Re: [Tutor] "Path tree"

[Michael C]

http://imgur.com/a/CwA2G

I don't know to do this with math :(








On Sun, Aug 13, 2017 at 1:07 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Hi all:
>
> I am trying to formulate a "path-finding" function, and I am stuck on this
> problem:
>
> Please look at the picture attached: Those dots are coordinates of (x,y),
> and this tree can be thought of as a list of tuples, with each tuple
> consisting of (x,y).  Now I am trying to make a function go through this
> list of tuples and then return the "path." to go from, say, 4 to 8. If I
> simply compute for the dot for shortest distance, then the solution would
> be to go from 4 to 8 direct, but that doesn't work, because the correct
> solution should have been 4,3,2,5,6,8.
>
>
> How do I do this?
>
> Thanks!
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Fwd: Re: "Path tree"

[Michael C]

I dont know what a data model is :(
I am thinking with one entry, I can have (x,y,z). Z is probably a list and
it says to what point it connects to. so it's a list of lists.
The problem then becomes: how do I generate a list of possible routes?
So I'll potentially have a very big list of routes and then I choose the
shortest one?



On Mon, Aug 14, 2017 at 3:31 PM, Mats Wichmann <m...@wichmann.us> wrote:

> On 08/14/2017 03:06 PM, Alan Gauld via Tutor wrote:
> >
> > Forwarding to the list.
> >
> >  Forwarded Message 
> >
> >
> >
> >
> > pic
> > http://imgur.com/a/CwA2G
> >
> > On Mon, Aug 14, 2017 at 8:55 AM, Alan Gauld via Tutor <tutor@python.org
> > <mailto:tutor@python.org>> wrote:
> >
> > On 13/08/17 21:07, Michael C wrote:
> >
> > > Please look at the picture attached:
>
>
> So in modeling this in your program you need to describe not just the
> x,y coordinates, but also the connections. point 1 can only reach point
> 2, so it has one link.  point 2 can reach 3 and 5, so two links. How can
> you describe this in your data model?
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] "Path tree"

[Michael C]

Hi all:

I am trying to formulate a "path-finding" function, and I am stuck on this
problem:

Please look at the picture attached: Those dots are coordinates of (x,y),
and this tree can be thought of as a list of tuples, with each tuple
consisting of (x,y).  Now I am trying to make a function go through this
list of tuples and then return the "path." to go from, say, 4 to 8. If I
simply compute for the dot for shortest distance, then the solution would
be to go from 4 to 8 direct, but that doesn't work, because the correct
solution should have been 4,3,2,5,6,8.


How do I do this?

Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] "Path tree"

[Michael C]

Ok, I will work with all these. Thx all!

On Aug 16, 2017 20:22, "Abdur-Rahmaan Janhangeer" <arj.pyt...@gmail.com>
wrote:

> in addition to the answers i'd say now you have the motivation to learn
> python data structures and algorithms
>
> http://interactivepython.org/runestone/static/pythonds/index.html
>
> barnum and miller
>
> it is free though i have not found a good pdf book form from where to
> download, but you have the site anyway !
>
> Now, the website has more materials than when i first knew it.
>
> hope it helps !
>
> Abdur-Rahmaan Janhangeer,
> Mauritius
> abdurrahmaanjanhangeer.wordpress.com
>
> On 14 Aug 2017 02:28, "Michael C" <mysecretrobotfact...@gmail.com> wrote:
>
> Hi all:
>
> I am trying to formulate a "path-finding" function, and I am stuck on this
> problem:
>
> Please look at the picture attached: Those dots are coordinates of (x,y),
> and this tree can be thought of as a list of tuples, with each tuple
> consisting of (x,y).  Now I am trying to make a function go through this
> list of tuples and then return the "path." to go from, say, 4 to 8. If I
> simply compute for the dot for shortest distance, then the solution would
> be to go from 4 to 8 direct, but that doesn't work, because the correct
> solution should have been 4,3,2,5,6,8.
>
>
> How do I do this?
>
> Thanks!
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] class newbie

[Michael C]

never mind, I forgot to put 'self' in the method definition!

class mahschool:
def print(self):
print('Say something')


a = mahschool()

a.print()


On Sun, Jul 23, 2017 at 1:24 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> class mahschool:
> def print():
> print('Say something')
>
>
> a = mahschool()
>
> a.print()
>
>
>
> With this, I get this error:
>
> Traceback (most recent call last):
>   File "test.py", line 8, in 
> a.print()
> TypeError: print() takes 0 positional arguments but 1 was given
>
>
> What did I do wrong?
>
> Thanks!
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] class newbie

[Michael C]

thanks!

On Sun, Jul 23, 2017 at 5:35 PM, Danny Yoo <d...@hashcollision.org> wrote:

> On Sun, Jul 23, 2017 at 1:24 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > class mahschool:
> > def print():
> > print('Say something')
>
>
> By the way, you've chosen a name for your method that's spelled the
> same as the name of the built-in "print" function.  I'd recommend you
> choose a different name than "print" in your method name, just to
> avoid any potential confusion.  This isn't going to solve the
> immediate problem that you encountered and solved: you figured out
> that methods need to have a self argument.  But you probably still
> want to rename to avoid the name collision.
>
>
> Good luck!
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] class newbie

[Michael C]

class mahschool:
def print():
print('Say something')


a = mahschool()

a.print()



With this, I get this error:

Traceback (most recent call last):
  File "test.py", line 8, in 
a.print()
TypeError: print() takes 0 positional arguments but 1 was given


What did I do wrong?

Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] Press ESC to exit()

[Michael C]

Hi all, I am trying to write a script to exit itself when ESC is pressed. I
have found several answers regarding it such as this:

http://stackoverflow.com/questions/43709710/push-esc-
to-terminate-python-script?noredirect=1#comment74464169_43709710

But those only work when the program goes to that point.

Is there a way to write it so that it would run exit() even when the
program is in the
background?

Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] Press ESC to exit()

[Michael C]

Hi all, I found out that one way to press ESC to kill the script was to use
my previous
script language, AutoHotKey and this is how it works:


AutoHotKey code
 ## function that kills the window with title '*Python 3.6.1 Shell*'

kill()
{
WinKill, *Python 3.6.1 Shell*
}

## When ESC is pressed, runs the function 'kill'
Esc::kill()



Yes, that's the entire script.


Is there a way to write it in Python on windows?


Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] Hi all: How do I save a file in a designated folder?

[Michael C]

from PIL import Image
from PIL import ImageGrab

# takes the screenshot
screenshot = ImageGrab.grab()
# display the screenshot
screenshot.show()
# save the screenshot
screenshot.save("\test\missed.png")



This is my current code, using Python Image Library!

What I would like to get help with is:

1. How to name the file with time stamp.   e.g.   05012017.png and so forth.
2. How to save it in a designated folder like  C:\test\test2\ and so forth.

P.S. I am on windows 10


Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

Actually, that is the whole script! I didn't get used to have the cmd.exe
window pop up at all, could it be something I did?

Or, is there a way to suppress that from showing up?

thanks!

On Wed, May 17, 2017 at 3:30 PM, eryk sun <eryk...@gmail.com> wrote:

> On Wed, May 17, 2017 at 8:24 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > from PIL import Image
> >
> > im = Image.open('pic.bmp')
> > im.show()
> >
> > I ran this code and it not only opened the picture in paint, which is
> what
> > I want, but it also opens a CMD.exe console window! how do I prevent
> that from
> > happening?
>
> You're probably running a .py script that's associated with py.exe or
> python.exe. These executables create a new console (i.e. an instance
> of the console host process, conhost.exe), if they don't inherit one
> from their parent process. The new console defaults to creating a
> visible window. Change the file extension to .pyw. This file extension
> should be associated with pyw.exe or pythonw.exe, which will not
> create a console.
>
> FYI, the cmd shell is unrelated to that console window. Windows users
> often confuse the cmd shell with the console window that it uses. I
> suppose it's less confusing on Linux. Like cmd, bash will inherit the
> parent's terminal/console; however, it doesn't automatically spawn a
> terminal on Linux if the parent doesn't have one. (Getting that
> behavior on Windows requires the DETACHED_PROCESS creation flag.)
> Since Windows users typically run cmd.exe to get a command-line shell
> for running programs, they associate cmd.exe with the console window.
> It isn't obvious that other programs create consoles without any
> associated instance of cmd.exe.
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] How do I display a picture?

