问题

我正在尝试获取Windows（64位）进程的基址，使用Python3，假设已知PID。
我查看了这里所有关于堆栈的问题，但解决方案都已经过时/不起作用。

我假设在一个名为pid的变量中有进程的PID。

我尝试过的众多代码片段之一是

PROCESS_ALL_ACCESS = 0x1F0FFF
processHandle = win32api.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
modules = win32process.EnumProcessModules(processHandle)
fileName = win32process.GetModuleFileNameEx(processHandle, modules[0])
base_address = win32api.GetModuleHandle(fileName)
processHandle.close()

但我在GetModuleHandle上遇到错误：“无法找到指定的模块”。

感谢您的帮助。

英文:

I am trying to get the base-address of a process in Windows (64-bit), with Python3, assuming to know the PID.
I looked over all questions here on stack, but the solutions are old/not working.

I assume to have the PID of the process in a variable called pid.

One of the many pieces of code I tried is

PROCESS_ALL_ACCESS = 0x1F0FFF
processHandle = win32api.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
modules = win32process.EnumProcessModules(processHandle)
fileName = win32process.GetModuleFileNameEx(processHandle, modules[0])
base_address = win32api.GetModuleHandle(fileName)
processHandle.close()

But I get error on GetModuleHandle: 'Impossible to find the specified module'.

Thank you for the help.

答案1

得分: 3

根据[MS.Docs]: GetModuleHandleW函数（链接：https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlew）（强调由我添加）：

检索指定模块的模块句柄。模块必须由调用进程加载。

这意味着它对当前进程可以正常工作，但对于任何其他进程，您将获得未定义行为，因为您尝试检索：

其他进程的*.dll*（或*.exe*）名称（GetModuleFileNameEx调用）
在当前进程中的名称的句柄（如果已加载）（GetModuleHandle调用），这是没有意义的。

~~虽然在这个主题上没有明确的文档（或者至少我找不到任何文档）~~，句柄就是基地址。这也是您依赖的原则（调用GetModuleHandle），但您可以直接使用EnumProcessModules返回的值（查看下面的示例，这些值相同）。

如果您想要严格一些，您可以使用[MS.Docs]: GetModuleInformation函数（链接：https://learn.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getmoduleinformation）。不幸的是，这个函数没有被PyWin32导出，一个替代方法是使用[Python 3.Docs]: ctypes - 用于Python的外部函数库（链接：https://docs.python.org/3/library/ctypes.html#module-ctypes）。

code00.py：

#!/usr/bin/env python3

import sys
import win32api as wapi
import win32process as wproc
import win32con as wcon
import ctypes as ct
from ctypes import wintypes as wt
import traceback as tb

class MODULEINFO(ct.Structure):
    _fields_ = [
        ("lpBaseOfDll", ct.c_void_p),
        ("SizeOfImage", wt.DWORD),
        ("EntryPoint", ct.c_void_p),
    ]

get_module_information_func_name = "GetModuleInformation"
GetModuleInformation = getattr(ct.WinDLL("kernel32"), get_module_information_func_name, getattr(ct.WinDLL("psapi"), get_module_information_func_name))
GetModuleInformation.argtypes = [wt.HANDLE, wt.HMODULE, ct.POINTER(MODULEINFO)]
GetModuleInformation.restype = wt.BOOL

def get_base_address_original(process_handle, module_handle):
    module_file_name = wproc.GetModuleFileNameEx(process_handle, module_handle)
    print("    File for module {0:d}: {1:s}".format(module_handle, module_file_name))
    module_base_address = wapi.GetModuleHandle(module_file_name)
    return module_base_address

def get_base_address_new(process_handle, module_handle):
    module_info = MODULEINFO()
    res = GetModuleInformation(process_handle.handle, module_handle, ct.byref(module_info))
    print("    Result: {0:}, Base: {1:d}, Size: {2:d}".format(res, module_info.lpBaseOfDll, module_info.SizeOfImage))
    if not res:
        print("    {0:s} failed: {1:d}".format(get_module_information_func_name, getattr(ct.WinDLL("kernel32"), "GetLastError")()))
    return module_info.lpBaseOfDll

