Re: [Tutor] using while loop for read process memory
Michael C <[email protected]> Thu, 12 Oct 2017 18:54:10 -0700
| Newsgroups | gmane.comp.python.ctypes,gmane.comp.python.tutor |
|---|---|
| Message-ID | <CANyKM1jQ=qqMULunwxLB2jcUPwF1eW4cBj-D3qMvcJ3w-5j_qQ@mail.gmail.com> |
--===============3380934340269398946== Content-Type: multipart/alternative; boundary="001a113e39dce660c7055b63ee96" --001a113e39dce660c7055b63ee96 Content-Type: text/plain; charset="UTF-8" Here is my question about the memory: So I have a base address of a chunk of memory from it's size, from VirtualQueryEx (if you dont use windows, it's ok, it's not about how u get these values, because I think the base concept is the same) start = mbi.BaseAddress finish = mbi.RegionSize So at this time, I use while and this is how it looks like while index < finish: # access the memory here: while memory function( index) # then index += 1, for the inner loop ## this line complete the outer while loop index += mbi.RegionSize so Why did I put down index += 1 ? That's because what I think about the memory looks like this (short)(int)(double)(int)(int)(int)(double) and so on, since I can't predict which address is the beginning of a double, the only way to deal with that is to use increment by 1. Now, from what I have been reading, it seems there is a better way to do it, for instance, a for loop. for(start,finish, 8) why 8? because double begins at exact 0 or multiple of 8 bytes, right? On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <[email protected]> wrote: > On 08/10/17 20:18, Michael C wrote: > > This is the red part > > index = current_address > > end = current_address + mbi.RegionSize > > > > while index < end: > > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \ > > ctypes.sizeof(buffer), > > ctypes.byref(nread)): > > ## value comparison to be implemented. > > pass > > else: > > raise ctypes.WinError(ctypes.get_last_error()) > > > > index += 1 > > I haven't been following this closely so may be way off here, > but does this mean you are incrementing the memory address > by 1? If so you are only increasing the pointer by 1 byte > but you are, presumably, reading multiple bytes at a time > (the size of the buffer presumably). > > Do you perhaps need to treat the buffer as a byte array > and use something like the struct module to decode it? > (assuming you know what you are reading...?) > > But I may be way off, I'm just going on a cursory look. > > -- > Alan G > Author of the Learn to Program web site > http://www.alan-g.me.uk/ > http://www.amazon.com/author/alan_gauld > Follow my photo-blog on Flickr at: > http://www.flickr.com/photos/alangauldphotos > > > _______________________________________________ > Tutor maillist - [email protected] > To unsubscribe or change subscription options: > https://mail.python.org/mailman/listinfo/tutor > --001a113e39dce660c7055b63ee96 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Here is my question about the memory:<div><br></div><div>S= o I have a base address of a chunk of memory from it's size, from Virtu= alQueryEx</div><div>(if you dont use windows, it's ok, it's not abo= ut how u get these values, because I think</div><div>the base concept is th= e same)</div><div><br></div><div>start =3D mbi.BaseAddress<br></div><div>fi= nish =3D mbi.RegionSize<br></div><div><br></div><div>So at this time, I use= while and this is how it looks like</div><div><br></div><div>while index &= lt; finish:</div><div>=C2=A0 =C2=A0# access the memory here:</div><div>=C2= =A0 =C2=A0while memory function( index)</div><div>=C2=A0 =C2=A0# then index= +=3D 1, for the inner loop</div><div>=C2=A0=C2=A0</div><div>## this line c= omplete the outer while loop</div><div>index +=3D mbi.RegionSize<br></div><= div><br></div><div><br></div><div>so Why did I put down index +=3D 1=C2=A0 = ?</div><div><br></div><div>That's because what I think about the memory= looks like this</div><div>(short)(int)(double)(int)(int)(int)(double)=C2= =A0 and so on,</div><div><br></div><div>since I can't predict which add= ress is the beginning of a double, the only way</div><div>to deal with that= is to use increment by 1.</div><div><br></div><div>Now, from what I have b= een reading, it seems there is a better way to do it,</div><div>for instanc= e, a for loop.</div><div><br></div><div>for(start,finish, 8)</div><div><br>= </div><div>why 8? because double begins at exact 0 or multiple of 8 bytes, = right?</div><div><br></div><div><br></div></div><div class=3D"gmail_extra">= <br><div class=3D"gmail_quote">On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld v= ia Tutor <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>></span> wrote:<br><blockquote class=3D"= gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-= left:1ex"><span class=3D"">On 08/10/17 20:18, Michael C wrote:<br> > This is the red part=C2=A0<br> > =C2=A0 index =3D current_address<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 end =3D current_address + mbi.RegionSize<b= r> ><br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 while index < end:<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if ReadProcessMemory(Process= , index, ctypes.byref(buffer), \<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(buffer),<br> > ctypes.byref(nread)):<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ## value compa= rison to be implemented.<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pass=C2=A0 =C2= =A0<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = raise ctypes.WinError(ctypes.get_<wbr>last_error())<br> ><br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 index +=3D 1<br> <br> </span>I haven't been following this closely so may be way off here,<br= > but does this mean you are incrementing the memory address<br> by 1? If so you are only increasing the pointer by 1 byte<br> but you are, presumably, reading multiple bytes at a time<br> (the size of the buffer presumably).<br> <br> Do you perhaps need to treat the buffer as a byte array<br> and use something like the struct module to decode it?<br> (assuming you know what you are reading...?)<br> <br> But I may be way off, I'm just going on a cursory look.<br> <br> --<br> Alan G<br> Author of the Learn to Program web site<br> <a href=3D"http://www.alan-g.me.uk/" rel=3D"noreferrer" target=3D"_blank">h= ttp://www.alan-g.me.uk/</a><br> <a href=3D"http://www.amazon.com/author/alan_gauld" rel=3D"noreferrer" targ= et=3D"_blank">http://www.amazon.com/author/<wbr>alan_gauld</a><br> Follow my photo-blog on Flickr at:<br> <a href=3D"http://www.flickr.com/photos/alangauldphotos" rel=3D"noreferrer"= target=3D"_blank">http://www.flickr.com/photos/<wbr>alangauldphotos</a><br= > <br> <br> ______________________________<wbr>_________________<br> Tutor maillist=C2=A0 -=C2=A0 <a href=3D"mailto:[email protected]">Tutor@pyth= on.org</a><br> To unsubscribe or change subscription options:<br> <a href=3D"https://mail.python.org/mailman/listinfo/tutor" rel=3D"noreferre= r" target=3D"_blank">https://mail.python.org/<wbr>mailman/listinfo/tutor</a= ><br> </blockquote></div><br></div> --001a113e39dce660c7055b63ee96-- --===============3380934340269398946== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot --===============3380934340269398946== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ctypes-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ctypes-users --===============3380934340269398946==--