Re: How do I scan memory for singles, doubles and so on?

--===============1462545871648459894==
Content-Type: multipart/alternative; boundary="001a113d31e8c60808055afb6301"

--001a113d31e8c60808055afb6301
Content-Type: text/plain; charset="UTF-8"

Or to put it better, I think, it's

How do I set up ReadProcessMemory, so that it returns a double instead of
129819721.

On Sat, Oct 7, 2017 at 2:00 PM, Michael C <[email protected]>
wrote:

> Hi all:
>
> I am working on a memory scanner, and the source code and output is as
> following:
>
> Now, I know why my buffer from read process memory looks like values such
> as "67108864" ; it's because I read into the buffer entire chunk of memory
> at a time, because I fed read process memory this:  "mbi.RegionSize"
>
> Now, how do I read for values such as doubles?
> I am guessing I need to use a for loop to scan for small bits of memory
> chunk
> at a time.
>
> Is there a way to do it?
>
> Thanks!
>
>
>
>
> >output starts
>
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(6385664)
> buffer is:  c_ulong(67108864)
> buffer is:  c_ulong(7761920)
> buffer is:  c_ulong(7798784)
> buffer is:  c_ulong(7872512)
> buffer is:  c_ulong(8007680)
> buffer is:  c_ulong(8044544)
> buffer is:  c_ulong(8069120)
> buffer is:  c_ulong(8216576)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(3976)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(1318755581)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
>
> > code starts
>
> buffer = ctypes.c_uint()
> nread = SIZE_T()
>
> start = ctypes.c_void_p(mbi.BaseAddress)
>
> ReadProcessMemory = Kernel32.ReadProcessMemory
>
> MEM_COMMIT = 0x00001000;
> PAGE_READWRITE = 0x04;
>
> current_address = sysinfo.lpMinimumApplicationAddress
> end_address = sysinfo.lpMaximumApplicationAddress
>
> while current_address < end_address:
>     Kernel32.VirtualQueryEx(Process, \
>     current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))
>
>     if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
>
>         if ReadProcessMemory(Process, current_address,
> ctypes.byref(buffer), \
>                              ctypes.sizeof(buffer), ctypes.byref(nread)):
>                 print('buffer is: ',buffer)
>         else:
>                 raise ctypes.WinError(ctypes.get_last_error())
>
>     current_address += mbi.RegionSize
>
>

--001a113d31e8c60808055afb6301
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Or to put it better, I think, it&#39;s<div><br></div><div>=
How do I set up ReadProcessMemory, so that it returns a double instead of 1=
29819721.</div></div><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Sat, Oct 7, 2017 at 2:00 PM, Michael C <span dir=3D"ltr">&lt;<a href=
=3D"mailto:[email protected]" target=3D"_blank">mysecretrobotf=
[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><d=
iv dir=3D"ltr"><div>Hi all:</div><div><br></div><div>I am working on a memo=
ry scanner, and the source code and output is as</div><div>following:</div>=
<div><br></div><div>Now, I know why my buffer from read process memory look=
s like values such</div><div>as &quot;67108864&quot; ; it&#39;s because I r=
ead into the buffer entire chunk of memory</div><div>at a time, because I f=
ed read process memory this:=C2=A0 &quot;mbi.RegionSize&quot;</div><div><br=
></div><div>Now, how do I read for values such as doubles?</div><div>I am g=
uessing I need to use a for loop to scan for small bits of memory chunk</di=
v><div>at a time.</div><div><br></div><div>Is there a way to do it?</div><d=
iv><br></div><div>Thanks!</div><div><br></div><div><br></div><div><br></div=
><div><br></div><div>&gt;output starts</div><div><br></div><div><div>buffer=
 is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buffe=
r is:=C2=A0 c_ulong(6385664)</div><div>buffer is:=C2=A0 c_ulong(67108864)</=
div><div>buffer is:=C2=A0 c_ulong(7761920)</div><div>buffer is:=C2=A0 c_ulo=
ng(7798784)</div><div>buffer is:=C2=A0 c_ulong(7872512)</div><div>buffer is=
:=C2=A0 c_ulong(8007680)</div><div>buffer is:=C2=A0 c_ulong(8044544)</div><=
div>buffer is:=C2=A0 c_ulong(8069120)</div><div>buffer is:=C2=A0 c_ulong(82=
16576)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c_u=
long(0)</div><div>buffer is:=C2=A0 c_ulong(3976)</div><div>buffer is:=C2=A0=
 c_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=
=A0 c_ulong(1318755581)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>buf=
fer is:=C2=A0 c_ulong(0)</div><div>buffer is:=C2=A0 c_ulong(0)</div><div>bu=
ffer is:=C2=A0 c_ulong(0)</div></div><div><br></div>&gt; code starts<div><b=
r></div><div><div>buffer =3D ctypes.c_uint()</div><div>nread =3D SIZE_T()</=
div><div><br></div><div>start =3D ctypes.c_void_p(mbi.<wbr>BaseAddress)</di=
v><div><br></div><div>ReadProcessMemory =3D Kernel32.ReadProcessMemory</div=
><div><br></div><div>MEM_COMMIT =3D 0x00001000;</div><div>PAGE_READWRITE =
=3D 0x04;</div><div><br></div><div>current_address =3D sysinfo.<wbr>lpMinim=
umApplicationAddress</div><div>end_address =3D sysinfo.<wbr>lpMaximumApplic=
ationAddress</div><div><br></div><div>while current_address &lt; end_addres=
s:</div><div>=C2=A0 =C2=A0 Kernel32.VirtualQueryEx(<wbr>Process, \</div><di=
v>=C2=A0 =C2=A0 current_address, ctypes.byref(mbi),ctypes.<wbr>sizeof(mbi))=
</div><div><br></div><div>=C2=A0 =C2=A0 if mbi.Protect =3D=3D PAGE_READWRIT=
E and mbi.State =3D=3D MEM_COMMIT :</div><div><br></div><div>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 if ReadProcessMemory(Process, current_address, ctypes.byref(b=
uffer), \</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(buffer), cty=
pes.byref(nread)):</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 print(&#39;buffer is: &#39;,buffer)</div><div>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 else:</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 raise ctypes.WinError(ctypes.get_<wbr>last_error())</div><div><br><=
/div><div>=C2=A0 =C2=A0 current_address +=3D mbi.RegionSize</div></div><div=
><br></div></div>
</blockquote></div><br></div>

--001a113d31e8c60808055afb6301--


--===============1462545871648459894==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============1462545871648459894==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============1462545871648459894==--