Re: How come this is different?
Michael C <[email protected]> Fri, 9 Dec 2016 16:09:58 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1j8mx+F1zaDX7+vYZBsDG0t+SgpjVSd9-mNEPiz+qQOOw@mail.gmail.com> |
--===============3483743568158070774== Content-Type: multipart/alternative; boundary=001a114a9eaef019bd054342b039 --001a114a9eaef019bd054342b039 Content-Type: text/plain; charset=UTF-8 I am working on a memory scanner of my own, but I am stuck at Virtualqueryex() and readprocessmemory() https://msdn.microsoft.com/en-us/library/windows/desktop/ ms680553(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ aa366907(v=vs.85).aspx if Anyone would help, here is the problem: For SIZE_T WINAPI VirtualQueryEx( _In_ HANDLE hProcess, _In_opt_ LPCVOID lpAddress, _Out_ PMEMORY_BASIC_INFORMATION lpBuffer, _In_ SIZE_T dwLength ); For this, how do I declare the lpbuffer? and what is dwlength? Do I use another function to retrieve those values? And then, I need to feed this function to find my target address of my value! BOOL WINAPI ReadProcessMemory( _In_ HANDLE hProcess, _In_ LPCVOID lpBaseAddress, _Out_ LPVOID lpBuffer, _In_ SIZE_T nSize, _Out_ SIZE_T *lpNumberOfBytesRead ); I am working on virtualQueryEx at the moment, hopefully I'll get it soon! On Fri, Dec 9, 2016 at 4:03 PM, Michael C <[email protected]> wrote: > Oh this is my entire work in progress, I pull those out to figure out the > windows API line by line, so I do have a .py containing only those, as seen > here: > > import ctypes > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True) > > PROCESS_QUERY_INFORMATION = 0x0400 > PROCESS_VM_READ = 0x0010 > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False, > 20224) > print(ph) > > > On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <[email protected]> > wrote: > >> That's not it, Python is perfectly happy with 0x0400 as a literal. >> >> Michael, is the code you've provided below all copied and pasted from >> your actual code, or did you retype any of it? Is it all in fact at the >> 0-indent level and in the same file? Likewise is that error report copied >> and pasted, or are you just paraphrasing? >> >> On Fri, 9 Dec 2016 15:33:12 -0700 >> "David A. Van Arnem" <[email protected]> wrote: >> >> > Hi Michael, >> > >> > I believe Python doesn't accept a hex representation like "0x0400". In >> > situations where I've needed a hex value like that, I've used something >> > like: >> > >> > PROCESS_QUERY_INFORMATION = int("400", 16) >> > >> > This creates an integer from the string "400" in base 16 (hex). >> > >> > David >> > >> > On 12/09/2016 03:25 PM, Michael C wrote: >> > > Hi all: >> > > >> > > I am trying to write my own memory scanner, but I have >> encountered a >> > > few problem. Apparently, directly specifying " >> > > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the >> interpreter >> > > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined" >> > > >> > > so I should do what I did here, to define it for myself first? is this >> > > correct? >> > > >> > > Thanks >> > > >> > > Code: >> > > >> > > import ctypes >> > > >> > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True) >> > > >> > > PROCESS_QUERY_INFORMATION = 0x0400 >> > > PROCESS_VM_READ = 0x0010 >> > > >> > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_RE >> AD,False, >> > > 20224) >> > > >> > > print(ph) >> > > >> > > >> > > >> > > ------------------------------------------------------------ >> ------------------ >> > > Developer Access Program for Intel Xeon Phi Processors >> > > Access to Intel Xeon Phi processor-based developer platforms. >> > > With one year of Intel Parallel Studio XE. >> > > Training and support from Colfax. >> > > Order your platform today.http://sdm.link/xeonphi >> > > >> > > >> > > >> > > _______________________________________________ >> > > ctypes-users mailing list >> > > [email protected] >> > > https://lists.sourceforge.net/lists/listinfo/ctypes-users >> > > >> > >> >> >> -- >> Rob Gaddi, Highland Technology >> 18 Otis St. >> San Francisco, CA 94103 >> 415-551-1700 >> >> ------------------------------------------------------------ >> ------------------ >> Developer Access Program for Intel Xeon Phi Processors >> Access to Intel Xeon Phi processor-based developer platforms. >> With one year of Intel Parallel Studio XE. >> Training and support from Colfax. >> Order your platform today.http://sdm.link/xeonphi >> _______________________________________________ >> ctypes-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/ctypes-users >> > > --001a114a9eaef019bd054342b039 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><font face=3D"arial, helvetica, sans-serif">I am working o= n a memory scanner of my own, but I am stuck at Virtualqueryex() and readpr= ocessmemory()</font><div><font face=3D"arial, helvetica, sans-serif"><a hre= f=3D"https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553(v=3D= vs.85).aspx" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/librar= y/windows/desktop/<wbr>ms680553(v=3Dvs.85).aspx</a><br></font></div><div><f= ont face=3D"arial, helvetica, sans-serif"><a href=3D"https://msdn.microsoft= .com/en-us/library/windows/desktop/aa366907(v=3Dvs.85).aspx" target=3D"_bla= nk">https://msdn.microsoft.com/en-<wbr>us/library/windows/desktop/<wbr>aa36= 6907(v=3Dvs.85).aspx</a><br></font></div><div><font face=3D"arial, helvetic= a, sans-serif"><br></font></div><div><font face=3D"arial, helvetica, sans-s= erif">if Anyone would help, here is the problem:</font></div><div><font fac= e=3D"arial, helvetica, sans-serif"><br></font></div><div><font face=3D"aria= l, helvetica, sans-serif"><br></font></div><div><font face=3D"arial, helvet= ica, sans-serif">For=C2=A0</font></div><div><pre style=3D"padding:5px;margi= n-top:0px;margin-bottom:0px;overflow:auto;word-wrap:break-word;word-break:b= reak-word;white-space:pre-wrap;color:rgb(0,0,0);font-size:14px"><font face= =3D"arial, helvetica, sans-serif">SIZE_T WINAPI VirtualQueryEx( _In_=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0HANDLE =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0hProcess, _In_opt_=C2=A0LPCVOID =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0lpAddress, _Out_=C2=A0=C2=A0=C2=A0=C2=A0PMEMORY_BASIC_<wbr>INFORMATION lpBuffer, _In_=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0SIZE_T =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0dwLength );</font></pre><pre style=3D"padding:5px;margin-top:0px;margin-bottom:0px;o= verflow:auto;word-wrap:break-word;word-break:break-word;white-space:pre-wra= p;color:rgb(0,0,0);font-size:14px"><br></pre><pre style=3D"padding:5px;marg= in-top:0px;margin-bottom:0px;overflow:auto;word-wrap:break-word;word-break:= break-word;white-space:pre-wrap;color:rgb(0,0,0);font-size:14px"><font face= =3D"arial, helvetica, sans-serif">For this, how do I declare the lpbuffer? = and what is dwlength? Do I use another function to retrieve those values?</= font></pre><pre style=3D"padding:5px;margin-top:0px;margin-bottom:0px;overf= low:auto;word-wrap:break-word;word-break:break-word;white-space:pre-wrap;co= lor:rgb(0,0,0);font-size:14px"><font face=3D"arial, helvetica, sans-serif">= <br></font></pre><pre style=3D"padding:5px;margin-top:0px;margin-bottom:0px= ;overflow:auto;word-wrap:break-word;word-break:break-word;white-space:pre-w= rap;color:rgb(0,0,0);font-size:14px">And then, I need to feed this function= to find my target address of my value!