JeanExtreme002 / PyMemoryEditor

:floppy_disk: Multi-platform library developed with ctypes for reading, writing and searching process memory, in a simple and friendly way with Python 3. The package supports Windows and Linux (32-bit and 64-bit).
https://pypi.org/project/PyMemoryEditor/
MIT License
56 stars 10 forks source link

Freeze script in search_by_value function #5

Closed GermanAizek closed 7 months ago

GermanAizek commented 7 months ago

@JeanExtreme002, crackme.exe is Unreal Engine 5 application

try:
  with OpenProcess(process_name = "crackme.exe") as p:
    for addr in p.search_by_value(str, len(target), target, ScanTypesEnum.EXACT_VALUE):
        value = p.read_process_memory(addr, str, len(target))

        new = value.replace(target, replacet)

        print("Found at: 0x{0} {1} {2} {3}".format(str(addr), value, "->", new))

        size = len(target)

        p.write_process_memory(addr, str, size, new)
except Exception as e:
    print(e)
Traceback (most recent call last):
  File "C:\Users\NUMAiei\Downloads\WindowsNoEditor\Binaries\Win64\crack.py", line 33, in <module>
    replace(p, sqlt, rsqlt)
  File "C:\Users\NUMAiei\Downloads\WindowsNoEditor\Binaries\Win64\crack.py", line 8, in replace
    for addr in p.search_by_value(str, len(target), target, ScanTypesEnum.EXACT_VALUE):
  File "C:\Python312\Lib\site-packages\PyMemoryEditor\win32\functions.py", line 199, in SearchAddressesByValue
    for offset in searching_method(region_data, size, target_value_bytes, bufflength, scan_type, pytype is str):
  File "C:\Python312\Lib\site-packages\PyMemoryEditor\util\scan.py", line 27, in scan_memory_for_exact_value
    for found_index in searcher.search(memory_region_data, memory_region_data_size):
  File "C:\Python312\Lib\site-packages\PyMemoryEditor\util\search\kmp.py", line 45, in search
    if offset == self.__pattern_length:
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyboardInterrupt

CrySearch GUI working is great. I think I understand why this is so, he uses other WinAPI methods to bypass antiVMA (virtual memory access)

GermanAizek commented 7 months ago

@JeanExtreme002, does it make sense to add bypass methods in library, or should everyone do it themselves?

GermanAizek commented 7 months ago

@JeanExtreme002, I found out that you do not have function VirtualProtectEx for reading and writing proc mem

https://www.unknowncheats.me/forum/c-/398218-readprocessmemory-access_denied.html