Re: How come this is different?
Michael C <[email protected]> Tue, 13 Dec 2016 12:06:03 -0800
| Newsgroups | gmane.comp.python.ctypes |
|---|---|
| Message-ID | <CANyKM1iD=A7BWhEPi+c_3x1+-=cwYRgvoiDQNLCrBP=hcAEpow@mail.gmail.com> |
--===============4125513401933029542==
Content-Type: multipart/alternative; boundary=001a114a9eaeff3ae405438fbfde
--001a114a9eaeff3ae405438fbfde
Content-Type: text/plain; charset=UTF-8
I am trying to sort of whether or not my basic memory information parameter
has received the proper values for each of the attritubes, so far, this is
my print out of them, and I don't know if they are right. please take a
look:
import ctypes
from ctypes import wintypes
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_VM_READ = 0x0010
PROCESS_QUERY_INFORMATION = 0x0400
if not hasattr(wintypes, 'PVOID'):
wintypes.PVOID = wintypes.LPVOID
if not hasattr(wintypes, 'SIZE_T'):
wintypes.SIZE_T = ctypes.c_size_t
if not hasattr(wintypes, 'PSIZE_T'):
wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
class MEMORY_BASIC_INFORMATION(ctypes.Structure):
_fields_ = (('BaseAddress', wintypes.PVOID),
('AllocationBase', wintypes.PVOID),
('AllocationProtect', wintypes.DWORD),
('RegionSize', wintypes.SIZE_T),
('State', wintypes.DWORD),
('Protect', wintypes.DWORD),
('Type', wintypes.DWORD))
PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)
dtype = ctypes.c_double
handle = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ, False, 9552)
mbi = MEMORY_BASIC_INFORMATION()
kernel32.VirtualQueryEx(handle, None, ctypes.byref(mbi),
ctypes.sizeof(mbi))
print(mbi.BaseAddress)
print(mbi.AllocationBase)
print(mbi.AllocationProtect)
print(mbi.RegionSize)
print(mbi.State)
print(mbi.Protect)
print(mbi.Type)
------- print out------
None
None
0
2228224
65536
1
0
On Tue, Dec 13, 2016 at 11:00 AM, Michael C <[email protected]>
wrote:
> I get that this part would basically ensure the scanner find the address
> of source
> array itself, but I have been trying for several days to change that into
> a generic
> description so I can find any value I want, without success. What should I
> put down
> instead for "source_array"?
>
> ph = kernel32.GetCurrentProcess()
> count = 10
> source_array = (dtype * count)(*range(10))
> address = ctypes.addressof(source_array)
>
>
> block_size here means the size of the memory the target process uses right?
> Or does it mean something else?
>
> block_size = min(mbi.RegionSize - (address - mbi.BaseAddress),
> ctypes.sizeof(dtype) * count)
>
>
> thx!
>
> On Sat, Dec 10, 2016 at 3:26 PM, Michael C <[email protected]
> > wrote:
>
>> i have to go to work, will take a look later!
>>
>> thx!
>>
>> On Sat, Dec 10, 2016 at 3:25 PM eryk sun <[email protected]> wrote:
>>
>>> On Sat, Dec 10, 2016 at 9:30 PM, Michael C
>>>
>>> <[email protected]> wrote:
>>>
>>> > I am stuck on which line of information to feed to ReadmemoryProcess
>>> with
>>>
>>> > this, I think I properly retrieved the information from Virtualqueryex
>>>
>>>
>>>
>>> Here's an example that uses VirtualQueryEx to determine whether the
>>>
>>> specified address is allocated and readable. If so, it reads up to
>>>
>>> `count` double-precision floats via ReadProcessMemory, but it won't
>>>
>>> read past the allocated region size.
