Re: [Tutor] How do I scan memory for singles, doubles and so on?

[Mats Wichmann]

On 10/07/2017 09:18 PM, Michael C wrote:
> I am following some examples online such as this one:
> https://social.msdn.microsoft.com/Forums/vstudio/en-US/ce0cc398-2b96-4688-b8a4-b5f4c9ebc064/memory-searcher-with-virtualqueryex-and-readprocessmemory?forum=vclanguage
> 
> 
> i think I got most of it right, so this following part is what I would like
> you to look at:
> 
> DWORD read = 0;
> LPVOID buffer = 0
> 
> (ReadProcessMemory(hackProcess, (void*)start, , sizeof(int), )
> 
> 
> So, what's the Python equivalent statements for sizeof(int) ?

There isn't one, directly, since python types are dynamic (and once
Python knows something is an int it can morph into a bigint later).

But probably for your purposes, this would give what you want:

Python 3.6.2 (default, Sep 22 2017, 08:28:09)
[GCC 7.2.1 20170915 (Red Hat 7.2.1-2)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ctypes
>>> ctypes.sizeof(ctypes.c_int)
4
>>> ctypes.sizeof(ctypes.c_long)
8
>>> ctypes.sizeof(ctypes.c_float)
4
>>> ctypes.sizeof(ctypes.c_double)
8
>>>


___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

thank for replying, but I am toast, so I'll reply tomorrow,
thanks!

On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor 
wrote:

> On 08/10/17 20:18, Michael C wrote:
> > This is the red part
> >   index = current_address
> > end = current_address + mbi.RegionSize
> >
> > while index < end:
> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
> >  ctypes.sizeof(buffer),
> > ctypes.byref(nread)):
> > ## value comparison to be implemented.
> > pass
> > else:
> > raise ctypes.WinError(ctypes.get_last_error())
> >
> > index += 1
>
> I haven't been following this closely so may be way off here,
> but does this mean you are incrementing the memory address
> by 1? If so you are only increasing the pointer by 1 byte
> but you are, presumably, reading multiple bytes at a time
> (the size of the buffer presumably).
>
> Do you perhaps need to treat the buffer as a byte array
> and use something like the struct module to decode it?
> (assuming you know what you are reading...?)
>
> But I may be way off, I'm just going on a cursory look.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor