Re: How come this is different?

--===============8401283152514939444==
Content-Type: multipart/alternative; boundary=f403045d96aec320c10543547acb

--f403045d96aec320c10543547acb
Content-Type: text/plain; charset=UTF-8

I believe the memory_basic_information in my code off of VirtualQueryEx
somehow turns into something to feed ReadProcessMemory, but I am lost there.

I know I have to fix this somehow:
source_array = (wintypes.DWORD * 10)(*range(10))

On Sat, Dec 10, 2016 at 1:19 PM, Michael C <[email protected]>
wrote:

> oh I see, it finds itself in its own process.
>
> Can you tell me how to use VirtualQueryEx to get the parameters to feed
> ReadprocessMemory? Here is what I have
>
>
> code:
>
> from ctypes import c_long, c_uint, c_char, c_ushort
> from ctypes import Structure
> from ctypes import *
> import ctypes
> from ctypes import wintypes
>
> BYTE      = c_ubyte
> WORD      = c_ushort
> DWORD     = c_ulong
> LPBYTE    = POINTER(c_ubyte)
> LPTSTR    = POINTER(c_char)
> HANDLE    = c_void_p
> PVOID     = c_void_p
> LPVOID    = c_void_p
> UINT_PTR  = c_ulong
> SIZE_T    = c_ulong
>
>
>
> class MEMORY_BASIC_INFORMATION(Structure):
>     _fields_ = [
>         ("BaseAddress", PVOID),
>         ("AllocationBase", PVOID),
>         ("AllocationProtect", DWORD),
>         ("RegionSize", SIZE_T),
>         ("State", DWORD),
>         ("Protect", DWORD),
>         ("Type", DWORD),
> ]
>
>
>
> user32 = ctypes.WinDLL('user32', use_last_error=True)
> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
> PROCESS_QUERY_INFORMATION = 0x0400
> PROCESS_VM_READ = 0x0010
>
> base = 0
> memory_basic_information = MEMORY_BASIC_INFORMATION()
>
> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
> 4900)
>
> print(kernel32.VirtualQueryEx(ph, base, byref(memory_basic_information),
>                                sizeof(memory_basic_information)))
>
>
>
>
>
>
>
>
>
> On Sat, Dec 10, 2016 at 1:16 PM, eryk sun <[email protected]> wrote:
>
>> On Sat, Dec 10, 2016 at 7:44 PM, Michael C
>> <[email protected]> wrote:
>> > what does this do?
>> >
>> > source_array = (wintypes.DWORD * 10)(*range(10))
>>
>> That's creating an array of 10 DWORD values, {0,1,2,3,4,5,6,7,8,9},
>> which is used for the the demo. ctypes arrays are initialized with
>> positional arguments, which is why it uses the splat (*) operator on
>> range(10).
>>
>
>