[Michael C]

Hi all,

How do I display a picture?
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

in fact, when I ran this:

import os
os.system("mspaint 1.bmp")


It also opened a cmd.exe window and the script wouldn't continue until I
closed the cmd window!

On Wed, May 17, 2017 at 1:24 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> from PIL import Image
>
>
> im = Image.open('pic.bmp')
> im.show()
>
>
> I ran this code and it not only opened the picture in paint, which is what
> I want,
> but it also opens a CMD.exe console window! how do I prevent that from
> happening?
>
> thanks!
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] Python Image Library

[Michael C]

from PIL import Image


im = Image.open('pic.bmp')
im.show()


I ran this code and it not only opened the picture in paint, which is what
I want,
but it also opens a CMD.exe console window! how do I prevent that from
happening?

thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] copy/paste/move files

[Michael C]

Hi all,

How do I move files to a designated folder or copy/paste?

thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

when I run this, while it's called test.pyw, this pops up

from PIL import Image

im = Image.open('1.bmp')
im.show()



[image: Inline image 1]

On Wed, May 17, 2017 at 6:51 PM, eryk sun <eryk...@gmail.com> wrote:

> On Wed, May 17, 2017 at 10:33 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > On Wed, May 17, 2017 at 3:30 PM, eryk sun <eryk...@gmail.com> wrote:
> >
> >> You're probably running a .py script that's associated with py.exe or
> >> python.exe. These executables create a new console (i.e. an instance
> >> of the console host process, conhost.exe), if they don't inherit one
> >> from their parent process. The new console defaults to creating a
> >> visible window. Change the file extension to .pyw. This file extension
> >> should be associated with pyw.exe or pythonw.exe, which will not
> >> create a console.
> >>
> >> FYI, the cmd shell is unrelated to that console window. Windows users
> >> often confuse the cmd shell with the console window that it uses. I
> >> suppose it's less confusing on Linux. Like cmd, bash will inherit the
> >> parent's terminal/console; however, it doesn't automatically spawn a
> >> terminal on Linux if the parent doesn't have one. (Getting that
> >> behavior on Windows requires the DETACHED_PROCESS creation flag.)
> >> Since Windows users typically run cmd.exe to get a command-line shell
> >> for running programs, they associate cmd.exe with the console window.
> >> It isn't obvious that other programs create consoles without any
> >> associated instance of cmd.exe.
> >
> > Actually, that is the whole script! I didn't get used to have the cmd.exe
> > window pop up at all, could it be something I did?
>
> Changing the script's extension to .pyw didn't prevent the console
> from appearing? Or did you not try it?
>
> Also, to reiterate, the cmd shell doesn't create or own any window,
> and unless something really weird is going on, there's no cmd.exe
> instance associated with the console window that you're seeing. cmd
> can use a console via standard I/O File handles, and usually does, but
> not always. It's no different from python.exe, powershell.exe, or any
> other console application. Really, there is no such thing as a "cmd
> window", "python window", or "PowerShell window". Because these are
> long-running shell processes (e.g. Python's REPL), people are inclined
> to think in those terms, and that's fine, but would you call it a
> "where.exe window", "chcp.com window", "doskey.exe window",
> "whoami.exe window", "findstr.exe window"? I think not. It's clear
> that these programs simply use the console; they don't own it. Neither
> do shells, but in the case of shells and other long-running console
> processes, we're loose with language for convenience -- as long as it
> doesn't confuse our understanding of how things really work.
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] How do I display a picture?

[Michael C]

If all PIL does with .show() is to invoke the system default image viewer,
why would it pop an empty console window?
the existence of this window causes the script to hang, so i have to so far
manually close it before the script would continue to run.

On Wed, May 17, 2017 at 6:03 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 18/05/17 00:24, Michael C wrote:
>
> > or to find another way to display the picture without using python image
> > library.
>
>
> There are lots of ways it depends on what you actually want
> to do with the image. For example you can run your favourite
> image viewer program(that looks like what PIL is doing)
>
> Or you could create a temporary html file with an img tag
> pointing at the image, then open your browser on that file.
>
> Or you can create a simple GUI and put the image into a
> canvas component.
>
> Or you could use a different image editing module like
> the ImageMagik module(forgotten the name) or Blender.
>
> It just depends what you need it for which solution suits.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] copy/paste/move files

[Michael C]

Ok!

On Wed, May 17, 2017 at 4:11 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 17/05/17 20:09, Michael C wrote:
>
> > How do I move files to a designated folder or copy/paste?
>
> copy/paste is a UI specific thing, you don't do that in Python code.
> What you do  is either copy a file or move it.
>
> The shutil module provides easy functions for both.
> See the documentation for the module.
>
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] How do I display a picture?

[Michael C]

I use python image library and apparently when I do

im = Image.open('1.png')
im.show()


show() actually opens a empty console window that doesn't do anything and
as long as it's around the script hangs.
Currently I have to close it by clicking on the close button and it makes
my script useless.

so  i am trying find either a way to prevent that from poping up or to
close it automatically somehow

or to find another way to display the picture without using python image
library.



On Wed, May 17, 2017 at 4:13 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 17/05/17 21:33, Michael C wrote:
>
> > How do I display a picture?
>
> What do you mean? What kind of picture?
> Where do you want it displayed (what kind
> of window/screen)?
>
> There are a dozen possible ways to "display a picture"
> depending on what you specifically want.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] deleting elements of a dictionary

[Michael C]

  for n in list(read_dictionary):
> print(read_dictionary[n])
> if read_dictionary[n] == '5':
> del read_dictionary[n]

After doing this how do I save it back to the dictionary?
then i ll do this
numpy.save('loc_string_dictionary.npy', dictionary)

On Thu, May 18, 2017 at 3:05 PM, Peter Otten <__pete...@web.de> wrote:

> Michael C wrote:
>
> > I am trying to remove incorrect entries of my dictionary.
> > I have multiple keys for the same value,
> >
> > ex,
> > [111]:[5]
> > [222]:[5]
> > [333]:[5}
> >
> > and I have found out that some key:value pairs are incorrect, and the
> best
> > thing to do
> > is to delete all entries who value is 5. So this is what I am doing:
> >
> > import numpy
> > read_dictionary = numpy.load('loc_string_dictionary.npy').item()
> >
> > for n in read_dictionary:
> > print(read_dictionary[n])
> > if read_dictionary[n] == '5':
> > del read_dictionary[n]
> >
> >
> > However, I get this error:
> > RuntimeError: dictionary changed size during iteration
> >
> > and I can see why.
> >
> > What's the better thing to do?
>
> You can copy the keys into a list:
>
>   for n in list(read_dictionary):
> > print(read_dictionary[n])
> > if read_dictionary[n] == '5':
> > del read_dictionary[n]
>
> As the list doesn't change size during iteration there'll be no error or
> skipped key aka list item.
>
> If there are only a few items to delete build a list of keys and delete the
> dict entries in a secend pass:
>
> delenda = [k for k, v in read_dictionary.items() if v == "5"]
> for k in delenda:
> del read_dictionary[k]
>
> If there are many items to delete or you just want to default to the most
> idiomatic solution put the pairs you want to keep into a new dict:
>
> read_dictionary = {k: v for k, v in read_dictionary.items() if v != "5"}
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] always on top

[Michael C]

Hi all:

I am running a code to examine another window's activities, while I use
that window to do stuff. However, the python shell keeps grabbing the
Topmost position so what
I do on the other window, the one that has to stay on top the whole time,
keeps getting into the shell window.

Is making my task window the topmost window somehow the way to go?
Or is there a way to suppress the shell so it doesn't grab the focus?

Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] always on top

[Michael C]

nvm, the problem went away on its own :)
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

os.startfile('1.bmp')

works like a charm!

Now I need to figure out how to close this window once I finish with it!