</pre><pre style=3D"padding:5px;marg= in-top:0px;margin-bottom:0px;overflow:auto;word-wrap:break-word;word-break:= break-word;white-space:pre-wrap;color:rgb(0,0,0);font-size:14px"><pre style= =3D"padding:5px;margin-top:0px;margin-bottom:0px;overflow:auto;word-wrap:br= eak-word;word-break:break-word;white-space:pre-wrap;font-family:consolas,co= urier,monospace">BOOL WINAPI ReadProcessMemory( _In_=C2=A0=C2=A0HANDLE =C2=A0hProcess, _In_=C2=A0=C2=A0LPCVOID lpBaseAddress, _Out_=C2=A0LPVOID =C2=A0lpBuffer, _In_=C2=A0=C2=A0SIZE_T =C2=A0nSize, _Out_=C2=A0SIZE_T =C2=A0*lpNumberOfBytesRead );</pre></pre><pre style=3D"padding:5px;margin-top:0px;margin-bottom:0px;ov= erflow:auto;word-wrap:break-word;word-break:break-word;white-space:pre-wrap= ;color:rgb(0,0,0);font-size:14px"><font face=3D"arial, helvetica, sans-seri= f"><br></font></pre><pre style=3D"padding:5px;margin-top:0px;margin-bottom:= 0px;overflow:auto;word-wrap:break-word;word-break:break-word;white-space:pr= e-wrap;color:rgb(0,0,0);font-size:14px"><font face=3D"arial, helvetica, san= s-serif">I am working on virtualQueryEx at the moment, hopefully I'll g= et it soon!</font></pre><pre style=3D"padding:5px;margin-top:0px;margin-bot= tom:0px;overflow:auto;word-wrap:break-word;word-break:break-word;white-spac= e:pre-wrap;color:rgb(0,0,0);font-size:14px"><font face=3D"arial, helvetica,= sans-serif"><br></font></pre><pre style=3D"padding:5px;margin-top:0px;marg= in-bottom:0px;overflow:auto;word-wrap:break-word;word-break:break-word;whit= e-space:pre-wrap;color:rgb(0,0,0);font-size:14px"><font face=3D"arial, helv= etica, sans-serif"><br></font></pre></div><div class=3D"gmail_extra"><font = face=3D"arial, helvetica, sans-serif"><br></font><div class=3D"gmail_quote"= ><font face=3D"arial, helvetica, sans-serif">On Fri, Dec 9, 2016 at 4:03 PM= , Michael C <span dir=3D"ltr"><<a href=3D"mailto:mysecretrobotfactory@gm= ail.com" target=3D"_blank">mysecretrobotfactory@gmail.<wbr>com</a>></spa= n> wrote:<br></font><blockquote class=3D"gmail_quote" style=3D"margin:0px 0= px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div = dir=3D"ltr"><font face=3D"arial, helvetica, sans-serif">Oh this is my entir= e work in progress, I pull those out to figure out the windows API line by = line, so I do have a .py containing only those, as seen here:<span class=3D= "m_-5920348481470861325gmail-"><div><br></div><div><div>import ctypes</div>= <div><br></div><div>kernel32 =3D ctypes.WinDLL('kernel32', use_last= _error=3DTrue)</div><div><br></div><div>PROCESS_QUERY_INFORMATION =3D 0x040= 0</div><div>PROCESS_VM_READ =3D 0x0010</div><div><br></div><div>ph =3D kern= el32.OpenProcess(PROCESS_Q<wbr>UERY_INFORMATION|PROCESS_VM_RE<wbr>AD,False,= 20224)</div><div>print(ph)</div></div><div><br></div></span></font></div><= div class=3D"m_-5920348481470861325gmail-HOEnZb"><div class=3D"m_-592034848= 1470861325gmail-h5"><div class=3D"gmail_extra"><font face=3D"arial, helveti= ca, sans-serif"><br></font><div class=3D"gmail_quote"><font face=3D"arial, = helvetica, sans-serif">On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <span dir= =3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a><wbr>></span> wrote:<br></font><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t:1px solid rgb(204,204,204);padding-left:1ex"><font face=3D"arial, helveti= ca, sans-serif">That's not it, Python is perfectly happy with 0x0400 as= a literal.<br> <br> Michael, is the code you've provided below all copied and pasted from y= our actual code, or did you retype any of it?=C2=A0 Is it all in fact at th= e 0-indent level and in the same file?=C2=A0 Likewise is that error report = copied and pasted, or are you just paraphrasing?<br> </font><div class=3D"m_-5920348481470861325gmail-m_7429241619834784684HOEnZ= b"><div class=3D"m_-5920348481470861325gmail-m_7429241619834784684h5"><font= face=3D"arial, helvetica, sans-serif"><br> On Fri, 9 Dec 2016 15:33:12 -0700<br> "David A. Van Arnem" <<a href=3D"mailto:[email protected]" t= arget=3D"_blank">[email protected]</a>> wrote:<br> <br> > Hi Michael,<br> ><br> > I believe Python doesn't accept a hex representation like "0x= 0400".