How do I scan memory for singles, doubles and so on?

--===============2815362699900402419==
Content-Type: multipart/alternative; boundary="f40304353a0820ca11055afb3f54"

--f40304353a0820ca11055afb3f54
Content-Type: text/plain; charset="UTF-8"

Hi all:

I am working on a memory scanner, and the source code and output is as
following:

Now, I know why my buffer from read process memory looks like values such
as "67108864" ; it's because I read into the buffer entire chunk of memory
at a time, because I fed read process memory this:  "mbi.RegionSize"

Now, how do I read for values such as doubles?
I am guessing I need to use a for loop to scan for small bits of memory
chunk
at a time.

Is there a way to do it?

Thanks!




>output starts

buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(6385664)
buffer is:  c_ulong(67108864)
buffer is:  c_ulong(7761920)
buffer is:  c_ulong(7798784)
buffer is:  c_ulong(7872512)
buffer is:  c_ulong(8007680)
buffer is:  c_ulong(8044544)
buffer is:  c_ulong(8069120)
buffer is:  c_ulong(8216576)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(3976)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(1318755581)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)

> code starts

buffer = ctypes.c_uint()
nread = SIZE_T()

start = ctypes.c_void_p(mbi.BaseAddress)

ReadProcessMemory = Kernel32.ReadProcessMemory

MEM_COMMIT = 0x00001000;
PAGE_READWRITE = 0x04;

current_address = sysinfo.lpMinimumApplicationAddress
end_address = sysinfo.lpMaximumApplicationAddress

while current_address < end_address:
    Kernel32.VirtualQueryEx(Process, \
    current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))

    if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :

        if ReadProcessMemory(Process, current_address,
ctypes.byref(buffer), \
                             ctypes.sizeof(buffer), ctypes.byref(nread)):
                print('buffer is: ',buffer)
        else:
                raise ctypes.WinError(ctypes.get_last_error())

    current_address += mbi.RegionSize

--f40304353a0820ca11055afb3f54
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi all:</div><div><br></div><div>I am working on a me=
mory scanner, and the source code and output is as</div><div>following:</di=
v><div><br></div><div>Now, I know why my buffer from read process memory lo=
oks like values such</div><div>as &quot;67108864&quot; ; it&#39;s because I=
 read into the buffer entire chunk of memory</div><div>at a time, because I=
 fed read process memory this:=C2=A0 &quot;mbi.RegionSize&quot;</div><div><=
br></div><div>Now, how do I read for values such as doubles?</div><div>I am=
 guessing I need to use a for loop to scan for small bits of memory chunk</=
div><div>at a time.</div><div><br></div><div>Is there a way to do it?</div>=
<div><br></div><div>Thanks!</div><div><br></div><div><br></div><div><br></d=
iv><div><br></div><div>&gt;output starts</div><div><br></div><div><div>buff=
er is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buf=
fer is:=C2=A0 c_ulong(6385664)</div><div>buffer is:=C2=A0 c_ulong(67108864)=
</div><div>buffer is:=C2=A0 c_ulong(7761920)</div><div>buffer is:=C2=A0 c_u=
long(7798784)</div><div>buffer is:=C2=A0 c_ulong(7872512)</div><div>buffer =
is:=C2=A0 c_ulong(8007680)</div><div>buffer is:=C2=A0 c_ulong(8044544)</div=
><div>buffer is:=C2=A0 c_ulong(8069120)</div><div>buffer is:=C2=A0 c_ulong(=
8216576)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c=
_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(3976)</div><div>buffer is:=C2=
=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buffer is:=
=C2=A0 c_ulong(1318755581)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>=
buffer is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div=
>buffer is:=C2=A0 c_ulong(0)</div></div><div><br></div>&gt; code starts<div=
><br></div><div><div>buffer =3D ctypes.c_uint()</div><div>nread =3D SIZE_T(=
)</div><div><br></div><div>start =3D ctypes.c_void_p(mbi.BaseAddress)</div>=
<div><br></div><div>ReadProcessMemory =3D Kernel32.ReadProcessMemory</div><=
div><br></div><div>MEM_COMMIT =3D 0x00001000;</div><div>PAGE_READWRITE =3D =
0x04;</div><div><br></div><div>current_address =3D sysinfo.lpMinimumApplica=
tionAddress</div><div>end_address =3D sysinfo.lpMaximumApplicationAddress</=
div><div><br></div><div>while current_address &lt; end_address:</div><div>=
=C2=A0 =C2=A0 Kernel32.VirtualQueryEx(Process, \</div><div>=C2=A0 =C2=A0 cu=
rrent_address, ctypes.byref(mbi),ctypes.sizeof(mbi))</div><div><br></div><d=
iv>=C2=A0 =C2=A0 if mbi.Protect =3D=3D PAGE_READWRITE and mbi.State =3D=3D =
MEM_COMMIT :</div><div><br></div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 if ReadPr=
ocessMemory(Process, current_address, ctypes.byref(buffer), \</div><div>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(buffer), ctypes.byref(nread)):</di=
v><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 print(&#39;b=
uffer is: &#39;,buffer)</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 else:</div><d=
iv>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ctypes.Win=
Error(ctypes.get_last_error())</div><div><br></div><div>=C2=A0 =C2=A0 curre=
nt_address +=3D mbi.RegionSize</div></div><div><br></div></div>

--f40304353a0820ca11055afb3f54--


--===============2815362699900402419==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============2815362699900402419==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============2815362699900402419==--