def main(*argv):
    pid = int(argv[0]) if argv and argv[0].isdecimal() else wapi.GetCurrentProcessId()
    print("Working on pid {0:d}".format(pid))
    process_handle = wapi.OpenProcess(wcon.PROCESS_ALL_ACCESS, False, pid)
    print("Process handle: {0:d}".format(process_handle.handle))
    module_handles = wproc.EnumProcessModules(process_handle)
    print("Loaded modules: {0:}".format(module_handles))
    module_index = 0  # 0 - the executable itself
    module_handle = module_handles[module_index]
    get_base_address_funcs = [
        #get_base_address_original,  # Original behavior moved in a function
        get_base_address_new,
    ]
    for get_base_address in get_base_address_funcs:
        print("\nAttempting {0:s}".format(get_base_address.__name__))
        try:
            module_base_address = get_base_address(process_handle, module_handle)
            print("    Base address: 0x{0:016X} ({1:d})".format(module_base_address, module_base_address))
        except:
            tb.print_exc()
    process_handle.close()

if __name__ == "__main__":
    print("Python {0:s} {1:d}bit on {2:s}\n".format(" ".join(item.strip() for item in sys.version.split("\n")), 64 if sys.maxsize > 0x100000000 else 32, sys.platform))
    main(*sys.argv[1:])
    print("\nDone.")

