Re: How come this is different?
Michael C <[email protected]> Tue, 13 Dec 2016 11:00:50 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1jCkGEb4ib1a6bZpurjh0QKO86eBpnakZuL=s7mPk2Gfw@mail.gmail.com> |
--===============1154384761746810439==
Content-Type: multipart/alternative; boundary=94eb2c062b0ac79eb505438ed6aa
--94eb2c062b0ac79eb505438ed6aa
Content-Type: text/plain; charset=UTF-8
I get that this part would basically ensure the scanner find the address of
source
array itself, but I have been trying for several days to change that into a
generic
description so I can find any value I want, without success. What should I
put down
instead for "source_array"?
ph = kernel32.GetCurrentProcess()
count = 10
source_array = (dtype * count)(*range(10))
address = ctypes.addressof(source_array)
block_size here means the size of the memory the target process uses right?
Or does it mean something else?
block_size = min(mbi.RegionSize - (address - mbi.BaseAddress),
ctypes.sizeof(dtype) * count)
thx!
On Sat, Dec 10, 2016 at 3:26 PM, Michael C <[email protected]>
wrote:
> i have to go to work, will take a look later!
>
> thx!
>
> On Sat, Dec 10, 2016 at 3:25 PM eryk sun <[email protected]> wrote:
>
>> On Sat, Dec 10, 2016 at 9:30 PM, Michael C
>>
>> <[email protected]> wrote:
>>
>> > I am stuck on which line of information to feed to ReadmemoryProcess
>> with
>>
>> > this, I think I properly retrieved the information from Virtualqueryex
>>
>>
>>
>> Here's an example that uses VirtualQueryEx to determine whether the
>>
>> specified address is allocated and readable. If so, it reads up to
>>
>> `count` double-precision floats via ReadProcessMemory, but it won't
>>
>> read past the allocated region size.
>>
>>
>>
>> import ctypes
>>
>> from ctypes import wintypes
>>
>>
>>
>> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>
>>
>>
>> PROCESS_VM_READ = 0x0010
>>
>> PROCESS_QUERY_INFORMATION = 0x0400
>>
>>
>>
>> MEM_COMMIT = 0x00001000
>>
>> MEM_RESERVE = 0x00002000
>>
>> MEM_FREE = 0x00010000
>>
>> MEM_PRIVATE = 0x00020000
>>
>> MEM_MAPPED = 0x00040000
>>
>> MEM_IMAGE = 0x01000000
>>
>>
>>
>> PAGE_NOACCESS = 0x00000001
>>
>> PAGE_READONLY = 0x00000002
>>
>> PAGE_READWRITE = 0x00000004
>>
>> PAGE_WRITECOPY = 0x00000008
>>
>> PAGE_EXECUTE = 0x00000010
>>
>> PAGE_EXECUTE_READ = 0x00000020
>>
>> PAGE_EXECUTE_READWRITE = 0x00000040
>>
>> PAGE_EXECUTE_WRITECOPY = 0x00000080
>>
>> PAGE_GUARD = 0x00000100
>>
>> PAGE_NOCACHE = 0x00000200
>>
>> PAGE_WRITECOMBINE = 0x00000400
>>
>> PAGE_TARGETS_INVALID = 0x40000000
>>
>>
>>
>> if not hasattr(wintypes, 'PVOID'):
>>
>> wintypes.PVOID = wintypes.LPVOID
>>
>>
>>
>> if not hasattr(wintypes, 'SIZE_T'):
>>
>> wintypes.SIZE_T = ctypes.c_size_t
>>
>>
>>
>> if not hasattr(wintypes, 'PSIZE_T'):
>>
>> wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>>
>>
>>
>> class MEMORY_BASIC_INFORMATION(ctypes.Structure):
>>
>> _fields_ = (('BaseAddress', wintypes.PVOID),
>>
>> ('AllocationBase', wintypes.PVOID),
>>
>> ('AllocationProtect', wintypes.DWORD),
>>
>> ('RegionSize', wintypes.SIZE_T),
>>
>> ('State', wintypes.DWORD),
>>
>> ('Protect', wintypes.DWORD),
>>
>> ('Type', wintypes.DWORD))
>>
>>
>>
>> PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)
>>
>>
>>
>> def _check_zero(result, func, args):
>>
>> """ Check for zero or NULL return value. """
>>
>> if not result:
>>
>> raise ctypes.WinError(ctypes.get_last_error())
>>
>> return args
>>
>>
>>
>> # https://msdn.microsoft.com/en-us/library/ms683179
>>
>> kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>>
>>
>>
>> # https://msdn.microsoft.com/en-us/library/ms684320
>>
>> kernel32.OpenProcess.errcheck = _check_zero
>>
>> kernel32.OpenProcess.restype = wintypes.HANDLE
>>
>>
>>
>> # https://msdn.microsoft.com/en-us/library/ms680553
>>
>> kernel32.ReadProcessMemory.errcheck = _check_zero
>>
>> kernel32.ReadProcessMemory.argtypes = (
>>
>> wintypes.HANDLE, # _In_ hProcess
>>
>> wintypes.LPCVOID, # _In_ lpBaseAddress
>>
>> wintypes.LPVOID, # _Out_ lpBuffer
>>
>> wintypes.SIZE_T, # _In_ nSize
>>
>> wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>>
>>
>>
>> # https://msdn.microsoft.com/en-us/library/aa366907
>>
>> kernel32.VirtualQueryEx.errcheck = _check_zero
>>
>> kernel32.VirtualQueryEx.restype = wintypes.SIZE_T
>>
>> kernel32.VirtualQueryEx.argtypes = (
>>
>> wintypes.HANDLE, # _In_ hProcess
