Re: [Tutor] ctypes wintypes
Michael C <[email protected]> Fri, 6 Oct 2017 15:36:23 -0700
| Newsgroups | gmane.comp.python.ctypes,gmane.comp.python.tutor |
|---|---|
| Message-ID | <CANyKM1gGBsZNhuBtRTpxkazhSvECMbE00QrTvycDY=8zthb7Eg@mail.gmail.com> |
--===============6749266080481737044==
Content-Type: multipart/alternative; boundary="94eb2c0473287d8095055ae87892"
--94eb2c0473287d8095055ae87892
Content-Type: text/plain; charset="UTF-8"
I think I pieced together what you have been helping me with, but this
still raise a error
I have been loosely following this guide:
https://www.codeproject.com/articles/716227/csharp-how-to-scan-a-process-memory
>code start.
import ctypes
from ctypes.wintypes import WORD, DWORD, LPVOID
PVOID = LPVOID
SIZE_T = ctypes.c_size_t
# https://msdn.microsoft.com/en-us/library/aa383751#DWORD_PTR
if ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulonglong):
DWORD_PTR = ctypes.c_ulonglong
elif ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulong):
DWORD_PTR = ctypes.c_ulong
class SYSTEM_INFO(ctypes.Structure):
"""https://msdn.microsoft.com/en-us/library/ms724958"""
class _U(ctypes.Union):
class _S(ctypes.Structure):
_fields_ = (('wProcessorArchitecture', WORD),
('wReserved', WORD))
_fields_ = (('dwOemId', DWORD), # obsolete
('_s', _S))
_anonymous_ = ('_s',)
_fields_ = (('_u', _U),
('dwPageSize', DWORD),
('lpMinimumApplicationAddress', LPVOID),
('lpMaximumApplicationAddress', LPVOID),
('dwActiveProcessorMask', DWORD_PTR),
('dwNumberOfProcessors', DWORD),
('dwProcessorType', DWORD),
('dwAllocationGranularity', DWORD),
('wProcessorLevel', WORD),
('wProcessorRevision', WORD))
_anonymous_ = ('_u',)
LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO)
Kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
Kernel32.GetSystemInfo.restype = None
Kernel32.GetSystemInfo.argtypes = (LPSYSTEM_INFO,)
sysinfo = SYSTEM_INFO()
Kernel32.GetSystemInfo(ctypes.byref(sysinfo))
print(sysinfo.lpMinimumApplicationAddress)
print(sysinfo.lpMaximumApplicationAddress)
# maybe it will change, maybe it won't. Assuming it won't.
# 2nd, get Open process.
PID = 1234
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010
Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
False, PID)
print('process:', Process)
# 3rd
class MEMORY_BASIC_INFORMATION(ctypes.Structure):
"""https://msdn.microsoft.com/en-us/library/aa366775"""
_fields_ = (('BaseAddress', PVOID),
('AllocationBase', PVOID),
('AllocationProtect', DWORD),
('RegionSize', SIZE_T),
('State', DWORD),
('Protect', DWORD),
('Type', DWORD))
##PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)
mbi = MEMORY_BASIC_INFORMATION()
##sysinfo.lpMinimumApplicationAddress
print('VirtualQueryEx ran properly?',Kernel32.VirtualQueryEx(Process, \
None, ctypes.byref(mbi),ctypes.sizeof(mbi)))
# sysinfo.lpMinimumApplicationAddress replaced by None
print('')
print('mbi start')
print('mbi.BaseAddress: ',mbi.BaseAddress)
print('mbi.AllocationBase: ',mbi.AllocationBase)
print('mbi.AllocationProtect: ',mbi.AllocationProtect)
print('mbi.RegionSize: ',mbi.RegionSize)
print('mbi.State: ',mbi.State)
print('mbi.Protect: ', mbi.Protect)
print('mbi.Type: ',mbi.Type)
buffer = ctypes.create_string_buffer(mbi.RegionSize)
nread = SIZE_T()
start = ctypes.c_void_p(mbi.BaseAddress)
##start_pointer = ctypes.byref(start)
ReadProcessMemory = Kernel32.ReadProcessMemory
if ReadProcessMemory(Process, start, ctypes.byref(buffer), \
ctypes.sizeof(buffer), ctypes.byref(nread)):
print('buffer is: ',buffer)
else:
raise ctypes.WinError(ctypes.get_last_error())
# once I figure out read process memory, I'll combine it with virtual
process memory.
