Re: NtQuerySystemInformation

I finally solved the problem. Here is the code if anyone else needs it:

from ctypes import *
from ctypes.util import *

class SYSTEM_HANDLE(Structure):

_fields_ = [("ProcessId", c_ulong),
("ObjetTypeNumber", c_byte),
("Flags", c_byte),
("Handle", c_ushort),
("Object", c_void_p ),
("GrantedAccess", c_ulong)
]

class SYSTEM_HANDLE_INFORMATION(Structure):

_fields_ = [("HandleCount", c_ulong),
("Handles", POINTER(SYSTEM_HANDLE))
]


handleInfoSize = c_ulong(0x1000)

SystemHandleInformation = 16

handleInfo = create_string_buffer(handleInfoSize.value)

pHandleInfo = cast(handleInfo, POINTER(SYSTEM_HANDLE_INFORMATION))

while windll.ntdll.NtQuerySystemInformation(SystemHandleInformation,
pHandleInfo, handleInfoSize, None) == -1073741820:
handleInfoSize.value *= c_ulong(2).value
handleInfo = create_string_buffer(handleInfoSize.value)
pHandleInfo = cast(handleInfo, POINTER(SYSTEM_HANDLE_INFORMATION))

On Thu, Oct 29, 2015 at 12:27 PM, Cristian Badescu <
[email protected]> wrote:

> After calling NtQuerySystemInformation with _stdcall (windll) as Diez
> suggested, i am getting STATUS_INFO_LENGTH_MISMATCH. After calling
> realloc to get a new size a few time trying to get to the actual buffer
> size required (for SystemHandleInformation the function does not return the
> required buffer size) the function fails with an 0xC0000005 (Access
> Violation) error. This is the code i use:
>
> from ctypes import *
> from ctypes.util import *
>
> class SYSTEM_HANDLE(Structure):
>
> _fields_ = [("ProcessId", c_ulong),
> ("ObjetTypeNumber", c_byte),
> ("Flags", c_byte),
> ("Handle", c_ushort),
> ("Object", c_void_p ),
> ("GrantedAccess", c_ulong)
> ]
>
> class SYSTEM_HANDLE_INFORMATION(Structure):
>
> _fields_ = [("HandleCount", c_ulong),
> ("Handles", SYSTEM_HANDLE * 1)
> ]
>
>
> handleInfoSize = c_ulong(sizeof(SYSTEM_HANDLE_INFORMATION))
>
> SystemHandleInformation = 16
>
> c_lib=CDLL(find_library("c"))
> malloc=c_lib.malloc
> malloc.restype=c_void_p
> handleInfo = malloc(handleInfoSize.value)
>
> pHandleInfo = cast(handleInfo, POINTER(SYSTEM_HANDLE_INFORMATION))
>
> size = c_ulong(sizeof(SYSTEM_HANDLE_INFORMATION))
>
> print(pHandleInfo.contents)
>
> while windll.ntdll.NtQuerySystemInformation(SystemHandleInformation,
> byref(pHandleInfo), handleInfoSize, byref(size)) == -1073741820:
> print("Buffer size to small!")
> handleInfo = c_lib.realloc(handleInfo, handleInfoSize.value +
> c_ulong(sizeof(SYSTEM_HANDLE)).value * c_ulong(100).value)
> handleInfoSize.value += c_ulong(sizeof(SYSTEM_HANDLE)).value *
> c_ulong(100).value
>
> On Wed, Oct 28, 2015 at 3:15 PM, Thor Andreas Tangen <[email protected]>
> wrote:
>
>> Why not call it as
>>
>> spi = SYSTEM_HANDLE_INFORMATION()
>>
>> retlen = c_ulong()
>>
>> res = windll.ntdll.NtQuerySystemInformation(SystemHandleInformation,
>>                                             byref(spi),
>>                                             sizeof(spi),
>>                                             byref(retlen))
>>
>>
>> On Wed, Oct 28, 2015 at 2:03 PM, Diez B. Roggisch <[email protected]> wrote:
>>
>>> Have you tried defining the signature of NtQuerySystemInformation? It
>>> could be that arguments are being truncated.
>>>
>>> Also, is that really a CDLL, not a WINDLL?
>>>
>>> Cheers,
>>>
>>> Diez
>>>
>>> On 28 Oct 2015, at 13:31, Cristian Badescu <[email protected]>
>>> wrote:
>>>
>>> Hello,
>>>
>>> I am trying to get handles information by using NtQuerySystemInformation
>>> but my code fails for some reason. I am using the following code to call
>>> NtQuerySystemInformation:
>>>
>>> from ctypes import *
>>> from ctypes.util import *
>>>
>>> class SYSTEM_HANDLE(Structure):
>>>
>>>     _fields_ = [("ProcessId", c_ulong),
>>>                 ("ObjetTypeNumber", c_byte),
>>>                 ("Flags", c_byte),
>>>                 ("Handle", c_ushort),
>>>                 ("Object", c_void_p ),
>>>                 ("GrantedAccess", c_ulong)
>>>                 ]
>>>
>>> class SYSTEM_HANDLE_INFORMATION(Structure):
>>>
>>>     _fields_ = [("HandleCount", c_ulong),
>>>                 ("Handles", SYSTEM_HANDLE * 1)
>>>                 ]
>>>
>>> handleInfoSize = 65536
>>>
>>> SystemHandleInformation = 16
>>>
>>> c_lib=CDLL(find_library("c"))
>>> malloc=c_lib.malloc
>>> malloc.restype=c_void_p
>>> handleInfo = malloc(handleInfoSize)
>>>
>>> pHandleInfo = cast(handleInfo, POINTER(SYSTEM_HANDLE_INFORMATION))
>>>
>>> retVal = cdll.ntdll.NtQuerySystemInformation(SystemHandleInformation, pHandleInfo, handleInfoSize, None)
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> _______________________________________________
>>> ctypes-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>>
>>> _______________________________________________
>>> ctypes-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>>
>>>
>>
>

------------------------------------------------------------------------------

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users