>>>
>>>
>>>
>>> import ctypes
>>>
>>> from ctypes import wintypes
>>>
>>>
>>>
>>> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>>
>>>
>>>
>>> PROCESS_VM_READ = 0x0010
>>>
>>> PROCESS_QUERY_INFORMATION = 0x0400
>>>
>>>
>>>
>>> MEM_COMMIT = 0x00001000
>>>
>>> MEM_RESERVE = 0x00002000
>>>
>>> MEM_FREE = 0x00010000
>>>
>>> MEM_PRIVATE = 0x00020000
>>>
>>> MEM_MAPPED = 0x00040000
>>>
>>> MEM_IMAGE = 0x01000000
>>>
>>>
>>>
>>> PAGE_NOACCESS = 0x00000001
>>>
>>> PAGE_READONLY = 0x00000002
>>>
>>> PAGE_READWRITE = 0x00000004
>>>
>>> PAGE_WRITECOPY = 0x00000008
>>>
>>> PAGE_EXECUTE = 0x00000010
>>>
>>> PAGE_EXECUTE_READ = 0x00000020
>>>
>>> PAGE_EXECUTE_READWRITE = 0x00000040
>>>
>>> PAGE_EXECUTE_WRITECOPY = 0x00000080
>>>
>>> PAGE_GUARD = 0x00000100
>>>
>>> PAGE_NOCACHE = 0x00000200
>>>
>>> PAGE_WRITECOMBINE = 0x00000400
>>>
>>> PAGE_TARGETS_INVALID = 0x40000000
>>>
>>>
>>>
>>> if not hasattr(wintypes, 'PVOID'):
>>>
>>> wintypes.PVOID = wintypes.LPVOID
>>>
>>>
>>>
>>> if not hasattr(wintypes, 'SIZE_T'):
>>>
>>> wintypes.SIZE_T = ctypes.c_size_t
>>>
>>>
>>>
>>> if not hasattr(wintypes, 'PSIZE_T'):
>>>
>>> wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>>>
>>>
>>>
>>> class MEMORY_BASIC_INFORMATION(ctypes.Structure):
>>>
>>> _fields_ = (('BaseAddress', wintypes.PVOID),
>>>
>>> ('AllocationBase', wintypes.PVOID),
>>>
>>> ('AllocationProtect', wintypes.DWORD),
>>>
>>> ('RegionSize', wintypes.SIZE_T),
>>>
>>> ('State', wintypes.DWORD),
>>>
>>> ('Protect', wintypes.DWORD),
>>>
>>> ('Type', wintypes.DWORD))
>>>
>>>
>>>
>>> PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)
>>>
>>>
>>>
>>> def _check_zero(result, func, args):
>>>
>>> """ Check for zero or NULL return value. """
>>>
>>> if not result:
>>>
>>> raise ctypes.WinError(ctypes.get_last_error())
>>>
>>> return args
>>>
>>>
>>>
>>> # https://msdn.microsoft.com/en-us/library/ms683179
>>>
>>> kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>>>
>>>
>>>
>>> # https://msdn.microsoft.com/en-us/library/ms684320
>>>
>>> kernel32.OpenProcess.errcheck = _check_zero
>>>
>>> kernel32.OpenProcess.restype = wintypes.HANDLE
>>>
>>>
>>>
>>> # https://msdn.microsoft.com/en-us/library/ms680553
>>>
>>> kernel32.ReadProcessMemory.errcheck = _check_zero
>>>
>>> kernel32.ReadProcessMemory.argtypes = (
>>>
>>> wintypes.HANDLE, # _In_ hProcess
>>>
>>> wintypes.LPCVOID, # _In_ lpBaseAddress
>>>
>>> wintypes.LPVOID, # _Out_ lpBuffer
>>>
>>> wintypes.SIZE_T, # _In_ nSize
>>>
>>> wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>>>
>>>
>>>
>>> # https://msdn.microsoft.com/en-us/library/aa366907
>>>
>>> kernel32.VirtualQueryEx.errcheck = _check_zero
>>>
>>> kernel32.VirtualQueryEx.restype = wintypes.SIZE_T
>>>
>>> kernel32.VirtualQueryEx.argtypes = (
>>>
>>> wintypes.HANDLE, # _In_ hProcess
>>>
>>> wintypes.LPCVOID, # _In_opt_ lpAddress
>>>
>>> PMEMORY_BASIC_INFORMATION, # _Out_ lpBuffer
>>>
>>> wintypes.SIZE_T) # _In_ dwLength
>>>
>>>
>>>
>>> if __name__ == '__main__':
>>>
>>> import sys
>>>
>>>
>>>
>>> dtype = ctypes.c_double
>>>
>>>
>>>
>>> if len(sys.argv) == 4:
>>>
>>> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>>>
>>> PROCESS_VM_READ, False, int(sys.argv[1]))
>>>
>>> address = int(sys.argv[2], 16)
>>>
>>> count = int(sys.argv[3])
>>>
>>> elif len(sys.argv) == 1:
>>>
>>> ph = kernel32.GetCurrentProcess()
>>>
>>> count = 10
>>>
>>> source_array = (dtype * count)(*range(10))
>>>
>>> address = ctypes.addressof(source_array)
>>>
>>> else:
>>>
>>> sys.exit('Usage: %s pid address count' % sys.argv[0])
>>>
>>>
>>>
>>> mbi = MEMORY_BASIC_INFORMATION()
>>>
>>> kernel32.VirtualQueryEx(ph, address, ctypes.byref(mbi),
>>>
>>> ctypes.sizeof(mbi))
>>>
>>>
>>>
>>> if mbi.State & MEM_FREE:
>>>
>>> sys.exit('Address not allocated')
>>>
