Re: How come this is different?
Michael C <[email protected]> Sat, 10 Dec 2016 11:44:19 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1gxXLwZNYMoz_1=3xz+8xqMuGE9SzrYoCoKxhwyw9gjNg@mail.gmail.com> |
--===============5706304202059171093== Content-Type: multipart/alternative; boundary=f403045d96aebec8a80543531868 --f403045d96aebec8a80543531868 Content-Type: text/plain; charset=UTF-8 what does this do? source_array = (wintypes.DWORD * 10)(*range(10)) On Sat, Dec 10, 2016 at 11:40 AM, Michael C <[email protected]> wrote: > How do I tell it to scan for double? > Also, how do I specify the target process? > > Thax > > On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <[email protected]> wrote: > >> On Sat, Dec 10, 2016 at 12:12 AM, Michael C >> <[email protected]> wrote: >> > Here is my entire current work in progress: >> > >> > #import modules >> > import ctypes >> > import time >> >> [snip] >> >> Here's a working example for ReadProcessMemory. >> >> import ctypes >> from ctypes import wintypes >> >> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True) >> >> PROCESS_VM_READ = 0x0010 >> PROCESS_QUERY_INFORMATION = 0x0400 >> >> if not hasattr(wintypes, 'SIZE_T'): >> wintypes.SIZE_T = ctypes.c_size_t >> >> if not hasattr(wintypes, 'PSIZE_T'): >> wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T) >> >> def _check_zero(result, func, args): >> """ Check for zero or NULL return value. """ >> if not result: >> raise ctypes.WinError(ctypes.get_last_error()) >> return args >> >> # https://msdn.microsoft.com/en-us/library/ms683179 >> kernel32.GetCurrentProcess.restype = wintypes.HANDLE >> >> # https://msdn.microsoft.com/en-us/library/ms684320 >> kernel32.OpenProcess.errcheck = _check_zero >> kernel32.OpenProcess.restype = wintypes.HANDLE >> >> # https://msdn.microsoft.com/en-us/library/ms680553 >> kernel32.ReadProcessMemory.errcheck = _check_zero >> kernel32.ReadProcessMemory.argtypes = ( >> wintypes.HANDLE, # _In_ hProcess >> wintypes.LPCVOID, # _In_ lpBaseAddress >> wintypes.LPVOID, # _Out_ lpBuffer >> wintypes.SIZE_T, # _In_ nSize >> wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead >> >> if __name__ == '__main__': >> import sys >> >> if len(sys.argv) == 4: >> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION | >> PROCESS_VM_READ, False, int(sys.argv[1])) >> base_address = int(sys.argv[2]) >> block_size = int(sys.argv[3]) >> elif len(sys.argv) == 1: >> ph = kernel32.GetCurrentProcess() >> source_array = (wintypes.DWORD * 10)(*range(10)) >> base_address = ctypes.addressof(source_array) >> block_size = ctypes.sizeof(source_array) >> else: >> sys.exit('Usage: %s pid base_address block_size' % >> sys.argv[0]) >> >> address_list = range(base_address, base_address + block_size, >> ctypes.sizeof(wintypes.DWORD)) >> data = wintypes.DWORD() >> >> for address in address_list: >> kernel32.ReadProcessMemory(ph, address, ctypes.byref(data), >> ctypes.sizeof(data), None) >> print('%x: %d' % (address, data.value)) >> >> This script defaults to a demo that reads an array of DWORD values >> from its own process. You can also provide it the PID, base address, >> and block size to read from another process. You could extend this >> with another option to configure the type of data read (e.g. char, >> float) based on simple ctypes format codes, e.g. "L" for a DWORD, >> where "L" is the value of `wintypes.DWORD._type_`. Or instead follow >> WinDbg conventions (e.g. db, dw, dd). >> >> Note that I assign an errcheck function for the OpenProcess and >> ReadProcessMemory function pointers. In this case both use the same >> _check_zero function, which raises an OSError (or WindowsError in 2.x) >> when the call fails. Idiomatic Python programming uses exceptions for >> error handling and resource management (i.e. try/except/finally). Get >> the error code from the exception's `winerror` attribute when handling >> it. Here's the complete list of WinAPI error codes: >> >> https://msdn.microsoft.com/en-us/library/ms681381 >> > > --f403045d96aebec8a80543531868 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">what does this do?<div><br></div><div>source_array =3D (wi= ntypes.DWORD * 10)(*range(10))<br></div></div><div class=3D"gmail_extra"><b= r><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at 11:40 AM, Michael C <s= pan dir=3D"ltr"><<a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a>></span> wrote:<br><block= quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc= solid;padding-left:1ex"><div dir=3D"ltr">How do I tell it to scan for doub= le?=C2=A0<div>Also, how do I specify the target process?</div><div><br></di= v><div>Thax</div></div><div class=3D"HOEnZb"><div class=3D"h5"><div class= =3D"gmail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at 6:3= 0 AM, eryk sun <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" t= arget=3D"_blank">[email protected]</a>></span> wrote:<br><blockquote cla= ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa= dding-left:1ex"><span>On Sat, Dec 10, 2016 at 12:12 AM, Michael C<br> <<a href=3D"mailto:[email protected]" target=3D"_blank">mys= [email protected]<wbr>m</a>> wrote:<br> > Here is my entire current work in progress:<br> ><br> > #import modules<br> > import ctypes<br> > import time<br> <br> </span>[snip]<br> <br> Here's a working example for ReadProcessMemory.