输出：

>     e:\Work\Dev\StackOverflow\q059610466>"e:\Work\Dev\VEnvs\py_pc064_03.07.06_test0\Scripts\python.exe" code00.py
Python 3.7.6 (tags/v3.7.6:43364a7ae0, Dec 19 2019, 00:42:30) [MSC v.1916 64 bit (AMD64)] 64bit on win32
>     Working on pid 59608
Process handle: 452
Loaded modules: (140696816713728, 140714582343680, 140714572513280, 140714535354368, 140714547544064, 140713592946688, 140714443341824, 140714557898752, 140714556325888, 140714550362112, 140714414964736, 140714562486272, 140714532798464, 140714555473920, 140714548592640, 140714533322752, 140714531946496, 140714553769984, 140714555670528, 140714558750720, 140714581426176, 140714556129280, 140714546036736, 140714518052864, 140714532601856, 140714524737536, 140714210361344, 1797128192, 140714574151680, 140714535026688, 140714557046784, 140714538172416, 140714531291136, 140714530963456, 140714530766848, 140714530832384, 1796931584, 140714561044480, 140714573299712, 140714215014400, 140714529849344, 1798438912, 140714
<details>
<summary>英文:</summary>
According to [\[MS.Docs\]: GetModuleHandleW function](https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlew) (**emphasis** is mine):
&gt; Retrieves a module handle for the specified module. **The module must have been loaded by the calling process**.
That means that it will work fine for the current process, but for any other one you&#39;d get *Undefined Behavior*, because you try retrieving:
1. The *.dll* (or *.exe*) name from the other process (*GetModuleFileNameEx* call)
2. The handle for the name at previous step (*GetModuleHandle* call) **but in the current process** (if loaded), which makes no sense
&lt;s&gt;Although there&#39;s no clear documentation on this topic (or at least I couldn&#39;t find any)&lt;/s&gt;, the handle **is** the base address. This is a principle that you also rely on (calling *GetModuleHandle*), but you can use the values returned by *EnumProcessModules* directly (look at the example below, the values are the same).
If you want to be rigorous, you could use [\[MS.Docs\]: GetModuleInformation function](https://learn.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getmoduleinformation). Unfortunately, that&#39;s not exported by *PyWin32*, and an alternative is using [\[Python 3.Docs\]: ctypes - A foreign function library for Python](https://docs.python.org/3/library/ctypes.html#module-ctypes).
*code00.py*:
&lt;!-- language: python --&gt;
#!/usr/bin/env python3
import sys
import win32api as wapi
import win32process as wproc
import win32con as wcon
import ctypes as ct
from ctypes import wintypes as wt
import traceback as tb
class MODULEINFO(ct.Structure):
_fields_ = [
(&quot;lpBaseOfDll&quot;, ct.c_void_p),
(&quot;SizeOfImage&quot;, wt.DWORD),
(&quot;EntryPoint&quot;, ct.c_void_p),
]
get_module_information_func_name = &quot;GetModuleInformation&quot;
GetModuleInformation = getattr(ct.WinDLL(&quot;kernel32&quot;), get_module_information_func_name, getattr(ct.WinDLL(&quot;psapi&quot;), get_module_information_func_name))
GetModuleInformation.argtypes = [wt.HANDLE, wt.HMODULE, ct.POINTER(MODULEINFO)]
GetModuleInformation.restype = wt.BOOL
def get_base_address_original(process_handle, module_handle):
module_file_name = wproc.GetModuleFileNameEx(process_handle, module_handle)
print(&quot;    File for module {0:d}: {1:s}&quot;.format(module_handle, module_file_name))
module_base_address = wapi.GetModuleHandle(module_file_name)
return module_base_address
def get_base_address_new(process_handle, module_handle):
module_info = MODULEINFO()
res = GetModuleInformation(process_handle.handle, module_handle, ct.byref(module_info))
print(&quot;    Result: {0:}, Base: {1:d}, Size: {2:d}&quot;.format(res, module_info.lpBaseOfDll, module_info.SizeOfImage))
if not res:
print(&quot;    {0:s} failed: {1:d}&quot;.format(get_module_information_func_name, getattr(ct.WinDLL(&quot;kernel32&quot;), &quot;GetLastError&quot;)()))
return module_info.lpBaseOfDll
def main(*argv):
pid = int(argv[0]) if argv and argv[0].isdecimal() else wapi.GetCurrentProcessId()
print(&quot;Working on pid {0:d}&quot;.format(pid))