# if they don't equal to that, then it's time to move to the next thing?
# Don't do read memory yet.
# make it traverse through all memory and print out when protect and state
# are both true.
##
##MEM_COMMIT = 0x00001000;
##PAGE_READWRITE = 0x04;
##
##current_address = sysinfo.lpMinimumApplicationAddress
##end_address = sysinfo.lpMaximumApplicationAddress
##
##while current_address < end_address:
## Kernel32.VirtualQueryEx(Process, \
## current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))
##
## if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
## print(current_address)
## print('Both are true')
##
##
## current_address += mbi.RegionSize
On Fri, Oct 6, 2017 at 3:29 PM, eryk sun <[email protected]> wrote:
> On Fri, Oct 6, 2017 at 11:05 PM, Michael C
> <[email protected]> wrote:
> > For this read process memory, if I am trying compose a LPCVOID
> > lpBaseAddress, am I not making a variable that equals to
> mbi.BaseAddress,
> > and then making a pointer pointing to it?
> >
> > start_address = mbi.BaseAddress
> > LPCVOID = ctypes.byref(start_address)
>
> LPCVOID is a pointer type; don't use it as a variable name because
> it's confusing to someone who's reading your code.
>
> The `BaseAddress` field is an LPVOID, which is an alias for
> ctypes.c_void_p. Simple C types such as c_void_p are automatically
> converted to Python native types such as int, bytes, and str. It's
> fine that mbi.BaseAddress is a Python int. With argtypes defined for
> ReadProcessMemory, ctypes will convert the int back to a void pointer
> for you automatically.
>
--94eb2c0473287d8095055ae87892
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">I think I pieced together what you have been helping me wi=
th, but this still raise a error<div>I have been loosely following this gui=
de:=C2=A0</div><div><a href=3D"https://www.codeproject.com/articles/716227/=
csharp-how-to-scan-a-process-memory">https://www.codeproject.com/articles/7=
16227/csharp-how-to-scan-a-process-memory</a><br></div><div><br></div><div>=
<br></div><div><br></div><div>>code start.</div><div><br></div><div><br>=
</div><div><div>import ctypes</div><div>from ctypes.wintypes import WORD, D=
WORD, LPVOID</div><div><br></div><div>PVOID =3D LPVOID</div><div>SIZE_T =3D=
ctypes.c_size_t</div><div><br></div><div># <a href=3D"https://msdn.microso=
ft.com/en-us/library/aa383751#DWORD_PTR">https://msdn.microsoft.com/en-us/l=
ibrary/aa383751#DWORD_PTR</a></div><div>if ctypes.sizeof(ctypes.c_void_p) =
=3D=3D ctypes.sizeof(ctypes.c_ulonglong):</div><div>=C2=A0 =C2=A0 DWORD_PTR=
=3D ctypes.c_ulonglong</div><div>elif ctypes.sizeof(ctypes.c_void_p) =3D=
=3D ctypes.sizeof(ctypes.c_ulong):</div><div>=C2=A0 =C2=A0 DWORD_PTR =3D ct=
ypes.c_ulong</div><div><br></div><div>class SYSTEM_INFO(ctypes.Structure):<=
/div><div>=C2=A0 =C2=A0 """<a href=3D"https://msdn.microsoft=
.com/en-us/library/ms724958">https://msdn.microsoft.com/en-us/library/ms724=
958</a>"""</div><div>=C2=A0 =C2=A0 class _U(ctypes.Union):</=
div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 class _S(ctypes.Structure):</div><div>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 _fields_ =3D (('wProcessorArc=
hitecture', WORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('wReserved', WORD))</div=
><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 _fields_ =3D (('dwOemId', DWORD),=
# obsolete</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 ('_s', _S))</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
_anonymous_ =3D ('_s',)</div><div>=C2=A0 =C2=A0 _fields_ =3D ((=
