Re: [Tutor] ctypes wintypes
Michael C <[email protected]> Fri, 6 Oct 2017 11:43:04 -0700
| Newsgroups | gmane.comp.python.ctypes,gmane.comp.python.tutor |
|---|---|
| Message-ID | <CANyKM1guDzqAm9s39vL_9rPeezF3-D4Wu0hfUXH4+N_Q1Kp85A@mail.gmail.com> |
--===============3595587220895657151== Content-Type: multipart/alternative; boundary="f40304353a081a7354055ae536ce" --f40304353a081a7354055ae536ce Content-Type: text/plain; charset="UTF-8" Sorry but I dont understand this line: mbi = MEMORY_BASIC_INFORMATION() This creates a instance of the class? Also, I thought with VirtualQueryEx, what you need for it is a handle, which I acquire from this Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, False, PID) and then feed it to the function like so: VirtualQuery(Process, ctypes.byref(mbi), ctypes.sizeof(mbi)) I know it doesn't work. But what are these lines for? They don't look like handle to me: VirtualQuery = kernel32.VirtualQuery VirtualQuery.restype = SIZE_T VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T) thanks ! On Thu, Oct 5, 2017 at 1:13 PM, eryk sun <[email protected]> wrote: > On Thu, Oct 5, 2017 at 8:27 PM, Michael C > <[email protected]> wrote: > > > > How do I see the values of each field? This doesn't work. > > > > print(PMEMORY_BASIC_INFORMATION.Protect) > > Create an instance of MEMORY_BASIC_INFORMATION and pass a pointer to > it via byref(). For example, the following queries the region of > memory of the VirtualQuery function itself. > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True) > > MEM_COMMIT = 0x1000 > PAGE_EXECUTE_READ = 0x20 > PAGE_EXECUTE_WRITECOPY = 0x80 > > VirtualQuery = kernel32.VirtualQuery > VirtualQuery.restype = SIZE_T > VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T) > > mbi = MEMORY_BASIC_INFORMATION() > VirtualQuery(VirtualQuery, ctypes.byref(mbi), ctypes.sizeof(mbi)) > > >>> mbi.AllocationBase == kernel32._handle > True > >>> mbi.AllocationProtect == PAGE_EXECUTE_WRITECOPY > True > >>> mbi.BaseAddress > 140703181352960 > >>> mbi.RegionSize > 364544 > >>> mbi.State == MEM_COMMIT > True > >>> mbi.Protect == PAGE_EXECUTE_READ > True > --f40304353a081a7354055ae536ce Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Sorry but I dont understand this line:<div><br></div><div>= <span style=3D"font-size:12.8px">mbi =3D MEMORY_BASIC_INFORMATION()</span><= br></div><div><span style=3D"font-size:12.8px"><br></span></div><div><span = style=3D"font-size:12.8px">This creates a instance of the class?</span></di= v><div><span style=3D"font-size:12.8px"><br></span></div><div><span style= =3D"font-size:12.8px">Also, I thought with VirtualQueryEx, what you need fo= r it</span></div><div><span style=3D"font-size:12.8px">is a handle, which I= acquire from this</span></div><div><span style=3D"font-size:12.8px"><br></= span></div><div><span style=3D"font-size:12.8px">Process =3D Kernel32.OpenP= rocess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, False, PID)</span><br></d= iv><div><span style=3D"font-size:12.8px"><br></span></div><div><span style= =3D"font-size:12.8px">and then feed it to the function like so:</span></div= ><div><span style=3D"font-size:12.8px"><br></span></div><div><span style=3D= "font-size:12.8px">VirtualQuery(</span><span style=3D"font-size:12.8px">Pro= cess</span><span style=3D"font-size:12.8px">, ctypes.byref(mbi), ctypes.siz= eof(mbi))</span><br></div><div><br></div><div><span style=3D"font-size:12.8= px">I know it doesn't work. But what are these lines for? They don'= t look like handle to me:</span></div><div><span style=3D"font-size:12.8px"= ><br></span></div><div><div><span style=3D"font-size:12.8px">VirtualQuery = =3D kernel32.VirtualQuery</span></div><div><span style=3D"font-size:12.8px"= >VirtualQuery.restype =3D SIZE_T</span></div><div><span style=3D"font-size:= 12.8px">VirtualQuery.argtypes =3D (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_= T)</span></div></div><div><span style=3D"font-size:12.8px"><br></span></div= ><div><span style=3D"font-size:12.8px"><br></span></div><div><span style=3D= "font-size:12.8px"><br></span></div><div><span style=3D"font-size:12.8px">t= hanks !</span></div></div><div class=3D"gmail_extra"><br><div class=3D"gmai= l_quote">On Thu, Oct 5, 2017 at 1:13 PM, eryk sun <span dir=3D"ltr"><<a = href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&g= t;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0= .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=3D"">On Thu,= Oct 5, 2017 at 8:27 PM, Michael C<br> <<a href=3D"mailto:[email protected]">mysecretrobotfactory@= gmail.<wbr>com</a>> wrote:<br> ><br> > How do I see the values of each field? This doesn't work.<br> ><br> > print(PMEMORY_BASIC_<wbr>INFORMATION.Protect)<br> <br> </span>Create an instance of MEMORY_BASIC_INFORMATION and pass a pointer to= <br> it via byref(). For example, the following queries the region of<br> memory of the VirtualQuery function itself.<br> <br> =C2=A0 =C2=A0 kernel32 =3D ctypes.WinDLL('kernel32', use_last_error= =3DTrue)<br> <br> =C2=A0 =C2=A0 MEM_COMMIT =3D 0x1000<br> =C2=A0 =C2=A0 PAGE_EXECUTE_READ =3D 0x20<br> =C2=A0 =C2=A0 PAGE_EXECUTE_WRITECOPY =3D 0x80<br> <br> =C2=A0 =C2=A0 VirtualQuery =3D kernel32.VirtualQuery<br> =C2=A0 =C2=A0 VirtualQuery.restype =3D SIZE_T<br> =C2=A0 =C2=A0 VirtualQuery.argtypes =3D (LPVOID, PMEMORY_BASIC_INFORMATION,= SIZE_T)<br> <br> =C2=A0 =C2=A0 mbi =3D MEMORY_BASIC_INFORMATION()<br> =C2=A0 =C2=A0 VirtualQuery(VirtualQuery, ctypes.byref(mbi), ctypes.sizeof(m= bi))<br> <br> =C2=A0 =C2=A0 >>> mbi.AllocationBase =3D=3D kernel32._handle<br> =C2=A0 =C2=A0 True<br> =C2=A0 =C2=A0 >>> mbi.AllocationProtect =3D=3D PAGE_EXECUTE_WRITEC= OPY<br> =C2=A0 =C2=A0 True<br> =C2=A0 =C2=A0 >>> mbi.BaseAddress<br> =C2=A0 =C2=A0 140703181352960<br> =C2=A0 =C2=A0 >>> mbi.RegionSize<br> =C2=A0 =C2=A0 364544<br> =C2=A0 =C2=A0 >>> mbi.State =3D=3D MEM_COMMIT<br> =C2=A0 =C2=A0 True<br> =C2=A0 =C2=A0 >>> mbi.Protect =3D=3D=C2=A0 PAGE_EXECUTE_READ<br> =C2=A0 =C2=A0 True<br> </blockquote></div><br></div> --f40304353a081a7354055ae536ce-- --===============3595587220895657151== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot --===============3595587220895657151== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ctypes-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ctypes-users --===============3595587220895657151==--