process_handle = wapi.OpenProcess(wcon.PROCESS_ALL_ACCESS, False, pid)
print(&quot;Process handle: {0:d}&quot;.format(process_handle.handle))
module_handles = wproc.EnumProcessModules(process_handle)
print(&quot;Loaded modules: {0:}&quot;.format(module_handles))
module_index = 0  # 0 - the executable itself
module_handle = module_handles[module_index]
get_base_address_funcs = [
#get_base_address_original,  # Original behavior moved in a function
get_base_address_new,
]
for get_base_address in get_base_address_funcs:
print(&quot;\nAttempting {0:s}&quot;.format(get_base_address.__name__))
try:
module_base_address = get_base_address(process_handle, module_handle)
print(&quot;    Base address: 0x{0:016X} ({1:d})&quot;.format(module_base_address, module_base_address))
except:
tb.print_exc()
process_handle.close()
#input(&quot;\nPress ENTER to exit&gt; &quot;)
if __name__ == &quot;__main__&quot;:
print(&quot;Python {0:s} {1:d}bit on {2:s}\n&quot;.format(&quot; &quot;.join(item.strip() for item in sys.version.split(&quot;\n&quot;)), 64 if sys.maxsize &gt; 0x100000000 else 32, sys.platform))
main(*sys.argv[1:])
print(&quot;\nDone.&quot;)
**Output**:
&lt;!-- language-all: lang-bat --&gt;
&gt;     e:\Work\Dev\StackOverflow\q059610466&gt;&quot;e:\Work\Dev\VEnvs\py_pc064_03.07.06_test0\Scripts\python.exe&quot; code00.py
Python 3.7.6 (tags/v3.7.6:43364a7ae0, Dec 19 2019, 00:42:30) [MSC v.1916 64 bit (AMD64)] 64bit on win32
&gt;     Working on pid 59608
Process handle: 452
Loaded modules: (140696816713728, 140714582343680, 140714572513280, 140714535354368, 140714547544064, 140713592946688, 140714443341824, 140714557898752, 140714556325888, 140714550362112, 140714414964736, 140714562486272, 140714532798464, 140714555473920, 140714548592640, 140714533322752, 140714531946496, 140714553769984, 140714555670528, 140714558750720, 140714581426176, 140714556129280, 140714546036736, 140714518052864, 140714532601856, 140714524737536, 140714210361344, 1797128192, 140714574151680, 140714535026688, 140714557046784, 140714538172416, 140714531291136, 140714530963456, 140714530766848, 140714530832384, 1796931584, 140714561044480, 140714573299712, 140714215014400, 140714529849344, 1798438912, 140714559995904, 140714167042048)
&gt;     Attempting get_base_address_new
Result: 1, Base: 140696816713728, Size: 110592
Base address: 0x00007FF687C80000 (140696816713728)
&gt;     Done.
&gt;     e:\Work\Dev\StackOverflow\q059610466&gt;:: Attempting to run with Task Manager pid
e:\Work\Dev\StackOverflow\q059610466&gt;&quot;e:\Work\Dev\VEnvs\py_pc064_03.07.06_test0\Scripts\python.exe&quot; code00.py 22784
Python 3.7.6 (tags/v3.7.6:43364a7ae0, Dec 19 2019, 00:42:30) [MSC v.1916 64 bit (AMD64)] 64bit on win32
&gt;     Working on pid 22784
Process handle: 480
Loaded modules: (140699900903424, 140714582343680, 140714572513280, 140714535354368, 140714547544064, 140714573299712, 140714531946496, 140714550362112, 140714562486272, 140714532798464, 140714530963456, 140714530766848, 140714556981248, 140714557898752, 140714556325888, 140714555473920, 140714365222912, 140714548592640, 140714496753664, 140714533322752, 140714553769984, 140714574151680, 140714535026688, 140714557046784, 140714538172416, 140714581426176, 140714558750720, 140714531291136, 140714530832384, 140714546036736, 140714444521472, 140714567467008, 140714532601856, 140714468966400, 140714452385792, 140714267115520, 140714510843904, 140714478731264, 140713698263040, 140714510254080, 140714556129280, 140714565435392, 140714110091264, 140714491379712, 140714455007232, 140714514382848, 140714459529216, 140714281140224, 140714370859008, 140714471260160, 140714566746112, 140713839362048, 140714555670528, 140714171695104, 140714508615680, 140714514841600, 140714029154304, 140714036625408, 140714329636864, 140714447011840, 140714434691072, 140714470866944, 140714561044480, 140714520870912, 140714469883904, 140714494787584, 140714293592064, 140713999335424, 140714400743424, 140714497605632, 140714502193152, 140714197254144, 140714415030272, 140714035576832, 140714065854464, 140714513006592, 140714529652736, 140714512809984, 140714495049728, 140714038657024, 140714371448832, 140714421911552, 140714325966848, 140714196074496, 140714057924608, 140714058317824, 140714064281600, 140714058121216, 140714519756800, 140714327539712, 140714311614464, 140714501079040, 140714546167808, 140714531422208, 140714531553280, 140714557767680, 140714518052864, 140714524737536, 140714167631872, 140714528669696, 140714331865088, 140714310369280, 140714310238208, 140714520018944, 140714458939392, 2018133999616, 140714401988608, 2018141863936, 140714514644992, 140714454810624, 140714294640640)
