Re: [Tutor] ctypes wintypes

--===============5734904561965624562==
Content-Type: multipart/alternative; boundary="f403043e4f780da302055ae6769c"

--f403043e4f780da302055ae6769c
Content-Type: text/plain; charset="UTF-8"

Hi all:

How do I create a buffer, or rather, is a buffer just a variable?
How do I create a pointer to it?

This code ran fine (thanks to you, Eryk, I now know about how to work
VirtualQueryEx work)
until when I ran the read process memory part.

I think I am not feeding the function properly.

Please look at the red part of this code

Thanks!


>code starts here

mbi = MEMORY_BASIC_INFORMATION()
sysinfo.lpMinimumApplicationAddress

print('VirtualQueryEx ran properly?',Kernel32.VirtualQueryEx(Process, \
    sysinfo.lpMinimumApplicationAddress,
ctypes.byref(mbi),ctypes.sizeof(mbi)))

print('')
print('mbi start')
print('mbi.BaseAddress: ',mbi.BaseAddress)
print('mbi.AllocationBase: ',mbi.AllocationBase)
print('mbi.AllocationProtect: ',mbi.AllocationProtect)
print('mbi.RegionSize: ',mbi.RegionSize)
print('mbi.State: ',mbi.State)
print('mbi.Protect: ', mbi.Protect)
print('mbi.Type: ',mbi.Type)

buffer = ctypes.create_string_buffer(4)
bufferSize = (ctypes.sizeof(buffer))

ReadProcessMemory = Kernel32.ReadProcessMemory

if ReadProcessMemory(Process, ctypes.byref(mbi), buffer, bufferSize, None):
        print('buffer is: ',buffer)
else:
        print('something is wrong')

On Fri, Oct 6, 2017 at 12:03 PM, eryk sun <[email protected]> wrote:

> On Fri, Oct 6, 2017 at 7:43 PM, Michael C
> <[email protected]> wrote:
> > Sorry but I dont understand this line:
> >
> > mbi = MEMORY_BASIC_INFORMATION()
> >
> > This creates a instance of the class?
>
> Yes, and this allocates sizeof(MEMORY_BASIC_INFORMATION) bytes at
> addressof(mbi), which you pass to a function by reference via
> byref(mbi).
>
> > Also, I thought with VirtualQueryEx, what you need for it
> > is a handle, which I acquire from this
> > Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_
> READ,
> > False, PID)
>
> My example called VirtualQuery, not VirtualQueryEx. Internally
> VirtualQuery calls VirtualQueryEx using the pseudo handle
> (HANDLE)(-1), which refers to the current process.
>
> > and then feed it to the function like so:
> >
> > VirtualQuery(Process, ctypes.byref(mbi), ctypes.sizeof(mbi))
> >
> > I know it doesn't work. But what are these lines for? They don't look
> like
> > handle to me:
> >
> > VirtualQuery = kernel32.VirtualQuery
> > VirtualQuery.restype = SIZE_T
> > VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)
>
> In the above, I'm setting the function pointer's argtypes attribute to
> the types of the 3 parameters that VirtualQuery takes: the target
> address (i.e. LPVOID), a pointer to the buffer (i.e.
> PMEMORY_BASIC_INFORMATION), and the size of the buffer (SIZE_T). This
> is to allow ctypes to correctly check and convert arguments passed to
> the function.
>
> VirtualQueryEx has four parameters, starting with the handle to the
> target process, hProcess. The remaining 3 are the same as
> VirtualQuery.
>