=C2=A0 In<br> > situations where I've needed a hex value like that, I've used = something<br> > like:<br> ><br> > PROCESS_QUERY_INFORMATION =3D int("400", 16)<br> ><br> > This creates an integer from the string "400" in base 16 (he= x).<br> ><br> > David<br> ><br> > On 12/09/2016 03:25 PM, Michael C wrote:<br> > > Hi all:<br> > ><br> > >=C2=A0 =C2=A0 =C2=A0 =C2=A0 I am trying to write my own memory sca= nner, but I have encountered a<br> > > few problem. Apparently, directly specifying "<br> > > PROCESS_QUERY_INFORMATION|PROC<wbr>ESS_VM_READ" is not ok, s= ince the interpreter<br> > > returns "NameError: name 'PROCESS_QUERY_INFORMATION'= is not defined"<br> > ><br> > > so I should do what I did here, to define it for myself first? is= this<br> > > correct?<br> > ><br> > > Thanks<br> > ><br> > > Code:<br> > ><br> > > import ctypes<br> > ><br> > > kernel32 =3D ctypes.WinDLL('kernel32', use_last_error=3DT= rue)<br> > ><br> > > PROCESS_QUERY_INFORMATION =3D 0x0400<br> > > PROCESS_VM_READ =3D 0x0010<br> > ><br> > > ph =3D kernel32.OpenProcess(PROCESS_Q<wbr>UERY_INFORMATION|PROCES= S_VM_RE<wbr>AD,False,<br> > > 20224)<br> > ><br> > > print(ph)<br> > ><br> > ><br> > ><br> > > ------------------------------<wbr>------------------------------= <wbr>------------------<br> > > Developer Access Program for Intel Xeon Phi Processors<br> > > Access to Intel Xeon Phi processor-based developer platforms.<br> > > With one year of Intel Parallel Studio XE.<br> > > Training and support from Colfax.<br> > > Order your platform today.<a href=3D"http://sdm.link/xeonphi" rel= =3D"noreferrer" target=3D"_blank">http://sdm.link/xeonphi</a><br> > ><br> > ><br> > ><br> > > ______________________________<wbr>_________________<br> > > ctypes-users mailing list<br> > > <a href=3D"mailto:[email protected]" target=3D"_= blank">[email protected]<wbr>.net</a><br> > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/ctypes-us= ers" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/<wb= r>lists/listinfo/ctypes-users</a><br> > ><br> ><br> <br> <br> </font></div></div><span class=3D"m_-5920348481470861325gmail-m_74292416198= 34784684HOEnZb"><font color=3D"#888888" face=3D"arial, helvetica, sans-seri= f">--<br> Rob Gaddi, Highland Technology<br> 18 Otis St.<br> San Francisco, CA 94103<br> <a href=3D"tel:415-551-1700" value=3D"+14155511700" target=3D"_blank">415-5= 51-1700</a><br> </font></span><div class=3D"m_-5920348481470861325gmail-m_74292416198347846= 84HOEnZb"><div class=3D"m_-5920348481470861325gmail-m_7429241619834784684h5= "><font face=3D"arial, helvetica, sans-serif"><br> ------------------------------<wbr>------------------------------<wbr>-----= -------------<br> Developer Access Program for Intel Xeon Phi Processors<br> Access to Intel Xeon Phi processor-based developer platforms.<br> With one year of Intel Parallel Studio XE.<br> Training and support from Colfax.<br> Order your platform today.<a href=3D"http://sdm.link/xeonphi" rel=3D"norefe= rrer" target=3D"_blank">http://sdm.link/xeonphi</a><br> ______________________________<wbr>_________________<br> ctypes-users mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">cty= [email protected]<wbr>.net</a><br> <a href=3D"https://lists.sourceforge.net/lists/listinfo/ctypes-users" rel= =3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/<wbr>lists/= listinfo/ctypes-users</a><br> </font></div></div></blockquote></div><font face=3D"arial, helvetica, sans-= serif"><br></font></div> </div></div></blockquote></div><br></div></div> --001a114a9eaef019bd054342b039-- --===============3483743568158070774== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today.http://sdm.link/xeonphi --===============3483743568158070774== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ctypes-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ctypes-users --===============3483743568158070774==--