Re: NtQuerySystemInformation

After calling NtQuerySystemInformation with _stdcall (windll) as Diez
suggested, i am getting STATUS_INFO_LENGTH_MISMATCH. After calling realloc
to get a new size a few time trying to get to the actual buffer size
required (for SystemHandleInformation the function does not return the
required buffer size) the function fails with an 0xC0000005 (Access
Violation) error. This is the code i use:

from ctypes import *
from ctypes.util import *

class SYSTEM_HANDLE(Structure):

_fields_ = [("ProcessId", c_ulong),
("ObjetTypeNumber", c_byte),
("Flags", c_byte),
("Handle", c_ushort),
("Object", c_void_p ),
("GrantedAccess", c_ulong)
]

class SYSTEM_HANDLE_INFORMATION(Structure):

_fields_ = [("HandleCount", c_ulong),
("Handles", SYSTEM_HANDLE * 1)
]


handleInfoSize = c_ulong(sizeof(SYSTEM_HANDLE_INFORMATION))

SystemHandleInformation = 16

c_lib=CDLL(find_library("c"))
malloc=c_lib.malloc
malloc.restype=c_void_p
handleInfo = malloc(handleInfoSize.value)

pHandleInfo = cast(handleInfo, POINTER(SYSTEM_HANDLE_INFORMATION))

size = c_ulong(sizeof(SYSTEM_HANDLE_INFORMATION))

print(pHandleInfo.contents)

while windll.ntdll.NtQuerySystemInformation(SystemHandleInformation,
byref(pHandleInfo), handleInfoSize, byref(size)) == -1073741820:
print("Buffer size to small!")
handleInfo = c_lib.realloc(handleInfo, handleInfoSize.value +
c_ulong(sizeof(SYSTEM_HANDLE)).value * c_ulong(100).value)
handleInfoSize.value += c_ulong(sizeof(SYSTEM_HANDLE)).value *
c_ulong(100).value

On Wed, Oct 28, 2015 at 3:15 PM, Thor Andreas Tangen <[email protected]>
wrote:

> Why not call it as
>
> spi = SYSTEM_HANDLE_INFORMATION()
>
> retlen = c_ulong()
>
> res = windll.ntdll.NtQuerySystemInformation(SystemHandleInformation,
>                                             byref(spi),
>                                             sizeof(spi),
>                                             byref(retlen))
>
>
> On Wed, Oct 28, 2015 at 2:03 PM, Diez B. Roggisch <[email protected]> wrote:
>
>> Have you tried defining the signature of NtQuerySystemInformation? It
>> could be that arguments are being truncated.
>>
>> Also, is that really a CDLL, not a WINDLL?
>>
>> Cheers,
>>
>> Diez
>>
>> On 28 Oct 2015, at 13:31, Cristian Badescu <[email protected]>
>> wrote:
>>
>> Hello,
>>
>> I am trying to get handles information by using NtQuerySystemInformation
>> but my code fails for some reason. I am using the following code to call
>> NtQuerySystemInformation:
>>
>> from ctypes import *
>> from ctypes.util import *
>>
>> class SYSTEM_HANDLE(Structure):
>>
>>     _fields_ = [("ProcessId", c_ulong),
>>                 ("ObjetTypeNumber", c_byte),
>>                 ("Flags", c_byte),
>>                 ("Handle", c_ushort),
>>                 ("Object", c_void_p ),
>>                 ("GrantedAccess", c_ulong)
>>                 ]
>>
>> class SYSTEM_HANDLE_INFORMATION(Structure):
>>
>>     _fields_ = [("HandleCount", c_ulong),
>>                 ("Handles", SYSTEM_HANDLE * 1)
>>                 ]
>>
>> handleInfoSize = 65536
>>
>> SystemHandleInformation = 16
>>
>> c_lib=CDLL(find_library("c"))
>> malloc=c_lib.malloc
>> malloc.restype=c_void_p
>> handleInfo = malloc(handleInfoSize)
>>
>> pHandleInfo = cast(handleInfo, POINTER(SYSTEM_HANDLE_INFORMATION))
>>
>> retVal = cdll.ntdll.NtQuerySystemInformation(SystemHandleInformation, pHandleInfo, handleInfoSize, None)
>>
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> ctypes-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>>
>> _______________________________________________
>> ctypes-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>
>>
>

------------------------------------------------------------------------------

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users