Re: How to dereference pointer pointing at memory in another process?

  Hi Diez,

Thanks for the reply.

>> How can I modify the ctypes pointer dereferencing behavior so that the
>> memory is read from somewhere other than the current process?
> I doubt you can modify that, nor do I see how that would help. E.g. for
> shared memory, you need to translate pointers in each sharing process
> separately - *before* dereferencing.

The shared memory example is another good one - a generalized solution 
to that problem or the problem I mentioned would solve both simultaneously.
It would be ideal (and very Pythonic) to do this in such a way that 
removes the need for manual pointer translation.

> The question is: how do you access the debugee's memory to begin with?

Via ReadProcessMemory().  The resulting buffer is copied into a ctypes 
struct.

This works great for everything except pointers.  My current solution is 
to wrap that "RPM() + copy-to-local-struct" operation and call it 
instead of accessing 'contents' whenever I need to deref a pointer from 
the other process.

That works, but it's ugly - I'm looking for something more elegant and 
less workaround-y.

For instance, a wrapper (decorator? etc.?) that provides the same API as 
ctypes, but is "aware" of which process a pointer points into.
So then dereferencing such a "wrapper" pointer that points to a struct 
that contains pointers results in those pointers being wrapped as well. 
  And pointer arithmetic on such a "wrapped" pointer results in another 
wrapped pointer to a different address.  And so on.

That's just one possible approach.

SystemTap [1] has a subset of functionality that solves the 
cross-process memory access problem elegantly - you can simply write 
code [2,3] as if it were running in the other process, and ST takes care 
of fixing up the memory accesses, etc.  There's a lot of other stuff 
that doesn't apply in there, but it's an example of one way to solve the 
problem at hand.

[1] http://sourceware.org/systemtap/
[2] Script code: 
http://sourceware.org/systemtap/langref/Components_SystemTap_script.html#SECTION00044000000000000000
[3] Embedded C code: 
http://sourceware.org/systemtap/langref/Components_SystemTap_script.html#SECTION00045000000000000000


------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d