9;_u', _U),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 ('dwPageSize', DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ('lpMinimumApplicationAddress', LPVOID=
),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('=
lpMaximumApplicationAddress', LPVOID),</div><div>=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('dwActiveProcessorMask',=C2=A0 =
=C2=A0DWORD_PTR),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ('dwNumberOfProcessors',=C2=A0 =C2=A0 DWORD),</div><div>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('dwProcessorTy=
pe',=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0DWORD),</div><div>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('dwAllocationGranularity'=
;, DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 ('wProcessorLevel',=C2=A0 =C2=A0 WORD),</div><div>=C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('wProcessorRevision', W=
ORD))</div><div>=C2=A0 =C2=A0 _anonymous_ =3D ('_u',)</div><div><br=
></div><div>LPSYSTEM_INFO =3D ctypes.POINTER(SYSTEM_INFO)</div><div><br></d=
iv><div><br></div><div><br></div><div>Kernel32 =3D ctypes.WinDLL('kerne=
l32', use_last_error=3DTrue)</div><div>Kernel32.GetSystemInfo.restype =
=3D None</div><div>Kernel32.GetSystemInfo.argtypes =3D (LPSYSTEM_INFO,)</di=
v><div><br></div><div>sysinfo =3D SYSTEM_INFO()</div><div>Kernel32.GetSyste=
mInfo(ctypes.byref(sysinfo))</div><div><br></div><div>print(sysinfo.lpMinim=
umApplicationAddress)</div><div>print(sysinfo.lpMaximumApplicationAddress)<=
/div><div><br></div><div><br></div><div># maybe it will change, maybe it wo=
n't. Assuming it won't.</div><div><br></div><div># 2nd, get Open pr=
ocess.</div><div><br></div><div><br></div><div><br></div><div>PID =3D 1234=
=C2=A0 =C2=A0 =C2=A0 =C2=A0</div><div>PROCESS_QUERY_INFORMATION =3D 0x0400<=
/div><div>PROCESS_VM_READ =3D 0x0010</div><div><br></div><div>Process =3D K=
ernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, False, PID)<=
/div><div>print('process:', Process)</div><div><br></div><div><br><=
/div><div><br></div><div># 3rd</div><div><br></div><div>class MEMORY_BASIC_=
INFORMATION(ctypes.Structure):</div><div>=C2=A0 =C2=A0 """<a=
href=3D"https://msdn.microsoft.com/en-us/library/aa366775">https://msdn.mi=
crosoft.com/en-us/library/aa366775</a>"""</div><div>=C2=A0 =
=C2=A0 _fields_ =3D (('BaseAddress', PVOID),</div><div>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('AllocationBase',=C2=
=A0 =C2=A0 PVOID),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ('AllocationProtect', DWORD),</div><div>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('RegionSize', SIZE_T),</=
div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Stat=
e',=C2=A0 =C2=A0DWORD),</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 ('Protect', DWORD),</div><div>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ('Type',=C2=A0 =C2=A0 DWO=
RD))</div><div><br></div><div>##PMEMORY_BASIC_INFORMATION =3D ctypes.POINTE=
R(MEMORY_BASIC_INFORMATION)</div><div><br></div><div>mbi =3D MEMORY_BASIC_I=
NFORMATION()</div><div>##sysinfo.lpMinimumApplicationAddress</div><div><br>=
</div><div>print('VirtualQueryEx ran properly?',Kernel32.VirtualQue=
ryEx(Process, \</div><div>=C2=A0 =C2=A0 None, ctypes.byref(mbi),ctypes.size=
of(mbi)))</div><div># sysinfo.lpMinimumApplicationAddress replaced by None<=
/div><div><br></div><div>print('')</div><div>print('mbi start&#=
39;)</div><div>print('mbi.BaseAddress: ',mbi.BaseAddress)</div><div=
>print('mbi.AllocationBase: ',mbi.AllocationBase)</div><div>print(&=
#39;mbi.AllocationProtect: ',mbi.AllocationProtect)</div><div>print(=
9;mbi.RegionSize: ',mbi.RegionSize)</div><div>print('mbi.State: =