On Thu, May 18, 2017 at 8:14 AM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Oh I have been using Pillow 4.0 the whole time alright, sorry I forgot to
> mention it.
>
> On Thu, May 18, 2017 at 1:55 AM, Alan Gauld via Tutor <tutor@python.org>
> wrote:
>
>> On 18/05/17 02:58, Michael C wrote:
>> > when I run this, while it's called test.pyw, this pops up
>> >
>> > from PIL import Image
>> >
>> > im = Image.open('1.bmp')
>> > im.show()
>>
>> One suggestion is to use Pillow instead of PIL.
>> So far as I know PIL is frozen and all new development
>> is on Pillow. It is backwardly compatible although for
>> this case that hardly matters! But it's just possible
>> that this is fixed in Pillow?
>>
>> But if this is all you are using PIL for then its
>> overkill and you would be much better off sing a
>> different approach. But that depends on what you
>> are trying to achieve.
>>
>> --
>> Alan G
>> Author of the Learn to Program web site
>> http://www.alan-g.me.uk/
>> http://www.amazon.com/author/alan_gauld
>> Follow my photo-blog on Flickr at:
>> http://www.flickr.com/photos/alangauldphotos
>>
>>
>> ___
>> Tutor maillist  -  Tutor@python.org
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

Oh I have been using Pillow 4.0 the whole time alright, sorry I forgot to
mention it.

On Thu, May 18, 2017 at 1:55 AM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 18/05/17 02:58, Michael C wrote:
> > when I run this, while it's called test.pyw, this pops up
> >
> > from PIL import Image
> >
> > im = Image.open('1.bmp')
> > im.show()
>
> One suggestion is to use Pillow instead of PIL.
> So far as I know PIL is frozen and all new development
> is on Pillow. It is backwardly compatible although for
> this case that hardly matters! But it's just possible
> that this is fixed in Pillow?
>
> But if this is all you are using PIL for then its
> overkill and you would be much better off sing a
> different approach. But that depends on what you
> are trying to achieve.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

Did you go into the source code of PIL/Pillow?  Awesome!!!

On Wed, May 17, 2017 at 7:52 PM, eryk sun <eryk...@gmail.com> wrote:

> On Thu, May 18, 2017 at 1:58 AM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > when I run this, while it's called test.pyw, this pops up
> >
> > from PIL import Image
> >
> > im = Image.open('1.bmp')
> > im.show()
>
> Ok, I stand corrected. It's something weird, and most likely due to
> Windows support here being an afterthought throw in just for coverage,
> instead of something anyone actually cared about. The code does indeed
> use os.system to show the file, which is just about the worst thing
> one can do here for a Windows viewer.
>
> >>> print(inspect.getsource(ImageShow.WindowsViewer))
> class WindowsViewer(Viewer):
> format = "BMP"
>
> def get_command(self, file, **options):
> return ('start "Pillow" /WAIT "%s" '
> '&& ping -n 2 127.0.0.1 >NUL '
> '&& del /f "%s"' % (file, file))
>
> >>> print(inspect.getsource(ImageShow.Viewer.show_file))
> def show_file(self, file, **options):
> """Display given file"""
> os.system(self.get_command(file, **options))
> return 1
>
> The WindowsViewer class preferrably should override show_file to  call
> ShellExecuteExW directly via ctypes, and wait (if possible) to delete
> the temporary file. Or at least use subprocess.call with shell=True,
> which will hide the console window. Note that being able to wait on
> the image viewer is not guaranteed. For example, the image viewer in
> Windows 10 is an app that cannot be waited on.
>
> Since you already have a file on disk, you could skip PIL completely.
> Just use os.startfile('1.bmp').
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] recursion

[Michael C]

hi all:

I have a function to return (x,y) value, but sometimes it would naturally
unable to return those 2 values properly. I know what recursion is, and I
think all I got to do is to call this function a 2nd time and the problem
would go away.

How do I do recursion? The function basically look like this


def return_xy():
blah blah blah
return x,y
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] real time response

[Michael C]

hi all:

I have a code that takes about 20 seconds to complete, but I also need to
response
to events (the appearance of red dots on a canvas)  so I could place a few
lines to
check for this condition like this


def do_stuff:
 blah
 blah
 check()
 blah
 blah
 blah
 check()
 blah
 blah
 blah
 check()
 blah

and then either break or return if condition is met?

But that just isn't responsive enough. Is there a way to make function
check for the  event every 0.5 seconds without interfering with the
do_stuff, ie a code that has its' own space? then something interrupts and
closes down do_stuff and run
another function in response?


thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] threading tutorial

[Michael C]

Right now all i need is to grab 3 values from 3 variables before killing a
thread, like this:

def stuff():
   do stuff,
get values, (x,y,d)


# main code
startthread(stuff(), blah)
# if else need to sleep or kill the thread, and because I'll restart the
thread later, I'd like to get the values from the thread, say x,y,d in
order to restart the thread.
loop.


Therefore, how do I get a few values from a few variables from the thread
and then close it?

Threading is very new to me, so I have to be very diligent.

Thanks!




On Thu, May 25, 2017 at 11:06 AM Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Hi all:
>
>  I tried to google for tutorials of threading, but they are all
> equally confusing.
>  Does someone know of a good page or a book that talk about threading?
>
>
> thanks!
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] threading tutorial

[Michael C]

Hi all:

 I tried to google for tutorials of threading, but they are all equally
confusing.
 Does someone know of a good page or a book that talk about threading?


thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] threading tutorial

[Michael C]

message received, i ll take a look tomorrow asap.

thanks for replying!!!

On Thu, May 25, 2017 at 3:03 PM, Cameron Simpson <c...@zip.com.au> wrote:

> On 25May2017 11:52, Michael C <mysecretrobotfact...@gmail.com> wrote:
>
>> Right now all i need is to grab 3 values from 3 variables before killing a
>> thread, like this:
>>
>> def stuff():
>>   do stuff,
>>get values, (x,y,d)
>>
>> # main code
>> startthread(stuff(), blah)
>> # if else need to sleep or kill the thread, and because I'll restart the
>> thread later, I'd like to get the values from the thread, say x,y,d in
>> order to restart the thread.
>> loop.
>>
>> Therefore, how do I get a few values from a few variables from the thread
>> and then close it?
>>
>> Threading is very new to me, so I have to be very diligent.
>>
>
> You always need to be diligent with threads :-)
>
> Can you explain why you need to use a thread for this? The first cut of
> your program looks like you could do it with a ordinary function:
>
>  def stuff():
>... compute x, y, z ...
>return x, y, z
>
>  def main():
>x, y, z = stuff()
>
> OTOH, your later description suggests that you want to kick off a thread
> to work on something, and have your main program let it run, or pause it.
> The implication is that x, y, z represent the thread state allowing you to
> restart it from scratch at the same point where you paused/stopped things.
>
> There are a few different ways to manage that scenario. But first, write
> yourself a small Thread based program to familiarise yourself with threads.
> For example (untested):
>
>  from __future__ import print_function
>  from time import sleep
>  from threading import Thread
>
>  def thread_main_body():
>print("thread started")
>for n in range(20):
>  print("thread", n)
>  sleep(0.3)
>print("thread done")
>
>  def main():
>print("main")
>T = Thread(target=thread_main_body)
>print("main: Thread created but _not_ started")
>sleep(1)
>T.start()
>print("thread started")
>for n in range(10):
>  print("main", n)
>  sleep(0.4)
>print("main program waiting for thread")
>T.join()
>print("main program done")
>
> You should see the main thread and your subthread outputs interleaved. The
> sleeps are just to ensure some interleaving and to give good interactive
> feel.  It should run for about 8 seconds overall. Make sure you're happy
> you understand what is happening, why, and when.
>
> There are a few things you need to keep in mind with threads (in Python,
> and to a degree in other languages):
>
> 1: You can't kill/stop a Thread. Instead, the usual approach to to share
> some state with some kind of "running" flag, a boolean saying that the
> Thread's function should continue. Then the thread polls that regularly.
> Eg, if the thread function runs a main loop it might look like this:
>
>  def fn():
>global run_me
>while run_me:
>  ... do some work ...
>
> and then elsewhere you go:
>
>  global run_me
>  run_me = True
>  ... create and start the Thread ...
>  ... later ...
>  run_me = False
>  T.join()
>
> so effectively you ask the Thread to stop, and it obeys when it notices
> the change to "run_me". Using a global for this is pretty crube, and not
> the general approach, BTW.
>
> 2: Like any other function, the local varaibles to the thread function are
> not available outside. Thus the "global" hack above. So to share state you
> would usually make some kind of object with the state, and pass it in to
> the Thread when you create and start it:
>
>  def fn(state):
>while state.run_me:
>  ... do stuff, keep important things like results in "state" ...
>  state.x = 1
>  state.y = whatever
>
>  class State(object):
>pass
>
>  def main():
>state = State()
>state.run_me = True
>T = Thread(target=fn, args=(state,))
>T.start()
>for n in range(10):
>  print("main", n, "x =", state.x, "y =", state.y)
>  sleep(0.3)
>state.run_me = False
>T.join()
>
> As I remarked, there are a few ways to approach your scenario. The above
> should get you started on one approach. Pausing can be done in a few ways,
> either by starting and stopping individual threads, one after another, or
> by starting one thread and using a mutex of some kind to cause it to
> suspend activity when needed. Yet another approach is corroutines, but I'd
> recommend getting threading understood first to avoid confusion.
>
> Come back woith some functioning code and more questions.
>
> Cheers,
> Cameron Simpson <c...@zip.com.au>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] deleting elements of a dictionary

[Michael C]

list(read_dictionary) converts the dictionary into a list right? How can
you save the list as a dictionary?

Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] deleting elements of a dictionary

[Michael C]

I am trying to remove incorrect entries of my dictionary.
I have multiple keys for the same value,

ex,
[111]:[5]
[222]:[5]
[333]:[5}

and I have found out that some key:value pairs are incorrect, and the best
thing to do
is to delete all entries who value is 5. So this is what I am doing:

import numpy
read_dictionary = numpy.load('loc_string_dictionary.npy').item()

for n in read_dictionary:
print(read_dictionary[n])
if read_dictionary[n] == '5':
del read_dictionary[n]


However, I get this error:
RuntimeError: dictionary changed size during iteration

and I can see why.

What's the better thing to do?

thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python Image Library

[Michael C]

I'll use it when I get to it! Thanks!

For now, I use this, as suggested by eryk sun:
os.startfile('1.bmp')

it doesn't pop the window.

Thanks Alan!



On Thu, May 18, 2017 at 10:06 AM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 18/05/17 16:43, Michael C wrote:
> > os.startfile('1.bmp')
> >
> > works like a charm!
> >
> > Now I need to figure out how to close this window once I finish with it!
>
> Sadly that is manual. Unless you care to write code to search for the
> process and use the Windows API to kill it off.
>
> If you really want the image under your programs control you
> need to build a GUI, even if a very basic one and display
> the image in a window. A very simplistic Tkinter app will
> do for simply splatting an image on screen then closing
> it later. But it all depends what else you need the app to
> do how complex it gets after that.
>
> Here is some untested Tkinter code to display an image
> for 2 seconds:
>
> import tkinter as tk
>
> top = tk.Tk()
> tk.Label(top, image='1.bmp').pack()
> top.after(2000, top.quit)
>
> top.mainloop()
>
> If not that, something quite like it...
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] recursion

[Michael C]

hi all:

oh ya, my function does in fact take no input and doesn't change anything,
and all i wanted to was to call itself a 2nd time, yes, so I solved it a
few hours back ,and it's good enough for me for now :)

Thanks for the response!!!

On Mon, May 22, 2017 at 2:16 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 22/05/17 17:11, Michael C wrote:
>
> > I have a function to return (x,y) value, but sometimes it would naturally
> > unable to return those 2 values properly. I know what recursion is, and I
> > think all I got to do is to call this function a 2nd time and the problem
> > would go away.
>
> Sorry, but that is too vague to help us in any way.
> Recursion is not about calling the function a second time,
> it is about calling the function from within the same function.
> How or whether that would help solve your problem is not at
> all obvious.
>
> You need to ideally show us your code or at least give us more
> information about what is going wrong.
> What kind of values are you expecting back?
> What do you mean by "naturally unable to return those"?
> Why not? What does it return instead?
> How are the values being returned(or calculated/obtained)?
>
>
> > How do I do recursion? The function basically look like this
> >
> > def return_xy():
> > blah blah blah
> > return x,y
>
> That looks like any function that takes no inputs and returns
> a tuple. It does not help us to help you in any way.
>
> The fact that it takes no inputs and does not apparently
> modify any state variables means recursion would be pointless
> - in fact it would lead to an infinite loop and lock up your
> program.
>
> We need more detail, and unless you have a good reason not
> to, you should just show us your code. We are ok with you
> posting anything up to, say, 100 lines long...
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] recursion

[Michael C]

no i don't have a way, it just hasn't happened yet  LOL

On Mon, May 22, 2017 at 10:18 PM, Peter Otten <__pete...@web.de> wrote:

> Michael C wrote:
>
> > oh ya, my function does in fact take no input and doesn't change
> anything,
> > and all i wanted to was to call itself a 2nd time, yes, so I solved it a
> > few hours back ,and it's good enough for me for now :)
>
> Would you mind showing the code? I'd like to see how you avoid infinite
> recursion.
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] how do i open picture files without knowing the file name?

[Michael C]

I am running this code so I can do some image manipulation with them.
The thing is, I have a lot of pictures to go through, so I can't type the
file names
one by one in the code. However, the order of the files to be processed
doesn't
matter, so getting them in a random fashion is alright!

How do I make the python code open picture files? thanks!








## need to open random png. Any png.

from PIL import Image


## need to load picture so I can process them. Any pictures is fine as
## I need to process every picture in the folder
im = Image.open('1.png')

## do my things...
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] how do i open picture files without knowing the file name?

[Michael C]

i ll look into it! thx for now!


On Tue, May 16, 2017 at 12:51 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 16/05/17 19:49, Michael C wrote:
> > I am running this code so I can do some image manipulation with them.
> > The thing is, I have a lot of pictures to go through, so I can't type the
> > file names
>
> Do you know the folder where they live?
> If so os.listdir() will give you a list of filenames.
> If there are subfolders then os.walk() will traverse them.
>
> If you don't understand that come back with more specific
> questions about what puzzles you and we will expand
> as necessary.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] threading tutorial

[Michael C]

let me try that! thanks!


On Thu, Jun 1, 2017 at 10:52 AM, Jerry Hill <malaclyp...@gmail.com> wrote:

> On Thu, Jun 1, 2017 at 11:30 AM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > Oh i get it alright, however in my code I have to push the W button like
> > this:
> >
> > import pyautogui
> > import time
> >
> > pyautogui.keyDown('w')
> > time.sleep(2)
> > pyautogui.keyUp('w')
>
> ...
>
> > theoretically deals with my problem, in practice though, my function
> spend
> > almost
> > all its time holding down the 'w' button, given how many miliseconds i
> need
> > it. and so it's not responsive enough
> > for this reason.
>
> From that example, it looks like you spend almost all the time
> sleeping, right?  Maybe sleep for a shorter amount of time, in a loop
> where you can check the flag?  Something like:
>
> global run_me
> time_to_sleep = 2
> time_asleep = 0
>
> pyautogui.keyDown('w')
> while run_me and (time_asleep < time_to_sleep):
> delta = time_to_sleep/100
> time.sleep(delta)
> time_asleep += delta
> pyautogui.keyUp('w')
>
> That would let you check the flag more often, so you can clean up properly.
>
> --
> Jerry
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] threading tutorial

[Michael C]

ihave to look at this tomorrow, thanks for the reply!



On Thu, Jun 1, 2017 at 6:18 PM Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 01/06/17 16:30, Michael C wrote:
> > Oh i get it alright, however in my code I have to push the W button like
> > this:
> >
> > import pyautogui
> > import time
> >
> > pyautogui.keyDown('w')
> > time.sleep(2)
> > pyautogui.keyUp('w')
>
> So this emulates a user pressing the w key for 2 seconds.
> What's not clear is where this appears in your design,
> is it part of the code running in the thread or is it
> part of the code that stops the thread?
>
> If you can explain a little bit more of the high level
> requirement hee rather than the implementation perhaps
> we can come up with a better solution - ideally one
> that doesn't involve any keypress emulation at all...
>
> > while the example you gave:
> >
> >  def fn():
> >global run_me
> >while run_me:
> >  ... do some work ...
> >
> > and then elsewhere you go:
> >
> >  global run_me
> >  run_me = True
> >  ... create and start the Thread ...
> >  ... later ...
> >  run_me = False
> >  T.join()
> >
> > theoretically deals with my problem, in practice though, my function
> spend
> > almost all its time holding down the 'w' button,
>
> The fact you say the function suggests you mean the thread.
> So the question is why does it need to hold the key down
> for so long? Indeed why does a background process need
> to emulate a button press? What is the button press doing?
> Is it in turn detected by some other process/thread? We
> need to understand how the various bits interact to give
> a better solution.
>
> > Is there a way to pause/kill the thread?
>
> Not really other than setting a flag, but if its the
> thread that's doing the sleeping then killing it
> won't help - in fact if you could kill it in the
> middle of the sleep() you'd have the problem of
> a key being "held down" forever - probably a
> bad thing... Thats why its better to have the
> thread kill itself on detection of the semaphore.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] threading tutorial

[Michael C]

Oh i get it alright, however in my code I have to push the W button like
this:

import pyautogui
import time

pyautogui.keyDown('w')
time.sleep(2)
pyautogui.keyUp('w')

while the example you gave:




 def fn():
   global run_me
   while run_me:
 ... do some work ...

and then elsewhere you go:

 global run_me
 run_me = True
 ... create and start the Thread ...
 ... later ...
 run_me = False
 T.join()





theoretically deals with my problem, in practice though, my function spend
almost
all its time holding down the 'w' button, given how many miliseconds i need
it. and so it's not responsive enough
for this reason.

