using while loop for read process memory

--===============5996081793525170698==
Content-Type: multipart/alternative; boundary="001a1134e7c675e0b0055b0c4909"

--001a1134e7c675e0b0055b0c4909
Content-Type: text/plain; charset="UTF-8"

Hi all:

I have the following code, and somehow I must have fed the read process
Memory incorrectly. what the code does is to check a region of memory to
see
whether or not it can be scanned.

mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT

If this is true,then it proceeds to scan the memory fro current_address to
current_address + mbi.RegionSize.

However, a strange thing happens: The loop runs twice successfully, and
then it
pops:

raise ctypes.WinError(ctypes.get_last_error())
OSError: [WinError 299] Only part of a ReadProcessMemory or
WriteProcessMemory request was completed.

Now, I know the problem is not with VirtualQueryEx, because if I comment out
the red part and just run VirtualQueryEx, it would actually skim through
all regions
without a single error.

The red part is the problem. I have tried to modify the loop.

Somehow, if I use this:

        index = current_address
        end = current_address + mbi.RegionSize - 7

Where the end is less by 7, the loop would not pop any error and it would
finish
the loop

What did I do wrong?

thanks!




>code starts



current_address = sysinfo.lpMinimumApplicationAddress
end_address = sysinfo.lpMaximumApplicationAddress

while current_address < end_address:
    Kernel32.VirtualQueryEx(Process, \
    current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))

    if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
        print('This region can be scanned!')
        index = current_address
        end = current_address + mbi.RegionSize

        while index < end:
            if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
                                 ctypes.sizeof(buffer),
ctypes.byref(nread)):
                ## value comparison to be implemented.
                pass
            else:
                    raise ctypes.WinError(ctypes.get_last_error())

            index += 1

    current_address += mbi.RegionSize

--001a1134e7c675e0b0055b0c4909
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi all:</div><div><br></div><div>I have the following=
 code, and somehow I must have fed the read process</div><div> Memory incor=
rectly. what the code does is to check a region of memory to see=C2=A0</div=
><div>whether or not it can be scanned.</div><div><br></div><div>mbi.Protec=
t =3D=3D PAGE_READWRITE and mbi.State =3D=3D MEM_COMMIT=C2=A0<br></div><div=
><br></div><div>If this is true,then it proceeds to scan the memory fro cur=
rent_address to=C2=A0</div><div>current_address + mbi.RegionSize.=C2=A0<br>=
</div><div><br></div><div>However, a strange thing happens: The loop runs t=
wice successfully, and then it=C2=A0</div><div>pops:</div><div><br></div><d=
iv>raise ctypes.WinError(ctypes.get_last_error())</div><div>OSError: [WinEr=
ror 299] Only part of a ReadProcessMemory or WriteProcessMemory request was=
 completed.</div><div><br></div><div>Now, I know the problem is not with Vi=
rtualQueryEx, because if I comment out</div><div>the red part and just run =
VirtualQueryEx, it would actually skim through all regions</div><div>withou=
t a single error.</div><div><br></div><div>The red part is the problem. I h=
ave tried to modify the loop.<br></div><div><br></div><div>Somehow, if I us=
e this:</div><div><br></div><div><div><font color=3D"#ff0000">=C2=A0 =C2=A0=
 =C2=A0 =C2=A0 index =3D current_address</font></div><div><font color=3D"#f=
f0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0 end =3D current_address + mbi.RegionSize=
 - 7</font></div></div><div><font color=3D"#ff0000"><br></font></div><div><=
font color=3D"#000000">Where the end is less by 7, the loop would not pop a=
ny error and it would finish</font></div><div><font color=3D"#000000">the l=
oop</font></div><div><br></div><div><font color=3D"#000000">What did I do w=
rong?</font></div><div><font color=3D"#000000"><br></font></div><div><font =
color=3D"#000000">thanks!</font></div><div><br></div><div><br></div><div><b=
r></div><div><br></div>&gt;code starts<div><br></div><div><br></div><div><b=
r></div><div><div>current_address =3D sysinfo.lpMinimumApplicationAddress</=
div><div>end_address =3D sysinfo.lpMaximumApplicationAddress</div><div><br>=
</div><div>while current_address &lt; end_address:</div><div>=C2=A0 =C2=A0 =
Kernel32.VirtualQueryEx(Process, \</div><div>=C2=A0 =C2=A0 current_address,=
 ctypes.byref(mbi),ctypes.sizeof(mbi))</div><div><br></div><div>=C2=A0 =C2=
=A0 if mbi.Protect =3D=3D PAGE_READWRITE and mbi.State =3D=3D MEM_COMMIT :<=
/div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 print(&#39;This region can be scanned=
!&#39;)</div><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0 index=
 =3D current_address</font></div><div><font color=3D"#ff0000">=C2=A0 =C2=A0=
 =C2=A0 =C2=A0 end =3D current_address + mbi.RegionSize</font></div><div><b=
r></div><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0 while inde=
x &lt; end:</font></div><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 if ReadProcessMemory(Process, index, ctypes.byref(buff=
er), \</font></div><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0ctypes.sizeof(buffer), ctypes.byref(nread)):</font></div><=
div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 ## value comparison to be implemented.</font></div><div><font co=
lor=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pas=
s=C2=A0 =C2=A0</font></div><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 else:</font></div><div><font color=3D"#ff0000">=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 raise ct=
ypes.WinError(ctypes.get_last_error())</font></div><div><font color=3D"#ff0=
000"><br></font></div><div><font color=3D"#ff0000">=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 index +=3D 1</font></div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0=C2=A0</div><div>=C2=A0 =C2=A0 current_address +=3D mbi.Regio=
nSize</div></div></div>

--001a1134e7c675e0b0055b0c4909--


--===============5996081793525170698==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============5996081793525170698==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users

--===============5996081793525170698==--