page. The page may or may not have additional permissions.

Looking for writeable and executable pages is important when exploiting a software vulnerability.

Parameters:

• address (int) - Memory address to query.

Returns: bool

True if the address belongs to a commited, writeable and executable page.

Raises:

• WindowsError - An exception is raised on error.

Determines if the given memory area is a valid code or data buffer.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is a valid code or data buffer, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is readable.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is readable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is writeable.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is writeable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is marked as copy-on-write.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is marked as copy-on-write, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is executable.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is executable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Determines if the given memory area is writeable and executable.

Looking for writeable and executable pages is important when exploiting a software vulnerability.

Parameters:

• address (int) - Memory address.
• size (int) - Number of bytes. Must be greater than zero.

Returns: bool

True if the memory area is writeable and executable, False otherwise.

Raises:

• ValueError - The size argument must be greater than zero.
• WindowsError - On error an exception is raised.

Produces a memory map to the process address space. Optionally restrict the map to the given address range.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: list( win32.MemoryBasicInformation )

List of memory region information objects.

Retrieves the filenames for memory mapped files in the debugee.

Parameters:

• memoryMap (list( win32.MemoryBasicInformation )) - (Optional) Memory map returned by get_memory_map. If not given, the current memory map is used.

Returns: dict( int → str )

Dictionary mapping memory addresses to file names. Native filenames are converted to Win32 filenames when possible.

Returns a generator that allows you to iterate through the memory contents of a process.

It's basically the same as the take_memory_snapshot method, but it takes the snapshot of each memory region as it goes, as opposed to taking the whole snapshot at once. This allows you to work with very large snapshots without a significant performance penalty.

Example:

   # Print the memory contents of a process.
   process.suspend()
   try:
       snapshot = process.generate_memory_snapshot()
       for mbi in snapshot:
           print HexDump.hexblock(mbi.content, mbi.BaseAddress)
   finally:
       process.resume()

The downside of this is the process must remain suspended while iterating the snapshot, otherwise strange things may happen.

The snapshot can be iterated more than once. Each time it's iterated the memory contents of the process will be fetched again.

You can also iterate the memory of a dead process, just as long as the last open handle to it hasn't been closed.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: generator of win32.MemoryBasicInformation

Generator that when iterated returns memory region information objects. Two extra properties are added to these objects:

• filename: Mapped filename, or None.
• content: Memory contents, or None.

Takes a snapshot of the memory contents of the process.

It's best if the process is suspended when taking the snapshot. Execution can be resumed afterwards.

You can also iterate the memory of a dead process, just as long as the last open handle to it hasn't been closed.

Parameters:

• minAddr (int) - (Optional) Starting address in address range to query.
• maxAddr (int) - (Optional) Ending address in address range to query.

Returns: list( win32.MemoryBasicInformation )

List of memory region information objects. Two extra properties are added to these objects:

• filename: Mapped filename, or None.
• content: Memory contents, or None.

Attempts to restore the memory state as it was when the given snapshot was taken.

Parameters:

• snapshot (list( win32.MemoryBasicInformation )) - Memory snapshot returned by take_memory_snapshot. Snapshots returned by generate_memory_snapshot don't work here.
• bSkipMappedFiles (bool) - True to avoid restoring the contents of memory mapped files, False otherwise. Use with care! Setting this to False can cause undesired side effects - changes to memory mapped files may be written to disk by the OS. Also note that most mapped files are typically executables and don't change, so trying to restore their contents is usually a waste of time.

Raises:

• WindowsError - An error occured while restoring the snapshot.
• RuntimeError - An error occured while restoring the snapshot.
• TypeError - A snapshot of the wrong type was passed.