Re: [Tutor] using while loop for read process memory
Michael C <[email protected]> Fri, 13 Oct 2017 16:10:04 -0700
| Newsgroups | gmane.comp.python.ctypes,gmane.comp.python.tutor |
|---|---|
| Message-ID | <CANyKM1hAKEq645aZeP9gK5Sr=7buLFEt0CVt5ZF5ypOgWwzMVg@mail.gmail.com> |
--===============7285688098735361269== Content-Type: multipart/alternative; boundary="94eb2c0dd4b8de5b86055b75c182" --94eb2c0dd4b8de5b86055b75c182 Content-Type: text/plain; charset="UTF-8" Sorry Alan, Steve, everyone Can you take a look of this please? Here is my question about the memory: So I have a base address of a chunk of memory from it's size, from VirtualQueryEx (if you dont use windows, it's ok, it's not about how u get these values, because I think the base concept is the same) start = mbi.BaseAddress finish = mbi.RegionSize So at this time, I use while and this is how it looks like while index < finish: # access the memory here: while memory function( index) # then index += 1, for the inner loop ## this line complete the outer while loop index += mbi.RegionSize so Why did I put down index += 1 ? That's because what I think about the memory looks like this (short)(int)(double)(int)(int)(int)(double) and so on, since I can't predict which address is the beginning of a double, the only way to deal with that is to use increment by 1. Now, from what I have been reading, it seems there is a better way to do it, for instance, a for loop. for(start,finish, 8) why 8? because double begins at exact 0 or multiple of 8 bytes, right? On Thu, Oct 12, 2017 at 6:54 PM, Michael C <[email protected]> wrote: > Here is my question about the memory: > > So I have a base address of a chunk of memory from it's size, from > VirtualQueryEx > (if you dont use windows, it's ok, it's not about how u get these values, > because I think > the base concept is the same) > > start = mbi.BaseAddress > finish = mbi.RegionSize > > So at this time, I use while and this is how it looks like > > while index < finish: > # access the memory here: > while memory function( index) > # then index += 1, for the inner loop > > ## this line complete the outer while loop > index += mbi.RegionSize > > > so Why did I put down index += 1 ? > > That's because what I think about the memory looks like this > (short)(int)(double)(int)(int)(int)(double) and so on, > > since I can't predict which address is the beginning of a double, the only > way > to deal with that is to use increment by 1. > > Now, from what I have been reading, it seems there is a better way to do > it, > for instance, a for loop. > > for(start,finish, 8) > > why 8? because double begins at exact 0 or multiple of 8 bytes, right? > > > > On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <[email protected]> > wrote: > >> On 08/10/17 20:18, Michael C wrote: >> > This is the red part >> > index = current_address >> > end = current_address + mbi.RegionSize >> > >> > while index < end: >> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \ >> > ctypes.sizeof(buffer), >> > ctypes.byref(nread)): >> > ## value comparison to be implemented. >> > pass >> > else: >> > raise ctypes.WinError(ctypes.get_last_error()) >> > >> > index += 1 >> >> I haven't been following this closely so may be way off here, >> but does this mean you are incrementing the memory address >> by 1? If so you are only increasing the pointer by 1 byte >> but you are, presumably, reading multiple bytes at a time >> (the size of the buffer presumably). >> >> Do you perhaps need to treat the buffer as a byte array >> and use something like the struct module to decode it? >> (assuming you know what you are reading...?) >> >> But I may be way off, I'm just going on a cursory look. >> >> -- >> Alan G >> Author of the Learn to Program web site >> http://www.alan-g.me.uk/ >> http://www.amazon.com/author/alan_gauld >> Follow my photo-blog on Flickr at: >> http://www.flickr.com/photos/alangauldphotos >> >> >> _______________________________________________ >> Tutor maillist - [email protected] >> To unsubscribe or change subscription options: >> https://mail.python.org/mailman/listinfo/tutor >> > > --94eb2c0dd4b8de5b86055b75c182 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Sorry Alan, Steve, everyone<div><br></div><div>Can you tak= e a look of this please?</div><div><br></div><div><br></div><div><br></div>= <div><span style=3D"font-size:12.8px">Here is my question about the memory:= </span><div style=3D"font-size:12.8px"><br></div><div style=3D"font-size:12= .8px">So I have a base address of a chunk of memory from it's size, fro= m VirtualQueryEx</div><div style=3D"font-size:12.8px">(if you dont use wind= ows, it's ok, it's not about how u get these values, because I thin= k</div><div style=3D"font-size:12.8px">the base concept is the same)</div><= div style=3D"font-size:12.8px"><br></div><div style=3D"font-size:12.8px">st= art =3D mbi.BaseAddress<br></div><div style=3D"font-size:12.8px">finish =3D= mbi.RegionSize<br></div><div style=3D"font-size:12.8px"><br></div><div sty= le=3D"font-size:12.8px">So at this time, I use while and this is how it loo= ks like</div><div style=3D"font-size:12.8px"><br></div><div style=3D"font-s= ize:12.8px">while index < finish:</div><div style=3D"font-size:12.8px">= =C2=A0 =C2=A0# access the memory here:</div><div style=3D"font-size:12.8px"= >=C2=A0 =C2=A0while memory function( index)</div><div style=3D"font-size:12= .8px">=C2=A0 =C2=A0# then index +=3D 1, for the inner loop</div><div style= =3D"font-size:12.8px">=C2=A0=C2=A0</div><div style=3D"font-size:12.8px">## = this line complete the outer while loop</div><div style=3D"font-size:12.8px= ">index +=3D mbi.RegionSize<br></div><div style=3D"font-size:12.8px"><br></= div><div style=3D"font-size:12.8px"><br></div><div style=3D"font-size:12.8p= x">so Why did I put down index +=3D 1=C2=A0 ?