9;,mbi.State)</div><div>print('mbi.Protect: ', mbi.Protect)</div><d=
iv>print('mbi.Type: ',mbi.Type)</div><div><br></div><div><br></div>=
<div>buffer =3D ctypes.create_string_buffer(mbi.RegionSize)</div><div>nread=
=3D SIZE_T()</div><div><br></div><div>start =3D ctypes.c_void_p(mbi.BaseAd=
dress)</div><div>##start_pointer =3D ctypes.byref(start)</div><div><br></di=
v><div>ReadProcessMemory =3D Kernel32.ReadProcessMemory</div><div><br></div=
><div>if ReadProcessMemory(Process, start, ctypes.byref(buffer), \</div><di=
v>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0ctypes.sizeof(buffer), ctypes.byref(nread)):</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 print('buffer is: ',buffer)</div><div>else:</div><div>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.WinError(ctypes.get_last_error())<=
/div><div><br></div><div><br></div><div># once I figure out read process me=
mory, I'll combine it with virtual process memory.</div><div><br></div>=
<div># if they don't equal to that, then it's time to move to the n=
ext thing?</div><div># Don't do read memory yet.=C2=A0</div><div># make=
it traverse through all memory and print out when protect and state</div><=
div># are both true.</div><div>##</div><div>##MEM_COMMIT =3D 0x00001000;</d=
iv><div>##PAGE_READWRITE =3D 0x04;</div><div>##</div><div>##current_address=
=3D sysinfo.lpMinimumApplicationAddress</div><div>##end_address =3D sysinf=
o.lpMaximumApplicationAddress</div><div>##</div><div>##while current_addres=
s < end_address:</div><div>##=C2=A0 =C2=A0 Kernel32.VirtualQueryEx(Proce=
ss, \</div><div>##=C2=A0 =C2=A0 current_address, ctypes.byref(mbi),ctypes.s=
izeof(mbi))</div><div>##</div><div>##=C2=A0 =C2=A0 if mbi.Protect =3D=3D PA=
GE_READWRITE and mbi.State =3D=3D MEM_COMMIT :</div><div>##=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 print(current_address)</div><div>##=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 print('Both are true')</div><div>##</div><div>##</div><div>##=
=C2=A0 =C2=A0 current_address +=3D mbi.RegionSize</div></div><div><br></div=
></div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Fri, Oc=
t 6, 2017 at 3:29 PM, eryk sun <span dir=3D"ltr"><<a href=3D"mailto:eryk=
[email protected]" target=3D"_blank">[email protected]</a>></span> wrote:<br=
><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1=
px #ccc solid;padding-left:1ex"><span class=3D"">On Fri, Oct 6, 2017 at 11:=
05 PM, Michael C<br>
<<a href=3D"mailto:[email protected]">mysecretrobotfactory@=
gmail.<wbr>com</a>> wrote:<br>
> For this read process memory, if I am trying compose a LPCVOID<br>
> lpBaseAddress, am I not making a variable that equals to=C2=A0 mbi.Bas=
eAddress,<br>
> and then making a pointer pointing to it?<br>
><br>
> start_address =3D mbi.BaseAddress<br>
>=C2=A0 LPCVOID =3D ctypes.byref(start_address)<br>
<br>
</span>LPCVOID is a pointer type; don't use it as a variable name becau=
se<br>
it's confusing to someone who's reading your code.<br>
<br>
The `BaseAddress` field is an LPVOID, which is an alias for<br>
ctypes.c_void_p. Simple C types such as c_void_p are automatically<br>
converted to Python native types such as int, bytes, and str. It's<br>
fine that mbi.BaseAddress is a Python int. With argtypes defined for<br>
ReadProcessMemory, ctypes will convert the int back to a void pointer<br>
for you automatically.<br>
</blockquote></div><br></div>
--94eb2c0473287d8095055ae87892--
--===============6749266080481737044==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============6749266080481737044==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============6749266080481737044==--