import ctypes
import ctypes.wintypes as w
import struct
import subprocess

k32 = ctypes.WinDLL("kernel32", use_last_error=True)
k32.OpenProcess.restype = w.HANDLE
k32.ReadProcessMemory.argtypes = [
    w.HANDLE, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)
]
k32.ReadProcessMemory.restype = w.BOOL

def rpm(h, addr, size):
    buf = (ctypes.c_ubyte * size)()
    got = ctypes.c_size_t(0)
    if not k32.ReadProcessMemory(h, ctypes.c_void_p(addr), buf, size, ctypes.byref(got)):
        return None
    return bytes(buf[: got.value])

out = subprocess.check_output(['powershell', '-Command', '(Get-Process -Name *PathOfExile*).Id'])
pid = int(out.decode().split()[0])
h = k32.OpenProcess(0x1F0FFF, False, pid)

ptr = 0x48514e54000
b = rpm(h, ptr, 0x400)
print(f"=== Dump 0x48514e54000 (igs+0x360) ===")
for off in range(0, 0x300, 8):
    q = struct.unpack_from("<Q", b, off)[0]
    f1, f2 = struct.unpack_from("<ff", b, off)
    u1, u2 = struct.unpack_from("<II", b, off)
    if abs(f1) > 0.01 or abs(f2) > 0.01 or q != 0:
        print(f"  +{off:#04x}: QWORD={q:#018x} | f=({f1:10.3f}, {f2:10.3f}) | u32=({u1}, {u2})")