<br> <br> =C2=A0 =C2=A0 import ctypes<br> =C2=A0 =C2=A0 from ctypes import wintypes<br> <span><br> =C2=A0 =C2=A0 kernel32 =3D ctypes.WinDLL('kernel32', use_last_error= =3DTrue)<br> <br> </span>=C2=A0 =C2=A0 PROCESS_VM_READ=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0=3D 0x0010<br> =C2=A0 =C2=A0 PROCESS_QUERY_INFORMATION =3D 0x0400<br> <br> =C2=A0 =C2=A0 if not hasattr(wintypes, 'SIZE_T'):<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T =3D ctypes.c_size_t<br> <br> =C2=A0 =C2=A0 if not hasattr(wintypes, 'PSIZE_T'):<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T =3D ctypes.POINTER(wintypes.SI= ZE_T<wbr>)<br> <br> =C2=A0 =C2=A0 def _check_zero(result, func, args):<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 """ Check for zero or NULL retur= n value. """<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 if not result:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinError(ctypes.get_= las<wbr>t_error())<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 return args<br> <br> =C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68317= 9" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>= us/library/ms683179</a><br> =C2=A0 =C2=A0 kernel32.GetCurrentProcess.res<wbr>type =3D wintypes.HANDLE<b= r> <br> =C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68432= 0" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>= us/library/ms684320</a><br> =C2=A0 =C2=A0 kernel32.OpenProcess.errcheck =3D _check_zero<br> =C2=A0 =C2=A0 kernel32.OpenProcess.restype =3D wintypes.HANDLE<br> <br> =C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68055= 3" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>= us/library/ms680553</a><br> =C2=A0 =C2=A0 kernel32.ReadProcessMemory.err<wbr>check =3D _check_zero<br> =C2=A0 =C2=A0 kernel32.ReadProcessMemory.arg<wbr>types =3D (<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.HANDLE,=C2=A0 # _In_=C2=A0 hProcess<br= > =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPCVOID, # _In_=C2=A0 lpBaseAddress<br= > =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPVOID,=C2=A0 # _Out_ lpBuffer<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T,=C2=A0 # _In_=C2=A0 nSize<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead<b= r> <br> =C2=A0 =C2=A0 if __name__ =3D=3D '__main__':<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 import sys<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 if len(sys.argv) =3D=3D 4:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.OpenProcess(PROCE= SS_Q<wbr>UERY_INFORMATION |<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 PROCE= SS_VM_READ, False, int(sys.argv[1]))<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D int(sys.argv[2])= <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size=C2=A0 =3D int(sys.argv= [3])<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 elif len(sys.argv) =3D=3D 1:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProcess= ()<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 source_array =3D (wintypes.DWORD = * 10)(*range(10))<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D ctypes.addressof= (source_array)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size =3D ctypes.sizeof(sour= ce_array)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Usage: %s pid base_= address block_size' % sys.argv[0])<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 address_list =3D range(base_address, base_addre= ss + block_size,<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(wintypes.DWORD)<wbr>)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 data =3D wintypes.DWORD()<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 for address in address_list:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 kernel32.ReadProcessMemory(ph, ad= dress, ctypes.byref(data),<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(data)= , None)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 print('%x: %d' % (address= , data.value))<br> <br> This script defaults to a demo that reads an array of DWORD values<br> from its own process. You can also provide it the PID, base address,<br> and block size to read from another process. You could extend this<br> with another option to configure the type of data read (e.g. char,<br> float) based on simple ctypes format codes, e.g. "L" for a DWORD,= <br> where "L" is the value of `wintypes.DWORD._type_`. Or instead fol= low<br> WinDbg conventions (e.g. db, dw, dd).<br> <br> Note that I assign an errcheck function for the OpenProcess and<br> ReadProcessMemory function pointers. In this case both use the same<br> _check_zero function, which raises an OSError (or WindowsError in 2.x)<br> when the call fails. Idiomatic Python programming uses exceptions for<br> error handling and resource management (i.e. try/except/finally). Get<br> the error code from the exception's `winerror` attribute when handling<= br> it. Here's the complete list of WinAPI error codes:<br> <br> <a href=3D"https://msdn.microsoft.com/en-us/library/ms681381" rel=3D"norefe= rrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/library/ms681= 381</a><br> </blockquote></div><br></div> </div></div></blockquote></div><br></div> --f403045d96aebec8a80543531868-- --===============5706304202059171093== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today.http://sdm.link/xeonphi --===============5706304202059171093== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ctypes-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ctypes-users --===============5706304202059171093==--