>>> if mbi.State & MEM_RESERVE:
>>>
>>> sys.exit('Address reserved but not committed')
>>>
>>> if mbi.Protect & PAGE_NOACCESS:
>>>
>>> sys.exit('Address not accessible')
>>>
>>>
>>>
>>> block_size = min(mbi.RegionSize - (address - mbi.BaseAddress),
>>>
>>> ctypes.sizeof(dtype) * count)
>>>
>>> address_list = range(address, address + block_size,
>>>
>>> ctypes.sizeof(dtype))
>>>
>>>
>>>
>>> input('Press enter to list %d values, or Ctrl+Break to quit\n'
>>>
>>> % len(address_list))
>>>
>>>
>>>
>>> data = dtype()
>>>
>>> for address in address_list:
>>>
>>> kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>>>
>>> ctypes.sizeof(data), None)
>>>
>>> print('%x: %f' % (address, data.value))
>>>
>>>
>
--001a114a9eaeff3ae405438fbfde
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>I am trying to sort of whether or not my basic memory=
information parameter has received the proper values for each of the attri=
tubes, so far, this is my print out of them, and I don't know if they a=
re right. please take a look:</div><div><br></div><div><br></div><div>impor=
t ctypes</div><div>from ctypes import wintypes</div><div><br></div><div>ker=
nel32 =3D ctypes.WinDLL('kernel32', use_last_error=3DTrue)</div><di=
v><br></div><div>PROCESS_VM_READ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D 0x0=
010</div><div>PROCESS_QUERY_INFORMATION =3D 0x0400</div><div><br></div><div=
><br></div><div>if not hasattr(wintypes, 'PVOID'):</div><div>=C2=A0=
=C2=A0 wintypes.PVOID =3D wintypes.LPVOID</div><div><br></div><div>if not =
hasattr(wintypes, 'SIZE_T'):</div><div>=C2=A0 =C2=A0 wintypes.SIZE_=
T =3D ctypes.c_size_t</div><div><br></div><div>if not hasattr(wintypes, =
9;PSIZE_T'):</div><div>=C2=A0 =C2=A0 wintypes.PSIZE_T =3D ctypes.POINTE=
R(wintypes.SIZE_T)</div><div><br></div><div><br></div><div>class MEMORY_BAS=
IC_INFORMATION(ctypes.Structure):</div><div>=C2=A0 =C2=A0 _fields_ =3D ((&#=
39;BaseAddress', =C2=A0 =C2=A0 =C2=A0 wintypes.PVOID),</div><div>=C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('AllocationBase'=
, =C2=A0 =C2=A0wintypes.PVOID),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 ('AllocationProtect', wintypes.DWORD),</di=
v><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Region=
Size', =C2=A0 =C2=A0 =C2=A0 =C2=A0wintypes.SIZE_T),</div><div>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('State', =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.DWORD),</div><div>=C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Protect', =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Type', =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0wintypes.DWORD))</div><div><br></div><div>PMEMOR=
Y_BASIC_INFORMATION =3D ctypes.POINTER(MEMORY_BASIC_INFORMATION)</div><div>=
dtype =3D ctypes.c_double</div><div><br></div><div>handle =3D kernel32.Open=
Process(PROCESS_QUERY_INFORMATION |</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 PROCESS_VM_READ, False, 9552)</div><div><br></d=
iv><div><br></div><div>mbi =3D MEMORY_BASIC_INFORMATION()</div><div><br></d=
iv><div>kernel32.VirtualQueryEx(handle, None, ctypes.byref(mbi),</div><div>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(mbi))</div><div><br></div><div>pr=
int(mbi.BaseAddress)</div><div>print(mbi.AllocationBase)</div><div>print(mb=
i.AllocationProtect)</div><div>print(mbi.RegionSize)</div><div>print(mbi.St=
ate)</div><div>print(mbi.Protect)</div><div>print(mbi.Type)</div><div>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0</div><div><br></div><div><br><=
/div><div>------- print out------=C2=A0</div><div><br></div><div><br></div>=
<div><div>None</div><div>None</div><div>0</div><div>2228224</div><div>65536=
</div><div>1</div><div>0</div></div></div><div class=3D"gmail_extra"><br><d=
