Re: [Tutor] using while loop for read process memory
Michael C <[email protected]> Thu, 12 Oct 2017 18:58:47 -0700
| Newsgroups | gmane.comp.python.ctypes,gmane.comp.python.tutor |
|---|---|
| Message-ID | <CANyKM1hRa7A19q208SdmdPHt9kfz1wngRPPboQUZ5wLUjwvOOg@mail.gmail.com> |
--===============7609382275049144100==
Content-Type: multipart/alternative; boundary="001a113cf08862475a055b63ff8d"
--001a113cf08862475a055b63ff8d
Content-Type: text/plain; charset="UTF-8"
in fact, when I am using this:
end = start + mbi.RegionSize
I was getting error from the ReadProcessMemory function, and I couldn't
figure it out why.
Until I did this:
end = current_address + mbi.RegionSize - 7
then it doesn't complain anymore. I think it's because I ran this in a
while loop with start += 1
so in the last 7 bytes, I'd be reading past the end of this memory chunk.
Is this right?
On Thu, Oct 12, 2017 at 6:54 PM, Michael C <[email protected]>
wrote:
> Here is my question about the memory:
>
> So I have a base address of a chunk of memory from it's size, from
> VirtualQueryEx
> (if you dont use windows, it's ok, it's not about how u get these values,
> because I think
> the base concept is the same)
>
> start = mbi.BaseAddress
> finish = mbi.RegionSize
>
> So at this time, I use while and this is how it looks like
>
> while index < finish:
> # access the memory here:
> while memory function( index)
> # then index += 1, for the inner loop
>
> ## this line complete the outer while loop
> index += mbi.RegionSize
>
>
> so Why did I put down index += 1 ?
>
> That's because what I think about the memory looks like this
> (short)(int)(double)(int)(int)(int)(double) and so on,
>
> since I can't predict which address is the beginning of a double, the only
> way
> to deal with that is to use increment by 1.
>
> Now, from what I have been reading, it seems there is a better way to do
> it,
> for instance, a for loop.
>
> for(start,finish, 8)
>
> why 8? because double begins at exact 0 or multiple of 8 bytes, right?
>
>
>
> On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <[email protected]>
> wrote:
>
>> On 08/10/17 20:18, Michael C wrote:
>> > This is the red part
>> > index = current_address
>> > end = current_address + mbi.RegionSize
>> >
>> > while index < end:
>> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
>> > ctypes.sizeof(buffer),
>> > ctypes.byref(nread)):
>> > ## value comparison to be implemented.
>> > pass
>> > else:
>> > raise ctypes.WinError(ctypes.get_last_error())
>> >
>> > index += 1
>>
>> I haven't been following this closely so may be way off here,
>> but does this mean you are incrementing the memory address
>> by 1? If so you are only increasing the pointer by 1 byte
>> but you are, presumably, reading multiple bytes at a time
>> (the size of the buffer presumably).
>>
>> Do you perhaps need to treat the buffer as a byte array
>> and use something like the struct module to decode it?
>> (assuming you know what you are reading...?)
>>
>> But I may be way off, I'm just going on a cursory look.
>>
>> --
>> Alan G
>> Author of the Learn to Program web site
>> http://www.alan-g.me.uk/
>> http://www.amazon.com/author/alan_gauld
>> Follow my photo-blog on Flickr at:
>> http://www.flickr.com/photos/alangauldphotos
>>
>>
>> _______________________________________________
>> Tutor maillist - [email protected]
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
--001a113cf08862475a055b63ff8d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">in fact, when I am using this:<div><br></div><div>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 end =3D start + mbi.RegionSize<br></div><div><br></div=
><div>I was getting error from the ReadProcessMemory function, and I couldn=
't figure it out why.</div><div>Until I did this:</div><div>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 end =3D current_address + mbi.RegionSize - 7<br></div><di=
v><br></div><div>then it doesn't complain anymore. I think it's bec=
ause I ran this in a while loop with start +=3D 1</div><div>so in the last =
7 bytes, I'd be reading past the end of this memory chunk.</div><div><b=
r></div><div>Is this right?</div></div><div class=3D"gmail_extra"><br><div =
class=3D"gmail_quote">On Thu, Oct 12, 2017 at 6:54 PM, Michael C <span dir=
=3D"ltr"><<a href=3D"mailto:[email protected]" target=3D"_b=
lank">[email protected]</a>></span> wrote:<br><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex"><div dir=3D"ltr">Here is my question about the memory:<di=