</div><div style=3D"font-size:= 12.8px"><br></div><div style=3D"font-size:12.8px">That's because what I= think about the memory looks like this</div><div style=3D"font-size:12.8px= ">(short)(int)(double)(int)(int)<wbr>(int)(double)=C2=A0 and so on,</div><d= iv style=3D"font-size:12.8px"><br></div><div style=3D"font-size:12.8px">sin= ce I can't predict which address is the beginning of a double, the only= way</div><div style=3D"font-size:12.8px">to deal with that is to use incre= ment by 1.</div><div style=3D"font-size:12.8px"><br></div><div style=3D"fon= t-size:12.8px">Now, from what I have been reading, it seems there is a bett= er way to do it,</div><div style=3D"font-size:12.8px">for instance, a for l= oop.</div><div style=3D"font-size:12.8px"><br></div><div style=3D"font-size= :12.8px">for(start,finish, 8)</div><div style=3D"font-size:12.8px"><br></di= v><div style=3D"font-size:12.8px">why 8? because double begins at exact 0 o= r multiple of 8 bytes, right?</div></div></div><div class=3D"gmail_extra"><= br><div class=3D"gmail_quote">On Thu, Oct 12, 2017 at 6:54 PM, Michael C <s= pan dir=3D"ltr"><<a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a>></span> wrote:<br><block= quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc= solid;padding-left:1ex"><div dir=3D"ltr">Here is my question about the mem= ory:<div><br></div><div>So I have a base address of a chunk of memory from = it's size, from VirtualQueryEx</div><div>(if you dont use windows, it&#= 39;s ok, it's not about how u get these values, because I think</div><d= iv>the base concept is the same)</div><div><br></div><div>start =3D mbi.Bas= eAddress<br></div><div>finish =3D mbi.RegionSize<br></div><div><br></div><d= iv>So at this time, I use while and this is how it looks like</div><div><br= ></div><div>while index < finish:</div><div>=C2=A0 =C2=A0# access the me= mory here:</div><div>=C2=A0 =C2=A0while memory function( index)</div><div>= =C2=A0 =C2=A0# then index +=3D 1, for the inner loop</div><div>=C2=A0=C2=A0= </div><div>## this line complete the outer while loop</div><div>index +=3D = mbi.RegionSize<br></div><div><br></div><div><br></div><div>so Why did I put= down index +=3D 1=C2=A0 ?</div><div><br></div><div>That's because what= I think about the memory looks like this</div><div>(short)(int)(double)(in= t)(int)<wbr>(int)(double)=C2=A0 and so on,</div><div><br></div><div>since I= can't predict which address is the beginning of a double, the only way= </div><div>to deal with that is to use increment by 1.</div><div><br></div>= <div>Now, from what I have been reading, it seems there is a better way to = do it,</div><div>for instance, a for loop.</div><div><br></div><div>for(sta= rt,finish, 8)</div><div><br></div><div>why 8? because double begins at exac= t 0 or multiple of 8 bytes, right?</div><div><br></div><div><br></div></div= ><div class=3D"gmail_extra"><br><div class=3D"gmail_quote"><span class=3D""= >On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <span dir=3D"ltr"><= ;<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>= ></span> wrote:<br></span><div><div class=3D"h5"><blockquote class=3D"gm= ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le= ft:1ex"><span>On 08/10/17 20:18, Michael C wrote:<br> > This is the red part=C2=A0<br> > =C2=A0 index =3D current_address<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 end =3D current_address + mbi.RegionSize<b= r> ><br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 while index < end:<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if ReadProcessMemory(Process= , index, ctypes.byref(buffer), \<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ctypes.sizeof(buffer),<br> > ctypes.byref(nread)):<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ## value compa= rison to be implemented.<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pass=C2=A0 =C2= =A0<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 else:<br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = raise ctypes.WinError(ctypes.get_las<wbr>t_error())<br> ><br> > =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 index +=3D 1<br> <br> </span>I haven't been following this closely so may be way off here,<br= > but does this mean you are incrementing the memory address<br> by 1? If so you are only increasing the pointer by 1 byte<br> but you are, presumably, reading multiple bytes at a time<br> (the size of the buffer presumably).<br> <br> Do you perhaps need to treat the buffer as a byte array<br> and use something like the struct module to decode it?<br> (assuming you know what you are reading...?)<br> <br> But I may be way off, I'm just going on a cursory look.<br> <br> --<br> Alan G<br> Author of the Learn to Program web site<br> <a href=3D"http://www.alan-g.me.uk/" rel=3D"noreferrer" target=3D"_blank">h= ttp://www.alan-g.me.uk/</a><br> <a href=3D"http://www.amazon.com/author/alan_gauld" rel=3D"noreferrer" targ= et=3D"_blank">http://www.amazon.com/author/a<wbr>lan_gauld</a><br> Follow my photo-blog on Flickr at:<br> <a href=3D"http://www.flickr.com/photos/alangauldphotos" rel=3D"noreferrer"= target=3D"_blank">http://www.flickr.com/photos/a<wbr>langauldphotos</a><br= > <br> <br> ______________________________<wbr>_________________<br> Tutor maillist=C2=A0 -=C2=A0 <a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a><br> To unsubscribe or change subscription options:<br> <a href=3D"https://mail.python.org/mailman/listinfo/tutor" rel=3D"noreferre= r" target=3D"_blank">https://mail.python.org/mailma<wbr>n/listinfo/tutor</a= ><br> </blockquote></div></div></div><br></div> </blockquote></div><br></div> --94eb2c0dd4b8de5b86055b75c182-- --===============7285688098735361269== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot --===============7285688098735361269== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ctypes-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ctypes-users --===============7285688098735361269==--