试着让所有的团体
76630000 76746000 ucrtbase
76750000 76764000 profapi
...从字符串loaded_modules_raw
‘启动端模块名称\n 76630000 76746000 ucrtbase (递延)\n 76750000 76764000 profapi (延迟)\n 76770000 76840000 KERNEL32 (延迟)\n 76840000 msvcp_win (延迟)\n 768c0000 76903000 sechost (递延)\n 76920000 76af8000 KERNELBASE (延迟)\n 77090000 770d5000 SHLWAPI (推迟)770e0000 776a7000 windows_storage (延期)\n 776b0000 776d2000 GDI32 (延期)\n 776e0000 77758000 ADVAPI32 (递延)\n 777c0000 7787d000 msvcrt (递延)\n 77880000 77896000 win32u (递延)\n 778a0000 77928000 shcore (递延)\n 77940000 77965000 IMM32 (递延)\n 779c0000 77b4c000 ntdll D:\NG\bin\Debug\wntdll.pdb\E04B114840C9B587E2E333AED97D8C9A1\wntdll.pdb\n\nUnloaded模块:\n 76910000 76916000 psapi.dll\n‘
使用
loaded_modules = re.findall(r"\\n(\w+)\s(\w+)\s+(\w+)",loaded_modules_raw)试过re.DOTALL
结果我得到了None,为什么?
发布于 2020-01-02 11:28:40
s = '''start    end        module name\n76630000 76746000   ucrtbase   (deferred)             \n76750000 76764000   profapi    (deferred)             \n76770000 76840000   KERNEL32   (deferred)             \n76840000 768bc000   msvcp_win   (deferred)             \n768c0000 76903000   sechost    (deferred)             \n76920000 76af8000   KERNELBASE   (deferred)             \n77090000 770d5000   SHLWAPI    (deferred)             \n770e0000 776a7000   windows_storage   (deferred)             \n776b0000 776d2000   GDI32      (deferred)             \n776e0000 77758000   ADVAPI32   (deferred)             \n777c0000 7787d000   msvcrt     (deferred)             \n77880000 77896000   win32u     (deferred)             \n778a0000 77928000   shcore     (deferred)             \n77940000 77965000   IMM32      (deferred)             \n779c0000 77b4c000   ntdll      (pdb symbols)          D:\\NG\\bin\\Debug\\wntdll.pdb\\E04B114840C9B587E2E333AED97D8C9A1\\wntdll.pdb\n\nUnloaded modules:\n76910000 76916000   psapi.dll\n'''
import re
g = re.findall(r"^([0-9a-f]+)\s+([0-9a-f]+)\s+([\w.]+)", s, flags=re.M)
for start, end, module_name in g:
    print('{:<15} {:<15} {:<15}'.format(start, end, module_name))指纹:
76630000        76746000        ucrtbase       
76750000        76764000        profapi        
76770000        76840000        KERNEL32       
76840000        768bc000        msvcp_win      
768c0000        76903000        sechost        
76920000        76af8000        KERNELBASE     
77090000        770d5000        SHLWAPI        
770e0000        776a7000        windows_storage
776b0000        776d2000        GDI32          
776e0000        77758000        ADVAPI32       
777c0000        7787d000        msvcrt         
77880000        77896000        win32u         
778a0000        77928000        shcore         
77940000        77965000        IMM32          
779c0000        77b4c000        ntdll          
76910000        76916000        psapi.dll      https://stackoverflow.com/questions/59562438
复制相似问题