Re: How come this is different?
Michael C <[email protected]> Sat, 10 Dec 2016 11:52:52 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1hyygRngA-sVuySskH8W9wehRYD2LxxN6jdnd2bjuPZtg@mail.gmail.com> |
--===============6833843332047032515==
Content-Type: multipart/alternative; boundary=94eb2c062b0a4a7c5905435337da
--94eb2c062b0a4a7c5905435337da
Content-Type: text/plain; charset=UTF-8
Shouldn't I use VirtualQueryEX to find out these values?
ph = kernel32.GetCurrentProcess()
source_array = (wintypes.DWORD * 10)(*range(10))
base_address = ctypes.addressof(source_array)
block_size = ctypes.sizeof(source_array)
On Sat, Dec 10, 2016 at 11:44 AM, Michael C <[email protected]>
wrote:
> what does this do?
>
> source_array = (wintypes.DWORD * 10)(*range(10))
>
> On Sat, Dec 10, 2016 at 11:40 AM, Michael C <mysecretrobotfactory@gmail.
> com> wrote:
>
>> How do I tell it to scan for double?
>> Also, how do I specify the target process?
>>
>> Thax
>>
>> On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <[email protected]> wrote:
>>
>>> On Sat, Dec 10, 2016 at 12:12 AM, Michael C
>>> <[email protected]> wrote:
>>> > Here is my entire current work in progress:
>>> >
>>> > #import modules
>>> > import ctypes
>>> > import time
>>>
>>> [snip]
>>>
>>> Here's a working example for ReadProcessMemory.
>>>
>>> import ctypes
>>> from ctypes import wintypes
>>>
>>> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>>
>>> PROCESS_VM_READ = 0x0010
>>> PROCESS_QUERY_INFORMATION = 0x0400
>>>
>>> if not hasattr(wintypes, 'SIZE_T'):
>>> wintypes.SIZE_T = ctypes.c_size_t
>>>
>>> if not hasattr(wintypes, 'PSIZE_T'):
>>> wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>>>
>>> def _check_zero(result, func, args):
>>> """ Check for zero or NULL return value. """
>>> if not result:
>>> raise ctypes.WinError(ctypes.get_last_error())
>>> return args
>>>
>>> # https://msdn.microsoft.com/en-us/library/ms683179
>>> kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>>>
>>> # https://msdn.microsoft.com/en-us/library/ms684320
>>> kernel32.OpenProcess.errcheck = _check_zero
>>> kernel32.OpenProcess.restype = wintypes.HANDLE
>>>
>>> # https://msdn.microsoft.com/en-us/library/ms680553
>>> kernel32.ReadProcessMemory.errcheck = _check_zero
>>> kernel32.ReadProcessMemory.argtypes = (
>>> wintypes.HANDLE, # _In_ hProcess
>>> wintypes.LPCVOID, # _In_ lpBaseAddress
>>> wintypes.LPVOID, # _Out_ lpBuffer
>>> wintypes.SIZE_T, # _In_ nSize
>>> wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>>>
>>> if __name__ == '__main__':
>>> import sys
>>>
>>> if len(sys.argv) == 4:
>>> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>>> PROCESS_VM_READ, False, int(sys.argv[1]))
>>> base_address = int(sys.argv[2])
>>> block_size = int(sys.argv[3])
>>> elif len(sys.argv) == 1:
>>> ph = kernel32.GetCurrentProcess()
>>> source_array = (wintypes.DWORD * 10)(*range(10))
>>> base_address = ctypes.addressof(source_array)
>>> block_size = ctypes.sizeof(source_array)
>>> else:
>>> sys.exit('Usage: %s pid base_address block_size' %
>>> sys.argv[0])
>>>
>>> address_list = range(base_address, base_address + block_size,
>>> ctypes.sizeof(wintypes.DWORD))
>>> data = wintypes.DWORD()
>>>
>>> for address in address_list:
>>> kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>>> ctypes.sizeof(data), None)
>>> print('%x: %d' % (address, data.value))
>>>
>>> This script defaults to a demo that reads an array of DWORD values
>>> from its own process. You can also provide it the PID, base address,
>>> and block size to read from another process. You could extend this
>>> with another option to configure the type of data read (e.g. char,
>>> float) based on simple ctypes format codes, e.g. "L" for a DWORD,
>>> where "L" is the value of `wintypes.DWORD._type_`. Or instead follow
>>> WinDbg conventions (e.g. db, dw, dd).
