Package: pdmemedit
Edit/read/observe memory with pymem and pandas DataFramespip install pdmemeditTested against Windows 10 / Python 3.10 / AnacondaWhy not use the best libraries for organizing Big Data to organize Big Data?# Here is an example# start a separate Python process and get the pidfromtimeimportsleepimportostu=(6666,77777554,"b1abvababubux",b"b1abvababubux","b1abvababubux".encode("utf-16-le"),)print(os.getpid())whileTrue:print(f"{tu=}\t{id(tu)=}")forvintu:print(f"{v=}\t{id(v)=}")sleep(5)# output:# tu=(6666, 77777554, 'b1abvababubux', b'b1abvababubux', b'b\x001\x00a\x00b\x00v\x00a\x00b\x00a\x00b\x00u\x00b\x00u\x00x\x00')	id(tu)=1784089644304# v=6666	id(v)=1784088602128# v=77777554	id(v)=1784088604816# v='b1abvababubux'	id(v)=1784089580144# v=b'b1abvababubux'	id(v)=1784089556480# v=b'b\x001\x00a\x00b\x00v\x00a\x00b\x00a\x00b\x00u\x00b\x00u\x00x\x00'	id(v)=1784089244720importpymemimportnumpyasnpfrompdmemeditimportPdmemory# pass either pid or filename, but not bothpdme=Pdmemory(pid=21956,filename=None# pid of the Python process we have just created)# memory to DataFramepdme.update_region_df(limitfunction=lambdax:True,dtypes=("S1",np.int8,np.uint8,np.int16,np.uint16,np.int32,np.uint32,np.int64,np.uint64,np.float32,np.float64,),allowed_protections=(pymem.ressources.structure.MEMORY_PROTECTION.PAGE_EXECUTE_READ,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_EXECUTE_READWRITE,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_EXECUTE_WRITECOPY,# pymem.ressources.structure.MEMORY_PROTECTION.PAGE_NOACCESS,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_READONLY,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_READWRITE,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_WRITECOPY,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_GUARD,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_NOCACHE,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_WRITECOMBINE,),)regiondf=pdme.get_regiondf()print(regiondf)#################################################################### Search for a string# Don't forget to get a memory dump by calling pdme.update_region_df before you search for a stringpdme.search_string("b1abvababubux")stringresultsdf=pdme.get_searchstringdf()print(stringresultsdf)#################################################################### Search for a number# Don't forget to get a memory dump by calling pdme.update_region_df before you search for a numberpdme.search_number(numexprquery=f"(a == 77777554)",# numexpr.evaluate string, name of 'a' can't be changeddtypes=(np.int8,np.uint8,np.int16,np.uint16,np.int32,np.uint32,np.int64,np.uint64,# np.float32,# np.float64,),)numberresults=pdme.get_searchnumberdf()print(numberresults)#################################################################### Call pdme.search_number first, edit the DataFrame (self.numbersearchdf) until it serves your needs# and call pdme.observe_numbers to see how the value changespdme.observe_numbers(# ctrl+c to breakkeepcondition="(new >= old)",# numexpr.evaluate string, names of 'new/old' can't be changedsleep_between_scans=1,savefolder=None,printoutputlimit=100,)observedvalues=pdme.get_observerdf()print(observedvalues)#################################################################### How to edit the memorynumberresults.ff_write.apply(lambdax:x(99999999))# Overwrites results with 99999999stringresultsdf.ff_write_str.apply(lambdax:x("B"))# binary/utf-8/utf-16-le... conversation should work automatically - overwrites each single letter# Output after calling numberresults.ff_write/stringresultsdf.ff_write_str# tu=(6666, 99999999, 'BBBBBBBBBBBBB', b'BBBBBBBBBBBBB', b'B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00')	id(tu)=1784089644304# v=6666	id(v)=1784088602128# v=99999999	id(v)=1784088604816# v='BBBBBBBBBBBBB'	id(v)=1784089580144# v=b'BBBBBBBBBBBBB'	id(v)=1784089556480# v=b'B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00B\x00'	id(v)=1784089244720#################################################################### Use this with care, and limit the area of interest as much as possible, this method might use a lot of memory and get really slow, since# it dumps the memory of the whole process and compares every single byte with the last memory dump.# You can stop recording by pressing Ctrl+Cpdme.record_all_changing_values(# might get very slow and use a lot of memorylimitfunc=lambdax:True,dtype=np.uint32,allowed_protections=(pymem.ressources.structure.MEMORY_PROTECTION.PAGE_EXECUTE_READ,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_EXECUTE_READWRITE,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_READWRITE,pymem.ressources.structure.MEMORY_PROTECTION.PAGE_READONLY,),)pdme.get_differencesdf()