iv class=3D"gmail_quote">On Tue, Dec 13, 2016 at 11:00 AM, Michael C <span =
dir=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D=
"_blank">[email protected]</a>></span> wrote:<br><blockquot=
e class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc sol=
id;padding-left:1ex"><div dir=3D"ltr"><div>I get that this part would basic=
ally ensure the scanner find the address of source</div><div>array itself, =
but I have been trying for several days to change that into a generic</div>=
<div>description so I can find any value I want, without success. What shou=
ld I put down</div><div>instead for "source_array"?</div><span cl=
ass=3D""><div><br></div><div>ph =3D kernel32.GetCurrentProcess()</div><div>=
count =3D 10</div><div>source_array =3D (dtype * count)(*range(10))</div><d=
iv>address =3D ctypes.addressof(source_array)</div><div><br></div><div><br>=
</div></span><div>block_size here means the size of the memory the target p=
rocess uses right?</div><div>Or does it mean something else?</div><span cla=
ss=3D""><div><br></div><div>block_size =3D min(mbi.RegionSize - (address - =
mbi.BaseAddress),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(dtype) * count)<=
/div><div><br></div><div><br></div></span><div>thx!</div></div><div class=
=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_extra"><br><div class=3D"=
gmail_quote">On Sat, Dec 10, 2016 at 3:26 PM, Michael C <span dir=3D"ltr">&=
lt;<a href=3D"mailto:[email protected]" target=3D"_blank">myse=
cretrobotfactory@gmail.<wbr>com</a>></span> wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex"><div>i have to go to work, will take a look later!</div><div>=
<br></div><div>thx!<div><div class=3D"m_2599278519846705763h5"><br><div cla=
ss=3D"gmail_quote"><div>On Sat, Dec 10, 2016 at 3:25 PM eryk sun <<a hre=
f=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>> =
wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8e=
x;border-left:1px #ccc solid;padding-left:1ex">On Sat, Dec 10, 2016 at 9:30=
PM, Michael C<br class=3D"m_2599278519846705763m_555296832871345257gmail_m=
sg"><br><<a href=3D"mailto:[email protected]" class=3D"m_25=
99278519846705763m_555296832871345257gmail_msg" target=3D"_blank">mysecretr=
[email protected]<wbr>m</a>> wrote:<br class=3D"m_2599278519846705763=
m_555296832871345257gmail_msg"><br>> I am stuck on which line of informa=
tion to feed to ReadmemoryProcess with<br class=3D"m_2599278519846705763m_5=
55296832871345257gmail_msg"><br>> this, I think I properly retrieved the=
information from Virtualqueryex<br class=3D"m_2599278519846705763m_5552968=
32871345257gmail_msg"><br><br class=3D"m_2599278519846705763m_5552968328713=
45257gmail_msg"><br>Here's an example that uses VirtualQueryEx to deter=
mine whether the<br class=3D"m_2599278519846705763m_555296832871345257gmail=
_msg"><br>specified address is allocated and readable. If so, it reads up t=
o<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>`coun=
t` double-precision floats via ReadProcessMemory, but it won't<br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>read past the a=
llocated region size.<br class=3D"m_2599278519846705763m_555296832871345257=
gmail_msg"><br><br class=3D"m_2599278519846705763m_555296832871345257gmail_=
msg"><br>=C2=A0 =C2=A0 import ctypes<br class=3D"m_2599278519846705763m_555=
296832871345257gmail_msg"><br>=C2=A0 =C2=A0 from ctypes import wintypes<br =
class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br><br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 k=
ernel32 =3D ctypes.WinDLL('kernel32', use_last_error=3DTrue)<br cla=
ss=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br><br class=3D"=
m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PROCE=
SS_VM_READ=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D 0x0010<br class=3D"m=
