import ctypes, struct
from ctypes import wintypes

k32 = ctypes.WinDLL('kernel32', use_last_error=True)

pid = 49116
h = k32.OpenProcess(0x410, False, pid)
base = 0x7ff6afc20000

def rpm_chunked(addr, total_size, chunk_size=65536):
    res = bytearray()
    for off in range(0, total_size, chunk_size):
        curr_addr = addr + off
        to_read = min(chunk_size, total_size - off)
        buf = (ctypes.c_ubyte * to_read)()
        got = ctypes.c_size_t(0)
        if k32.ReadProcessMemory(h, ctypes.c_void_p(curr_addr), buf, to_read, ctypes.byref(got)):
            res.extend(buf[:got.value])
        else:
            res.extend(b"\x00" * to_read)
    return bytes(res)

text_size = 0x2E86000
blob = rpm_chunked(base + 0x1000, text_size)

print("Blob len:", len(blob))
# Find 80 78 2F 00
hits = []
start = 0
while True:
    idx = blob.find(b"\x80\x78\x2F\x00", start)
    if idx == -1:
        break
    va = base + 0x1000 + idx
    print(f"Match 80 78 2F 00 @ {va:#x}:")
    ctx = blob[max(0, idx - 16):min(len(blob), idx + 32)]
    print(f"   Hex: {ctx.hex()}")
    hits.append(va)
    start = idx + 1
    if len(hits) >= 10:
        break

print("Total matches for 80 78 2F 00:", len(hits))