ctypes-users — Discussion forum for ctypes users

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

Shouldn't I use VirtualQueryEX to find out these values?

        ph = kernel32.GetCurrentProcess()
        source_array = (wintypes.DWORD * 10)(*range(10))
        base_address = ctypes.addressof(source_array)
        block_size = ctypes.sizeof(source_array)



On Sat, Dec 10, 2016 at 11:44 AM, Michael C <mys...@gm...>
wrote:

> what does this do?
>
> source_array = (wintypes.DWORD * 10)(*range(10))
>
> On Sat, Dec 10, 2016 at 11:40 AM, Michael C <mysecretrobotfactory@gmail.
> com> wrote:
>
>> How do I tell it to scan for double?
>> Also, how do I specify the target process?
>>
>> Thax
>>
>> On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <er...@gm...> wrote:
>>
>>> On Sat, Dec 10, 2016 at 12:12 AM, Michael C
>>> <mys...@gm...> wrote:
>>> > Here is my entire current work in progress:
>>> >
>>> > #import modules
>>> > import ctypes
>>> > import time
>>>
>>> [snip]
>>>
>>> Here's a working example for ReadProcessMemory.
>>>
>>>     import ctypes
>>>     from ctypes import wintypes
>>>
>>>     kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>>
>>>     PROCESS_VM_READ           = 0x0010
>>>     PROCESS_QUERY_INFORMATION = 0x0400
>>>
>>>     if not hasattr(wintypes, 'SIZE_T'):
>>>         wintypes.SIZE_T = ctypes.c_size_t
>>>
>>>     if not hasattr(wintypes, 'PSIZE_T'):
>>>         wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>>>
>>>     def _check_zero(result, func, args):
>>>         """ Check for zero or NULL return value. """
>>>         if not result:
>>>             raise ctypes.WinError(ctypes.get_last_error())
>>>         return args
>>>
>>>     # https://msdn.microsoft.com/en-us/library/ms683179
>>>     kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>>>
>>>     # https://msdn.microsoft.com/en-us/library/ms684320
>>>     kernel32.OpenProcess.errcheck = _check_zero
>>>     kernel32.OpenProcess.restype = wintypes.HANDLE
>>>
>>>     # https://msdn.microsoft.com/en-us/library/ms680553
>>>     kernel32.ReadProcessMemory.errcheck = _check_zero
>>>     kernel32.ReadProcessMemory.argtypes = (
>>>         wintypes.HANDLE,  # _In_  hProcess
>>>         wintypes.LPCVOID, # _In_  lpBaseAddress
>>>         wintypes.LPVOID,  # _Out_ lpBuffer
>>>         wintypes.SIZE_T,  # _In_  nSize
>>>         wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>>>
>>>     if __name__ == '__main__':
>>>         import sys
>>>
>>>         if len(sys.argv) == 4:
>>>             ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>>>                     PROCESS_VM_READ, False, int(sys.argv[1]))
>>>             base_address = int(sys.argv[2])
>>>             block_size  = int(sys.argv[3])
>>>         elif len(sys.argv) == 1:
>>>             ph = kernel32.GetCurrentProcess()
>>>             source_array = (wintypes.DWORD * 10)(*range(10))
>>>             base_address = ctypes.addressof(source_array)
>>>             block_size = ctypes.sizeof(source_array)
>>>         else:
>>>             sys.exit('Usage: %s pid base_address block_size' %
>>> sys.argv[0])
>>>
>>>         address_list = range(base_address, base_address + block_size,
>>>                              ctypes.sizeof(wintypes.DWORD))
>>>         data = wintypes.DWORD()
>>>
>>>         for address in address_list:
>>>             kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>>>                 ctypes.sizeof(data), None)
>>>             print('%x: %d' % (address, data.value))
>>>
>>> This script defaults to a demo that reads an array of DWORD values
>>> from its own process. You can also provide it the PID, base address,
>>> and block size to read from another process. You could extend this
>>> with another option to configure the type of data read (e.g. char,
>>> float) based on simple ctypes format codes, e.g. "L" for a DWORD,
>>> where "L" is the value of `wintypes.DWORD._type_`. Or instead follow
>>> WinDbg conventions (e.g. db, dw, dd).
>>>
>>> Note that I assign an errcheck function for the OpenProcess and
>>> ReadProcessMemory function pointers. In this case both use the same
>>> _check_zero function, which raises an OSError (or WindowsError in 2.x)
>>> when the call fails. Idiomatic Python programming uses exceptions for
>>> error handling and resource management (i.e. try/except/finally). Get
>>> the error code from the exception's `winerror` attribute when handling
>>> it. Here's the complete list of WinAPI error codes:
>>>
>>> https://msdn.microsoft.com/en-us/library/ms681381
>>>
>>
>>
>

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

what does this do?

source_array = (wintypes.DWORD * 10)(*range(10))

On Sat, Dec 10, 2016 at 11:40 AM, Michael C <mys...@gm...>
wrote:

> How do I tell it to scan for double?
> Also, how do I specify the target process?
>
> Thax
>
> On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <er...@gm...> wrote:
>
>> On Sat, Dec 10, 2016 at 12:12 AM, Michael C
>> <mys...@gm...> wrote:
>> > Here is my entire current work in progress:
>> >
>> > #import modules
>> > import ctypes
>> > import time
>>
>> [snip]
>>
>> Here's a working example for ReadProcessMemory.
>>
>>     import ctypes
>>     from ctypes import wintypes
>>
>>     kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>
>>     PROCESS_VM_READ           = 0x0010
>>     PROCESS_QUERY_INFORMATION = 0x0400
>>
>>     if not hasattr(wintypes, 'SIZE_T'):
>>         wintypes.SIZE_T = ctypes.c_size_t
>>
>>     if not hasattr(wintypes, 'PSIZE_T'):
>>         wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>>
>>     def _check_zero(result, func, args):
>>         """ Check for zero or NULL return value. """
>>         if not result:
>>             raise ctypes.WinError(ctypes.get_last_error())
>>         return args
>>
>>     # https://msdn.microsoft.com/en-us/library/ms683179
>>     kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>>
>>     # https://msdn.microsoft.com/en-us/library/ms684320
>>     kernel32.OpenProcess.errcheck = _check_zero
>>     kernel32.OpenProcess.restype = wintypes.HANDLE
>>
>>     # https://msdn.microsoft.com/en-us/library/ms680553
>>     kernel32.ReadProcessMemory.errcheck = _check_zero
>>     kernel32.ReadProcessMemory.argtypes = (
>>         wintypes.HANDLE,  # _In_  hProcess
>>         wintypes.LPCVOID, # _In_  lpBaseAddress
>>         wintypes.LPVOID,  # _Out_ lpBuffer
>>         wintypes.SIZE_T,  # _In_  nSize
>>         wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>>
>>     if __name__ == '__main__':
>>         import sys
>>
>>         if len(sys.argv) == 4:
>>             ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>>                     PROCESS_VM_READ, False, int(sys.argv[1]))
>>             base_address = int(sys.argv[2])
>>             block_size  = int(sys.argv[3])
>>         elif len(sys.argv) == 1:
>>             ph = kernel32.GetCurrentProcess()
>>             source_array = (wintypes.DWORD * 10)(*range(10))
>>             base_address = ctypes.addressof(source_array)
>>             block_size = ctypes.sizeof(source_array)
>>         else:
>>             sys.exit('Usage: %s pid base_address block_size' %
>> sys.argv[0])
>>
>>         address_list = range(base_address, base_address + block_size,
>>                              ctypes.sizeof(wintypes.DWORD))
>>         data = wintypes.DWORD()
>>
>>         for address in address_list:
>>             kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>>                 ctypes.sizeof(data), None)
>>             print('%x: %d' % (address, data.value))
>>
>> This script defaults to a demo that reads an array of DWORD values
>> from its own process. You can also provide it the PID, base address,
>> and block size to read from another process. You could extend this
>> with another option to configure the type of data read (e.g. char,
>> float) based on simple ctypes format codes, e.g. "L" for a DWORD,
>> where "L" is the value of `wintypes.DWORD._type_`. Or instead follow
>> WinDbg conventions (e.g. db, dw, dd).
>>
>> Note that I assign an errcheck function for the OpenProcess and
>> ReadProcessMemory function pointers. In this case both use the same
>> _check_zero function, which raises an OSError (or WindowsError in 2.x)
>> when the call fails. Idiomatic Python programming uses exceptions for
>> error handling and resource management (i.e. try/except/finally). Get
>> the error code from the exception's `winerror` attribute when handling
>> it. Here's the complete list of WinAPI error codes:
>>
>> https://msdn.microsoft.com/en-us/library/ms681381
>>
>
>

