Re: How come this is different?
Michael C <[email protected]> Sat, 10 Dec 2016 12:05:47 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1h+NMpX5KyZZ1FMmCOUaj_=ApxNTS4T5X_BqSUp-6_L6g@mail.gmail.com> |
--===============1231625063160641803==
Content-Type: multipart/alternative; boundary=94eb2c05be948799e50543536545
--94eb2c05be948799e50543536545
Content-Type: text/plain; charset=UTF-8
this is what i use at the moment for virtualqueryEX
from ctypes import c_long, c_uint, c_char, c_ushort
from ctypes import Structure
from ctypes import *
import ctypes
BYTE = c_ubyte
WORD = c_ushort
DWORD = c_ulong
LPBYTE = POINTER(c_ubyte)
LPTSTR = POINTER(c_char)
HANDLE = c_void_p
PVOID = c_void_p
LPVOID = c_void_p
UINT_PTR = c_ulong
SIZE_T = c_ulong
class MEMORY_BASIC_INFORMATION(Structure):
_fields_ = [
("BaseAddress", PVOID),
("AllocationBase", PVOID),
("AllocationProtect", DWORD),
("RegionSize", SIZE_T),
("State", DWORD),
("Protect", DWORD),
("Type", DWORD),
]
user32 = ctypes.WinDLL('user32', use_last_error=True)
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010
base = 0
memory_basic_information = MEMORY_BASIC_INFORMATION()
ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
4900)
print(kernel32.VirtualQueryEx(ph, base, byref(memory_basic_information),
sizeof(memory_basic_information)))
On Sat, Dec 10, 2016 at 11:52 AM, Michael C <[email protected]>
wrote:
> Shouldn't I use VirtualQueryEX to find out these values?
>
> ph = kernel32.GetCurrentProcess()
> source_array = (wintypes.DWORD * 10)(*range(10))
> base_address = ctypes.addressof(source_array)
> block_size = ctypes.sizeof(source_array)
>
>
>
> On Sat, Dec 10, 2016 at 11:44 AM, Michael C <mysecretrobotfactory@gmail.
> com> wrote:
>
>> what does this do?
>>
>> source_array = (wintypes.DWORD * 10)(*range(10))
>>
>> On Sat, Dec 10, 2016 at 11:40 AM, Michael C <
>> [email protected]> wrote:
>>
>>> How do I tell it to scan for double?
>>> Also, how do I specify the target process?
>>>
>>> Thax
>>>
>>> On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <[email protected]> wrote:
>>>
>>>> On Sat, Dec 10, 2016 at 12:12 AM, Michael C
>>>> <[email protected]> wrote:
>>>> > Here is my entire current work in progress:
>>>> >
>>>> > #import modules
>>>> > import ctypes
>>>> > import time
>>>>
>>>> [snip]
>>>>
>>>> Here's a working example for ReadProcessMemory.