>>
>> wintypes.LPCVOID, # _In_opt_ lpAddress
>>
>> PMEMORY_BASIC_INFORMATION, # _Out_ lpBuffer
>>
>> wintypes.SIZE_T) # _In_ dwLength
>>
>>
>>
>> if __name__ == '__main__':
>>
>> import sys
>>
>>
>>
>> dtype = ctypes.c_double
>>
>>
>>
>> if len(sys.argv) == 4:
>>
>> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>>
>> PROCESS_VM_READ, False, int(sys.argv[1]))
>>
>> address = int(sys.argv[2], 16)
>>
>> count = int(sys.argv[3])
>>
>> elif len(sys.argv) == 1:
>>
>> ph = kernel32.GetCurrentProcess()
>>
>> count = 10
>>
>> source_array = (dtype * count)(*range(10))
>>
>> address = ctypes.addressof(source_array)
>>
>> else:
>>
>> sys.exit('Usage: %s pid address count' % sys.argv[0])
>>
>>
>>
>> mbi = MEMORY_BASIC_INFORMATION()
>>
>> kernel32.VirtualQueryEx(ph, address, ctypes.byref(mbi),
>>
>> ctypes.sizeof(mbi))
>>
>>
>>
>> if mbi.State & MEM_FREE:
>>
>> sys.exit('Address not allocated')
>>
>> if mbi.State & MEM_RESERVE:
>>
>> sys.exit('Address reserved but not committed')
>>
>> if mbi.Protect & PAGE_NOACCESS:
>>
>> sys.exit('Address not accessible')
>>
>>
>>
>> block_size = min(mbi.RegionSize - (address - mbi.BaseAddress),
>>
>> ctypes.sizeof(dtype) * count)
>>
>> address_list = range(address, address + block_size,
>>
>> ctypes.sizeof(dtype))
>>
>>
>>
>> input('Press enter to list %d values, or Ctrl+Break to quit\n'
>>
>> % len(address_list))
>>
>>
>>
>> data = dtype()
>>
>> for address in address_list:
>>
>> kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>>
>> ctypes.sizeof(data), None)
>>
>> print('%x: %f' % (address, data.value))
>>
>>
--94eb2c062b0ac79eb505438ed6aa
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>I get that this part would basically ensure the scann=
er find the address of source</div><div>array itself, but I have been tryin=
g for several days to change that into a generic</div><div>description so I=
can find any value I want, without success. What should I put down</div><d=
iv>instead for "source_array"?</div><div><br></div><div>ph =3D ke=
rnel32.GetCurrentProcess()</div><div>count =3D 10</div><div>source_array =
=3D (dtype * count)(*range(10))</div><div>address =3D ctypes.addressof(sour=
ce_array)</div><div><br></div><div><br></div><div>block_size here means the=
size of the memory the target process uses right?</div><div>Or does it mea=
n something else?</div><div><br></div><div>block_size =3D min(mbi.RegionSiz=
e - (address - mbi.BaseAddress),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(dt=
ype) * count)</div><div><br></div><div><br></div><div>thx!</div></div><div =
class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Sat, Dec 10, 2016 a=
t 3:26 PM, Michael C <span dir=3D"ltr"><<a href=3D"mailto:mysecretrobotf=
[email protected]" target=3D"_blank">[email protected]</a>><=
/span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8=
ex;border-left:1px #ccc solid;padding-left:1ex"><div>i have to go to work, =
will take a look later!</div><div><br></div><div>thx!<div><div class=3D"h5"=
><br><div class=3D"gmail_quote"><div>On Sat, Dec 10, 2016 at 3:25 PM eryk s=
un <<a href=3D"mailto:[email protected]" target=3D"_blank">eryksun@gmail=
.com</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Sat, Dec 10,=
2016 at 9:30 PM, Michael C<br class=3D"m_555296832871345257gmail_msg"><br>=
<<a href=3D"mailto:[email protected]" class=3D"m_5552968328=
71345257gmail_msg" target=3D"_blank">mysecretrobotfactory@gmail.<wbr>com</a=
>> wrote:<br class=3D"m_555296832871345257gmail_msg"><br>> I am stuck=
on which line of information to feed to ReadmemoryProcess with<br class=3D=
"m_555296832871345257gmail_msg"><br>> this, I think I properly retrieved=
the information from Virtualqueryex<br class=3D"m_555296832871345257gmail_=
msg"><br><br class=3D"m_555296832871345257gmail_msg"><br>Here's an exam=
ple that uses VirtualQueryEx to determine whether the<br class=3D"m_5552968=
32871345257gmail_msg"><br>specified address is allocated and readable. If s=
o, it reads up to<br class=3D"m_555296832871345257gmail_msg"><br>`count` do=
uble-precision floats via ReadProcessMemory, but it won't<br class=3D"m=
_555296832871345257gmail_msg"><br>read past the allocated region size.<br c=
lass=3D"m_555296832871345257gmail_msg"><br><br class=3D"m_55529683287134525=
7gmail_msg"><br>=C2=A0 =C2=A0 import ctypes<br class=3D"m_55529683287134525=
