你可以在紧急情况下制作一个powershell脚本（没有python没有互联网只有基本机器不能安装任何东西）

下面的代码是垃圾黑客你可能需要声明适当的托管类型等以使其健壮它只是为了展示一个想法

$procid = (Get-Process -Name $args[0]).Id
$baseaddr = (Get-Process -Name $args[0] -Module)[0].BaseAddress;
$signature = @"
[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(
    uint h,bool b ,uint p);
[DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(
    IntPtr hp,IntPtr Base,[Out]Byte[] buff,int Size,[Out]int bread);
"@
$rpm = Add-Type -MemberDefinition $signature -Name rpm -PassThru
[Byte[]] $buff = New-Object Byte[](256)
[int]$bread =0;
$proc = $rpm::OpenProcess(0x001F0FFF,0,$procid);
$read = $rpm::ReadProcessMemory($proc,$baseaddr,$buff,256,$bread);
$a = "";
$a+=[char[]]$buff[0..1]+[char[]]$buff[78..118]
$procid
"{0:X}" -f [int]$baseaddr
$a

运行它就像

powershell -f foo.ps1 note*
3388
8D0000
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

powershell -f foo.ps1 exp*
304
C40000
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

我最近在 python 中创建了一个 API 来读取和写入内存 - 对于快速解决方案可能很有用。 https://github.com/samsonpianofingers/pymem

你可以像这样使用它

import pymem

handle = pymem.open_process_name("program.exe")
address = 0x12c0000
size = 1000
buffer = pymem.read_bytes(handle, address, size)
with open("dump.bin", "wb") as f:
    f.write(buffer)
    f.flush()
    f.close()