windows specific: read process memory

--===============2240628104390445699==
Content-Type: multipart/alternative; boundary="f4030439553473b233055a08d647"

--f4030439553473b233055a08d647
Content-Type: text/plain; charset="UTF-8"

Hi all, I have a few questions about memory scanning!
The following code attempts to print out all addresses whose value is
int(-143)!

1. I am using a for loop to go through all the addresses! Is this the right
thing to do?
2. I feed the read process memory function with hex(i), correct?

3. I am a little bummed by what to put down for my buffer and buffer size,
is
what I did proper?

4. This is not in the code, but if I actually know the value I want in the
memory is
a Double, how do i modify my code to look at only doubles?

thanks all!

> code starts


User32 = ctypes.WinDLL('User32', use_last_error=True)
Kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_VM_READ = 0x0010
PID = 'given'


Process = Kernel32.OpenProcess(PROCESS_VM_READ, 0, PID)
ReadProcessMemory = Kernel32.ReadProcessMemory


buffer_size = 1000
buffer = ctypes.create_string_buffer(buffer_size)

# looking for the addresses where the values are -143, for example
# I used 10000000 as an abitrary number, I need to scan the entire
application
# memory space, but I am not sure how to acquire that value.

for i in range(1,10000000):
        if ReadProcessMemory(Process, hex(i), buffer, buffer_size, None):
            if float(buffer) == int(-143) :
                print(float(buffer))


print('Done.')

--f4030439553473b233055a08d647
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><span style=3D"font-size:12.8px">Hi all, I have a few ques=
tions about memory scanning!</span><div style=3D"font-size:12.8px">The foll=
owing code attempts to print out all addresses whose value is=C2=A0 int(-14=
3)!</div><div style=3D"font-size:12.8px"><br></div><div style=3D"font-size:=
12.8px">1. I am using a for loop to go through all the addresses! Is this t=
he right thing to do?</div><div style=3D"font-size:12.8px">2. I feed the re=
ad process memory function with hex(i), correct?</div><div style=3D"font-si=
ze:12.8px"><br></div><div style=3D"font-size:12.8px">3. I am a little bumme=
d by what to put down for my buffer and buffer size, is=C2=A0</div><div sty=
le=3D"font-size:12.8px">what I did proper?</div><div style=3D"font-size:12.=
8px"><br></div><div style=3D"font-size:12.8px">4. This is not in the code, =
but if I actually know the value I want in the memory is</div><div style=3D=
"font-size:12.8px">a Double, how do i modify my code to look at only double=
s?</div><div style=3D"font-size:12.8px"><br></div><div style=3D"font-size:1=
2.8px">thanks all!</div><div style=3D"font-size:12.8px"><div>=C2=A0</div><d=
iv>&gt; code starts</div><div><br></div><div><div><br></div><div>User32 =3D=
 ctypes.WinDLL(&#39;User32&#39;, use_last_error=3DTrue)</div><div>Kernel32 =
=3D ctypes.WinDLL(&#39;kernel32&#39;, use_last_error=3DTrue)</div><div>PROC=
ESS_VM_READ =3D 0x0010</div><div>PID =3D &#39;given&#39;</div><div><br></di=
v><div><br></div><div>Process =3D Kernel32.OpenProcess(PROCESS_<wbr>VM_READ=
, 0, PID)</div><div>ReadProcessMemory =3D Kernel32.ReadProcessMemory</div><=
div><br></div><div><br></div><div>buffer_size =3D 1000</div><div>buffer =3D=
 ctypes.create_string_buffer(<wbr>buffer_size)</div><div><br></div><div># l=
ooking for the addresses where the values are -143, for example</div><div>#=
 I used 10000000 as an abitrary number, I need to scan the entire applicati=
on</div><div># memory space, but I am not sure how to acquire that value.</=
div><div><br></div><div>for i in range(1,10000000):</div><div>=C2=A0 =C2=A0=
 =C2=A0 =C2=A0 if ReadProcessMemory(Process, hex(i), buffer, buffer_size, N=
one):</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if float(buffer) =
=3D=3D int(-143) :</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 print(float(buffer))</div><div><br></div><div><br></div><div>pri=
nt(&#39;Done.&#39;)</div></div></div></div>

--f4030439553473b233055a08d647--


--===============2240628104390445699==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============2240628104390445699==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============2240628104390445699==--