Is there a way to pause/kill the thread?

thanks!

On Thu, May 25, 2017 at 7:47 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> message received, i ll take a look tomorrow asap.
>
> thanks for replying!!!
>
> On Thu, May 25, 2017 at 3:03 PM, Cameron Simpson <c...@zip.com.au> wrote:
>
>> On 25May2017 11:52, Michael C <mysecretrobotfact...@gmail.com> wrote:
>>
>>> Right now all i need is to grab 3 values from 3 variables before killing
>>> a
>>> thread, like this:
>>>
>>> def stuff():
>>>   do stuff,
>>>get values, (x,y,d)
>>>
>>> # main code
>>> startthread(stuff(), blah)
>>> # if else need to sleep or kill the thread, and because I'll restart the
>>> thread later, I'd like to get the values from the thread, say x,y,d in
>>> order to restart the thread.
>>> loop.
>>>
>>> Therefore, how do I get a few values from a few variables from the thread
>>> and then close it?
>>>
>>> Threading is very new to me, so I have to be very diligent.
>>>
>>
>> You always need to be diligent with threads :-)
>>
>> Can you explain why you need to use a thread for this? The first cut of
>> your program looks like you could do it with a ordinary function:
>>
>>  def stuff():
>>... compute x, y, z ...
>>return x, y, z
>>
>>  def main():
>>x, y, z = stuff()
>>
>> OTOH, your later description suggests that you want to kick off a thread
>> to work on something, and have your main program let it run, or pause it.
>> The implication is that x, y, z represent the thread state allowing you to
>> restart it from scratch at the same point where you paused/stopped things.
>>
>> There are a few different ways to manage that scenario. But first, write
>> yourself a small Thread based program to familiarise yourself with threads.
>> For example (untested):
>>
>>  from __future__ import print_function
>>  from time import sleep
>>  from threading import Thread
>>
>>  def thread_main_body():
>>print("thread started")
>>for n in range(20):
>>  print("thread", n)
>>  sleep(0.3)
>>print("thread done")
>>
>>  def main():
>>print("main")
>>T = Thread(target=thread_main_body)
>>print("main: Thread created but _not_ started")
>>sleep(1)
>>T.start()
>>print("thread started")
>>for n in range(10):
>>  print("main", n)
>>  sleep(0.4)
>>print("main program waiting for thread")
>>T.join()
>>print("main program done")
>>
>> You should see the main thread and your subthread outputs interleaved.
>> The sleeps are just to ensure some interleaving and to give good
>> interactive feel.  It should run for about 8 seconds overall. Make sure
>> you're happy you understand what is happening, why, and when.
>>
>> There are a few things you need to keep in mind with threads (in Python,
>> and to a degree in other languages):
>>
>> 1: You can't kill/stop a Thread. Instead, the usual approach to to share
>> some state with some kind of "running" flag, a boolean saying that the
>> Thread's function should continue. Then the thread polls that regularly.
>> Eg, if the thread function runs a main loop it might look like this:
>>
>>  def fn():
>>global run_me
>>while run_me:
>>  ... do some work ...
>>
>> and then elsewhere you go:
>>
>>  global run_me
>>  run_me = True
>>  ... create and start the Thread ...
>>  ... later ...
>>  run_me = False
>>  T.join()
>>
>> so effectively you ask the Thread to stop, and it obeys when it notices
>> the change to "run_me". Using a global for this is pretty crube, and not
>> the general approach, BTW.
>>
>> 2: L

[Tutor] tkinter actively maintained?

[Michael C]

Hi all:

is tkinter still being actively maintained? I only had to ask about this
because I have never looked stuff like this up before.

Is it ok to develop using it, is it going to be dropped in the near future?

thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] [ctypes-users] Press ESC to exit()

[Michael C]

holy cow

On Mon, May 1, 2017 at 8:02 PM eryk sun <eryk...@gmail.com> wrote:

> On Mon, May 1, 2017 at 6:28 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > Hi all, I found out that one way to press ESC to kill the script was to
> use
> > my previous
> > script language, AutoHotKey and this is how it works:
> >
> > AutoHotKey code
> >  ## function that kills the window with title '*Python 3.6.1 Shell*'
> >
> > kill()
> > {
> > WinKill, *Python 3.6.1 Shell*
> > }
> >
> > ## When ESC is pressed, runs the function 'kill'
> > Esc::kill()
> >
> > Yes, that's the entire script.
> > Is there a way to write it in Python on windows?
>
> Instead of using a hotkey, you can set a global low-level keyboard
> hook. Then optionally you can check for a particular foreground window
> before handling the key. For example:
>
> import ctypes
> import win32con
> import win32gui
>
> from ctypes import wintypes
>
> user32 = ctypes.WinDLL('user32', use_last_error=True)
>
> VK_ESCAPE = 0x1B
>
> LLKHF_EXTENDED  = 0x0001
> LLKHF_LOWER_IL_INJECTED = 0x0002
> LLKHF_INJECTED  = 0x0010
> LLKHF_ALTDOWN   = 0x0020
> LLKHF_UP= 0x0080
>
> ULONG_PTR = wintypes.WPARAM
> class KBDLLHOOKSTRUCT(ctypes.Structure):
> _fields_ = (('vkCode',  wintypes.DWORD),
> ('scanCode',wintypes.DWORD),
> ('flags',   wintypes.DWORD),
> ('time',wintypes.DWORD),
> ('dwExtraInfo', ULONG_PTR))
>
> HOOKPROC = ctypes.WINFUNCTYPE(wintypes.LPARAM, ctypes.c_int,
> wintypes.WPARAM, wintypes.LPARAM)
>
> user32.SetWindowsHookExW.restype = wintypes.HHOOK
> user32.SetWindowsHookExW.argtypes = (
> ctypes.c_int,   # _In_ idHook
> HOOKPROC,   # _In_ lpfn
> wintypes.HINSTANCE, # _In_ hMod
> wintypes.DWORD) # _In_ dwThreadId
>
> user32.CallNextHookEx.restype = wintypes.LPARAM
> user32.CallNextHookEx.argtypes = (
> wintypes.HHOOK,  # _In_opt_ hhk
> ctypes.c_int,# _In_ nCode
> wintypes.WPARAM, # _In_ wParam
> wintypes.LPARAM) # _In_ lParam
>
> def keyboard_hook(handler, hwnd=None):
> @HOOKPROC
> def hookfunc(nCode, wParam, lParam):
> event = KBDLLHOOKSTRUCT.from_address(lParam)
> if hwnd is not None and win32gui.GetForegroundWindow() == hwnd:
> handler(event)
> return user32.CallNextHookEx(hHook, nCode, wParam, lParam)
>
> hHook = user32.SetWindowsHookExW(win32con.WH_KEYBOARD_LL, hookfunc,
> None, 0)
> if not hHook:
> raise ctypes.WinError(ctypes.get_last_error())
>
> win32gui.PumpMessages()
>
> if __name__ == '__main__':
> import msvcrt
> import threading
> import win32console
>
> print('Press escape to quit')
>
> def escape_handler(event):
> if event.vkCode == VK_ESCAPE:
> # kill the hook thread
> win32gui.PostQuitMessage(0)
> elif not (event.flags & LLKHF_UP):
> print('Virtual Key Code: {:#04x} [{}]'.format(event.vkCode,
> event.time))
>
> t = threading.Thread(target=keyboard_hook, args=(escape_handler,
> win32console.GetConsoleWindow()), daemon=True)
> t.start()
>
> # consume keyboard input
> while t.is_alive():
> if msvcrt.kbhit():
> msvcrt.getwch()
>
> The __main__ demo should be run as a console script. The keyboard hook
> filters on the console window handle from GetConsoleWindow().
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

