Re: How come this is different?
Michael C <[email protected]> Sat, 10 Dec 2016 11:40:04 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1gnZa6-5ngQLqZf_Vt7H110KAiNL__9G0TovfG14doeTQ@mail.gmail.com> |
--===============0083511356327704041== Content-Type: multipart/alternative; boundary=94eb2c062b0a8c46340543530941 --94eb2c062b0a8c46340543530941 Content-Type: text/plain; charset=UTF-8 How do I tell it to scan for double? Also, how do I specify the target process? Thax On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <[email protected]> wrote: > On Sat, Dec 10, 2016 at 12:12 AM, Michael C > <[email protected]> wrote: > > Here is my entire current work in progress: > > > > #import modules > > import ctypes > > import time > > [snip] > > Here's a working example for ReadProcessMemory. > > import ctypes > from ctypes import wintypes > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True) > > PROCESS_VM_READ = 0x0010 > PROCESS_QUERY_INFORMATION = 0x0400 > > if not hasattr(wintypes, 'SIZE_T'): > wintypes.SIZE_T = ctypes.c_size_t > > if not hasattr(wintypes, 'PSIZE_T'): > wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T) > > def _check_zero(result, func, args): > """ Check for zero or NULL return value. """ > if not result: > raise ctypes.WinError(ctypes.get_last_error()) > return args > > # https://msdn.microsoft.com/en-us/library/ms683179 > kernel32.GetCurrentProcess.restype = wintypes.HANDLE > > # https://msdn.microsoft.com/en-us/library/ms684320 > kernel32.OpenProcess.errcheck = _check_zero > kernel32.OpenProcess.restype = wintypes.HANDLE > > # https://msdn.microsoft.com/en-us/library/ms680553 > kernel32.ReadProcessMemory.errcheck = _check_zero > kernel32.ReadProcessMemory.argtypes = ( > wintypes.HANDLE, # _In_ hProcess > wintypes.LPCVOID, # _In_ lpBaseAddress > wintypes.LPVOID, # _Out_ lpBuffer > wintypes.SIZE_T, # _In_ nSize > wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead > > if __name__ == '__main__': > import sys > > if len(sys.argv) == 4: > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION | > PROCESS_VM_READ, False, int(sys.argv[1])) > base_address = int(sys.argv[2]) > block_size = int(sys.argv[3]) > elif len(sys.argv) == 1: > ph = kernel32.GetCurrentProcess() > source_array = (wintypes.DWORD * 10)(*range(10)) > base_address = ctypes.addressof(source_array) > block_size = ctypes.sizeof(source_array) > else: > sys.exit('Usage: %s pid base_address block_size' % sys.argv[0]) > > address_list = range(base_address, base_address + block_size, > ctypes.sizeof(wintypes.DWORD)) > data = wintypes.DWORD() > > for address in address_list: > kernel32.ReadProcessMemory(ph, address, ctypes.byref(data), > ctypes.sizeof(data), None) > print('%x: %d' % (address, data.value)) > > This script defaults to a demo that reads an array of DWORD values > from its own process. You can also provide it the PID, base address, > and block size to read from another process. You could extend this > with another option to configure the type of data read (e.g. char, > float) based on simple ctypes format codes, e.g. "L" for a DWORD, > where "L" is the value of `wintypes.DWORD._type_`. Or instead follow > WinDbg conventions (e.g. db, dw, dd). > > Note that I assign an errcheck function for the OpenProcess and > ReadProcessMemory function pointers. In this case both use the same > _check_zero function, which raises an OSError (or WindowsError in 2.x) > when the call fails. Idiomatic Python programming uses exceptions for > error handling and resource management (i.e. try/except/finally). Get > the error code from the exception's `winerror` attribute when handling > it. Here's the complete list of WinAPI error codes: > > https://msdn.microsoft.com/en-us/library/ms681381 > --94eb2c062b0a8c46340543530941 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">How do I tell it to scan for double?=C2=A0<div>Also, how d= o I specify the target process?</div><div><br></div><div>Thax</div></div><d= iv class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 201= 6 at 6:30 AM, eryk sun <span dir=3D"ltr"><<a href=3D"mailto:eryksun@gmai= l.com" target=3D"_blank">[email protected]</a>></span> wrote:<br><blockq= uote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc = solid;padding-left:1ex"><span class=3D"">On Sat, Dec 10, 2016 at 12:12 AM, = Michael C<br> <<a href=3D"mailto:[email protected]">mysecretrobotfactory@= gmail.<wbr>com</a>> wrote:<br> > Here is my entire current work in progress:<br> ><br> > #import modules<br> > import ctypes<br> > import time<br> <br> </span>[snip]<br> <br> Here's a working example for ReadProcessMemory.