v><br></div><div>So I have a base address of a chunk of memory from it'=
s size, from VirtualQueryEx</div><div>(if you dont use windows, it's ok=
, it's not about how u get these values, because I think</div><div>the =
base concept is the same)</div><div><br></div><div>start =3D mbi.BaseAddres=
s<br></div><div>finish =3D mbi.RegionSize<br></div><div><br></div><div>So a=
t this time, I use while and this is how it looks like</div><div><br></div>=
<div>while index < finish:</div><div>=C2=A0 =C2=A0# access the memory he=
re:</div><div>=C2=A0 =C2=A0while memory function( index)</div><div>=C2=A0 =
=C2=A0# then index +=3D 1, for the inner loop</div><div>=C2=A0=C2=A0</div><=
div>## this line complete the outer while loop</div><div>index +=3D mbi.Reg=
ionSize<br></div><div><br></div><div><br></div><div>so Why did I put down i=
ndex +=3D 1=C2=A0 ?</div><div><br></div><div>That's because what I thin=
k about the memory looks like this</div><div>(short)(int)(double)(int)(int)=
<wbr>(int)(double)=C2=A0 and so on,</div><div><br></div><div>since I can=
9;t predict which address is the beginning of a double, the only way</div><=
div>to deal with that is to use increment by 1.</div><div><br></div><div>No=
w, from what I have been reading, it seems there is a better way to do it,<=
/div><div>for instance, a for loop.</div><div><br></div><div>for(start,fini=
sh, 8)</div><div><br></div><div>why 8? because double begins at exact 0 or =
multiple of 8 bytes, right?</div><div><br></div><div><br></div></div><div c=
lass=3D"gmail_extra"><br><div class=3D"gmail_quote"><span class=3D"">On Sun=
, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <span dir=3D"ltr"><<a hre=
f=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>></s=
pan> wrote:<br></span><div><div class=3D"h5"><blockquote class=3D"gmail_quo=
te" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"=
><span>On 08/10/17 20:18, Michael C wrote:<br>
> This is the red part=C2=A0<br>
> =C2=A0 index =3D current_address<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 end =3D current_address + mbi.RegionSize<b=
r>
><br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 while index < end:<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if ReadProcessMemory(Process=
, index, ctypes.byref(buffer), \<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(buffer),<br>
> ctypes.byref(nread)):<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ## value compa=
rison to be implemented.<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pass=C2=A0 =C2=
=A0<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
raise ctypes.WinError(ctypes.get_las<wbr>t_error())<br>
><br>
> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 index +=3D 1<br>
<br>
</span>I haven't been following this closely so may be way off here,<br=
>
but does this mean you are incrementing the memory address<br>
by 1? If so you are only increasing the pointer by 1 byte<br>
but you are, presumably, reading multiple bytes at a time<br>
(the size of the buffer presumably).<br>
<br>
Do you perhaps need to treat the buffer as a byte array<br>
and use something like the struct module to decode it?<br>
(assuming you know what you are reading...?)<br>
<br>
But I may be way off, I'm just going on a cursory look.<br>
<br>
--<br>
Alan G<br>
Author of the Learn to Program web site<br>
<a href=3D"http://www.alan-g.me.uk/" rel=3D"noreferrer" target=3D"_blank">h=
ttp://www.alan-g.me.uk/</a><br>
<a href=3D"http://www.amazon.com/author/alan_gauld" rel=3D"noreferrer" targ=
et=3D"_blank">http://www.amazon.com/author/a<wbr>lan_gauld</a><br>
Follow my photo-blog on Flickr at:<br>
<a href=3D"http://www.flickr.com/photos/alangauldphotos" rel=3D"noreferrer"=
target=3D"_blank">http://www.flickr.com/photos/a<wbr>langauldphotos</a><br=
>
<br>
<br>
______________________________<wbr>_________________<br>
Tutor maillist=C2=A0 -=C2=A0 <a href=3D"mailto:[email protected]" target=3D"=
_blank">[email protected]</a><br>
To unsubscribe or change subscription options:<br>
<a href=3D"https://mail.python.org/mailman/listinfo/tutor" rel=3D"noreferre=
r" target=3D"_blank">https://mail.python.org/mailma<wbr>n/listinfo/tutor</a=
><br>
</blockquote></div></div></div><br></div>
</blockquote></div><br></div>
--001a113cf08862475a055b63ff8d--
--===============7609382275049144100==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============7609382275049144100==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
ctypes-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ctypes-users
--===============7609382275049144100==--