Re: [Tutor] ctypes wintypes

--===============5876585757154577274==
Content-Type: multipart/alternative; boundary="94eb2c0dd4b8c128a1055ae80a99"

--94eb2c0dd4b8c128a1055ae80a99
Content-Type: text/plain; charset="UTF-8"

For this read process memory, if I am trying compose a LPCVOID
lpBaseAddress, am I not making a variable that equals to  mbi.BaseAddress,
and then making a pointer pointing to it?

start_address = mbi.BaseAddress
 LPCVOID = ctypes.byref(start_address)

?

But I get this

start = ctypes.byref(mbi.BaseAddress)
TypeError: byref() argument must be a ctypes instance, not 'int'


On Fri, Oct 6, 2017 at 2:53 PM, eryk sun <[email protected]> wrote:

> On Fri, Oct 6, 2017 at 10:26 PM, Michael C
> <[email protected]> wrote:
> >
> > base = mbi.BaseAddress
> > buffer = ctypes.c_int32()
> > buffer_pointer = ctypes.byref(buffer)
> > ReadProcessMemory = Kernel32.ReadProcessMemory
> >
> > if ReadProcessMemory(Process, base, buffer_pointer, mbi.RegionSize,
> None):
> >         print('buffer is: ',buffer)
> > else:
> >         raise ctypes.WinError(ctypes.get_last_error())
>
> If you need to read RegionSize bytes, then you have to allocate a
> buffer that's RegionSize bytes:
>
>     buffer = ctypes.create_string_buffer(mbi.RegionSize)
>
> Or use a smaller buffer and loop until the total number of bytes read
> is RegionSize.
>
> Also, remember to check that the state is MEM_COMMIT. You cannot read
> an address range that's free or reserved. It must be committed, i.e.
> backed by physical storage.
>

--94eb2c0dd4b8c128a1055ae80a99
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">For this read process memory, if I am trying compose a LPC=
VOID lpBaseAddress, am I not making a variable that equals to=C2=A0=C2=A0mb=
i.BaseAddress, and then making a pointer pointing to it?<div><br></div><div=
>start_address =3D mbi.BaseAddress</div><div>=C2=A0LPCVOID=C2=A0=3D=C2=A0ct=
ypes.byref(start_address)</div><div><br></div><div>?</div><div><br></div><d=
iv>But I get this=C2=A0</div><div><br></div><div><div>start =3D ctypes.byre=
f(mbi.BaseAddress)</div><div>TypeError: byref() argument must be a ctypes i=
nstance, not &#39;int&#39;</div></div><div><div><span style=3D"color:rgb(0,=
0,0);font-family:Consolas,Courier,monospace;font-size:14px;white-space:pre-=
wrap"><br></span></div><div class=3D"gmail_extra"><br><div class=3D"gmail_q=
uote">On Fri, Oct 6, 2017 at 2:53 PM, eryk sun <span dir=3D"ltr">&lt;<a hre=
f=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&gt;<=
/span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span cl=
ass=3D"gmail-m_8128812170903062614gmail-">On Fri, Oct 6, 2017 at 10:26 PM, =
Michael C<br>
&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">mys=
[email protected]<wbr>m</a>&gt; wrote:<br>
&gt;<br>
&gt; base =3D mbi.BaseAddress<br>
&gt; buffer =3D ctypes.c_int32()<br>
&gt; buffer_pointer =3D ctypes.byref(buffer)<br>
&gt; ReadProcessMemory =3D Kernel32.ReadProcessMemory<br>
&gt;<br>
&gt; if ReadProcessMemory(Process, base, buffer_pointer, mbi.RegionSize, No=
ne):<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0print(&#39;buffer is: &#39;,buffer)<b=
r>
&gt; else:<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0raise ctypes.WinError(ctypes.get_las<=
wbr>t_error())<br>
<br>
</span>If you need to read RegionSize bytes, then you have to allocate a<br=
>
buffer that&#39;s RegionSize bytes:<br>
<br>
=C2=A0 =C2=A0 buffer =3D ctypes.create_string_buffer(mb<wbr>i.RegionSize)<b=
r>
<br>
Or use a smaller buffer and loop until the total number of bytes read<br>
is RegionSize.<br>
<br>
Also, remember to check that the state is MEM_COMMIT. You cannot read<br>
an address range that&#39;s free or reserved. It must be committed, i.e.<br=
>
backed by physical storage.<br>
</blockquote></div><br></div></div></div>

--94eb2c0dd4b8c128a1055ae80a99--


--===============5876585757154577274==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============5876585757154577274==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============5876585757154577274==--