Hi Eryk Sun:

I started out with what you gave me:

>code starts
class SYSTEM_INFO(ctypes.Structure):
"""https://msdn.microsoft.com/en-us/library/ms724958"";
class _U(ctypes.Union):
class _S(ctypes.Structure):
_fields_ = (('wProcessorArchitecture', WORD),
('wReserved', WORD))
_fields_ = (('dwOemId', DWORD), # obsolete
('_s', _S))
_anonymous_ = ('_s',)
_fields_ = (('_u', _U),
('dwPageSize', DWORD),
('lpMinimumApplicationAddress', LPVOID),
('lpMaximumApplicationAddress', LPVOID),
('dwActiveProcessorMask',   DWORD_PTR),
('dwNumberOfProcessors',DWORD),
('dwProcessorType', DWORD),
('dwAllocationGranularity', DWORD),
('wProcessorLevel',WORD),
('wProcessorRevision', WORD))
_anonymous_ = ('_u',)

LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO)


> code ends


I am trying to acquire "lpMinimumApplicationAddress" and
"lpMaximumApplicationAddress" from system_info, so I did this,

>code
Kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
Kernel32.GetSystemInfo(LPSYSTEM_INFO)
print(LPLPSYSTEM_INFO.lpMinimumApplicationAddress)

>code ends

 and then it says

Traceback (most recent call last):
  File "C:/Users/AwesomeGuy/Google Drive/My life of hacking/SWTOR/mah
scanner/with_eryk_sun_s_help_peace by peace.py", line 55, in 
Kernel32.GetSystemInfo(LPSYSTEM_INFO)
ctypes.ArgumentError: argument 1: : Don't know how to
convert parameter 1



thanks for reading!


On Thu, Oct 5, 2017 at 1:13 PM, eryk sun <eryk...@gmail.com> wrote:

> On Thu, Oct 5, 2017 at 8:27 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> >
> > How do I see the values of each field? This doesn't work.
> >
> > print(PMEMORY_BASIC_INFORMATION.Protect)
>
> Create an instance of MEMORY_BASIC_INFORMATION and pass a pointer to
> it via byref(). For example, the following queries the region of
> memory of the VirtualQuery function itself.
>
> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
> MEM_COMMIT = 0x1000
> PAGE_EXECUTE_READ = 0x20
> PAGE_EXECUTE_WRITECOPY = 0x80
>
> VirtualQuery = kernel32.VirtualQuery
> VirtualQuery.restype = SIZE_T
> VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)
>
> mbi = MEMORY_BASIC_INFORMATION()
> VirtualQuery(VirtualQuery, ctypes.byref(mbi), ctypes.sizeof(mbi))
>
> >>> mbi.AllocationBase == kernel32._handle
> True
> >>> mbi.AllocationProtect == PAGE_EXECUTE_WRITECOPY
> True
> >>> mbi.BaseAddress
> 140703181352960
> >>> mbi.RegionSize
> 364544
> >>> mbi.State == MEM_COMMIT
> True
> >>> mbi.Protect ==  PAGE_EXECUTE_READ
> True
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

Hi all:

How do I create a buffer, or rather, is a buffer just a variable?
How do I create a pointer to it?

This code ran fine (thanks to you, Eryk, I now know about how to work
VirtualQueryEx work)
until when I ran the read process memory part.

I think I am not feeding the function properly.

Please look at the red part of this code

Thanks!


>code starts here

mbi = MEMORY_BASIC_INFORMATION()
sysinfo.lpMinimumApplicationAddress

print('VirtualQueryEx ran properly?',Kernel32.VirtualQueryEx(Process, \
sysinfo.lpMinimumApplicationAddress,
ctypes.byref(mbi),ctypes.sizeof(mbi)))

print('')
print('mbi start')
print('mbi.BaseAddress: ',mbi.BaseAddress)
print('mbi.AllocationBase: ',mbi.AllocationBase)
print('mbi.AllocationProtect: ',mbi.AllocationProtect)
print('mbi.RegionSize: ',mbi.RegionSize)
print('mbi.State: ',mbi.State)
print('mbi.Protect: ', mbi.Protect)
print('mbi.Type: ',mbi.Type)

buffer = ctypes.create_string_buffer(4)
bufferSize = (ctypes.sizeof(buffer))

ReadProcessMemory = Kernel32.ReadProcessMemory

if ReadProcessMemory(Process, ctypes.byref(mbi), buffer, bufferSize, None):
print('buffer is: ',buffer)
else:
print('something is wrong')

On Fri, Oct 6, 2017 at 12:03 PM, eryk sun <eryk...@gmail.com> wrote:

> On Fri, Oct 6, 2017 at 7:43 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > Sorry but I dont understand this line:
> >
> > mbi = MEMORY_BASIC_INFORMATION()
> >
> > This creates a instance of the class?
>
> Yes, and this allocates sizeof(MEMORY_BASIC_INFORMATION) bytes at
> addressof(mbi), which you pass to a function by reference via
> byref(mbi).
>
> > Also, I thought with VirtualQueryEx, what you need for it
> > is a handle, which I acquire from this
> > Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_
> READ,
> > False, PID)
>
> My example called VirtualQuery, not VirtualQueryEx. Internally
> VirtualQuery calls VirtualQueryEx using the pseudo handle
> (HANDLE)(-1), which refers to the current process.
>
> > and then feed it to the function like so:
> >
> > VirtualQuery(Process, ctypes.byref(mbi), ctypes.sizeof(mbi))
> >
> > I know it doesn't work. But what are these lines for? They don't look
> like
> > handle to me:
> >
> > VirtualQuery = kernel32.VirtualQuery
> > VirtualQuery.restype = SIZE_T
> > VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)
>
> In the above, I'm setting the function pointer's argtypes attribute to
> the types of the 3 parameters that VirtualQuery takes: the target
> address (i.e. LPVOID), a pointer to the buffer (i.e.
> PMEMORY_BASIC_INFORMATION), and the size of the buffer (SIZE_T). This
> is to allow ctypes to correctly check and convert arguments passed to
> the function.
>
> VirtualQueryEx has four parameters, starting with the handle to the
> target process, hProcess. The remaining 3 are the same as
> VirtualQuery.
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

Sorry but I dont understand this line:

mbi = MEMORY_BASIC_INFORMATION()

This creates a instance of the class?

Also, I thought with VirtualQueryEx, what you need for it
is a handle, which I acquire from this

Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
False, PID)

and then feed it to the function like so:

VirtualQuery(Process, ctypes.byref(mbi), ctypes.sizeof(mbi))

I know it doesn't work. But what are these lines for? They don't look like
handle to me:

VirtualQuery = kernel32.VirtualQuery
VirtualQuery.restype = SIZE_T
VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)



thanks !

On Thu, Oct 5, 2017 at 1:13 PM, eryk sun <eryk...@gmail.com> wrote:

> On Thu, Oct 5, 2017 at 8:27 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> >
> > How do I see the values of each field? This doesn't work.
> >
> > print(PMEMORY_BASIC_INFORMATION.Protect)
>
> Create an instance of MEMORY_BASIC_INFORMATION and pass a pointer to
> it via byref(). For example, the following queries the region of
> memory of the VirtualQuery function itself.
>
> kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
>
> MEM_COMMIT = 0x1000
> PAGE_EXECUTE_READ = 0x20
> PAGE_EXECUTE_WRITECOPY = 0x80
>
> VirtualQuery = kernel32.VirtualQuery
> VirtualQuery.restype = SIZE_T
> VirtualQuery.argtypes = (LPVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)
>
> mbi = MEMORY_BASIC_INFORMATION()
> VirtualQuery(VirtualQuery, ctypes.byref(mbi), ctypes.sizeof(mbi))
>
> >>> mbi.AllocationBase == kernel32._handle
> True
> >>> mbi.AllocationProtect == PAGE_EXECUTE_WRITECOPY
> True
> >>> mbi.BaseAddress
> 140703181352960
> >>> mbi.RegionSize
> 364544
> >>> mbi.State == MEM_COMMIT
> True
> >>> mbi.Protect ==  PAGE_EXECUTE_READ
> True
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] How do I scan memory for singles, doubles and so on?

