def get_modules(self): modules = {} for hModule in win32process.EnumProcessModulesEx( self.proc_handler, win32process.LIST_MODULES_ALL): modulepath = win32process.GetModuleFileNameEx( self.proc_handler, hModule) modules[modulepath.split('\\')[-1]] = hModule return modules
def pc_address_func(hook, process_handle, address: Address, version: str): if hook.base_cache is None: module_handles = win32process.EnumProcessModulesEx( process_handle, 0x03) for module_handle in sorted(module_handles): filename = win32process.GetModuleFileNameEx( process_handle, module_handle) if filename.lower().endswith("ff7_en.exe"): hook.base_cache = module_handle return hook.base_cache + address.pc_address
def __get_process_modules(self, hProcess): imagepath = win32process.GetModuleFileNameEx(hProcess, None) imagepath_upper = imagepath.upper() modules = [] for hModule in win32process.EnumProcessModulesEx(hProcess, win32process.LIST_MODULES_ALL): modulepath = win32process.GetModuleFileNameEx(hProcess, hModule) if modulepath.upper() != imagepath_upper: modules.append(modulepath) return imagepath, sorted(modules)
def openProcess(self, procName): pids = win32pdhutil.FindPerformanceAttributesByName( procName, None, None, win32pdh.PDH_FMT_LONG, None, True) print(pids) if len(pids) == 0: print("fail") return False elif len(pids) > 0: self.PID = pids[0] self.procHandle = self.kernel32.OpenProcess( privileges['PROCESS_ALL_ACCESS'], False, self.PID) self.baseAddr = win32process.EnumProcessModulesEx( self.procHandle)[0] return True
def get_loaded_modules(proc): global LOADED_MODULES, OFFSETS dlls = win32process.EnumProcessModulesEx(proc, 0x03) for dll in dlls: data = MODULEINFO() psapi.GetModuleInformation(proc, dll, data, sizeof(data)) name = win32process.GetModuleFileNameEx(proc, dll) print('%s -> 0x%x' % (name, data.lpBaseOfDll)) LOADED_MODULES.append([name, data.lpBaseOfDll]) print('Loaded modules:', len(LOADED_MODULES))
def bizhawk_address_func(hook, process_handle, address: Address, version: str): if hook.base_cache is None: module_handles = win32process.EnumProcessModulesEx( process_handle, 0x03) for module_handle in sorted(module_handles): filename = win32process.GetModuleFileNameEx( process_handle, module_handle) if filename.lower().endswith("octoshock.dll"): if version in _BIZHAWK_ADDRESS_MAP: hook.base_cache = module_handle + _BIZHAWK_ADDRESS_MAP[ version] else: raise NotImplementedError( "BizHawk version not implemented: " + version) if hook.base_cache is None: raise Exception("asdf") return hook.base_cache + address.psx_address
def psxfin_address_func(hook, process_handle, address: Address, version: str): a = address.psx_address if hook.base_cache is None: module_handles = win32process.EnumProcessModulesEx( process_handle, 0x03) for module_handle in sorted(module_handles): filename = win32process.GetModuleFileNameEx( process_handle, module_handle) if filename.endswith("psxfin.exe"): base1 = module_handle + 0x1899BC base2 = int.from_bytes(win32process.ReadProcessMemory( process_handle, base1, 4), byteorder='little') + 0x30 hook.base_cache = int.from_bytes( win32process.ReadProcessMemory(process_handle, base2, 4), byteorder='little') break return hook.base_cache + address.psx_address
def EnumModules(self, Handle): return win32process.EnumProcessModulesEx(Handle, 3)