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

How do I tell it to scan for double?
Also, how do I specify the target process?

Thax

On Sat, Dec 10, 2016 at 6:30 AM, eryk sun <er...@gm...> wrote:

> On Sat, Dec 10, 2016 at 12:12 AM, Michael C
> <mys...@gm...> wrote:
> > Here is my entire current work in progress:
> >
> > #import modules
> > import ctypes
> > import time
>
> [snip]
>
> Here's a working example for ReadProcessMemory.
>
>     import ctypes
>     from ctypes import wintypes
>
>     kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
>     PROCESS_VM_READ           = 0x0010
>     PROCESS_QUERY_INFORMATION = 0x0400
>
>     if not hasattr(wintypes, 'SIZE_T'):
>         wintypes.SIZE_T = ctypes.c_size_t
>
>     if not hasattr(wintypes, 'PSIZE_T'):
>         wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)
>
>     def _check_zero(result, func, args):
>         """ Check for zero or NULL return value. """
>         if not result:
>             raise ctypes.WinError(ctypes.get_last_error())
>         return args
>
>     # https://msdn.microsoft.com/en-us/library/ms683179
>     kernel32.GetCurrentProcess.restype = wintypes.HANDLE
>
>     # https://msdn.microsoft.com/en-us/library/ms684320
>     kernel32.OpenProcess.errcheck = _check_zero
>     kernel32.OpenProcess.restype = wintypes.HANDLE
>
>     # https://msdn.microsoft.com/en-us/library/ms680553
>     kernel32.ReadProcessMemory.errcheck = _check_zero
>     kernel32.ReadProcessMemory.argtypes = (
>         wintypes.HANDLE,  # _In_  hProcess
>         wintypes.LPCVOID, # _In_  lpBaseAddress
>         wintypes.LPVOID,  # _Out_ lpBuffer
>         wintypes.SIZE_T,  # _In_  nSize
>         wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead
>
>     if __name__ == '__main__':
>         import sys
>
>         if len(sys.argv) == 4:
>             ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
>                     PROCESS_VM_READ, False, int(sys.argv[1]))
>             base_address = int(sys.argv[2])
>             block_size  = int(sys.argv[3])
>         elif len(sys.argv) == 1:
>             ph = kernel32.GetCurrentProcess()
>             source_array = (wintypes.DWORD * 10)(*range(10))
>             base_address = ctypes.addressof(source_array)
>             block_size = ctypes.sizeof(source_array)
>         else:
>             sys.exit('Usage: %s pid base_address block_size' % sys.argv[0])
>
>         address_list = range(base_address, base_address + block_size,
>                              ctypes.sizeof(wintypes.DWORD))
>         data = wintypes.DWORD()
>
>         for address in address_list:
>             kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
>                 ctypes.sizeof(data), None)
>             print('%x: %d' % (address, data.value))
>
> This script defaults to a demo that reads an array of DWORD values
> from its own process. You can also provide it the PID, base address,
> and block size to read from another process. You could extend this
> with another option to configure the type of data read (e.g. char,
> float) based on simple ctypes format codes, e.g. "L" for a DWORD,
> where "L" is the value of `wintypes.DWORD._type_`. Or instead follow
> WinDbg conventions (e.g. db, dw, dd).
>
> Note that I assign an errcheck function for the OpenProcess and
> ReadProcessMemory function pointers. In this case both use the same
> _check_zero function, which raises an OSError (or WindowsError in 2.x)
> when the call fails. Idiomatic Python programming uses exceptions for
> error handling and resource management (i.e. try/except/finally). Get
> the error code from the exception's `winerror` attribute when handling
> it. Here's the complete list of WinAPI error codes:
>
> https://msdn.microsoft.com/en-us/library/ms681381
>

Re: [ctypes-users] How come this is different?

[eryk s. <er...@gm...>]

On Sat, Dec 10, 2016 at 12:12 AM, Michael C
<mys...@gm...> wrote:
> Here is my entire current work in progress:
>
> #import modules
> import ctypes
> import time

[snip]

Here's a working example for ReadProcessMemory.

    import ctypes
    from ctypes import wintypes

    kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

    PROCESS_VM_READ           = 0x0010
    PROCESS_QUERY_INFORMATION = 0x0400

    if not hasattr(wintypes, 'SIZE_T'):
        wintypes.SIZE_T = ctypes.c_size_t

    if not hasattr(wintypes, 'PSIZE_T'):
        wintypes.PSIZE_T = ctypes.POINTER(wintypes.SIZE_T)

    def _check_zero(result, func, args):
        """ Check for zero or NULL return value. """
        if not result:
            raise ctypes.WinError(ctypes.get_last_error())
        return args

    # https://msdn.microsoft.com/en-us/library/ms683179
    kernel32.GetCurrentProcess.restype = wintypes.HANDLE

    # https://msdn.microsoft.com/en-us/library/ms684320
    kernel32.OpenProcess.errcheck = _check_zero
    kernel32.OpenProcess.restype = wintypes.HANDLE