7gmail_msg"><br>=C2=A0 =C2=A0 from ctypes import wintypes<br class=3D"m_555=
296832871345257gmail_msg"><br><br class=3D"m_555296832871345257gmail_msg"><=
br>=C2=A0 =C2=A0 kernel32 =3D ctypes.WinDLL('kernel32', use_last_er=
ror=3DTrue)<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D"m_5=
55296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PROCESS_VM_READ=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0=3D 0x0010<br class=3D"m_555296832871345257gmail=
_msg"><br>=C2=A0 =C2=A0 PROCESS_QUERY_INFORMATION =3D 0x0400<br class=3D"m_=
555296832871345257gmail_msg"><br><br class=3D"m_555296832871345257gmail_msg=
"><br>=C2=A0 =C2=A0 MEM_COMMIT=C2=A0 =3D 0x00001000<br class=3D"m_555296832=
871345257gmail_msg"><br>=C2=A0 =C2=A0 MEM_RESERVE =3D 0x00002000<br class=
=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 MEM_FREE=C2=A0 =C2=A0 =
=3D 0x00010000<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0=
MEM_PRIVATE =3D 0x00020000<br class=3D"m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 MEM_MAPPED=C2=A0 =3D 0x00040000<br class=3D"m_555296832871345=
257gmail_msg"><br>=C2=A0 =C2=A0 MEM_IMAGE=C2=A0 =C2=A0=3D 0x01000000<br cla=
ss=3D"m_555296832871345257gmail_msg"><br><br class=3D"m_555296832871345257g=
mail_msg"><br>=C2=A0 =C2=A0 PAGE_NOACCESS=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=3D 0x00000001<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=
=A0 PAGE_READONLY=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D 0x00000002<br class=
=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_READWRITE=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0=3D 0x00000004<br class=3D"m_555296832871345257g=
mail_msg"><br>=C2=A0 =C2=A0 PAGE_WRITECOPY=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0=3D 0x00000008<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=
=A0 PAGE_EXECUTE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D 0x00000010<br =
class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_EXECUTE_READ=
=C2=A0 =C2=A0 =C2=A0 =3D 0x00000020<br class=3D"m_555296832871345257gmail_m=
sg"><br>=C2=A0 =C2=A0 PAGE_EXECUTE_READWRITE =3D 0x00000040<br class=3D"m_5=
55296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_EXECUTE_WRITECOPY =3D 0x=
00000080<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_=
GUARD=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D 0x00000100<br clas=
s=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_NOCACHE=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D 0x00000200<br class=3D"m_555296832871=
345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_WRITECOMBINE=C2=A0 =C2=A0 =C2=A0 =
=3D 0x00000400<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0=
PAGE_TARGETS_INVALID=C2=A0 =C2=A0=3D 0x40000000<br class=3D"m_555296832871=
345257gmail_msg"><br><br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0=
=C2=A0 if not hasattr(wintypes, 'PVOID'):<br class=3D"m_5552968328=
71345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PVOID =3D winty=
pes.LPVOID<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D"m_55=
5296832871345257gmail_msg"><br>=C2=A0 =C2=A0 if not hasattr(wintypes, '=
SIZE_T'):<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 wintypes.SIZE_T =3D ctypes.c_size_t<br class=3D"m_55529683287=
1345257gmail_msg"><br><br class=3D"m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 if not hasattr(wintypes, 'PSIZE_T'):<br class=3D"m_55529=
6832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T =
=3D ctypes.POINTER(wintypes.SIZE_<wbr>T)<br class=3D"m_555296832871345257gm=
ail_msg"><br><br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
class MEMORY_BASIC_INFORMATION(<wbr>ctypes.Structure):<br class=3D"m_555296=
832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 _fields_ =3D (('=
BaseAddress',=C2=A0 =C2=A0 =C2=A0 =C2=A0wintypes.PVOID),<br class=3D"m_=
555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ('AllocationBase',=C2=A0 =C2=A0 wintype=
s.PVOID),<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('AllocationProtec=
t', wintypes.DWORD),<br class=3D"m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Re=
gionSize',=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T),<br class=3D"m_5=
55296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ('State',=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0wintypes.DWORD),<br class=3D"m_555296832871345257gmail_=
msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 ('Protect',=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0wintypes.DW=
ORD),<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Type',=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.DWORD))<br class=3D"m_55529=
6832871345257gmail_msg"><br><br class=3D"m_555296832871345257gmail_msg"><br=
>=C2=A0 =C2=A0 PMEMORY_BASIC_INFORMATION =3D ctypes.POINTER(MEMORY_BASIC_<w=
br>INFORMATION)<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D=
"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 def _check_zero(result, f=
unc, args):<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 """ Check for zero or NULL return value. "=
;""<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 if not result:<br class=3D"m_555296832871345257gmail_msg"><br=
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinError(ctypes.get=
_<wbr>last_error())<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 return args<br class=3D"m_555296832871345257gmail_msg"=
><br><br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 # <a hre=
f=3D"https://msdn.microsoft.com/en-us/library/ms683179" rel=3D"noreferrer" =
class=3D"m_555296832871345257gmail_msg" target=3D"_blank">https://msdn.micr=
osoft.com/en-<wbr>us/library/ms683179</a><br class=3D"m_555296832871345257g=
mail_msg"><br>=C2=A0 =C2=A0 kernel32.GetCurrentProcess.<wbr>restype =3D win=
types.HANDLE<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D"m_=
555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 # <a href=3D"https://msdn.mi=
crosoft.com/en-us/library/ms684320" rel=3D"noreferrer" class=3D"m_555296832=
871345257gmail_msg" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us=
/library/ms684320</a><br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0=
=C2=A0 kernel32.OpenProcess.errcheck =3D _check_zero<br class=3D"m_5552968=
32871345257gmail_msg"><br>=C2=A0 =C2=A0 kernel32.OpenProcess.restype =3D wi=
ntypes.HANDLE<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D"m=
_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 # <a href=3D"https://msdn.m=
icrosoft.com/en-us/library/ms680553" rel=3D"noreferrer" class=3D"m_55529683=
2871345257gmail_msg" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>u=
s/library/ms680553</a><br class=3D"m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 kernel32.ReadProcessMemory.<wbr>errcheck =3D _check_zero<br clas=
s=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 kernel32.ReadProcessM=
emory.<wbr>argtypes =3D (<br class=3D"m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.HANDLE,=C2=A0 # _In_=C2=A0 hProcess<br=
class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wi=
ntypes.LPCVOID, # _In_=C2=A0 lpBaseAddress<br class=3D"m_555296832871345257=
gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPVOID,=C2=A0 # _Out_ l=
pBuffer<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0=
=C2=A0 wintypes.SIZE_T,=C2=A0 # _In_=C2=A0 nSize<br class=3D"m_55529683287=
1345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T) # _Out_=
lpNumberOfBytesRead<br class=3D"m_555296832871345257gmail_msg"><br><br cla=
ss=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 # <a href=3D"https:/=
/msdn.microsoft.com/en-us/library/aa366907" rel=3D"noreferrer" class=3D"m_5=
55296832871345257gmail_msg" target=3D"_blank">https://msdn.microsoft.com/en=
-<wbr>us/library/aa366907</a><br class=3D"m_555296832871345257gmail_msg"><b=
r>=C2=A0 =C2=A0 kernel32.VirtualQueryEx.<wbr>errcheck =3D _check_zero<br cl=
ass=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 kernel32.VirtualQue=
ryEx.<wbr>restype =3D wintypes.SIZE_T<br class=3D"m_555296832871345257gmail=
_msg"><br>=C2=A0 =C2=A0 kernel32.VirtualQueryEx.<wbr>argtypes =3D (<br clas=
s=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintype=
s.HANDLE,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# _In_=C2=A0 =C2=A0 =C2=
=A0hProcess<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 wintypes.LPCVOID,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # _In_opt=
_ lpAddress<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 PMEMORY_BASIC_INFORMATION, # _Out_=C2=A0 =C2=A0 lpBuffer<br c=
lass=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wint=
ypes.SIZE_T)=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# _In_=C2=A0 =C2=A0 =