[Michael C]

update:

I should have put down buffer = ctypes.c_double() instead of buffer =
ctypes.c_double.

Sorry all

On Sat, Oct 7, 2017 at 8:18 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> I am following some examples online such as this one:
> https://social.msdn.microsoft.com/Forums/vstudio/en-US/
> ce0cc398-2b96-4688-b8a4-b5f4c9ebc064/memory-searcher-
> with-virtualqueryex-and-readprocessmemory?forum=vclanguage
>
>
> i think I got most of it right, so this following part is what I would
> like you to look at:
>
> DWORD read = 0;
> LPVOID buffer = 0
>
> (ReadProcessMemory(hackProcess, (void*)start, , sizeof(int), )
>
>
> So, what's the Python equivalent statements for sizeof(int) ?
>
>
>
>
>
>
> On Sat, Oct 7, 2017 at 7:38 PM, Michael C <mysecretrobotfact...@gmail.com>
> wrote:
>
>> Oh I am trying to write my own memory scanner, because I thought the
>> Cheat Engine is pretty neat and I am just trying make one for myself.
>>
>> Onto the problem, I think what happens with Readprocessmemory is that
>>
>> BOOL WINAPI ReadProcessMemory(
>>   _In_  HANDLE  hProcess,
>>   _In_  LPCVOID lpBaseAddress,  _Out_ LPVOID  lpBuffer,
>>   _In_  SIZE_T  nSize,
>>   _Out_ SIZE_T  *lpNumberOfBytesRead
>> );
>>
>>
>> for LPVOID lpbuffer, it should be a
>>
>> buffer = ctypes.c_double
>>
>> because i am trying to search for a double.
>> However, the interpreter gives me this:
>>
>> ReadProcessMemory(Process, current_address, ctypes.byref(buffer), \
>> TypeError: byref() argument must be a ctypes instance, not
>> '_ctypes.PyCSimpleType'
>>
>>
>> so I am using
>> buffer = ctypes.c_uint()
>> instead. It returns things like   "c_ulong(2006549856)" , though.
>>
>> 2nd, I believe  _In_  SIZE_T  nSize, means I tell the interpreter to
>> read that much
>> data, which means I can use this parameter to get doubles, which is what
>> I want!
>>
>> However, I am using
>>
>> ctypes.sizeof(buffer)
>>
>> for it, so, I need either to change my buffer to a double, or to tell
>> this parameter to  search for
>> doubles somehow.
>>
>>
>> Am I on the right track?
>>
>>
>> Thanks!
>>
>>
>>
>> On Sat, Oct 7, 2017 at 6:58 PM, Mats Wichmann <m...@wichmann.us> wrote:
>>
>>> it might help if you mention what you are trying to do. if it is
>>> forensics, there a bunch of python tools in that area. your problem may
>>> already have solutions you could use.
>>>
>>> On October 7, 2017 3:00:25 PM MDT, Michael C <
>>> mysecretrobotfact...@gmail.com> wrote:
>>> >Hi all:
>>> >
>>> >I am working on a memory scanner, and the source code and output is as
>>> >following:
>>> >
>>> >Now, I know why my buffer from read process memory looks like values
>>> >such
>>> >as "67108864" ; it's because I read into the buffer entire chunk of
>>> >memory
>>> >at a time, because I fed read process memory this:  "mbi.RegionSize"
>>> >
>>> >Now, how do I read for values such as doubles?
>>> >I am guessing I need to use a for loop to scan for small bits of memory
>>> >chunk
>>> >at a time.
>>> >
>>> >Is there a way to do it?
>>> >
>>> >Thanks!
>>> >
>>> >
>>> >
>>> >
>>> >>output starts
>>> >
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(6385664)
>>> >buffer is:  c_ulong(67108864)
>>> >buffer is:  c_ulong(7761920)
>>> >buffer is:  c_ulong(7798784)
>>> >buffer is:  c_ulong(7872512)
>>> >buffer is:  c_ulong(8007680)
>>> >buffer is:  c_ulong(8044544)
>>> >buffer is:  c_ulong(8069120)
>>> >buffer is:  c_ulong(8216576)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(3976)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(1318755581)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(0)
>>> >buffer is:  c_ulong(0)
>>> >
>>> >> code starts
>>> >
>>> >buffer = ctypes.c_uint()
>>> >nread = SIZE_T()
>>> >
>>> >start = ctypes.c_

[Tutor] How do I scan memory for singles, doubles and so on?

[Michael C]

Hi all:

I am working on a memory scanner, and the source code and output is as
following:

Now, I know why my buffer from read process memory looks like values such
as "67108864" ; it's because I read into the buffer entire chunk of memory
at a time, because I fed read process memory this:  "mbi.RegionSize"

Now, how do I read for values such as doubles?
I am guessing I need to use a for loop to scan for small bits of memory
chunk
at a time.

Is there a way to do it?

Thanks!




>output starts

buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(6385664)
buffer is:  c_ulong(67108864)
buffer is:  c_ulong(7761920)
buffer is:  c_ulong(7798784)
buffer is:  c_ulong(7872512)
buffer is:  c_ulong(8007680)
buffer is:  c_ulong(8044544)
buffer is:  c_ulong(8069120)
buffer is:  c_ulong(8216576)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(3976)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(1318755581)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)
buffer is:  c_ulong(0)

> code starts

buffer = ctypes.c_uint()
nread = SIZE_T()

start = ctypes.c_void_p(mbi.BaseAddress)

ReadProcessMemory = Kernel32.ReadProcessMemory

MEM_COMMIT = 0x1000;
PAGE_READWRITE = 0x04;

current_address = sysinfo.lpMinimumApplicationAddress
end_address = sysinfo.lpMaximumApplicationAddress

while current_address < end_address:
Kernel32.VirtualQueryEx(Process, \
current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))

if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :

if ReadProcessMemory(Process, current_address,
ctypes.byref(buffer), \
 ctypes.sizeof(buffer), ctypes.byref(nread)):
print('buffer is: ',buffer)
else:
raise ctypes.WinError(ctypes.get_last_error())

current_address += mbi.RegionSize
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] How do I scan memory for singles, doubles and so on?

[Michael C]

Or to put it better, I think, it's

How do I set up ReadProcessMemory, so that it returns a double instead of
129819721.

On Sat, Oct 7, 2017 at 2:00 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Hi all:
>
> I am working on a memory scanner, and the source code and output is as
> following:
>
> Now, I know why my buffer from read process memory looks like values such
> as "67108864" ; it's because I read into the buffer entire chunk of memory
> at a time, because I fed read process memory this:  "mbi.RegionSize"
>
> Now, how do I read for values such as doubles?
> I am guessing I need to use a for loop to scan for small bits of memory
> chunk
> at a time.
>
> Is there a way to do it?
>
> Thanks!
>
>
>
>
> >output starts
>
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(6385664)
> buffer is:  c_ulong(67108864)
> buffer is:  c_ulong(7761920)
> buffer is:  c_ulong(7798784)
> buffer is:  c_ulong(7872512)
> buffer is:  c_ulong(8007680)
> buffer is:  c_ulong(8044544)
> buffer is:  c_ulong(8069120)
> buffer is:  c_ulong(8216576)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(3976)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(1318755581)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
> buffer is:  c_ulong(0)
>
> > code starts
>
> buffer = ctypes.c_uint()
> nread = SIZE_T()
>
> start = ctypes.c_void_p(mbi.BaseAddress)
>
> ReadProcessMemory = Kernel32.ReadProcessMemory
>
> MEM_COMMIT = 0x1000;
> PAGE_READWRITE = 0x04;
>
> current_address = sysinfo.lpMinimumApplicationAddress
> end_address = sysinfo.lpMaximumApplicationAddress
>
> while current_address < end_address:
> Kernel32.VirtualQueryEx(Process, \
> current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))
>
> if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
>
> if ReadProcessMemory(Process, current_address,
> ctypes.byref(buffer), \
>  ctypes.sizeof(buffer), ctypes.byref(nread)):
> print('buffer is: ',buffer)
> else:
> raise ctypes.WinError(ctypes.get_last_error())
>
> current_address += mbi.RegionSize
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] How do I scan memory for singles, doubles and so on?