_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PROCES=
S_QUERY_INFORMATION =3D 0x0400<br class=3D"m_2599278519846705763m_555296832=
871345257gmail_msg"><br><br class=3D"m_2599278519846705763m_555296832871345=
257gmail_msg"><br>=C2=A0 =C2=A0 MEM_COMMIT=C2=A0 =3D 0x00001000<br class=3D=
"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 MEM_=
RESERVE =3D 0x00002000<br class=3D"m_2599278519846705763m_55529683287134525=
7gmail_msg"><br>=C2=A0 =C2=A0 MEM_FREE=C2=A0 =C2=A0 =3D 0x00010000<br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 M=
EM_PRIVATE =3D 0x00020000<br class=3D"m_2599278519846705763m_55529683287134=
5257gmail_msg"><br>=C2=A0 =C2=A0 MEM_MAPPED=C2=A0 =3D 0x00040000<br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 M=
EM_IMAGE=C2=A0 =C2=A0=3D 0x01000000<br class=3D"m_2599278519846705763m_5552=
96832871345257gmail_msg"><br><br class=3D"m_2599278519846705763m_5552968328=
71345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_NOACCESS=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =3D 0x00000001<br class=3D"m_2599278519846705763m_55529683287134=
5257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_READONLY=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =3D 0x00000002<br class=3D"m_2599278519846705763m_555296832871345257=
gmail_msg"><br>=C2=A0 =C2=A0 PAGE_READWRITE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0=3D 0x00000004<br class=3D"m_2599278519846705763m_555296832871345257gmai=
l_msg"><br>=C2=A0 =C2=A0 PAGE_WRITECOPY=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=3D 0x00000008<br class=3D"m_2599278519846705763m_555296832871345257gmail_m=
sg"><br>=C2=A0 =C2=A0 PAGE_EXECUTE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=3D 0x00000010<br class=3D"m_2599278519846705763m_555296832871345257gmail_m=
sg"><br>=C2=A0 =C2=A0 PAGE_EXECUTE_READ=C2=A0 =C2=A0 =C2=A0 =3D 0x00000020<=
br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =
=C2=A0 PAGE_EXECUTE_READWRITE =3D 0x00000040<br class=3D"m_2599278519846705=
763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 PAGE_EXECUTE_WRITECOPY =
=3D 0x00000080<br class=3D"m_2599278519846705763m_555296832871345257gmail_m=
sg"><br>=C2=A0 =C2=A0 PAGE_GUARD=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0=3D 0x00000100<br class=3D"m_2599278519846705763m_555296832871345257g=
mail_msg"><br>=C2=A0 =C2=A0 PAGE_NOCACHE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0=3D 0x00000200<br class=3D"m_2599278519846705763m_555296832871345257g=
mail_msg"><br>=C2=A0 =C2=A0 PAGE_WRITECOMBINE=C2=A0 =C2=A0 =C2=A0 =3D 0x000=
00400<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 PAGE_TARGETS_INVALID=C2=A0 =C2=A0=3D 0x40000000<br class=3D"m=
_2599278519846705763m_555296832871345257gmail_msg"><br><br class=3D"m_25992=
78519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 if not hasat=
tr(wintypes, 'PVOID'):<br class=3D"m_2599278519846705763m_555296832=
871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PVOID =3D wint=
ypes.LPVOID<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"=
><br><br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 if not hasattr(wintypes, 'SIZE_T'):<br class=3D"m_259=
9278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 wintypes.SIZE_T =3D ctypes.c_size_t<br class=3D"m_2599278519846705763m_=
555296832871345257gmail_msg"><br><br class=3D"m_2599278519846705763m_555296=
832871345257gmail_msg"><br>=C2=A0 =C2=A0 if not hasattr(wintypes, 'PSIZ=
E_T'):<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg">=
<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T =3D ctypes.POINTER(wintype=
s.SIZE_T<wbr>)<br class=3D"m_2599278519846705763m_555296832871345257gmail_m=
sg"><br><br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><b=