<br> <br> =C2=A0 =C2=A0 import ctypes<br> =C2=A0 =C2=A0 from ctypes import wintypes<br> <span class=3D""><br> =C2=A0 =C2=A0 kernel32 =3D ctypes.WinDLL('kernel32', use_last_error= =3DTrue)<br> <br> </span>=C2=A0 =C2=A0 PROCESS_VM_READ=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0=3D 0x0010<br> =C2=A0 =C2=A0 PROCESS_QUERY_INFORMATION =3D 0x0400<br> <br> =C2=A0 =C2=A0 if not hasattr(wintypes, 'SIZE_T'):<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T =3D ctypes.c_size_t<br> <br> =C2=A0 =C2=A0 if not hasattr(wintypes, 'PSIZE_T'):<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T =3D ctypes.POINTER(wintypes.SI= ZE_<wbr>T)<br> <br> =C2=A0 =C2=A0 def _check_zero(result, func, args):<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 """ Check for zero or NULL retur= n value. """<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 if not result:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinError(ctypes.get_= <wbr>last_error())<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 return args<br> <br> =C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68317= 9" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>= us/library/ms683179</a><br> =C2=A0 =C2=A0 kernel32.GetCurrentProcess.<wbr>restype =3D wintypes.HANDLE<b= r> <br> =C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68432= 0" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>= us/library/ms684320</a><br> =C2=A0 =C2=A0 kernel32.OpenProcess.errcheck =3D _check_zero<br> =C2=A0 =C2=A0 kernel32.OpenProcess.restype =3D wintypes.HANDLE<br> <br> =C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68055= 3" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>= us/library/ms680553</a><br> =C2=A0 =C2=A0 kernel32.ReadProcessMemory.<wbr>errcheck =3D _check_zero<br> =C2=A0 =C2=A0 kernel32.ReadProcessMemory.<wbr>argtypes =3D (<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.HANDLE,=C2=A0 # _In_=C2=A0 hProcess<br= > =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPCVOID, # _In_=C2=A0 lpBaseAddress<br= > =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPVOID,=C2=A0 # _Out_ lpBuffer<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T,=C2=A0 # _In_=C2=A0 nSize<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead<b= r> <br> =C2=A0 =C2=A0 if __name__ =3D=3D '__main__':<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 import sys<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 if len(sys.argv) =3D=3D 4:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.OpenProcess(PROCE= SS_<wbr>QUERY_INFORMATION |<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 PROCE= SS_VM_READ, False, int(sys.argv[1]))<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D int(sys.argv[2])= <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size=C2=A0 =3D int(sys.argv= [3])<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 elif len(sys.argv) =3D=3D 1:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProcess= ()<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 source_array =3D (wintypes.DWORD = * 10)(*range(10))<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D ctypes.addressof= (source_array)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size =3D ctypes.sizeof(sour= ce_array)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Usage: %s pid base_= address block_size' % sys.argv[0])<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 address_list =3D range(base_address, base_addre= ss + block_size,<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(wintypes.DWORD))<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 data =3D wintypes.DWORD()<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 for address in address_list:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 kernel32.ReadProcessMemory(ph, ad= dress, ctypes.byref(data),<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(data)= , None)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 print('%x: %d' % (address= , data.value))<br> <br> This script defaults to a demo that reads an array of DWORD values<br> from its own process. You can also provide it the PID, base address,<br> and block size to read from another process. You could extend this<br> with another option to configure the type of data read (e.g. char,<br> float) based on simple ctypes format codes, e.g. "L" for a DWORD,= <br> where "L" is the value of `wintypes.DWORD._type_`. Or instead fol= low<br> WinDbg conventions (e.g. db, dw, dd).<br> <br> Note that I assign an errcheck function for the OpenProcess and<br> ReadProcessMemory function pointers. In this case both use the same<br> _check_zero function, which raises an OSError (or WindowsError in 2.x)<br> when the call fails. Idiomatic Python programming uses exceptions for<br> error handling and resource management (i.e. try/except/finally). Get<br> the error code from the exception's `winerror` attribute when handling<= br> it. Here's the complete list of WinAPI error codes:<br> <br> <a href=3D"https://msdn.microsoft.com/en-us/library/ms681381" rel=3D"norefe= rrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/library/ms681= 381</a><br> </blockquote></div><br></div> --94eb2c062b0a8c46340543530941-- --===============0083511356327704041== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today.http://sdm.link/xeonphi --===============0083511356327704041== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ctypes-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ctypes-users --===============0083511356327704041==--