    # https://msdn.microsoft.com/en-us/library/ms680553
    kernel32.ReadProcessMemory.errcheck = _check_zero
    kernel32.ReadProcessMemory.argtypes = (
        wintypes.HANDLE,  # _In_  hProcess
        wintypes.LPCVOID, # _In_  lpBaseAddress
        wintypes.LPVOID,  # _Out_ lpBuffer
        wintypes.SIZE_T,  # _In_  nSize
        wintypes.PSIZE_T) # _Out_ lpNumberOfBytesRead

    if __name__ == '__main__':
        import sys

        if len(sys.argv) == 4:
            ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |
                    PROCESS_VM_READ, False, int(sys.argv[1]))
            base_address = int(sys.argv[2])
            block_size  = int(sys.argv[3])
        elif len(sys.argv) == 1:
            ph = kernel32.GetCurrentProcess()
            source_array = (wintypes.DWORD * 10)(*range(10))
            base_address = ctypes.addressof(source_array)
            block_size = ctypes.sizeof(source_array)
        else:
            sys.exit('Usage: %s pid base_address block_size' % sys.argv[0])

        address_list = range(base_address, base_address + block_size,
                             ctypes.sizeof(wintypes.DWORD))
        data = wintypes.DWORD()

        for address in address_list:
            kernel32.ReadProcessMemory(ph, address, ctypes.byref(data),
                ctypes.sizeof(data), None)
            print('%x: %d' % (address, data.value))

This script defaults to a demo that reads an array of DWORD values
from its own process. You can also provide it the PID, base address,
and block size to read from another process. You could extend this
with another option to configure the type of data read (e.g. char,
float) based on simple ctypes format codes, e.g. "L" for a DWORD,
where "L" is the value of `wintypes.DWORD._type_`. Or instead follow
WinDbg conventions (e.g. db, dw, dd).

Note that I assign an errcheck function for the OpenProcess and
ReadProcessMemory function pointers. In this case both use the same
_check_zero function, which raises an OSError (or WindowsError in 2.x)
when the call fails. Idiomatic Python programming uses exceptions for
error handling and resource management (i.e. try/except/finally). Get
the error code from the exception's `winerror` attribute when handling
it. Here's the complete list of WinAPI error codes:

https://msdn.microsoft.com/en-us/library/ms681381

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

Here is my entire current work in progress:




#import modules
import ctypes
import time


# PID of the target process whose to be scanned.
#PID = 1234

time.sleep(2)

#All the following is to set up some parameters to feed to
#Openprocess
#
https://msdn.microsoft.com/en-us/library/windows/desktop/ms684320(v=vs.85).aspx
#and
#ReadProcessMemory
#
https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553(v=vs.85).aspx
# and I am not sure I got it all right, please take a look


user32 = ctypes.WinDLL('user32', use_last_error=True)

### proof of user32 being accessible
#hwnd = user32.GetForegroundWindow()
#pid = ctypes.c_ulong()
#user32.GetWindowThreadProcessId(hwnd, ctypes.byref(pid))
#print(pid.value)

### proof of kernel32
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
20224)
#print(ph)

mem = kernel32.ReadProcessMemory()

#The following is to set up the parametes to feed to ReadProcessMemory.
#ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory!
#
https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553(v=vs.85).aspx
#This part is problematic, since I am using python.ctypes so what I declare
#here could be error-prone

data = ctypes.create_string_buffer(4)
bufferSize = ctypes.sizeof(data)
bytesRead = ctypes.c_size_t(bufferSize)


#The range of memory space to be scanned through. I don't understand what
are
#the appropriate values because I am only beginning to learn about memory
#scanning.
#Doesn't each process get its own memory space? Therefore do I simply give
it
#0x000000 to 0xFFFFFF ?

address = 0x4000000
addresses_list = range(address,0x9000000,0x4)


#This is the part where the scanning takes place.
for i in addresses_list:
    ReadProcessMemory(ph, ctypes.c_void_p(i), data, bufferSize,
                      ctypes.byref(bytesRead))
    #Each i from the loop returns things like 0xNNNNNN, right?
    #somehow, that's not what I get.

    #Here, the value to be looked for: If looking for a number that is 1234,
    # make value == 1234
    if value == int(1234):
        #print the hit address.
        print(i)


On Fri, Dec 9, 2016 at 4:09 PM, Michael C <mys...@gm...>
wrote:

> I am working on a memory scanner of my own, but I am stuck at
> Virtualqueryex() and readprocessmemory()
> https://msdn.microsoft.com/en-us/library/windows/desktop/ms6
> 80553(v=vs.85).aspx
> https://msdn.microsoft.com/en-us/library/windows/desktop/aa3
> 66907(v=vs.85).aspx
>
> if Anyone would help, here is the problem:
>
>
> For
>
> SIZE_T WINAPI VirtualQueryEx(
>   _In_     HANDLE                    hProcess,
>   _In_opt_ LPCVOID                   lpAddress,
>   _Out_    PMEMORY_BASIC_INFORMATION lpBuffer,
>   _In_     SIZE_T                    dwLength
> );
>
>
> For this, how do I declare the lpbuffer? and what is dwlength? Do I use another function to retrieve those values?
>
>
> And then, I need to feed this function to find my target address of my value!
>
> BOOL WINAPI ReadProcessMemory(
>   _In_  HANDLE  hProcess,
>   _In_  LPCVOID lpBaseAddress,
>   _Out_ LPVOID  lpBuffer,
>   _In_  SIZE_T  nSize,
>   _Out_ SIZE_T  *lpNumberOfBytesRead
> );
>
>
> I am working on virtualQueryEx at the moment, hopefully I'll get it soon!
>
>
>
>
> On Fri, Dec 9, 2016 at 4:03 PM, Michael C <mys...@gm...>
> wrote:
>
>> Oh this is my entire work in progress, I pull those out to figure out the
>> windows API line by line, so I do have a .py containing only those, as seen
>> here:
>>
>> import ctypes
>>
>> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>
>> PROCESS_QUERY_INFORMATION = 0x0400
>> PROCESS_VM_READ = 0x0010
>>
>> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
>> 20224)
>> print(ph)
>>
>>
>> On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <rg...@hi...>
>> wrote:
>>
>>> That's not it, Python is perfectly happy with 0x0400 as a literal.
>>>
>>> Michael, is the code you've provided below all copied and pasted from
>>> your actual code, or did you retype any of it?  Is it all in fact at the
>>> 0-indent level and in the same file?  Likewise is that error report copied
>>> and pasted, or are you just paraphrasing?
>>>
>>> On Fri, 9 Dec 2016 15:33:12 -0700
>>> "David A. Van Arnem" <dva...@cm...> wrote:
>>>
>>> > Hi Michael,
>>> >
>>> > I believe Python doesn't accept a hex representation like "0x0400".  In
>>> > situations where I've needed a hex value like that, I've used something
>>> > like:
>>> >
>>> > PROCESS_QUERY_INFORMATION = int("400", 16)
>>> >
>>> > This creates an integer from the string "400" in base 16 (hex).
>>> >
>>> > David
>>> >
>>> > On 12/09/2016 03:25 PM, Michael C wrote:
>>> > > Hi all:
>>> > >
>>> > >        I am trying to write my own memory scanner, but I have
>>> encountered a
>>> > > few problem. Apparently, directly specifying "
>>> > > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the
>>> interpreter
>>> > > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
>>> > >
>>> > > so I should do what I did here, to define it for myself first? is
>>> this
>>> > > correct?
>>> > >
>>> > > Thanks
>>> > >
>>> > > Code:
>>> > >
>>> > > import ctypes
>>> > >
>>> > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>> > >
>>> > > PROCESS_QUERY_INFORMATION = 0x0400
>>> > > PROCESS_VM_READ = 0x0010
>>> > >
>>> > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_RE
>>> AD,False,
>>> > > 20224)
>>> > >
>>> > > print(ph)
>>> > >
>>> > >
>>> > >
>>> > > ------------------------------------------------------------
>>> ------------------
>>> > > Developer Access Program for Intel Xeon Phi Processors
>>> > > Access to Intel Xeon Phi processor-based developer platforms.
>>> > > With one year of Intel Parallel Studio XE.
>>> > > Training and support from Colfax.
>>> > > Order your platform today.http://sdm.link/xeonphi
>>> > >
>>> > >
>>> > >
>>> > > _______________________________________________
>>> > > ctypes-users mailing list
>>> > > cty...@li...
>>> > > https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>> > >
>>> >
>>>
>>>
>>> --
>>> Rob Gaddi, Highland Technology
>>> 18 Otis St.
>>> San Francisco, CA 94103
>>> 415-551-1700
>>>
>>> ------------------------------------------------------------
>>> ------------------
>>> Developer Access Program for Intel Xeon Phi Processors
>>> Access to Intel Xeon Phi processor-based developer platforms.
>>> With one year of Intel Parallel Studio XE.
>>> Training and support from Colfax.
>>> Order your platform today.http://sdm.link/xeonphi
>>> _______________________________________________
>>> ctypes-users mailing list
>>> cty...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>>
>>
>>
>

