List and edit in-memory sounds in soundbanks

ackit/verify/debugger.py

@@ -61,6 +61,43 @@ def read_mem(pid, addr, n):
         k32.CloseHandle(h)
 
 
+class _MBI(ctypes.Structure):
+    _fields_ = [("BaseAddress", ctypes.c_void_p), ("AllocationBase", ctypes.c_void_p),
+                ("AllocationProtect", wt.DWORD), ("RegionSize", ctypes.c_size_t), ("State", wt.DWORD),
+                ("Protect", wt.DWORD), ("Type", wt.DWORD)]
+
+
+k32.VirtualQueryEx.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.POINTER(_MBI), ctypes.c_size_t]
+k32.VirtualQueryEx.restype = ctypes.c_size_t
+MEM_COMMIT, PAGE_NOACCESS, PAGE_GUARD = 0x1000, 0x01, 0x100
+
+
+def search_memory(pid, needles, limit=1 << 32):
+    """Which of `needles` (bytes) occur anywhere in the committed memory of the process -> set."""
+    h = k32.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
+    if not h:
+        return set()
+    found = set()
+    try:
+        addr, mbi = 0, _MBI()
+        while addr < limit and len(found) < len(needles):
+            if not k32.VirtualQueryEx(h, ctypes.c_void_p(addr), ctypes.byref(mbi), ctypes.sizeof(mbi)):
+                break
+            size = mbi.RegionSize
+            if mbi.State == MEM_COMMIT and not mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD):
+                buf = ctypes.create_string_buffer(size)
+                got = ctypes.c_size_t()
+                if k32.ReadProcessMemory(h, ctypes.c_void_p(addr), buf, size, ctypes.byref(got)):
+                    data = buf.raw[:got.value]
+                    for n in needles:
+                        if n not in found and n in data:
+                            found.add(n)
+            addr = (mbi.BaseAddress or 0) + size
+    finally:
+        k32.CloseHandle(h)
+    return found
+
+
 u32 = ctypes.WinDLL("user32", use_last_error=True)
 WM_KEYDOWN, WM_KEYUP = 0x0100, 0x0101
 VK = dict(enter=0x0D, space=0x20, esc=0x1B, up=0x26, down=0x28, left=0x25, right=0x27, e=0x45)