r>=C2=A0 =C2=A0 class MEMORY_BASIC_INFORMATION(ctype<wbr>s.Structure):<br c=
lass=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 _fields_ =3D (('BaseAddress',=C2=A0 =C2=A0 =C2=A0=
=C2=A0wintypes.PVOID),<br class=3D"m_2599278519846705763m_5552968328713452=
57gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 ('AllocationBase',=C2=A0 =C2=A0 wintypes.PVOID),<br c=
lass=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Allocatio=
nProtect', wintypes.DWORD),<br class=3D"m_2599278519846705763m_55529683=
2871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 ('RegionSize',=C2=A0 =C2=A0 =C2=A0 =C2=A0 wint=
ypes.SIZE_T),<br class=3D"m_2599278519846705763m_555296832871345257gmail_ms=
g"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 ('State',=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0wintyp=
es.DWORD),<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg">=
<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (=
'Protect',=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0wintypes.DWORD),=
<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Type&=
#39;,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.DWORD))<br c=
lass=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br><br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 P=
MEMORY_BASIC_INFORMATION =3D ctypes.POINTER(MEMORY_BASIC_IN<wbr>FORMATION)<=
br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br><br cla=
ss=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0=
def _check_zero(result, func, args):<br class=3D"m_2599278519846705763m_55=
5296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 ""&quo=
t; Check for zero or NULL return value. """<br class=3D"m_25=
99278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 if not result:<br class=3D"m_2599278519846705763m_555296832871345257=
gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinEr=
ror(ctypes.get_las<wbr>t_error())<br class=3D"m_2599278519846705763m_555296=
832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 return args<br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br><br class=3D"m_=
2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 # <a hr=
ef=3D"https://msdn.microsoft.com/en-us/library/ms683179" rel=3D"noreferrer"=
class=3D"m_2599278519846705763m_555296832871345257gmail_msg" target=3D"_bl=
ank">https://msdn.microsoft.com/en-<wbr>us/library/ms683179</a><br class=3D=
"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 kern=
el32.GetCurrentProcess.res<wbr>type =3D wintypes.HANDLE<br class=3D"m_25992=
78519846705763m_555296832871345257gmail_msg"><br><br class=3D"m_25992785198=
46705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 # <a href=3D"https=
://msdn.microsoft.com/en-us/library/ms684320" rel=3D"noreferrer" class=3D"m=
_2599278519846705763m_555296832871345257gmail_msg" target=3D"_blank">https:=
//msdn.microsoft.com/en-<wbr>us/library/ms684320</a><br class=3D"m_25992785=
19846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 kernel32.OpenPr=
ocess.errcheck =3D _check_zero<br class=3D"m_2599278519846705763m_555296832=
871345257gmail_msg"><br>=C2=A0 =C2=A0 kernel32.OpenProcess.restype =3D wint=
ypes.HANDLE<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"=
><br><br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/ms68055=
3" rel=3D"noreferrer" class=3D"m_2599278519846705763m_555296832871345257gma=
il_msg" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/library/ms6=
80553</a><br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><=
br>=C2=A0 =C2=A0 kernel32.ReadProcessMemory.err<wbr>check =3D _check_zero<b=
r class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =
=C2=A0 kernel32.ReadProcessMemory.arg<wbr>types =3D (<br class=3D"m_2599278=