>>>>
>>>> import ctypes
>>>> from ctypes import wintypes
>>>>
>>>> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>>>
>>>> PROCESS_VM_READ = 0x0010
>>>> PROCESS_QUERY_INFORMATION = 0x0400
>>>>
>>>> if not hasattr(wintypes, 'SIZE_T'):
>>>> wintypes.SIZE_T = ctypes.c_size_t
>>>>
>>>> if not hasattr(wintypes, 'PSIZE_T'):
>>>> wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>>>>
>>>> def _check_zero(result, func, args):
>>>> """ Check for zero or NULL return value. """
>>>> if not result:
>>>> raise ctypes.WinError(ctypes.get_last_error())
>>>> return args
>>>>
>>>> # https://msdn.microsoft.com/en-us/library/ms683179
>>>> kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>>>>
>>>> # https://msdn.microsoft.com/en-us/library/ms684320
>>>> kernel32.OpenProcess.errcheck = _check_zero
>>>> kernel32.OpenProcess.restype = wintypes.HANDLE
>>>>
>>>> # https://msdn.microsoft.com/en-us/library/ms680553
>>>> kernel32.ReadProcessMemory.errcheck = _check_zero
>>>> kernel32.ReadProcessMemory.argtypes = (
>>>> wintypes.HANDLE, # _In_ hProcess
>>>> wintypes.LPCVOID, # _In_ lpBaseAddress
>>>> wintypes.LPVOID, # _Out_ lpBuffer
>>>> wintypes.SIZE_T, # _In_ nSize
>>>> wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>>>>
>>>> if __name__ == '__main__':
>>>> import sys
>>>>
>>>> if len(sys.argv) == 4:
>>>> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>>>> PROCESS_VM_READ, False, int(sys.argv[1]))
>>>> base_address = int(sys.argv[2])
>>>> block_size = int(sys.argv[3])
>>>> elif len(sys.argv) == 1:
>>>> ph = kernel32.GetCurrentProcess()
>>>> source_array = (wintypes.DWORD * 10)(*range(10))
>>>> base_address = ctypes.addressof(source_array)
>>>> block_size = ctypes.sizeof(source_array)
>>>> else:
>>>> sys.exit('Usage: %s pid base_address block_size' %
>>>> sys.argv[0])
>>>>
>>>> address_list = range(base_address, base_address + block_size,
>>>> ctypes.sizeof(wintypes.DWORD))
>>>> data = wintypes.DWORD()
>>>>
>>>> for address in address_list:
>>>> kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>>>> ctypes.sizeof(data), None)
>>>> print('%x: %d' % (address, data.value))
>>>>
>>>> This script defaults to a demo that reads an array of DWORD values
>>>> from its own process. You can also provide it the PID, base address,
>>>> and block size to read from another process. You could extend this
>>>> with another option to configure the type of data read (e.g. char,
>>>> float) based on simple ctypes format codes, e.g. "L" for a DWORD,
>>>> where "L" is the value of `wintypes.DWORD._type_`. Or instead follow
>>>> WinDbg conventions (e.g. db, dw, dd).
>>>>
>>>> Note that I assign an errcheck function for the OpenProcess and
>>>> ReadProcessMemory function pointers. In this case both use the same
>>>> _check_zero function, which raises an OSError (or WindowsError in 2.x)
>>>> when the call fails. Idiomatic Python programming uses exceptions for
>>>> error handling and resource management (i.e. try/except/finally). Get
>>>> the error code from the exception's `winerror` attribute when handling
>>>> it. Here's the complete list of WinAPI error codes:
>>>>
>>>> https://msdn.microsoft.com/en-us/library/ms681381
>>>>
>>>
>>>
>>
>
--94eb2c05be948799e50543536545
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">this is what i use at the moment for virtualqueryEX<div><b=
r></div><div><br></div><div><br><div><br></div><div><div>from ctypes import=
c_long, c_uint, c_char, c_ushort</div><div>from ctypes import Structure</d=
iv><div>from ctypes import *</div><div>import ctypes</div><div><br></div><d=
iv>BYTE =C2=A0 =C2=A0 =C2=A0=3D c_ubyte</div><div>WORD =C2=A0 =C2=A0 =C2=A0=
=3D c_ushort</div><div>DWORD =C2=A0 =C2=A0 =3D c_ulong</div><div>LPBYTE =C2=
=A0 =C2=A0=3D POINTER(c_ubyte)</div><div>LPTSTR =C2=A0 =C2=A0=3D POINTER(c_=
char)</div><div>HANDLE =C2=A0 =C2=A0=3D c_void_p</div><div>PVOID =C2=A0 =C2=
=A0 =3D c_void_p</div><div>LPVOID =C2=A0 =C2=A0=3D c_void_p</div><div>UINT_=
PTR =C2=A0=3D c_ulong</div><div>SIZE_T =C2=A0 =C2=A0=3D c_ulong</div><div><=
br></div><div><br></div><div><br></div><div>class MEMORY_BASIC_INFORMATION(=
Structure):</div><div>=C2=A0 =C2=A0 _fields_ =3D [</div><div>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 ("BaseAddress", PVOID),</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ("AllocationBase", PVOID),</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ("AllocationProtect", DWORD),</div><div>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 ("RegionSize", SIZE_T),</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ("State", DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 ("Protect", DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&q=
