if (context->Eip == 0x00403ff4)
{
    // grab the good serial ;)
    ReadProcessMemory(pinfo.hProcess, (PVOID)context->Edx, lpSerial, size, 0);
};

إقتباس :A process with appropriate access to a thread can examine the thread's registers by using the GetThreadContext function and set the contents of the thread's registers by using the SetThreadContext function
https://docs.microsoft.com/en-us/windows/win32/debug/thread-functions-for-debugging

https://github.com/cheat-engine/cheat-engine/search?q=GetThreadContext+SetThreadContext&unscoped_q=GetThreadContext+SetThreadContext

https://www.at4re.net/f/thread-268.html

#include <iostream>
#include <windows.h>
#include <string>
#include<cstdlib>
#include<ctime>
using namespace std;

int main() {
    
    int value;
    DWORD address = 0x0000C400;
    HWND hWnd = FindWindowA(0,"TargetName");
    DWORD pId;
    srand(time(0));
   
    if (hWnd == 0) {
        printf("connot find Api pleaser contact ");
        Sleep(1000);
        
    }else {
    
        GetWindowThreadProcessId(hWnd, &pId);
        HANDLE hProcess = OpenProcess(PROCESS_VM_READ,FALSE, pId);
        
        if (!hProcess) {
            printf("Connot OI Process");
            Sleep(1000);
        } else {
            
            ReadProcessMemory(hProcess, (LPVOID)address, &value, sizeof(value), 0);
            CloseHandle(hProcess);
        cout << value <<  endl;       
        system("Pause");
        }
        
        
    }
    
}

https://winappdbg.readthedocs.io/en/latest/_downloads/04_dump.py

https://nostarch.com/download/ghpython_src.zip

https://crattack.tistory.com/entry/python-thread-context-%EB%B3%B4%EA%B8%B0win7-64bit

E:\pytest>python loader.py

Enter The PID of the process to attach to : 6256
[*] Select PID 6256
[*] OpenProcess Handle : 512
[*] self.h_process : 512
[*] Enumerate Thread inside
[*] Dumping registers for Thread ID: 0x00002608
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x000000000362d560
[*] RDX : 0x000000000362d3e8
[*] End DUMP
[*] Dumping registers for Thread ID: 0x0000230c
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] Dumping registers for Thread ID: 0x00000a78
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] Dumping registers for Thread ID: 0x00001a58
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] Dumping registers for Thread ID: 0x00000c1c
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] Dumping registers for Thread ID: 0x000023e4
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] Dumping registers for Thread ID: 0x00000994
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] Dumping registers for Thread ID: 0x00001688
[*] RIP : 0x0000000000000001
[*] RSP : 0x00000000013ef4f0
[*] RBP : 0x00000000013ef280
[*] RAX : 0x000000005e340000
[*] RBX : 0x00000000013ef3b0
[*] RCX : 0x00000000013ef2f0
[*] RDX : 0x00009f1917c72eb1
[*] End DUMP
[*] finished debugging. Exiting...

E:\pytest>

www.at4re.net