>>> from ctypes import *
>>> user32 = windll.LoadLibrary('user32.dll')    # 加载动态链接库
>>> user32.MessageBoxA(0, 'Ctypes is cool!', 'Ctypes', 0)
# 调用MessageBoxA函数

ctypes数据类型

C数据类型

ctypes数据类型

C数据类型

c_char

char

c_float

float

c_short

short

c_double

double

c_int

int

c_void_p

void *

c_long

long

typedef struct _PROCESS_INFORMATION {
HANDLE hProcess;
HANDLE hThread;
DWORD dwProcessId;
DWORD dwThreadId;
} PROCESS_INFORMATION,
*LPPROCESS_INFORMATION;
在Python中由ctypes实现。
class _PROCESS_INFORMATION(Structure):
_fields_ = [('hProcess', c_void_p),
('hThread', c_void_p),
('dwProcessId', c_ulong),
('dwThreadId', c_ulong)]

   BOOL WriteProcessMemory(
HANDLE  hProcess,
LPVOID  lpBaseAddress,
LPCVOID lpBuffer,
SIZE_T  nSize,
SIZE_T*  lpNumberOfBytesWritten
);

    /*  ModifyMe.c */
#include
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
LPSTR lpCmdLine, int nCmdShow)
{
int a = 0;
int b = 1;
if ( a != b )  /* 此处即需要编写Python脚本修改的地方 */
{
MessageBox(NULL, "Bad Python", "Python", MB_OK);
}
else
{
MessageBox(NULL, "Good Python", "Python", MB_OK);
}
}

    7:        if ( a != b )
00401036   mov         eax,dword ptr [ebp-4]
00401039   cmp         eax,dword ptr [ebp-8]
0040103C   je          WinMain+4Dh (0040105d)

   #  -*- coding:utf-8 -*-
#  file: ModifyMemory.py
#
from ctypes import *
# 定义_PROCESS_INFORMATION结构体
class _PROCESS_INFORMATION(Structure):
_fields_ = [('hProcess', c_void_p),
('hThread', c_void_p),
('dwProcessId', c_ulong),
('dwThreadId', c_ulong)]
# 定义_STARTUPINFO结构体
class _STARTUPINFO(Structure):
_fields_ = [('cb',c_ulong),
('lpReserved', c_char_p),
('lpDesktop', c_char_p),
('lpTitle', c_char_p),
('dwX', c_ulong),
('dwY', c_ulong),
('dwXSize', c_ulong),
('dwYSize', c_ulong),
('dwXCountChars', c_ulong),
('dwYCountChars', c_ulong),
('dwFillAttribute', c_ulong),
('dwFlags', c_ulong),
('wShowWindow', c_ushort),
('cbReserved2', c_ushort),
('lpReserved2', c_char_p),
('hStdInput', c_ulong),
('hStdOutput', c_ulong),
('hStdError', c_ulong)]
NORMAL_PRIORITY_CLASS = 0x00000020     # 定义NORMAL_PRIORITY_CLASS
kernel32 = windll.LoadLibrary("kernel32.dll")  # 加载kernel32.dll
CreateProcess = kernel32.CreateProcessA   # 获得CreateProcess函数地址
ReadProcessMemory = kernel32.ReadProcessMemory
# 获得ReadProcessMemory函数地址
WriteProcessMemory = kernel32.WriteProcessMemory
# 获得WriteProcessMemory函数地址
TerminateProcess = kernel32.TerminateProcess
# 声明结构体
ProcessInfo = _PROCESS_INFORMATION()
StartupInfo = _STARTUPINFO()
file = 'ModifyMe.exe'       # 要进行修改的文件
address = 0x0040103c        # 要修改的内存地址
buffer = c_char_p("_")        # 缓冲区地址
bytesRead = c_ulong(0)       # 读入的字节数
bufferSize =  len(buffer.value)     # 缓冲区大小
# 创建进程
if CreateProcess(file, 0, 0, 0, 0, NORMAL_PRIORITY_CLASS,
0, 0, byref(StartupInfo), byref(ProcessInfo)):
# 读取要修改的内存地址，以判断是否是要修改的文件
if ReadProcessMemory(ProcessInfo.hProcess, address, buffer,
bufferSize, byref(bytesRead)):
if buffer.value == '\x74':
buffer.value = '\x75'     # 修改缓冲区内的值，将其写入内存
# 修改内存
if WriteProcessMemory(ProcessInfo.hProcess, address,
buffer, bufferSize, byref(bytesRead)):
print '成功改写内存!'
else:
print '写内存错误!'
else:
print '打开了错误的文件!'
TerminateProcess(ProcessInfo.hProcess,0)
# 如果不是要修改的文件，则终止进程
else:
print '读内存错误!'
else:
print '不能创建进程!'