"""peek_first_region.py <pid> <exact_size_bytes>
Find the first private-RW region of exactly <size>, dump its first 256 bytes
plus a sample at offset 4096 and at midpoint."""
import ctypes, ctypes.wintypes as wt, sys, struct

PROCESS_VM_READ = 0x10
PROCESS_QUERY_INFORMATION = 0x400
k = ctypes.windll.kernel32
k.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; k.OpenProcess.restype = wt.HANDLE
k.ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
k.ReadProcessMemory.restype = wt.BOOL
k.VirtualQueryEx.argtypes = [wt.HANDLE, wt.LPCVOID, ctypes.c_void_p, ctypes.c_size_t]
k.VirtualQueryEx.restype = ctypes.c_size_t

class MBI(ctypes.Structure):
    _fields_ = [("BaseAddress", ctypes.c_void_p), ("AllocationBase", ctypes.c_void_p),
                ("AllocationProtect", wt.DWORD), ("RegionSize", ctypes.c_size_t),
                ("State", wt.DWORD), ("Protect", wt.DWORD), ("Type", wt.DWORD)]

def rd(h, va, n):
    buf = (ctypes.c_ubyte * n)(); sz = ctypes.c_size_t(0)
    if not k.ReadProcessMemory(h, va, buf, n, ctypes.byref(sz)): return None
    return bytes(buf[:sz.value])

pid = int(sys.argv[1]); target_size = int(sys.argv[2])
h = k.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
if not h: print("OpenProcess fail"); sys.exit(2)

mbi = MBI()
addr = 0
found = 0
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)) and found < 3:
    base = mbi.BaseAddress or 0
    sz = mbi.RegionSize
    if (mbi.State == 0x1000 and mbi.Type == 0x20000 and (mbi.Protect & 0xFF) in (0x04, 0x40)
        and sz == target_size):
        print(f"\n=== region @ 0x{base:08x}  size={sz} ===")
        for off in [0, 256, 4096, sz // 2, sz - 64]:
            data = rd(h, base + off, 64)
            if data:
                print(f"  +0x{off:06x}: {data[:32].hex(' ')}")
                print(f"            {data[32:64].hex(' ')}")
        # Interpret first 32 bytes as DWORDs and floats
        data = rd(h, base, 32)
        if data:
            print(f"  as DWORDs: ", end='')
            for i in range(0, 32, 4):
                print(f"0x{struct.unpack_from('<I', data, i)[0]:08x}", end=' ')
            print()
            print(f"  as floats: ", end='')
            for i in range(0, 32, 4):
                print(f"{struct.unpack_from('<f', data, i)[0]:.3g}", end=' ')
            print()
        found += 1
    next_addr = base + sz
    if next_addr <= addr: break
    addr = next_addr
    if addr >= 0x80000000: break
k.CloseHandle(h)