--f403043e4f780da302055ae6769c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi all:<div><br></div><div>How do I create a buffer, or ra=
ther, is a buffer just a variable?</div><div>How do I create a pointer to i=
t?=C2=A0</div><div><br></div><div>This code ran fine (thanks to you, Eryk, =
I now know about how to work VirtualQueryEx work)</div><div>until when I ra=
n the read process memory part.</div><div><br></div><div>I think I am not f=
eeding the function properly.</div><div><br></div><div>Please look at the r=
ed part of this code</div><div><br></div><div>Thanks!</div><div><br><div><b=
r></div><div>&gt;code starts here</div><div><br></div><div><div>mbi =3D MEM=
ORY_BASIC_INFORMATION()</div><div>sysinfo.lpMinimumApplicationAddress</div>=
<div><br></div><div>print(&#39;VirtualQueryEx ran properly?&#39;,Kernel32.V=
irtualQueryEx(Process, \</div><div>=C2=A0 =C2=A0 sysinfo.lpMinimumApplicati=
onAddress, ctypes.byref(mbi),ctypes.sizeof(mbi)))</div><div><br></div><div>=
print(&#39;&#39;)</div><div>print(&#39;mbi start&#39;)</div><div>print(&#39=
;mbi.BaseAddress: &#39;,mbi.BaseAddress)</div><div>print(&#39;mbi.Allocatio=
nBase: &#39;,mbi.AllocationBase)</div><div>print(&#39;mbi.AllocationProtect=
: &#39;,mbi.AllocationProtect)</div><div>print(&#39;mbi.RegionSize: &#39;,m=
bi.RegionSize)</div><div>print(&#39;mbi.State: &#39;,mbi.State)</div><div>p=
rint(&#39;mbi.Protect: &#39;, mbi.Protect)</div><div>print(&#39;mbi.Type: &=
#39;,mbi.Type)</div><div><font color=3D"#ff0000"><br></font></div><div><fon=
t color=3D"#ff0000">buffer =3D ctypes.create_string_buffer(4)</font></div><=
div><font color=3D"#ff0000">bufferSize =3D (ctypes.sizeof(buffer))</font></=
div><div><font color=3D"#ff0000"><br></font></div><div><font color=3D"#ff00=
00">ReadProcessMemory =3D Kernel32.ReadProcessMemory</font></div><div><font=
 color=3D"#ff0000"><br></font></div><div><font color=3D"#ff0000">if ReadPro=
cessMemory(Process, ctypes.byref(mbi), buffer, bufferSize, None):</font></d=
iv><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0 print(&#39;buff=
er is: &#39;,buffer)</font></div><div>else:</div><div>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 print(&#39;something is wrong&#39;)</div></div></div></div><div clas=
s=3D"gmail_extra"><br><div class=3D"gmail_quote">On Fri, Oct 6, 2017 at 12:=
03 PM, eryk sun <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p=
adding-left:1ex"><span class=3D"">On Fri, Oct 6, 2017 at 7:43 PM, Michael C=
<br>
&lt;<a href=3D"mailto:[email protected]">mysecretrobotfactory@=
gmail.<wbr>com</a>&gt; wrote:<br>
&gt; Sorry but I dont understand this line:<br>
&gt;<br>
&gt; mbi =3D MEMORY_BASIC_INFORMATION()<br>
&gt;<br>
&gt; This creates a instance of the class?<br>
<br>
</span>Yes, and this allocates sizeof(MEMORY_BASIC_<wbr>INFORMATION) bytes =
at<br>
addressof(mbi), which you pass to a function by reference via<br>
byref(mbi).<br>
<span class=3D""><br>
&gt; Also, I thought with VirtualQueryEx, what you need for it<br>
&gt; is a handle, which I acquire from this<br>
&gt; Process =3D Kernel32.OpenProcess(PROCESS_<wbr>QUERY_INFORMATION|PROCES=
S_VM_<wbr>READ,<br>
&gt; False, PID)<br>
<br>
</span>My example called VirtualQuery, not VirtualQueryEx. Internally<br>
VirtualQuery calls VirtualQueryEx using the pseudo handle<br>
(HANDLE)(-1), which refers to the current process.<br>
<span class=3D""><br>
&gt; and then feed it to the function like so:<br>
&gt;<br>
&gt; VirtualQuery(Process, ctypes.byref(mbi), ctypes.sizeof(mbi))<br>
&gt;<br>
&gt; I know it doesn&#39;t work. But what are these lines for? They don&#39=
;t look like<br>
&gt; handle to me:<br>
&gt;<br>
&gt; VirtualQuery =3D kernel32.VirtualQuery<br>
&gt; VirtualQuery.restype =3D SIZE_T<br>
&gt; VirtualQuery.argtypes =3D (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)<=
br>
<br>
</span>In the above, I&#39;m setting the function pointer&#39;s argtypes at=
tribute to<br>
the types of the 3 parameters that VirtualQuery takes: the target<br>
address (i.e. LPVOID), a pointer to the buffer (i.e.<br>
PMEMORY_BASIC_INFORMATION), and the size of the buffer (SIZE_T). This<br>
is to allow ctypes to correctly check and convert arguments passed to<br>
the function.<br>
<br>
VirtualQueryEx has four parameters, starting with the handle to the<br>
target process, hProcess. The remaining 3 are the same as<br>
VirtualQuery.<br>
</blockquote></div><br></div>

--f403043e4f780da302055ae6769c--


--===============5734904561965624562==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============5734904561965624562==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============5734904561965624562==--