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

I am working on a memory scanner of my own, but I am stuck at
Virtualqueryex() and readprocessmemory()
https://msdn.microsoft.com/en-us/library/windows/desktop/
ms680553(v=vs.85).aspx
https://msdn.microsoft.com/en-us/library/windows/desktop/
aa366907(v=vs.85).aspx

if Anyone would help, here is the problem:


For

SIZE_T WINAPI VirtualQueryEx(
  _In_     HANDLE                    hProcess,
  _In_opt_ LPCVOID                   lpAddress,
  _Out_    PMEMORY_BASIC_INFORMATION lpBuffer,
  _In_     SIZE_T                    dwLength
);


For this, how do I declare the lpbuffer? and what is dwlength? Do I
use another function to retrieve those values?


And then, I need to feed this function to find my target address of my value!

BOOL WINAPI ReadProcessMemory(
  _In_  HANDLE  hProcess,
  _In_  LPCVOID lpBaseAddress,
  _Out_ LPVOID  lpBuffer,
  _In_  SIZE_T  nSize,
  _Out_ SIZE_T  *lpNumberOfBytesRead
);


I am working on virtualQueryEx at the moment, hopefully I'll get it soon!




On Fri, Dec 9, 2016 at 4:03 PM, Michael C <mys...@gm...>
wrote:

> Oh this is my entire work in progress, I pull those out to figure out the
> windows API line by line, so I do have a .py containing only those, as seen
> here:
>
> import ctypes
>
> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
> PROCESS_QUERY_INFORMATION = 0x0400
> PROCESS_VM_READ = 0x0010
>
> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
> 20224)
> print(ph)
>
>
> On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <rg...@hi...>
> wrote:
>
>> That's not it, Python is perfectly happy with 0x0400 as a literal.
>>
>> Michael, is the code you've provided below all copied and pasted from
>> your actual code, or did you retype any of it?  Is it all in fact at the
>> 0-indent level and in the same file?  Likewise is that error report copied
>> and pasted, or are you just paraphrasing?
>>
>> On Fri, 9 Dec 2016 15:33:12 -0700
>> "David A. Van Arnem" <dva...@cm...> wrote:
>>
>> > Hi Michael,
>> >
>> > I believe Python doesn't accept a hex representation like "0x0400".  In
>> > situations where I've needed a hex value like that, I've used something
>> > like:
>> >
>> > PROCESS_QUERY_INFORMATION = int("400", 16)
>> >
>> > This creates an integer from the string "400" in base 16 (hex).
>> >
>> > David
>> >
>> > On 12/09/2016 03:25 PM, Michael C wrote:
>> > > Hi all:
>> > >
>> > >        I am trying to write my own memory scanner, but I have
>> encountered a
>> > > few problem. Apparently, directly specifying "
>> > > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the
>> interpreter
>> > > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
>> > >
>> > > so I should do what I did here, to define it for myself first? is this
>> > > correct?
>> > >
>> > > Thanks
>> > >
>> > > Code:
>> > >
>> > > import ctypes
>> > >
>> > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>> > >
>> > > PROCESS_QUERY_INFORMATION = 0x0400
>> > > PROCESS_VM_READ = 0x0010
>> > >
>> > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_RE
>> AD,False,
>> > > 20224)
>> > >
>> > > print(ph)
>> > >
>> > >
>> > >
>> > > ------------------------------------------------------------
>> ------------------
>> > > Developer Access Program for Intel Xeon Phi Processors
>> > > Access to Intel Xeon Phi processor-based developer platforms.
>> > > With one year of Intel Parallel Studio XE.
>> > > Training and support from Colfax.
>> > > Order your platform today.http://sdm.link/xeonphi
>> > >
>> > >
>> > >
>> > > _______________________________________________
>> > > ctypes-users mailing list
>> > > cty...@li...
>> > > https://lists.sourceforge.net/lists/listinfo/ctypes-users
>> > >
>> >
>>
>>
>> --
>> Rob Gaddi, Highland Technology
>> 18 Otis St.
>> San Francisco, CA 94103
>> 415-551-1700
>>
>> ------------------------------------------------------------
>> ------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> ctypes-users mailing list
>> cty...@li...
>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>
>
>

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

 RESTART: C:\Users\AwesomeMe\Desktop\my prorgamming project\python\i am
working on\temp code park.py
760
>>>

On Fri, Dec 9, 2016 at 4:07 PM, Rob Gaddi <rg...@hi...>
wrote:

> And when you run that .py file, the entire error message with traceback
> is...?
>
> On Fri, 9 Dec 2016 16:03:36 -0800
> Michael C <mys...@gm...> wrote:
>
> > Oh this is my entire work in progress, I pull those out to figure out the
> > windows API line by line, so I do have a .py containing only those, as
> seen
> > here:
> >
> > import ctypes
> >
> > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
> >
> > PROCESS_QUERY_INFORMATION = 0x0400
> > PROCESS_VM_READ = 0x0010
> >
> > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_
> READ,False,
> > 20224)
> > print(ph)
> >
> >
> > On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <rg...@hi...
> >
> > wrote:
> >
> > > That's not it, Python is perfectly happy with 0x0400 as a literal.
> > >
> > > Michael, is the code you've provided below all copied and pasted from
> your
> > > actual code, or did you retype any of it?  Is it all in fact at the
> > > 0-indent level and in the same file?  Likewise is that error report
> copied
> > > and pasted, or are you just paraphrasing?
> > >
> > > On Fri, 9 Dec 2016 15:33:12 -0700
> > > "David A. Van Arnem" <dva...@cm...> wrote:
> > >
> > > > Hi Michael,
> > > >
> > > > I believe Python doesn't accept a hex representation like "0x0400".
> In
> > > > situations where I've needed a hex value like that, I've used
> something
> > > > like:
> > > >
> > > > PROCESS_QUERY_INFORMATION = int("400", 16)
> > > >
> > > > This creates an integer from the string "400" in base 16 (hex).
> > > >
> > > > David
> > > >
> > > > On 12/09/2016 03:25 PM, Michael C wrote:
> > > > > Hi all:
> > > > >
> > > > >        I am trying to write my own memory scanner, but I have
> > > encountered a
> > > > > few problem. Apparently, directly specifying "
> > > > > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the
> > > interpreter
> > > > > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not
> defined"
> > > > >
> > > > > so I should do what I did here, to define it for myself first? is
> this
> > > > > correct?
> > > > >
> > > > > Thanks
> > > > >
> > > > > Code:
> > > > >
> > > > > import ctypes
> > > > >
> > > > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
> > > > >
> > > > > PROCESS_QUERY_INFORMATION = 0x0400
> > > > > PROCESS_VM_READ = 0x0010
> > > > >
> > > > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_
> > > READ,False,
> > > > > 20224)
> > > > >
> > > > > print(ph)
> > > > >
> > > > >
> > > > >
> > > > > ------------------------------------------------------------
> > > ------------------
> > > > > Developer Access Program for Intel Xeon Phi Processors
> > > > > Access to Intel Xeon Phi processor-based developer platforms.
> > > > > With one year of Intel Parallel Studio XE.
> > > > > Training and support from Colfax.
> > > > > Order your platform today.http://sdm.link/xeonphi
> > > > >
> > > > >
> > > > >
> > > > > _______________________________________________
> > > > > ctypes-users mailing list
> > > > > cty...@li...
> > > > > https://lists.sourceforge.net/lists/listinfo/ctypes-users
> > > > >
> > > >
> > >
> > >
> > > --
> > > Rob Gaddi, Highland Technology
> > > 18 Otis St.
> > > San Francisco, CA 94103
> > > 415-551-1700
> > >
> > > ------------------------------------------------------------
> > > ------------------
> > > Developer Access Program for Intel Xeon Phi Processors
> > > Access to Intel Xeon Phi processor-based developer platforms.
> > > With one year of Intel Parallel Studio XE.
> > > Training and support from Colfax.
> > > Order your platform today.http://sdm.link/xeonphi
> > > _______________________________________________
> > > ctypes-users mailing list
> > > cty...@li...
> > > https://lists.sourceforge.net/lists/listinfo/ctypes-users
> > >
>
>
> --
> Rob Gaddi, Highland Technology
> 18 Otis St.
> San Francisco, CA 94103
> 415-551-1700
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> ctypes-users mailing list
> cty...@li...
> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>

Re: [ctypes-users] How come this is different?

[Rob G. <rg...@hi...>]

And when you run that .py file, the entire error message with traceback is...?

On Fri, 9 Dec 2016 16:03:36 -0800
Michael C <mys...@gm...> wrote:

> Oh this is my entire work in progress, I pull those out to figure out the
> windows API line by line, so I do have a .py containing only those, as seen
> here:
> 
> import ctypes
> 
> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
> 
> PROCESS_QUERY_INFORMATION = 0x0400
> PROCESS_VM_READ = 0x0010
> 
> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
> 20224)
> print(ph)
> 
> 
> On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <rg...@hi...>
> wrote:
> 
> > That's not it, Python is perfectly happy with 0x0400 as a literal.
> >
> > Michael, is the code you've provided below all copied and pasted from your
> > actual code, or did you retype any of it?  Is it all in fact at the
> > 0-indent level and in the same file?  Likewise is that error report copied
> > and pasted, or are you just paraphrasing?
> >
> > On Fri, 9 Dec 2016 15:33:12 -0700
> > "David A. Van Arnem" <dva...@cm...> wrote:
> >
> > > Hi Michael,
> > >
> > > I believe Python doesn't accept a hex representation like "0x0400".  In
> > > situations where I've needed a hex value like that, I've used something
> > > like:
> > >
> > > PROCESS_QUERY_INFORMATION = int("400", 16)
> > >
> > > This creates an integer from the string "400" in base 16 (hex).
> > >
> > > David
> > >
> > > On 12/09/2016 03:25 PM, Michael C wrote:
> > > > Hi all:
> > > >
> > > >        I am trying to write my own memory scanner, but I have
> > encountered a
> > > > few problem. Apparently, directly specifying "
> > > > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the
> > interpreter
> > > > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
> > > >
> > > > so I should do what I did here, to define it for myself first? is this
> > > > correct?
> > > >
> > > > Thanks
> > > >
> > > > Code:
> > > >
> > > > import ctypes
> > > >
> > > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
> > > >
> > > > PROCESS_QUERY_INFORMATION = 0x0400
> > > > PROCESS_VM_READ = 0x0010
> > > >
> > > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_
> > READ,False,
> > > > 20224)
> > > >
> > > > print(ph)
> > > >
> > > >
> > > >
> > > > ------------------------------------------------------------
> > ------------------
> > > > Developer Access Program for Intel Xeon Phi Processors
> > > > Access to Intel Xeon Phi processor-based developer platforms.
> > > > With one year of Intel Parallel Studio XE.
> > > > Training and support from Colfax.
> > > > Order your platform today.http://sdm.link/xeonphi
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > ctypes-users mailing list
> > > > cty...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/ctypes-users
> > > >
> > >
> >
> >
> > --
> > Rob Gaddi, Highland Technology
> > 18 Otis St.
> > San Francisco, CA 94103
> > 415-551-1700
> >
> > ------------------------------------------------------------
> > ------------------
> > Developer Access Program for Intel Xeon Phi Processors
> > Access to Intel Xeon Phi processor-based developer platforms.
> > With one year of Intel Parallel Studio XE.
> > Training and support from Colfax.
> > Order your platform today.http://sdm.link/xeonphi
> > _______________________________________________
> > ctypes-users mailing list
> > cty...@li...
> > https://lists.sourceforge.net/lists/listinfo/ctypes-users
> >


-- 
Rob Gaddi, Highland Technology
18 Otis St.
San Francisco, CA 94103
415-551-1700

Re: [ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

Oh this is my entire work in progress, I pull those out to figure out the
windows API line by line, so I do have a .py containing only those, as seen
here:

import ctypes

kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
20224)
print(ph)


On Fri, Dec 9, 2016 at 3:26 PM, Rob Gaddi <rg...@hi...>
wrote:

> That's not it, Python is perfectly happy with 0x0400 as a literal.
>
> Michael, is the code you've provided below all copied and pasted from your
> actual code, or did you retype any of it?  Is it all in fact at the
> 0-indent level and in the same file?  Likewise is that error report copied
> and pasted, or are you just paraphrasing?
>
> On Fri, 9 Dec 2016 15:33:12 -0700
> "David A. Van Arnem" <dva...@cm...> wrote:
>
> > Hi Michael,
> >
> > I believe Python doesn't accept a hex representation like "0x0400".  In
> > situations where I've needed a hex value like that, I've used something
> > like:
> >
> > PROCESS_QUERY_INFORMATION = int("400", 16)
> >
> > This creates an integer from the string "400" in base 16 (hex).
> >
> > David
> >
> > On 12/09/2016 03:25 PM, Michael C wrote:
> > > Hi all:
> > >
> > >        I am trying to write my own memory scanner, but I have
> encountered a
> > > few problem. Apparently, directly specifying "
> > > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the
> interpreter
> > > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
> > >
> > > so I should do what I did here, to define it for myself first? is this
> > > correct?
> > >
> > > Thanks
> > >
> > > Code:
> > >
> > > import ctypes
> > >
> > > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
> > >
> > > PROCESS_QUERY_INFORMATION = 0x0400
> > > PROCESS_VM_READ = 0x0010
> > >
> > > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_
> READ,False,
> > > 20224)
> > >
> > > print(ph)
> > >
> > >
> > >
> > > ------------------------------------------------------------
> ------------------
> > > Developer Access Program for Intel Xeon Phi Processors
> > > Access to Intel Xeon Phi processor-based developer platforms.
> > > With one year of Intel Parallel Studio XE.
> > > Training and support from Colfax.
> > > Order your platform today.http://sdm.link/xeonphi
> > >
> > >
> > >
> > > _______________________________________________
> > > ctypes-users mailing list
> > > cty...@li...
> > > https://lists.sourceforge.net/lists/listinfo/ctypes-users
> > >
> >
>
>
> --
> Rob Gaddi, Highland Technology
> 18 Otis St.
> San Francisco, CA 94103
> 415-551-1700
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> ctypes-users mailing list
> cty...@li...
> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>

Re: [ctypes-users] How come this is different?

[David A. V. A. <dva...@cm...>]

Oops, right you are, sorry!

David

On 12/09/2016 04:26 PM, Rob Gaddi wrote:
> That's not it, Python is perfectly happy with 0x0400 as a literal.
>
> Michael, is the code you've provided below all copied and pasted from your actual code, or did you retype any of it?  Is it all in fact at the 0-indent level and in the same file?  Likewise is that error report copied and pasted, or are you just paraphrasing?
>
> On Fri, 9 Dec 2016 15:33:12 -0700
> "David A. Van Arnem" <dva...@cm...> wrote:
>
>> Hi Michael,
>>
>> I believe Python doesn't accept a hex representation like "0x0400".  In
>> situations where I've needed a hex value like that, I've used something
>> like:
>>
>> PROCESS_QUERY_INFORMATION = int("400", 16)
>>
>> This creates an integer from the string "400" in base 16 (hex).
>>
>> David
>>
>> On 12/09/2016 03:25 PM, Michael C wrote:
>>> Hi all:
>>>
>>>        I am trying to write my own memory scanner, but I have encountered a
>>> few problem. Apparently, directly specifying "
>>> PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the interpreter
>>> returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
>>>
>>> so I should do what I did here, to define it for myself first? is this
>>> correct?
>>>
>>> Thanks
>>>
>>> Code:
>>>
>>> import ctypes
>>>
>>> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>>>
>>> PROCESS_QUERY_INFORMATION = 0x0400
>>> PROCESS_VM_READ = 0x0010
>>>
>>> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
>>> 20224)
>>>
>>> print(ph)
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Developer Access Program for Intel Xeon Phi Processors
>>> Access to Intel Xeon Phi processor-based developer platforms.
>>> With one year of Intel Parallel Studio XE.
>>> Training and support from Colfax.
>>> Order your platform today.http://sdm.link/xeonphi
>>>
>>>
>>>
>>> _______________________________________________
>>> ctypes-users mailing list
>>> cty...@li...
>>> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>>>
>>
>
>

Re: [ctypes-users] How come this is different?

[Rob G. <rg...@hi...>]

That's not it, Python is perfectly happy with 0x0400 as a literal.

Michael, is the code you've provided below all copied and pasted from your actual code, or did you retype any of it?  Is it all in fact at the 0-indent level and in the same file?  Likewise is that error report copied and pasted, or are you just paraphrasing?

On Fri, 9 Dec 2016 15:33:12 -0700
"David A. Van Arnem" <dva...@cm...> wrote:

> Hi Michael,
> 
> I believe Python doesn't accept a hex representation like "0x0400".  In 
> situations where I've needed a hex value like that, I've used something 
> like:
> 
> PROCESS_QUERY_INFORMATION = int("400", 16)
> 
> This creates an integer from the string "400" in base 16 (hex).
> 
> David
> 
> On 12/09/2016 03:25 PM, Michael C wrote:
> > Hi all:
> >
> >        I am trying to write my own memory scanner, but I have encountered a
> > few problem. Apparently, directly specifying "
> > PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the interpreter
> > returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
> >
> > so I should do what I did here, to define it for myself first? is this
> > correct?
> >
> > Thanks
> >
> > Code:
> >
> > import ctypes
> >
> > kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
> >
> > PROCESS_QUERY_INFORMATION = 0x0400
> > PROCESS_VM_READ = 0x0010
> >
> > ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
> > 20224)
> >
> > print(ph)
> >
> >
> >
> > ------------------------------------------------------------------------------
> > Developer Access Program for Intel Xeon Phi Processors
> > Access to Intel Xeon Phi processor-based developer platforms.
> > With one year of Intel Parallel Studio XE.
> > Training and support from Colfax.
> > Order your platform today.http://sdm.link/xeonphi
> >
> >
> >
> > _______________________________________________
> > ctypes-users mailing list
> > cty...@li...
> > https://lists.sourceforge.net/lists/listinfo/ctypes-users
> >
> 


-- 
Rob Gaddi, Highland Technology
18 Otis St.
San Francisco, CA 94103
415-551-1700

Re: [ctypes-users] How come this is different?

[David A. V. A. <dva...@cm...>]

Hi Michael,

I believe Python doesn't accept a hex representation like "0x0400".  In 
situations where I've needed a hex value like that, I've used something 
like:

PROCESS_QUERY_INFORMATION = int("400", 16)

This creates an integer from the string "400" in base 16 (hex).

David

On 12/09/2016 03:25 PM, Michael C wrote:
> Hi all:
>
>        I am trying to write my own memory scanner, but I have encountered a
> few problem. Apparently, directly specifying "
> PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the interpreter
> returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"
>
> so I should do what I did here, to define it for myself first? is this
> correct?
>
> Thanks
>
> Code:
>
> import ctypes
>
> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
> PROCESS_QUERY_INFORMATION = 0x0400
> PROCESS_VM_READ = 0x0010
>
> ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
> 20224)
>
> print(ph)
>
>
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
>
>
>
> _______________________________________________
> ctypes-users mailing list
> cty...@li...
> https://lists.sourceforge.net/lists/listinfo/ctypes-users
>

[ctypes-users] How come this is different?

[Michael C <mys...@gm...>]

Hi all:

       I am trying to write my own memory scanner, but I have encountered a
few problem. Apparently, directly specifying "
PROCESS_QUERY_INFORMATION|PROCESS_VM_READ" is not ok, since the interpreter
returns "NameError: name 'PROCESS_QUERY_INFORMATION' is not defined"

so I should do what I did here, to define it for myself first? is this
correct?