519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
wintypes.HANDLE,=C2=A0 # _In_=C2=A0 hProcess<br class=3D"m_2599278519846705=
763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.=
LPCVOID, # _In_=C2=A0 lpBaseAddress<br class=3D"m_2599278519846705763m_5552=
96832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.LPVOID,=
=C2=A0 # _Out_ lpBuffer<br class=3D"m_2599278519846705763m_5552968328713452=
57gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T,=C2=A0 # _In_=
=C2=A0 nSize<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg=
"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.PSIZE_T) # _Out_ lpNumberOfBytes=
Read<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br><b=
r class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =
=C2=A0 # <a href=3D"https://msdn.microsoft.com/en-us/library/aa366907" rel=
=3D"noreferrer" class=3D"m_2599278519846705763m_555296832871345257gmail_msg=
" target=3D"_blank">https://msdn.microsoft.com/en-<wbr>us/library/aa366907<=
/a><br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 kernel32.VirtualQueryEx.errche<wbr>ck =3D _check_zero<br class=
=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 k=
ernel32.VirtualQueryEx.restyp<wbr>e =3D wintypes.SIZE_T<br class=3D"m_25992=
78519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 kernel32.Vir=
tualQueryEx.argtyp<wbr>es =3D (<br class=3D"m_2599278519846705763m_55529683=
2871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.HANDLE,=C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# _In_=C2=A0 =C2=A0 =C2=A0hProcess<br cl=
ass=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 wintypes.LPCVOID,=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # _In=
_opt_ lpAddress<br class=3D"m_2599278519846705763m_555296832871345257gmail_=
msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 PMEMORY_BASIC_INFORMATION, # _Out_=C2=
=A0 =C2=A0 lpBuffer<br class=3D"m_2599278519846705763m_555296832871345257gm=
ail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 wintypes.SIZE_T)=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0# _In_=C2=A0 =C2=A0 =C2=A0dwLength<br class=3D"m_25=
99278519846705763m_555296832871345257gmail_msg"><br><br class=3D"m_25992785=
19846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 if __name__ =3D=
=3D '__main__':<br class=3D"m_2599278519846705763m_5552968328713452=
57gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 import sys<br class=3D"m_25992=
78519846705763m_555296832871345257gmail_msg"><br><br class=3D"m_25992785198=
46705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 dtyp=
e =3D ctypes.c_double<br class=3D"m_2599278519846705763m_555296832871345257=
gmail_msg"><br><br class=3D"m_2599278519846705763m_555296832871345257gmail_=
msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if len(sys.argv) =3D=3D 4:<br class=3D=
"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.OpenProcess(PROCESS_Q<wbr>UERY_INF=
ORMATION |<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg">=
<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 P=
ROCESS_VM_READ, False, int(sys.argv[1]))<br class=3D"m_2599278519846705763m=
_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
address =3D int(sys.argv[2], 16)<br class=3D"m_2599278519846705763m_555296=
832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 count =
=3D int(sys.argv[3])<br class=3D"m_2599278519846705763m_555296832871345257g=
mail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 elif len(sys.argv) =3D=3D 1:<br c=
lass=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ph =3D kernel32.GetCurrentProcess()<br clas=
s=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 count =3D 10<br class=3D"m_2599278519846705763m=
_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
