使用ctypes模塊調用WriteProcessMemory函數，在創建程序進程後，就可以修改該程序指定內存地址。WriteProcessMemory的函數原型如下所示。
BOOL WriteProcessMemory(
HANDLE hProcess,
LPVOID lpBaseAddress,
LPCVOID lpBuffer,
SIZE_T nSize,
SIZE_T* ? lpNumberOfBytesWritten
);
其參數含義如下。
· hProcess：要寫內存的進程句柄。
· lpBaseAddress：要寫的內存起始地址。
· lpBuffer：寫入值的地址。
· nSize：寫入值的大小。
· lpNumberOfBytesWritten? ：實際寫入的大小。
python代碼示例如下：
from?ctypes?import?*#?定義_PROCESS_INFORMATION結構體
class?_PROCESS_INFORMATION(Structure):?
_fields_?=?[('hProcess',?c_void_p),
('hThread',?c_void_p), ('dwProcessId',?c_ulong), ('dwThreadId',?c_ulong)]#?定義_STARTUPINFO結構體
class?_STARTUPINFO(Structure):
_fields_?=?[('cb',c_ulong),
('lpReserved',?c_char_p), ('lpDesktop',?c_char_p), ('lpTitle',?c_char_p), ('dwX',?c_ulong), ('dwY',?c_ulong), ('dwXSize',?c_ulong), ('dwYSize',?c_ulong), ('dwXCountChars',?c_ulong), ('dwYCountChars',?c_ulong), ('dwFillAttribute',?c_ulong), ('dwFlags',?c_ulong), ('wShowWindow',?c_ushort), ('cbReserved2',?c_ushort), ('lpReserved2',?c_char_p), ('hStdInput',?c_ulong), ('hStdOutput',?c_ulong), ('hStdError',?c_ulong)]NORMAL_PRIORITY_CLASS?=?0x00000020?#?定義NORMAL_PRIORITY_CLASS
kernel32?=?windll.LoadLibrary("kernel32.dll")#?加載kernel32.dll
CreateProcess?=?kernel32.CreateProcessA?#?獲得CreateProcess函數地址
ReadProcessMemory?=?kernel32.ReadProcessMemory?#?獲得ReadProcessMemory函數地址
WriteProcessMemory?=?kernel32.WriteProcessMemory#?獲得WriteProcessMemory函數地址
TerminateProcess?=?kernel32.TerminateProcess
#?聲明結構體
ProcessInfo?=?_PROCESS_INFORMATION()
StartupInfo?=?_STARTUPINFO()
file?=?'ModifyMe.exe'#?要進行修改的文件
address?=?0x0040103c#?要修改的內存地址
buffer?=?c_char_p("_")?#?緩沖區地址
bytesRead?=?c_ulong(0)?#?讀入的字節數
bufferSize?=?len(buffer.value)?#?緩沖區大小
#?創建進程
if?CreateProcess(file,?0,?0,?0,?0,?NORMAL_PRIORITY_CLASS,?0,?0,?byref(StartupInfo),?byref(ProcessInfo)):
#?讀取要修改的內存地址，以判斷是否是要修改的文件
if?ReadProcessMemory(ProcessInfo.hProcess,?address,?buffer,?bufferSize,?byref(bytesRead)):
if?buffer.value?==?'\x74':
buffer.value?=?'\x75'?#?修改緩沖區內的值，將其寫入內存
#?修改內存
if?WriteProcessMemory(ProcessInfo.hProcess,?address,?buffer,?bufferSize,?byref(bytesRead)):
print?'成功改寫內存!'
else:
print?'寫內存錯誤!'
else:
print?'打開了錯誤的文件!'
TerminateProcess(ProcessInfo.hProcess,0)#?如果不是要修改的文件，則終止進程else:
print?'讀內存錯誤!'
else:
print?'不能創建進程!'