Thanks

Code:

import ctypes

kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

ph = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,False,
20224)

print(ph)

Re: [ctypes-users] Acquiring process handle and convert it into PID

[<mys...@gm...>]

ok!

Sent from my iPhone

> On Nov 30, 2016, at 6:10 PM, eryk sun <er...@gm...> wrote:
> 
> On Wed, Nov 30, 2016 at 11:13 PM, Michael C
> <mys...@gm...> wrote:
>> I get it now! Reading MSDN is a merit on its own!
>> 
>> So this is the same thing right?
> 
> [...]
> 
>> # this part
>> pid = ctypes.c_ulong()
> 
> Yes, a DWORD is a c_ulong (i.e. C unsigned long):
> 
>>>> from ctypes import wintypes
>>>> wintypes.DWORD
>    <class 'ctypes.c_ulong'>
> 
> When in doubt, refer to the following MSDN page that lists common
> Windows data types:
> 
> https://msdn.microsoft.com/en-us/library/aa383751
> 
> In C, DWORD is defined as follows:
> 
>    typedef unsigned long DWORD;

Re: [ctypes-users] Acquiring process handle and convert it into PID

[eryk s. <er...@gm...>]

On Wed, Nov 30, 2016 at 11:13 PM, Michael C
<mys...@gm...> wrote:
> I get it now! Reading MSDN is a merit on its own!
>
> So this is the same thing right?

[...]

> # this part
> pid = ctypes.c_ulong()

Yes, a DWORD is a c_ulong (i.e. C unsigned long):

    >>> from ctypes import wintypes
    >>> wintypes.DWORD
    <class 'ctypes.c_ulong'>

When in doubt, refer to the following MSDN page that lists common
Windows data types:

https://msdn.microsoft.com/en-us/library/aa383751

In C, DWORD is defined as follows:

    typedef unsigned long DWORD;

Re: [ctypes-users] Acquiring process handle and convert it into PID

[Michael C <mys...@gm...>]

I get it now! Reading MSDN is a merit on its own!

So this is the same thing right?

thx!


import ctypes
import time

time.sleep(2)

user32 = ctypes.WinDLL('user32', use_last_error=True)
hwnd = user32.GetForegroundWindow()

# this part
pid = ctypes.c_ulong()

user32.GetWindowThreadProcessId(hwnd, ctypes.byref(pid))
print(pid.value)

On Wed, Nov 30, 2016 at 8:56 AM, eryk sun <er...@gm...> wrote:

> On Wed, Nov 30, 2016 at 4:33 PM, Michael C
> <mys...@gm...> wrote:
> > Sorry for asking about this over and over again.
> >
> > I ran the code at the bottom and got a
> >
> > user32.GetWindowThreadProcessId(handle, PID)
> > OSError: exception: access violation writing 0x00000001
> >
> > import ctypes
> > import time
> >
> > time.sleep(2)
> > user32 = ctypes.WinDLL('user32', use_last_error=True)
> > handle = user32.GetForegroundWindow()
> > print(handle)
> > PID = 1
> > user32.GetWindowThreadProcessId(handle, PID)
> > print (PID)
>
> Let's review the prototype:
>
>     DWORD WINAPI GetWindowThreadProcessId(
>       _In_      HWND    hWnd,
>       _Out_opt_ LPDWORD lpdwProcessId);
>
> lpdwProcessId is an LPDWORD. The LP stands for "long pointer". (Ignore
> the "long" part since it's a vestige of older CPU architectures.) You
> need to pass a pointer to a DWORD. That's a C unsigned long integer,
> so you can use ctypes.c_ulong(). Or use the wintypes module, which
> defines most of the common Windows data types. To pass a pointer you
> can use ctypes.byref. For example:
>
>     import ctypes
>     from ctypes import wintypes
>
>     user32 = ctypes.WinDLL('user32', use_last_error=True)
>
>     hwnd = user32.GetForegroundWindow()
>     pid = wintypes.DWORD()
>     user32.GetWindowThreadProcessId(hwnd, ctypes.byref(pid))
>
> The process ID is in the `value` attribute:
>
>     >>> pid.value
>     4832
>

Re: [ctypes-users] Acquiring process handle and convert it into PID

[eryk s. <er...@gm...>]

On Wed, Nov 30, 2016 at 4:33 PM, Michael C
<mys...@gm...> wrote:
> Sorry for asking about this over and over again.
>
> I ran the code at the bottom and got a
>
> user32.GetWindowThreadProcessId(handle, PID)
> OSError: exception: access violation writing 0x00000001
>
> import ctypes
> import time
>
> time.sleep(2)
> user32 = ctypes.WinDLL('user32', use_last_error=True)
> handle = user32.GetForegroundWindow()
> print(handle)
> PID = 1
> user32.GetWindowThreadProcessId(handle, PID)
> print (PID)

Let's review the prototype:

    DWORD WINAPI GetWindowThreadProcessId(
      _In_      HWND    hWnd,
      _Out_opt_ LPDWORD lpdwProcessId);

lpdwProcessId is an LPDWORD. The LP stands for "long pointer". (Ignore
the "long" part since it's a vestige of older CPU architectures.) You
need to pass a pointer to a DWORD. That's a C unsigned long integer,
so you can use ctypes.c_ulong(). Or use the wintypes module, which
defines most of the common Windows data types. To pass a pointer you
can use ctypes.byref. For example:

    import ctypes
    from ctypes import wintypes

    user32 = ctypes.WinDLL('user32', use_last_error=True)

    hwnd = user32.GetForegroundWindow()
    pid = wintypes.DWORD()
    user32.GetWindowThreadProcessId(hwnd, ctypes.byref(pid))

The process ID is in the `value` attribute:

    >>> pid.value
    4832

Re: [ctypes-users] Acquiring process handle and convert it into PID

[Michael C <mys...@gm...>]

Sorry for asking about this over and over again.

I ran the code at the bottom and got a

user32.GetWindowThreadProcessId(handle, PID)
OSError: exception: access violation writing 0x00000001



import ctypes
import time

time.sleep(2)
user32 = ctypes.WinDLL('user32', use_last_error=True)
handle = user32.GetForegroundWindow()
print(handle)
PID = 1
user32.GetWindowThreadProcessId(handle, PID)
print (PID)


On Wed, Nov 30, 2016 at 8:24 AM, eryk sun <er...@gm...> wrote:

> On Wed, Nov 30, 2016 at 4:15 PM, Michael C
> <mys...@gm...> wrote:
> > if I still want to use Windll somehow, since I need windows API, how
> should
> > I do it?
>
> Use WinDLL instead of windll, e.g.:
>
>     kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
> Using ctypes.windll is unreliable in principle. It caches instances of
> WinDLL, which cache function pointer objects. Thus other libraries can
> modify function prototypes (i.e. restype, argtypes, errcheck) in ways
> that break your code.
>

Re: [ctypes-users] Acquiring process handle and convert it into PID

[eryk s. <er...@gm...>]

On Wed, Nov 30, 2016 at 4:15 PM, Michael C
<mys...@gm...> wrote:
> if I still want to use Windll somehow, since I need windows API, how should
> I do it?