--f403045d96aec320c10543547acb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I believe the memory_basic_information in my code off of V=
irtualQueryEx somehow turns into something to feed ReadProcessMemory, but I=
 am lost there.<div><br></div><div>I know I have to fix this somehow:</div>=
<div>source_array =3D (wintypes.DWORD * 10)(*range(10))<br></div></div><div=
 class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 =
at 1:19 PM, Michael C <span dir=3D"ltr">&lt;<a href=3D"mailto:mysecretrobot=
[email protected]" target=3D"_blank">[email protected]</a>&gt;=
</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .=
8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div>oh I=
 see, it finds itself in its own process.</div><div><br></div>Can you tell =
me how to use VirtualQueryEx to get the parameters to feed ReadprocessMemor=
y? Here is what I have<div><br></div><div><br></div><div>code:</div><div><b=
r></div><div><span class=3D""><div>from ctypes import c_long, c_uint, c_cha=
r, c_ushort</div><div>from ctypes import Structure</div><div>from ctypes im=
port *</div></span><span class=3D""><div>import ctypes</div><div>from ctype=
s import wintypes</div><div><br></div></span><span class=3D""><div>BYTE =C2=
=A0 =C2=A0 =C2=A0=3D c_ubyte</div><div>WORD =C2=A0 =C2=A0 =C2=A0=3D c_ushor=
t</div><div>DWORD =C2=A0 =C2=A0 =3D c_ulong</div><div>LPBYTE =C2=A0 =C2=A0=
=3D POINTER(c_ubyte)</div><div>LPTSTR =C2=A0 =C2=A0=3D POINTER(c_char)</div=
><div>HANDLE =C2=A0 =C2=A0=3D c_void_p</div><div>PVOID =C2=A0 =C2=A0 =3D c_=
void_p</div><div>LPVOID =C2=A0 =C2=A0=3D c_void_p</div><div>UINT_PTR =C2=A0=
=3D c_ulong</div><div>SIZE_T =C2=A0 =C2=A0=3D c_ulong</div><div><br></div><=
div><br></div><div><br></div><div>class MEMORY_BASIC_INFORMATION(<wbr>Struc=
ture):</div><div>=C2=A0 =C2=A0 _fields_ =3D [</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 (&quot;BaseAddress&quot;, PVOID),</div><div>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 (&quot;AllocationBase&quot;, PVOID),</div><div>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 (&quot;AllocationProtect&quot;, DWORD),</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 (&quot;RegionSize&quot;, SIZE_T),</div><div>=C2=A0 =C2=A0 =C2=A0=
 =C2=A0 (&quot;State&quot;, DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (=
&quot;Protect&quot;, DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 (&quot;T=
ype&quot;, DWORD),</div><div>]</div><div><br></div><div><br></div><div><br>=
</div></span><span class=3D""><div>user32 =3D ctypes.WinDLL(&#39;user32&#39=
;, use_last_error=3DTrue)</div></span><span class=3D""><div>kernel32 =3D ct=
ypes.WinDLL(&#39;kernel32&#39;, use_last_error=3DTrue)</div><div><br></div>=
</span><span class=3D""><div>PROCESS_QUERY_INFORMATION =3D 0x0400</div><div=
>PROCESS_VM_READ =3D 0x0010</div><div><br></div></span><span class=3D""><di=
v>base =3D 0</div><div>memory_basic_information =3D MEMORY_BASIC_INFORMATIO=
N()</div><div><br></div><div>ph =3D kernel32.OpenProcess(PROCESS_<wbr>QUERY=
_INFORMATION|PROCESS_VM_<wbr>READ,False, 4900)</div><div><br></div><div>pri=
nt(kernel32.VirtualQueryEx(<wbr>ph, base, byref(memory_basic_<wbr>informati=
on),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sizeof(memory_basic_<wb=
r>information)))</div></span></div><div><div class=3D"h5"><div><br></div><d=
iv><br></div><div><br></div><div><br></div><div><br></div><div><br></div><d=
iv><br></div><div><br></div><div class=3D"gmail_extra"><br><div class=3D"gm=
ail_quote">On Sat, Dec 10, 2016 at 1:16 PM, eryk sun <span dir=3D"ltr">&lt;=
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a=
>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0p=
x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><s=
pan class=3D"m_3428741166974246879gmail-">On Sat, Dec 10, 2016 at 7:44 PM, =
Michael C<br>
&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">mys=
[email protected]<wbr>m</a>&gt; wrote:<br>
&gt; what does this do?<br>
&gt;<br>
&gt; source_array =3D (wintypes.DWORD * 10)(*range(10))<br>
<br>
</span>That&#39;s creating an array of 10 DWORD values, {0,1,2,3,4,5,6,7,8,=
9},<br>
which is used for the the demo. ctypes arrays are initialized with<br>
positional arguments, which is why it uses the splat (*) operator on<br>
range(10).<br>
</blockquote></div><br></div></div></div></div>
</blockquote></div><br></div>

--f403045d96aec320c10543547acb--


--===============8401283152514939444==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
--===============8401283152514939444==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============8401283152514939444==--