source_array =3D (dtype * count)(*range(10))<br class=3D"m_259927851984670=
5763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 address =3D ctypes.addressof(source_array)<br class=3D"m_25992785198=
46705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 else=
:<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Usage: %s pid address =
count' % sys.argv[0])<br class=3D"m_2599278519846705763m_55529683287134=
5257gmail_msg"><br><br class=3D"m_2599278519846705763m_555296832871345257gm=
ail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 mbi =3D MEMORY_BASIC_INFORMATION()=
<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=A0=
=C2=A0 =C2=A0 =C2=A0 kernel32.VirtualQueryEx(ph, address, ctypes.byref(mbi=
),<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(mbi))<br class=3D"m_25=
99278519846705763m_555296832871345257gmail_msg"><br><br class=3D"m_25992785=
19846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 i=
f mbi.State & MEM_FREE:<br class=3D"m_2599278519846705763m_555296832871=
345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit(=
9;Address not allocated')<br class=3D"m_2599278519846705763m_5552968328=
71345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if mbi.State & MEM_R=
ESERVE:<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br=
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Address reserved b=
ut not committed')<br class=3D"m_2599278519846705763m_55529683287134525=
7gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if mbi.Protect & PAGE_NOACC=
ESS:<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 sys.exit('Address not accessi=
ble')<br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><=
br><br class=3D"m_2599278519846705763m_555296832871345257gmail_msg"><br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 block_size =3D min(mbi.RegionSize - (address - mbi=
.BaseAddress),<br class=3D"m_2599278519846705763m_555296832871345257gmail_m=
sg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(dtype) * count)<br class=3D"m_2599278=
519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
address_list =3D range(address, address + block_size,<br class=3D"m_2599278=
519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0ctypes.sizeof(dtype))<br class=3D"m_2599278519846705763m_555296832871345=
257gmail_msg"><br><br class=3D"m_2599278519846705763m_555296832871345257gma=
il_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 input('Press enter to list %d v=
alues, or Ctrl+Break to quit\n'<br class=3D"m_2599278519846705763m_5552=
96832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 % len(address_list))<br class=3D"m_2599278519846705763m_555296832871345=
257gmail_msg"><br><br class=3D"m_2599278519846705763m_555296832871345257gma=
il_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 data =3D dtype()<br class=3D"m_2599=
278519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 for address in address_list:<br class=3D"m_2599278519846705763m_5552968=
32871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 kernel3=
2.ReadProcessMemory(ph, address, ctypes.byref(data),<br class=3D"m_25992785=
19846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ctypes.sizeof(data), None)<br class=3D"m_259927=
8519846705763m_555296832871345257gmail_msg"><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 print('%x: %f' % (address, data.value))<br class=3D"=
m_2599278519846705763m_555296832871345257gmail_msg"><br></blockquote></div>=
</div></div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
--001a114a9eaeff3ae405438fbfde--
--===============4125513401933029542==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
--===============4125513401933029542==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============4125513401933029542==--