Use WinDLL instead of windll, e.g.:

    kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

Using ctypes.windll is unreliable in principle. It caches instances of
WinDLL, which cache function pointer objects. Thus other libraries can
modify function prototypes (i.e. restype, argtypes, errcheck) in ways
that break your code.

Re: [ctypes-users] Acquiring process handle and convert it into PID

[Michael C <mys...@gm...>]

if I still want to use Windll somehow, since I need windows API, how should
I do it?

thx

On Wed, Nov 30, 2016 at 8:14 AM, Michael C <mys...@gm...>
wrote:

> Why is it a bad idea?
>
> On Wed, Nov 30, 2016 at 7:55 AM, eryk sun <er...@gm...> wrote:
>
>> On Tue, Nov 29, 2016 at 10:07 PM, Michael C
>> <mys...@gm...> wrote:
>> > I ran this but the value returned was 0. I am trying to save time by
>> > automating the PID acquisition process.
>> >
>> > import ctypes
>> > import time
>> >
>> > time.sleep(2)
>> > handle = ctypes.windll.user32.GetForegroundWindow()
>> > print(handle)
>> > PID = ctypes.windll.kernel32.GetProcessId(handle)
>> > print (PID)
>>
>> GetProcessId is the wrong function.
>>
>> To begin with, before writing a single line of code, you need to
>> familiarize yourself with the subject of WinAPI handles. Carefully
>> read the following pages:
>>
>> Object categories
>> https://msdn.microsoft.com/en-us/library/ms724515
>> User
>> https://msdn.microsoft.com/en-us/library/ms725486
>> GDI
>> https://msdn.microsoft.com/en-us/library/ms724291
>> Kernel
>> https://msdn.microsoft.com/en-us/library/ms724485
>>
>> Here's the function you'll need:
>>
>> GetWindowThreadProcessId
>> https://msdn.microsoft.com/en-us/library/ms633522
>>
>> Also, please stop using ctypes.windll. The global library loaders were
>> an extremely bad idea.
>>
>
>

Re: [ctypes-users] Acquiring process handle and convert it into PID

[Michael C <mys...@gm...>]

Why is it a bad idea?

On Wed, Nov 30, 2016 at 7:55 AM, eryk sun <er...@gm...> wrote:

> On Tue, Nov 29, 2016 at 10:07 PM, Michael C
> <mys...@gm...> wrote:
> > I ran this but the value returned was 0. I am trying to save time by
> > automating the PID acquisition process.
> >
> > import ctypes
> > import time
> >
> > time.sleep(2)
> > handle = ctypes.windll.user32.GetForegroundWindow()
> > print(handle)
> > PID = ctypes.windll.kernel32.GetProcessId(handle)
> > print (PID)
>
> GetProcessId is the wrong function.
>
> To begin with, before writing a single line of code, you need to
> familiarize yourself with the subject of WinAPI handles. Carefully
> read the following pages:
>
> Object categories
> https://msdn.microsoft.com/en-us/library/ms724515
> User
> https://msdn.microsoft.com/en-us/library/ms725486
> GDI
> https://msdn.microsoft.com/en-us/library/ms724291
> Kernel
> https://msdn.microsoft.com/en-us/library/ms724485
>
> Here's the function you'll need:
>
> GetWindowThreadProcessId
> https://msdn.microsoft.com/en-us/library/ms633522
>
> Also, please stop using ctypes.windll. The global library loaders were
> an extremely bad idea.
>

Re: [ctypes-users] Acquiring process handle and convert it into PID

[eryk s. <er...@gm...>]

On Tue, Nov 29, 2016 at 10:07 PM, Michael C
<mys...@gm...> wrote:
> I ran this but the value returned was 0. I am trying to save time by
> automating the PID acquisition process.
>
> import ctypes
> import time
>
> time.sleep(2)
> handle = ctypes.windll.user32.GetForegroundWindow()
> print(handle)
> PID = ctypes.windll.kernel32.GetProcessId(handle)
> print (PID)

GetProcessId is the wrong function.

To begin with, before writing a single line of code, you need to
familiarize yourself with the subject of WinAPI handles. Carefully
read the following pages:

Object categories
https://msdn.microsoft.com/en-us/library/ms724515
User
https://msdn.microsoft.com/en-us/library/ms725486
GDI
https://msdn.microsoft.com/en-us/library/ms724291
Kernel
https://msdn.microsoft.com/en-us/library/ms724485

Here's the function you'll need:

GetWindowThreadProcessId
https://msdn.microsoft.com/en-us/library/ms633522

Also, please stop using ctypes.windll. The global library loaders were
an extremely bad idea.

Re: [ctypes-users] Acquiring process handle and convert it into PID

[Michael C <mys...@gm...>]

i understand. This is my first email list. :)

On Tue, Nov 29, 2016 at 2:51 PM, Diez B. Roggisch <de...@we...> wrote:

> Hello Michael,
>
> > I ran this but the value returned was 0. I am trying to save time by
> automating the PID acquisition process.
> > thx all
> >
> >
> > import ctypes
> > import time
> >
> > time.sleep(2)
> > handle = ctypes.windll.user32.GetForegroundWindow()
> > print(handle)
> > PID = ctypes.windll.kernel32.GetProcessId(handle)
> > print (PID)
>
> Not too surprisingly. A HANDLE is an opaque reference to *something*. Not
> everything that takes a HANDLE takes a HANDLE of any kind. Windows have
> HANDLEs, Processes have HANDLES, etc…
>
> So you are missing a step here from getting the foreground Window’s HANDLE
> to the process it belongs to.
>
> But truth be told: these are not ctypes questions. These are windows
> system programming questions. There are better places for this to ask.
>
> And please learn how to operate a mailing list. Answer & proper quote to
> emails instead of writing new ones for every sentence. It is impossible to
> follow.
>
> Diez

Re: [ctypes-users] Acquiring process handle and convert it into PID

[Diez B. R. <de...@we...>]

Hello Michael,

> I ran this but the value returned was 0. I am trying to save time by automating the PID acquisition process.
> thx all
> 
> 
> import ctypes
> import time
> 
> time.sleep(2)
> handle = ctypes.windll.user32.GetForegroundWindow()
> print(handle)
> PID = ctypes.windll.kernel32.GetProcessId(handle)
> print (PID)

Not too surprisingly. A HANDLE is an opaque reference to *something*. Not everything that takes a HANDLE takes a HANDLE of any kind. Windows have HANDLEs, Processes have HANDLES, etc…

So you are missing a step here from getting the foreground Window’s HANDLE to the process it belongs to.

But truth be told: these are not ctypes questions. These are windows system programming questions. There are better places for this to ask.

And please learn how to operate a mailing list. Answer & proper quote to emails instead of writing new ones for every sentence. It is impossible to follow.

Diez

[ctypes-users] Acquiring process handle and convert it into PID

[Michael C <mys...@gm...>]

I ran this but the value returned was 0. I am trying to save time by
automating the PID acquisition process.
thx all


import ctypes
import time

time.sleep(2)
handle = ctypes.windll.user32.GetForegroundWindow()
print(handle)
PID = ctypes.windll.kernel32.GetProcessId(handle)
print (PID)