&gt;     Attempting get_base_address_new
Result: 1, Base: 140699900903424, Size: 1105920
Base address: 0x00007FF73F9D0000 (140699900903424)
&gt;     Done.
&lt;br&gt;
---
###Update *#0*
According to [\[MS.Docs\]: MODULEINFO structure](https://learn.microsoft.com/en-us/windows/win32/api/psapi/ns-psapi-moduleinfo) (**Remarks** section, **emphasis** still mine):
&gt; **The load address of a module is the same as the *HMODULE* value.**
So, things seem to be pretty straightforward.
*code01.py*:
&lt;!-- language: python --&gt;
#!/usr/bin/env python3
import sys
import win32api as wapi
import win32process as wproc
import win32con as wcon
def main(*argv):
pid = int(argv[0]) if argv and argv[0].isdecimal() else wapi.GetCurrentProcessId()
print(&quot;Working on pid {0:d}&quot;.format(pid))
process_handle = wapi.OpenProcess(wcon.PROCESS_ALL_ACCESS, False, pid)
print(&quot;  Process handle: {0:d}&quot;.format(process_handle.handle))
module_handles = wproc.EnumProcessModules(process_handle)
module_handles_count = len(module_handles)
print(&quot;  Loaded modules count: {0:d}&quot;.format(module_handles_count))
module_index = 0  # 0 - the executable itself
if module_index &gt; module_handles_count:
module_index = 0
module_handle = module_handles[module_index]
module_file_name = wproc.GetModuleFileNameEx(process_handle, module_handle)
print(&quot;  File [{0:s}] (index {1:d}) is loaded at address 0x{2:016X} ({3:d})&quot;.format(module_file_name, module_index, module_handle, module_handle))
process_handle.close()
if __name__ == &quot;__main__&quot;:
print(&quot;Python {0:s} {1:d}bit on {2:s}\n&quot;.format(&quot; &quot;.join(item.strip() for item in sys.version.split(&quot;\n&quot;)), 64 if sys.maxsize &gt; 0x100000000 else 32, sys.platform))
main(*sys.argv[1:])
print(&quot;\nDone.&quot;)
**Output**:
&gt;     e:\Work\Dev\StackOverflow\q059610466&gt;&quot;e:\Work\Dev\VEnvs\py_pc064_03.07.06_test0\Scripts\python.exe&quot; code01.py
Python 3.7.6 (tags/v3.7.6:43364a7ae0, Dec 19 2019, 00:42:30) [MSC v.1916 64 bit (AMD64)] 64bit on win32
&gt;     Working on pid 7184
Process handle: 456
Loaded modules count: 43
File [e:\Work\Dev\VEnvs\py_pc064_03.07.06_test0\Scripts\python.exe] (index 0) is loaded at address 0x00007FF687C80000 (140696816713728)
&gt;     Done.
&gt;     e:\Work\Dev\StackOverflow\q059610466&gt;:: Attempting to run with Task Manager pid
e:\Work\Dev\StackOverflow\q059610466&gt;&quot;e:\Work\Dev\VEnvs\py_pc064_03.07.06_test0\Scripts\python.exe&quot; code01.py 22784
Python 3.7.6 (tags/v3.7.6:43364a7ae0, Dec 19 2019, 00:42:30) [MSC v.1916 64 bit (AMD64)] 64bit on win32
&gt;     Working on pid 22784
Process handle: 624
Loaded modules count: 111
File [C:\WINDOWS\system32\taskmgr.exe] (index 0) is loaded at address 0x00007FF73F9D0000 (140699900903424)
&gt;     Done.
</details>

通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。

Python3获取进程的基址地址从PID

问题

答案1

如何在Golang中运行外部的Python脚本？

如何在地图上绘制一个矩形网格？

Nextcord (discord.py分支) – 如何告诉Discord当前正在运行的命令？

如何处理在snakemake中共享某些输入数据的工作流？

What's the correct way to type hint an empty list as a literal in python?

如何在Highcharts Gantt中更改本地化的星期名称

如何在同一个流中使用多个过滤器和映射函数？

如何使用Map/Set来将代码优化到O(n)？

.NET MAUI Android在GitHub Actions上构建失败，错误代码为1。

如何在Playwright视觉比较中屏蔽多个定位器？

在C++中，可以使用可变模板参数来检索类型的内部类型。

selenium.common.exceptions.StaleElementReferenceException: Message: stale element reference: stale element not found

Creating and opening a URL to log in to Website via Basic Auth with Robot Framework/Selenium (Python)

AG Grid 在上下文菜单中以大文本形式打开

发表评论