Re: How come this is different?
Michael C <[email protected]> Sat, 10 Dec 2016 13:30:23 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1iat7oDmvtGeLYTyDWGx+=-88_JsZ0ROQWG8-KsxitOCw@mail.gmail.com> |
--===============1942352186859990199==
Content-Type: multipart/alternative; boundary=001a113a3cd80c8826054354941b
--001a113a3cd80c8826054354941b
Content-Type: text/plain; charset=UTF-8
I am stuck on which line of information to feed to ReadmemoryProcess with
this, I think I properly retrieved the information from Virtualqueryex
from ctypes import c_long, c_uint, c_char, c_ushort
from ctypes import Structure
from ctypes import *
import ctypes
from ctypes import wintypes
BYTE = c_ubyte
WORD = c_ushort
DWORD = c_ulong
LPBYTE = POINTER(c_ubyte)
LPTSTR = POINTER(c_char)
HANDLE = c_void_p
PVOID = c_void_p
LPVOID = c_void_p
UINT_PTR = c_ulong
SIZE_T = c_ulong
class MEMORY_BASIC_INFORMATION(Structure):
_fields_ = [
("BaseAddress", PVOID),
("AllocationBase", PVOID),
("AllocationProtect", DWORD),
("RegionSize", SIZE_T),
("State", DWORD),
("Protect", DWORD),
("Type", DWORD),
]
user32 = ctypes.WinDLL('user32', use_last_error=True)
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010
base = 0
memory_basic_information = MEMORY_BASIC_INFORMATION()
ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
4900)
kernel32.VirtualQueryEx(ph, base, byref(memory_basic_information),
sizeof(memory_basic_information))
print(memory_basic_information.BaseAddress)
print(memory_basic_information.AllocationBase)
print(memory_basic_information.AllocationProtect)
print(memory_basic_information.RegionSize)
print(memory_basic_information.State)
print(memory_basic_information.Protect)
print(memory_basic_information.Type)
On Sat, Dec 10, 2016 at 1:25 PM, eryk sun <[email protected]> wrote:
> On Sat, Dec 10, 2016 at 7:52 PM, Michael C
> <[email protected]> wrote:
> > Shouldn't I use VirtualQueryEX to find out these values?
> >
> > ph = kernel32.GetCurrentProcess()
> > source_array = (wintypes.DWORD * 10)(*range(10))
> > base_address = ctypes.addressof(source_array)
> > block_size = ctypes.sizeof(source_array)
>
> VirtualQueryEx is used to query for information about a memory block
> (e.g. the allocation base address, region size, and protection). You
> would call it to get the base address and size if you wanted to read
> an entire allocated region, which would typically be a block of memory
> that's managed by a heap or some other allocator (e.g. Python's
> small-object allocator).
>
--001a113a3cd80c8826054354941b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">I am stuck on which line of information to feed to Readmem=
oryProcess with this, I think I properly retrieved the information from Vir=
tualqueryex<div><br></div><div><br></div><div><div>from ctypes import c_lon=
g, c_uint, c_char, c_ushort</div><div>from ctypes import Structure</div><di=
v>from ctypes import *</div><div>import ctypes</div><div>from ctypes import=
wintypes</div><div><br></div><div>BYTE =C2=A0 =C2=A0 =C2=A0=3D c_ubyte</di=
v><div>WORD =C2=A0 =C2=A0 =C2=A0=3D c_ushort</div><div>DWORD =C2=A0 =C2=A0 =
=3D c_ulong</div><div>LPBYTE =C2=A0 =C2=A0=3D POINTER(c_ubyte)</div><div>LP=
TSTR =C2=A0 =C2=A0=3D POINTER(c_char)</div><div>HANDLE =C2=A0 =C2=A0=3D c_v=
oid_p</div><div>PVOID =C2=A0 =C2=A0 =3D c_void_p</div><div>LPVOID =C2=A0 =
=C2=A0=3D c_void_p</div><div>UINT_PTR =C2=A0=3D c_ulong</div><div>SIZE_T =
=C2=A0 =C2=A0=3D c_ulong</div><div><br></div><div><br></div><div><br></div>=
<div>class MEMORY_BASIC_INFORMATION(Structure):</div><div>=C2=A0 =C2=A0 _fi=
elds_ =3D [</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("BaseAddress",=
PVOID),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("AllocationBase",=
PVOID),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("AllocationProtect&quo=
t;, DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("RegionSize", =
SIZE_T),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("State", DWORD),<=
/div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("Protect", DWORD),</div><d=
iv>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ("Type", DWORD),</div><div>]</div>=
<div><br></div><div><br></div><div><br></div><div>user32 =3D ctypes.WinDLL(=
'user32', use_last_error=3DTrue)</div><div>kernel32 =3D ctypes.WinD=
LL('kernel32', use_last_error=3DTrue)</div><div><br></div><div>PROC=
ESS_QUERY_INFORMATION =3D 0x0400</div><div>PROCESS_VM_READ =3D 0x0010</div>=
<div><br></div><div>base =3D 0</div><div>memory_basic_information =3D MEMOR=
Y_BASIC_INFORMATION()</div><div><br></div><div>ph =3D kernel32.OpenProcess(=
PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False, 4900)</div><div><br></div>=
<div>kernel32.VirtualQueryEx(ph, base, byref(memory_basic_information),</di=
v><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sizeof(memory_basic_informatio=
n))</div><div><br></div><div>print(memory_basic_information.BaseAddress)</d=
iv><div>print(memory_basic_information.AllocationBase)</div><div>print(memo=
ry_basic_information.AllocationProtect)</div><div>print(memory_basic_inform=
ation.RegionSize)</div><div>print(memory_basic_information.State)</div><div=
>print(memory_basic_information.Protect)</div><div>print(memory_basic_infor=
mation.Type)</div></div><div><br></div></div><div class=3D"gmail_extra"><br=
><div class=3D"gmail_quote">On Sat, Dec 10, 2016 at 1:25 PM, eryk sun <span=
dir=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"_blank">ery=
[email protected]</a>></span> wrote:<br><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><spa=
n class=3D"">On Sat, Dec 10, 2016 at 7:52 PM, Michael C<br>
<<a href=3D"mailto:[email protected]">mysecretrobotfactory@=
gmail.<wbr>com</a>> wrote:<br>
> Shouldn't I use VirtualQueryEX to find out these values?<br>
><br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ph =3D kernel32.GetCurrentProcess()<b=
r>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0source_array =3D (wintypes.DWORD * 10=
)(*range(10))<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0base_address =3D ctypes.addressof(sou=
rce_array)<br>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0block_size =3D ctypes.sizeof(source_a=
rray)<br>
<br>
</span>VirtualQueryEx is used to query for information about a memory block=
<br>
(e.g. the allocation base address, region size, and protection). You<br>
would call it to get the base address and size if you wanted to read<br>
an entire allocated region, which would typically be a block of memory<br>
that's managed by a heap or some other allocator (e.g. Python's<br>
small-object allocator).<br>
</blockquote></div><br></div>
--001a113a3cd80c8826054354941b--
--===============1942352186859990199==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
--===============1942352186859990199==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============1942352186859990199==--