=C2=A0dwLength<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D"=
m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 if __name__ =3D=3D '__=
main__':<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 import sys<br class=3D"m_555296832871345257gmail_msg"><br><br=
class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 dt=
ype =3D ctypes.c_double<br class=3D"m_555296832871345257gmail_msg"><br><br =
class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if =
len(sys.argv) =3D=3D 4:<br class=3D"m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.OpenProcess(PROCESS_=
<wbr>QUERY_INFORMATION |<br class=3D"m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 PROCESS_=
VM_READ, False, int(sys.argv[1]))<br class=3D"m_555296832871345257gmail_msg=
"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 address =3D int(sys.argv[2]=
, 16)<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 count =3D int(sys.argv[3])<br class=3D"m_5552968328713=
45257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 elif len(sys.argv) =3D=3D 1=
:<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProcess()<br class=3D"m_5552968=
32871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 count =
=3D 10<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 source_array =3D (dtype * count)(*range(10))<br class=
=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 address =3D ctypes.addressof(source_array)<br class=3D"m_55529683287=
1345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br class=3D"m_55529=
6832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.e=
xit('Usage: %s pid address count' % sys.argv[0])<br class=3D"m_5552=
96832871345257gmail_msg"><br><br class=3D"m_555296832871345257gmail_msg"><b=
r>=C2=A0 =C2=A0 =C2=A0 =C2=A0 mbi =3D MEMORY_BASIC_INFORMATION()<br class=
=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 kernel32=
.VirtualQueryEx(ph, address, ctypes.byref(mbi),<br class=3D"m_5552968328713=
45257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof=
(mbi))<br class=3D"m_555296832871345257gmail_msg"><br><br class=3D"m_555296=
832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if mbi.State & M=
EM_FREE:<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Address not allocated')<br class=
=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if mbi.S=
tate & MEM_RESERVE:<br class=3D"m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Address reserved but n=
ot committed')<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 if mbi.Protect & PAGE_NOACCESS:<br class=3D"m_5552=
96832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.=
exit('Address not accessible')<br class=3D"m_555296832871345257gmai=
l_msg"><br><br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 block_size =3D min(mbi.RegionSize - (address - mbi.BaseAddres=
s),<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.si=
zeof(dtype) * count)<br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 address_list =3D range(address, address + block_size,<=
br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0ctypes.sizeof(dtype))<br class=3D"m_555296832871345257gmail_msg"><br><br=
class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 in=
put('Press enter to list %d values, or Ctrl+Break to quit\n'<br cla=
ss=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 % len(address_list))<br class=3D"m_555296832871345257gmail_m=
sg"><br><br class=3D"m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 data =3D dtype()<br class=3D"m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 for address in address_list:<br class=3D"m_5552=
96832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 kern=
el32.ReadProcessMemory(ph, address, ctypes.byref(data),<br class=3D"m_55529=
6832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ctypes.sizeof(data), None)<br class=3D"m_555296832871345257gmail=
_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 print('%x: %f' =
% (address, data.value))<br class=3D"m_555296832871345257gmail_msg"><br></b=
lockquote></div></div></div></div></blockquote></div><br></div>
--94eb2c062b0ac79eb505438ed6aa--
--===============1154384761746810439==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
--===============1154384761746810439==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============1154384761746810439==--