uot;Type", DWORD),</div><div>]</div><div><br></div><div><br></div><div=
><br></div><div>user32 =3D ctypes.WinDLL('user32', use_last_error=
=3DTrue)</div><div>kernel32 =3D ctypes.WinDLL('kernel32', use_last_=
error=3DTrue)</div><div><br></div><div>PROCESS_QUERY_INFORMATION =3D 0x0400=
</div><div>PROCESS_VM_READ =3D 0x0010</div><div><br></div><div>base =3D 0</=
div><div>memory_basic_information =3D MEMORY_BASIC_INFORMATION()</div><div>=
ph =3D kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False=
, 4900)</div><div><br></div><div>print(kernel32.VirtualQueryEx(ph, base, by=
ref(memory_basic_information),<br></div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0sizeof(memory_basic_information)))</div></div></div></div><div cl=
ass=3D"gmail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at =
11:52 AM, Michael C <span dir=3D"ltr"><<a href=3D"mailto:mysecretrobotfa=
[email protected]" target=3D"_blank">[email protected]</a>></=
span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8e=
x;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">Shouldn'=
;t I use VirtualQueryEX to find out these values?<span class=3D""><div><br>=
</div><div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProce=
ss()</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 source_array =3D (wintypes.DWORD=
* 10)(*range(10))</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D c=
types.addressof(source_array)</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 block_s=
ize =3D ctypes.sizeof(source_array)</div></div><div><br></div><div><br></di=
v></span></div><div class=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_=
extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at 11:44 AM, Mic=
hael C <span dir=3D"ltr"><<a href=3D"mailto:[email protected]=
om" target=3D"_blank">mysecretrobotfactory@gmail.<wbr>com</a>></span> wr=
ote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border=
-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">what does this do?<=
span><div><br></div><div>source_array =3D (wintypes.DWORD * 10)(*range(10))=
<br></div></span></div><div class=3D"m_872627715796344014HOEnZb"><div class=
=3D"m_872627715796344014h5"><div class=3D"gmail_extra"><br><div class=3D"gm=
ail_quote">On Sat, Dec 10, 2016 at 11:40 AM, Michael C <span dir=3D"ltr">&l=
t;<a href=3D"mailto:[email protected]" target=3D"_blank">mysec=
[email protected]<wbr>m</a>></span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex"><div dir=3D"ltr">How do I tell it to scan for double?=C2=A0<d=
iv>Also, how do I specify the target process?</div><div><br></div><div>Thax=
</div></div><div class=3D"m_872627715796344014m_1486280987998100687HOEnZb">=
<div class=3D"m_872627715796344014m_1486280987998100687h5"><div class=3D"gm=
ail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at 6:30 AM, =
eryk sun <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" target=
=3D"_blank">[email protected]</a>></span> wrote:<br><blockquote class=3D=
"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding=
-left:1ex"><span>On Sat, Dec 10, 2016 at 12:12 AM, Michael C<br>
<<a href=3D"mailto:[email protected]" target=3D"_blank">mys=
[email protected]<wbr>m</a>> wrote:<br>
> Here is my entire current work in progress:<br>
><br>
> #import modules<br>
> import ctypes<br>
> import time<br>
<br>
</span>[snip]<br>
<br>
Here's a working example for ReadProcessMemory.<br>
<br>
=C2=A0 =C2=A0 import ctypes<br>
=C2=A0 =C2=A0 from ctypes import wintypes<br>
<span><br>
=C2=A0 =C2=A0 kernel32 =3D ctypes.WinDLL('kernel32', use_last_error=
=3DTrue)<br>
<br>
</span>=C2=A0 =C2=A0 PROCESS_VM_READ=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0=3D 0x0010<br>
=C2=A0 =C2=A0 PROCESS_QUERY_INFORMATION =3D 0x0400<br>
<br>
=C2=A0 =C2=A0 if not hasattr(wintypes, 'SIZE_T'):<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T =3D ctypes.c_size_t<br>
<br>
=C2=A0 =C2=A0 if not hasattr(wintypes, 'PSIZE_T'):<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T =3D ctypes.POINTER(wintypes.SI=
ZE_T<wbr>)<br>
<br>
=C2=A0 =C2=A0 def _check_zero(result, func, args):<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 """ Check for zero or NULL retur=
n value. """<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 if not result:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinError(ctypes.get_=
las<wbr>t_error())<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 return args<br>
<br>
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68317=
9" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>=
us/library/ms683179</a><br>
=C2=A0 =C2=A0 kernel32.GetCurrentProcess.res<wbr>type =3D wintypes.HANDLE<b=
r>
<br>
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68432=
0" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>=
us/library/ms684320</a><br>
=C2=A0 =C2=A0 kernel32.OpenProcess.errcheck =3D _check_zero<br>
=C2=A0 =C2=A0 kernel32.OpenProcess.restype =3D wintypes.HANDLE<br>
<br>
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68055=
3" rel=3D"noreferrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>=
us/library/ms680553</a><br>
=C2=A0 =C2=A0 kernel32.ReadProcessMemory.err<wbr>check =3D _check_zero<br>
=C2=A0 =C2=A0 kernel32.ReadProcessMemory.arg<wbr>types =3D (<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.HANDLE,=C2=A0 # _In_=C2=A0 hProcess<br=
>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPCVOID, # _In_=C2=A0 lpBaseAddress<br=
>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPVOID,=C2=A0 # _Out_ lpBuffer<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T,=C2=A0 # _In_=C2=A0 nSize<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead<b=
r>
<br>
=C2=A0 =C2=A0 if __name__ =3D=3D '__main__':<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 import sys<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 if len(sys.argv) =3D=3D 4:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.OpenProcess(PROCE=
SS_Q<wbr>UERY_INFORMATION |<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 PROCE=
SS_VM_READ, False, int(sys.argv[1]))<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D int(sys.argv[2])=
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size=C2=A0 =3D int(sys.argv=
[3])<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 elif len(sys.argv) =3D=3D 1:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProcess=
()<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 source_array =3D (wintypes.DWORD =
* 10)(*range(10))<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 base_address =3D ctypes.addressof=
(source_array)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 block_size =3D ctypes.sizeof(sour=
ce_array)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Usage: %s pid base_=
address block_size' % sys.argv[0])<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 address_list =3D range(base_address, base_addre=
ss + block_size,<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(wintypes.DWORD)<wbr>)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 data =3D wintypes.DWORD()<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 for address in address_list:<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 kernel32.ReadProcessMemory(ph, ad=
dress, ctypes.byref(data),<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(data)=
, None)<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 print('%x: %d' % (address=
, data.value))<br>
<br>
This script defaults to a demo that reads an array of DWORD values<br>
from its own process. You can also provide it the PID, base address,<br>
and block size to read from another process. You could extend this<br>
with another option to configure the type of data read (e.g. char,<br>
float) based on simple ctypes format codes, e.g. "L" for a DWORD,=
<br>
where "L" is the value of `wintypes.DWORD._type_`. Or instead fol=
low<br>
WinDbg conventions (e.g. db, dw, dd).<br>
<br>
Note that I assign an errcheck function for the OpenProcess and<br>
ReadProcessMemory function pointers. In this case both use the same<br>
_check_zero function, which raises an OSError (or WindowsError in 2.x)<br>
when the call fails. Idiomatic Python programming uses exceptions for<br>
error handling and resource management (i.e. try/except/finally). Get<br>
the error code from the exception's `winerror` attribute when handling<=
br>
it. Here's the complete list of WinAPI error codes:<br>
<br>
<a href=3D"https://msdn.microsoft.com/en-us/library/ms681381" rel=3D"norefe=
rrer" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/library/ms681=
381</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
--94eb2c05be948799e50543536545--
--===============1231625063160641803==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
--===============1231625063160641803==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============1231625063160641803==--