使用ReadWriteMemory读取010Editor内存时遇OverflowError求助

问题场景 #

尝试用ReadWriteMemory库读取64位程序010Editor的内存时，触发错误：OverflowError: int too long to convert，代码如下：

from ReadWriteMemory import ReadWriteMemory

base_address = 0x7FF6D60A0000
static_address_offset = 0x0074DE40
pointer_static_address = base_address + static_address_offset
offsets = [0x08, 0x08, 0xB0, 0x08, 0x278, 0x10, 0xD0]

rmw = ReadWriteMemory()
process = rmw.get_process_by_name('010Editor.exe')
process.open()
pointer = process.get_pointer(pointer_static_address, offsets=offsets)
pointer_value = process.read(pointer)
print(pointer_value)

解决方案 #

问题根源 #

010Editor是64位进程，而ReadWriteMemory的get_pointer方法默认采用32位整数处理地址，导致64位地址超出转换范围触发溢出错误。

修复步骤 #

1. 匹配Python与进程位数：确保运行代码的Python是64位版本，32位Python无法完整访问64位进程的地址空间。
2. 手动计算64位指针：绕过库的get_pointer方法，手动遍历偏移并读取64位地址值，修改后的代码如下：

from ReadWriteMemory import ReadWriteMemory

base_address = 0x7FF6D60A0000
static_address_offset = 0x0074DE40
current_address = base_address + static_address_offset
offsets = [0x08, 0x08, 0xB0, 0x08, 0x278, 0x10, 0xD0]

rmw = ReadWriteMemory()
process = rmw.get_process_by_name('010Editor.exe')
process.open()

# 逐偏移计算64位指针地址
for offset in offsets:
    # 读取当前地址的8字节（QWORD）值，确保是64位地址
    current_address = process.read(current_address, data_type="QWORD")
    current_address += offset

# 读取最终指针指向的值，根据实际数据类型调整data_type（如DWORD/QWORD/FLOAT等）
pointer_value = process.read(current_address, data_type="QWORD")
print(pointer_value)

说明 #

• 调用read方法时指定data_type="QWORD"，强制读取8字节的64位整数，避免32位转换限制。
• 若最终要读取的不是地址，而是其他类型数据（如整数、浮点数），需将最后的data_type改为对应类型（比如"DWORD"对应4位整数，"FLOAT"对应单精度浮点数）。

内容的提问来源于stack exchange，提问作者CidQu