XFEEDToolBox

"""Read only two build-pinned native entry points; no injection or input."""
import argparse
import ctypes as c
from ctypes import wintypes as w
import hashlib
import json
from pathlib import Path
import pefile

p=argparse.ArgumentParser(description=__doc__)
p.add_argument('--pid',type=int,required=True)
p.add_argument('--output',type=Path,required=True)
a=p.parse_args()
expected=Path(r'D:\SteamLibrary\steamapps\common\Elite Dangerous\Products\elite-dangerous-odyssey-64\EliteDangerous64.exe')
sha='6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93'
k=c.WinDLL('kernel32',use_last_error=True)
k.OpenProcess.argtypes=[w.DWORD,w.BOOL,w.DWORD];k.OpenProcess.restype=w.HANDLE
k.QueryFullProcessImageNameW.argtypes=[w.HANDLE,w.DWORD,w.LPWSTR,c.POINTER(w.DWORD)]
k.K32EnumProcessModules.argtypes=[w.HANDLE,c.POINTER(w.HMODULE),w.DWORD,c.POINTER(w.DWORD)]
k.ReadProcessMemory.argtypes=[w.HANDLE,c.c_void_p,c.c_void_p,c.c_size_t,c.POINTER(c.c_size_t)]
k.CloseHandle.argtypes=[w.HANDLE]
handle=k.OpenProcess(0x410,False,a.pid)
if not handle:raise c.WinError(c.get_last_error())
try:
    name=c.create_unicode_buffer(32768);length=w.DWORD(len(name))
    if not k.QueryFullProcessImageNameW(handle,0,name,c.byref(length)):raise c.WinError(c.get_last_error())
    if Path(name.value)!=expected or hashlib.sha256(expected.read_bytes()).hexdigest()!=sha:raise ValueError('Unexpected game identity')
    modules=(w.HMODULE*2048)();needed=w.DWORD()
    if not k.K32EnumProcessModules(handle,modules,c.sizeof(modules),c.byref(needed)):raise c.WinError(c.get_last_error())
    image=modules[0];pe=pefile.PE(str(expected),fast_load=True);rows=[]
    for label,rva in [('flow',0x2157520),('physics',0x2E6EA20)]:
        buffer=c.create_string_buffer(16);count=c.c_size_t()
        if not k.ReadProcessMemory(handle,image+rva,buffer,16,c.byref(count)) or count.value!=16:raise c.WinError(c.get_last_error())
        disk=pe.get_data(rva,16)
        rows.append({'name':label,'rva':hex(rva),'disk':disk.hex(),'memory':buffer.raw.hex(),'original':buffer.raw==disk})
    report={'processId':a.pid,'gameSha256':sha,'entries':rows,'writeAccessRequested':False,'screenUse':False}
    with a.output.open('x',encoding='utf-8') as f:json.dump(report,f,indent=2)
    print(json.dumps(report))
finally:k.CloseHandle(handle)