>>>
>>> Note that I assign an errcheck function for the OpenProcess and
>>> ReadProcessMemory function pointers. In this case both use the same
>>> _check_zero function, which raises an OSError (or WindowsError in 2.x)
>>> when the call fails. Idiomatic Python programming uses exceptions for
>>> error handling and resource management (i.e. try/except/finally). Get
>>> the error code from the exception's `winerror` attribute when handling
>>> it. Here's the complete list of WinAPI error codes:
>>>
>>> https://msdn.microsoft.com/en-us/library/ms681381
>>>
>>
>>
>
--94eb2c062b0a4a7c5905435337da
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">Shouldn't I use VirtualQueryEX to find out these value=
s?<div><br></div><div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetC=
urrentProcess()</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 source_array =3D (win=
types.DWORD * 10)(*range(10))</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 base_ad=
dress =3D ctypes.addressof(source_array)</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 block_size =3D ctypes.sizeof(source_array)</div></div><div><br></div><d=
iv><br></div></div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote=
">On Sat, Dec 10, 2016 at 11:44 AM, Michael C <span dir=3D"ltr"><<a href=
=3D"mailto:[email protected]" target=3D"_blank">mysecretrobotf=
[email protected]</a>></span> wrote:<br><blockquote class=3D"gmail_quote"=
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><d=
iv dir=3D"ltr">what does this do?<span class=3D""><div><br></div><div>sourc=
e_array =3D (wintypes.DWORD * 10)(*range(10))<br></div></span></div><div cl=
ass=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_extra"><br><div class=
=3D"gmail_quote">On Sat, Dec 10, 2016 at 11:40 AM, Michael C <span dir=3D"l=
tr"><<a href=3D"mailto:[email protected]" target=3D"_blank"=
>mysecretrobotfactory@gmail.<wbr>com</a>></span> wrote:<br><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex"><div dir=3D"ltr">How do I tell it to scan for double?=C2=
=A0<div>Also, how do I specify the target process?</div><div><br></div><div=
>Thax</div></div><div class=3D"m_1486280987998100687HOEnZb"><div class=3D"m=
_1486280987998100687h5"><div class=3D"gmail_extra"><br><div class=3D"gmail_=
quote">On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <span dir=3D"ltr"><<a h=
ref=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>>=
;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Sat, Dec 10, 201=
6 at 12:12 AM, Michael C<br>
<<a href=3D"mailto:[email protected]" target=3D"_blank">mys=
[email protected]<wbr>m</a>> wrote:<br>
> Here is my entire current work in progress:<br>
><br>
> #import modules<br>
> import ctypes<br>
> import time<br>
<br>
</span>[snip]<br>
<br>
Here's a working example for ReadProcessMemory.<br>
<br>
=C2=A0 =C2=A0 import ctypes<br>
=C2=A0 =C2=A0 from ctypes import wintypes<br>
<span><br>
=C2=A0 =C2=A0 kernel32 =3D ctypes.WinDLL('kernel32', use_last_error=
=3DTrue)<br>
<br>
</span>=C2=A0 =C2=A0 PROCESS_VM_READ=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0=3D 0x0010<br>
=C2=A0 =C2=A0 PROCESS_QUERY_INFORMATION =3D 0x0400<br>
<br>
=C2=A0 =C2=A0 if not hasattr(wintypes, 'SIZE_T'):<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T =3D ctypes.c_size_t<br>
<br>
=C2=A0 =C2=A0 if not hasattr(wintypes, 'PSIZE_T'):<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T =3D ctypes.POINTER(wintypes.SI=
ZE_T<wbr>)<br>
<br>
=C2=A0 =C2=A0 def _check_zero(result, func, args):<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 """ Check for zero or NULL retur=
n value. """<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 if not result:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinError(ctypes.get_=
las<wbr>t_error())<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 return args<br>
<br>
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68317=
9" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>=
us/library/ms683179</a><br>
=C2=A0 =C2=A0 kernel32.GetCurrentProcess.res<wbr>type =3D wintypes.HANDLE<b=
r>
<br>
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68432=
0" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>=
us/library/ms684320</a><br>
=C2=A0 =C2=A0 kernel32.OpenProcess.errcheck =3D _check_zero<br>
=C2=A0 =C2=A0 kernel32.OpenProcess.restype =3D wintypes.HANDLE<br>
<br>
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68055=
3" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>=
us/library/ms680553</a><br>
=C2=A0 =C2=A0 kernel32.ReadProcessMemory.err<wbr>check =3D _check_zero<br>
=C2=A0 =C2=A0 kernel32.ReadProcessMemory.arg<wbr>types =3D (<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.HANDLE,=C2=A0 # _In_=C2=A0 hProcess<br=
>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPCVOID, # _In_=C2=A0 lpBaseAddress<br=
>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPVOID,=C2=A0 # _Out_ lpBuffer<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T,=C2=A0 # _In_=C2=A0 nSize<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead<b=
r>
<br>
=C2=A0 =C2=A0 if __name__ =3D=3D '__main__':<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 import sys<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 if len(sys.argv) =3D=3D 4:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.OpenProcess(PROCE=
SS_Q<wbr>UERY_INFORMATION |<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 PROCE=
SS_VM_READ, False, int(sys.argv[1]))<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D int(sys.argv[2])=
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size=C2=A0 =3D int(sys.argv=
[3])<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 elif len(sys.argv) =3D=3D 1:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProcess=
()<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 source_array =3D (wintypes.DWORD =
* 10)(*range(10))<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D ctypes.addressof=
(source_array)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size =3D ctypes.sizeof(sour=
ce_array)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Usage: %s pid base_=
address block_size' % sys.argv[0])<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 address_list =3D range(base_address, base_addre=
ss + block_size,<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(wintypes.DWORD)<wbr>)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 data =3D wintypes.DWORD()<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 for address in address_list:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 kernel32.ReadProcessMemory(ph, ad=
dress, ctypes.byref(data),<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(data)=
, None)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 print('%x: %d' % (address=
, data.value))<br>
<br>
This script defaults to a demo that reads an array of DWORD values<br>
from its own process. You can also provide it the PID, base address,<br>
and block size to read from another process. You could extend this<br>
with another option to configure the type of data read (e.g. char,<br>
float) based on simple ctypes format codes, e.g. "L" for a DWORD,=
<br>
where "L" is the value of `wintypes.DWORD._type_`. Or instead fol=
low<br>
WinDbg conventions (e.g. db, dw, dd).<br>
<br>
Note that I assign an errcheck function for the OpenProcess and<br>
ReadProcessMemory function pointers. In this case both use the same<br>
_check_zero function, which raises an OSError (or WindowsError in 2.x)<br>
when the call fails. Idiomatic Python programming uses exceptions for<br>
error handling and resource management (i.e. try/except/finally). Get<br>
the error code from the exception's `winerror` attribute when handling<=
br>
it. Here's the complete list of WinAPI error codes:<br>
<br>
<a href=3D"https://msdn.microsoft.com/en-us/library/ms681381" rel=3D"norefe=
rrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/library/ms681=
381</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
--94eb2c062b0a4a7c5905435337da--
--===============6833843332047032515==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
--===============6833843332047032515==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============6833843332047032515==--