Re: How come this is different?

--===============7217090028628761743==
Content-Type: multipart/alternative; boundary=94eb2c05be946dee160543546bf7

--94eb2c05be946dee160543546bf7
Content-Type: text/plain; charset=UTF-8

oh I see, it finds itself in its own process.

Can you tell me how to use VirtualQueryEx to get the parameters to feed
ReadprocessMemory? Here is what I have


code:

from ctypes import c_long, c_uint, c_char, c_ushort
from ctypes import Structure
from ctypes import *
import ctypes
from ctypes import wintypes

BYTE      = c_ubyte
WORD      = c_ushort
DWORD     = c_ulong
LPBYTE    = POINTER(c_ubyte)
LPTSTR    = POINTER(c_char)
HANDLE    = c_void_p
PVOID     = c_void_p
LPVOID    = c_void_p
UINT_PTR  = c_ulong
SIZE_T    = c_ulong



class MEMORY_BASIC_INFORMATION(Structure):
    _fields_ = [
        ("BaseAddress", PVOID),
        ("AllocationBase", PVOID),
        ("AllocationProtect", DWORD),
        ("RegionSize", SIZE_T),
        ("State", DWORD),
        ("Protect", DWORD),
        ("Type", DWORD),
]



user32 = ctypes.WinDLL('user32', use_last_error=True)
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

base = 0
memory_basic_information = MEMORY_BASIC_INFORMATION()

ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
4900)

print(kernel32.VirtualQueryEx(ph, base, byref(memory_basic_information),
                               sizeof(memory_basic_information)))









On Sat, Dec 10, 2016 at 1:16 PM, eryk sun <[email protected]> wrote:

> On Sat, Dec 10, 2016 at 7:44 PM, Michael C
> <[email protected]> wrote:
> > what does this do?
> >
> > source_array = (wintypes.DWORD * 10)(*range(10))
>
> That's creating an array of 10 DWORD values, {0,1,2,3,4,5,6,7,8,9},
> which is used for the the demo. ctypes arrays are initialized with
> positional arguments, which is why it uses the splat (*) operator on
> range(10).
>

--94eb2c05be946dee160543546bf7
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>oh I see, it finds itself in its own process.</div><d=
iv><br></div>Can you tell me how to use VirtualQueryEx to get the parameter=
s to feed ReadprocessMemory? Here is what I have<div><br></div><div><br></d=
iv><div>code:</div><div><br></div><div><div>from ctypes import c_long, c_ui=
nt, c_char, c_ushort</div><div>from ctypes import Structure</div><div>from =
ctypes import *</div><div>import ctypes</div><div>from ctypes import wintyp=
es</div><div><br></div><div>BYTE =C2=A0 =C2=A0 =C2=A0=3D c_ubyte</div><div>=
WORD =C2=A0 =C2=A0 =C2=A0=3D c_ushort</div><div>DWORD =C2=A0 =C2=A0 =3D c_u=
long</div><div>LPBYTE =C2=A0 =C2=A0=3D POINTER(c_ubyte)</div><div>LPTSTR =
=C2=A0 =C2=A0=3D POINTER(c_char)</div><div>HANDLE =C2=A0 =C2=A0=3D c_void_p=
</div><div>PVOID =C2=A0 =C2=A0 =3D c_void_p</div><div>LPVOID =C2=A0 =C2=A0=
=3D c_void_p</div><div>UINT_PTR =C2=A0=3D c_ulong</div><div>SIZE_T =C2=A0 =
=C2=A0=3D c_ulong</div><div><br></div><div><br></div><div><br></div><div>cl=
ass MEMORY_BASIC_INFORMATION(Structure):</div><div>=C2=A0 =C2=A0 _fields_ =
=3D [</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;BaseAddress&quot;, PVOID=
),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;AllocationBase&quot;, PVOID=
),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;AllocationProtect&quot;, DW=
ORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;RegionSize&quot;, SIZE_T=
),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;State&quot;, DWORD),</div><=
div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;Protect&quot;, DWORD),</div><div>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;Type&quot;, DWORD),</div><div>]</div><div><=
br></div><div><br></div><div><br></div><div>user32 =3D ctypes.WinDLL(&#39;u=
ser32&#39;, use_last_error=3DTrue)</div><div>kernel32 =3D ctypes.WinDLL(&#3=
9;kernel32&#39;, use_last_error=3DTrue)</div><div><br></div><div>PROCESS_QU=
ERY_INFORMATION =3D 0x0400</div><div>PROCESS_VM_READ =3D 0x0010</div><div><=
br></div><div>base =3D 0</div><div>memory_basic_information =3D MEMORY_BASI=
C_INFORMATION()</div><div><br></div><div>ph =3D kernel32.OpenProcess(PROCES=
S_QUERY_INFORMATION|PROCESS_VM_READ,False, 4900)</div><div><br></div><div>p=
rint(kernel32.VirtualQueryEx(ph, base, byref(memory_basic_information),</di=
v><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sizeof(memory_basic_informatio=
n)))</div></div><div><br></div><div><br></div><div><br></div><div><br></div=
><div><br></div><div><br></div><div><br></div><div><br></div><div class=3D"=
gmail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at 1:16 PM=
, eryk sun <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" targe=
t=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><span class=3D"gmail-">On Sat, Dec 10, 201=
6 at 7:44 PM, Michael C<br>
&lt;<a href=3D"mailto:[email protected]">mysecretrobotfactory@=
gmail.<wbr>com</a>&gt; wrote:<br>
&gt; what does this do?<br>
&gt;<br>
&gt; source_array =3D (wintypes.DWORD * 10)(*range(10))<br>
<br>
</span>That&#39;s creating an array of 10 DWORD values, {0,1,2,3,4,5,6,7,8,=
9},<br>
which is used for the the demo. ctypes arrays are initialized with<br>
positional arguments, which is why it uses the splat (*) operator on<br>
range(10).<br>
</blockquote></div><br></div></div>

--94eb2c05be946dee160543546bf7--


--===============7217090028628761743==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
--===============7217090028628761743==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============7217090028628761743==--