python读取某进程内存数据_python中的ReadProcessMemory出现问题，无法读取64位进程内存...

I'm getting error code 998 (ERROR_NOACCESS) when using ReadProcessMemory to read the memory of a 64bit process (Minesweeper). I'm using python 3.5 64bit on windows 7 64bit.

The strange thing is, this error only happens with addresses that are higher up, like for example 0x 0000 0000 FF3E 0000. Lower addresses, like 0x 0000 0000 0012 AE40 don't throw an error and return correct Minesweeper data.

When I write the same program using nearly identical code in C#.NET and look at the same addresses, it works and I don't get an error!

I know the address I'm looking at is correct because I can see it with Cheat Engine and VMMap. I don't know if it's relevant, but the higher address I'm looking at is the base module address of the MineSweeper.exe module in Minesweeper.

Why is the python code not working?

Python code (throws error for higher addresses but works for lower):

import ctypes, struct

pid = 3484 # Minesweeper

processHandle = ctypes.windll.kernel32.OpenProcess(0x10, False, pid)

addr = 0x00000000FF3E0000 # Minesweeper.exe module base address

buffer = (ctypes.c_byte * 8)()

bytesRead = ctypes.c_ulonglong(0)

result = ctypes.windll.kernel32.ReadProcessMemory(processHandle, addr, buffer, len(buffer), ctypes.byref(bytesRead))

e = ctypes.windll.kernel32.GetLastError()

print('result: ' + str(result) + ', err code: ' + str(e))

print('data: ' + str(struct.unpack('Q', buffer)[0]))

ctypes.windll.kernel32.CloseHandle(processHandle)

# Output:

# result: 0, err code: 998

# data: 0

C#.NET code (64bit project, no errors):

[DllImport("kernel32.dll")]

static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

[DllImport("kernel32.dll")]

static extern Int32 ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, [Out] byte[] buffer, UInt32 size, out IntPtr lpNumberOfBytesRead);

[DllImport("kernel32.dll")]

static extern bool CloseHandle(IntPtr hObject);

static void Main(string[] args)

{

var pid = 3484; // Minesweeper

var processHandle = OpenProcess(0x10, false, pid);

var addr = 0x00000000FF3E0000; // Minesweeper.exe module base address

var buffer = new byte[8];

IntPtr bytesRead;

var result = ReadProcessMemory(processHandle, new IntPtr(addr), buffer, (uint)buffer.Length, out bytesRead);

Console.WriteLine("result: " + result);

Console.WriteLine("data: " + BitConverter.ToInt64(buffer, 0).ToString());

CloseHandle(processHandle);

Console.ReadLine();

}

// Output:

// result: 1

// data: 12894362189

解决方案

See eryksun's comment, it fixed my problem! Changed 'addr' to 'ctypes.c_void_p(addr)' in the ReadProcessMemory call.