[Michael C]

I am following some examples online such as this one:
https://social.msdn.microsoft.com/Forums/vstudio/en-US/ce0cc398-2b96-4688-b8a4-b5f4c9ebc064/memory-searcher-with-virtualqueryex-and-readprocessmemory?forum=vclanguage


i think I got most of it right, so this following part is what I would like
you to look at:

DWORD read = 0;
LPVOID buffer = 0

(ReadProcessMemory(hackProcess, (void*)start, , sizeof(int), )


So, what's the Python equivalent statements for sizeof(int) ?






On Sat, Oct 7, 2017 at 7:38 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Oh I am trying to write my own memory scanner, because I thought the Cheat
> Engine is pretty neat and I am just trying make one for myself.
>
> Onto the problem, I think what happens with Readprocessmemory is that
>
> BOOL WINAPI ReadProcessMemory(
>   _In_  HANDLE  hProcess,
>   _In_  LPCVOID lpBaseAddress,  _Out_ LPVOID  lpBuffer,
>   _In_  SIZE_T  nSize,
>   _Out_ SIZE_T  *lpNumberOfBytesRead
> );
>
>
> for LPVOID lpbuffer, it should be a
>
> buffer = ctypes.c_double
>
> because i am trying to search for a double.
> However, the interpreter gives me this:
>
> ReadProcessMemory(Process, current_address, ctypes.byref(buffer), \
> TypeError: byref() argument must be a ctypes instance, not
> '_ctypes.PyCSimpleType'
>
>
> so I am using
> buffer = ctypes.c_uint()
> instead. It returns things like   "c_ulong(2006549856)" , though.
>
> 2nd, I believe  _In_  SIZE_T  nSize, means I tell the interpreter to read
> that much
> data, which means I can use this parameter to get doubles, which is what I
> want!
>
> However, I am using
>
> ctypes.sizeof(buffer)
>
> for it, so, I need either to change my buffer to a double, or to tell this
> parameter to  search for
> doubles somehow.
>
>
> Am I on the right track?
>
>
> Thanks!
>
>
>
> On Sat, Oct 7, 2017 at 6:58 PM, Mats Wichmann <m...@wichmann.us> wrote:
>
>> it might help if you mention what you are trying to do. if it is
>> forensics, there a bunch of python tools in that area. your problem may
>> already have solutions you could use.
>>
>> On October 7, 2017 3:00:25 PM MDT, Michael C <
>> mysecretrobotfact...@gmail.com> wrote:
>> >Hi all:
>> >
>> >I am working on a memory scanner, and the source code and output is as
>> >following:
>> >
>> >Now, I know why my buffer from read process memory looks like values
>> >such
>> >as "67108864" ; it's because I read into the buffer entire chunk of
>> >memory
>> >at a time, because I fed read process memory this:  "mbi.RegionSize"
>> >
>> >Now, how do I read for values such as doubles?
>> >I am guessing I need to use a for loop to scan for small bits of memory
>> >chunk
>> >at a time.
>> >
>> >Is there a way to do it?
>> >
>> >Thanks!
>> >
>> >
>> >
>> >
>> >>output starts
>> >
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(6385664)
>> >buffer is:  c_ulong(67108864)
>> >buffer is:  c_ulong(7761920)
>> >buffer is:  c_ulong(7798784)
>> >buffer is:  c_ulong(7872512)
>> >buffer is:  c_ulong(8007680)
>> >buffer is:  c_ulong(8044544)
>> >buffer is:  c_ulong(8069120)
>> >buffer is:  c_ulong(8216576)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(3976)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(1318755581)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(0)
>> >buffer is:  c_ulong(0)
>> >
>> >> code starts
>> >
>> >buffer = ctypes.c_uint()
>> >nread = SIZE_T()
>> >
>> >start = ctypes.c_void_p(mbi.BaseAddress)
>> >
>> >ReadProcessMemory = Kernel32.ReadProcessMemory
>> >
>> >MEM_COMMIT = 0x1000;
>> >PAGE_READWRITE = 0x04;
>> >
>> >current_address = sysinfo.lpMinimumApplicationAddress
>> >end_address = sysinfo.lpMaximumApplicationAddress
>> >
>> >while current_address < end_address:
>> >Kernel32.VirtualQueryEx(Process, \
>> >current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))
>> >
>> >if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
>> >
>> >if ReadProcessMemory(Process, current_address,
>> >ctypes.byref(buffer), \
>> >   ctypes.sizeof(buffer), ctypes.byref(nread)):
>> >print('buffer is: ',buffer)
>> >else:
>> >raise ctypes.WinError(ctypes.get_last_error())
>> >
>> >current_address += mbi.RegionSize
>> >___
>> >Tutor maillist  -  Tutor@python.org
>> >To unsubscribe or change subscription options:
>> >https://mail.python.org/mailman/listinfo/tutor
>>
>> --
>> Sent from my Android device with K-9 Mail. Please excuse my brevity.
>> ___
>> Tutor maillist  -  Tutor@python.org
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] How do I scan memory for singles, doubles and so on?

[Michael C]

Oh I am trying to write my own memory scanner, because I thought the Cheat
Engine is pretty neat and I am just trying make one for myself.

Onto the problem, I think what happens with Readprocessmemory is that

BOOL WINAPI ReadProcessMemory(
  _In_  HANDLE  hProcess,
  _In_  LPCVOID lpBaseAddress,  _Out_ LPVOID  lpBuffer,
  _In_  SIZE_T  nSize,
  _Out_ SIZE_T  *lpNumberOfBytesRead
);


for LPVOID lpbuffer, it should be a

buffer = ctypes.c_double

because i am trying to search for a double.
However, the interpreter gives me this:

ReadProcessMemory(Process, current_address, ctypes.byref(buffer), \
TypeError: byref() argument must be a ctypes instance, not
'_ctypes.PyCSimpleType'


so I am using
buffer = ctypes.c_uint()
instead. It returns things like   "c_ulong(2006549856)" , though.

2nd, I believe  _In_  SIZE_T  nSize, means I tell the interpreter to read
that much
data, which means I can use this parameter to get doubles, which is what I
want!

However, I am using

ctypes.sizeof(buffer)

for it, so, I need either to change my buffer to a double, or to tell this
parameter to  search for
doubles somehow.


Am I on the right track?


Thanks!



On Sat, Oct 7, 2017 at 6:58 PM, Mats Wichmann <m...@wichmann.us> wrote:

> it might help if you mention what you are trying to do. if it is
> forensics, there a bunch of python tools in that area. your problem may
> already have solutions you could use.
>
> On October 7, 2017 3:00:25 PM MDT, Michael C <mysecretrobotfactory@gmail.
> com> wrote:
> >Hi all:
> >
> >I am working on a memory scanner, and the source code and output is as
> >following:
> >
> >Now, I know why my buffer from read process memory looks like values
> >such
> >as "67108864" ; it's because I read into the buffer entire chunk of
> >memory
> >at a time, because I fed read process memory this:  "mbi.RegionSize"
> >
> >Now, how do I read for values such as doubles?
> >I am guessing I need to use a for loop to scan for small bits of memory
> >chunk
> >at a time.
> >
> >Is there a way to do it?
> >
> >Thanks!
> >
> >
> >
> >
> >>output starts
> >
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(6385664)
> >buffer is:  c_ulong(67108864)
> >buffer is:  c_ulong(7761920)
> >buffer is:  c_ulong(7798784)
> >buffer is:  c_ulong(7872512)
> >buffer is:  c_ulong(8007680)
> >buffer is:  c_ulong(8044544)
> >buffer is:  c_ulong(8069120)
> >buffer is:  c_ulong(8216576)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(3976)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(1318755581)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(0)
> >buffer is:  c_ulong(0)
> >
> >> code starts
> >
> >buffer = ctypes.c_uint()
> >nread = SIZE_T()
> >
> >start = ctypes.c_void_p(mbi.BaseAddress)
> >
> >ReadProcessMemory = Kernel32.ReadProcessMemory
> >
> >MEM_COMMIT = 0x1000;
> >PAGE_READWRITE = 0x04;
> >
> >current_address = sysinfo.lpMinimumApplicationAddress
> >end_address = sysinfo.lpMaximumApplicationAddress
> >
> >while current_address < end_address:
> >Kernel32.VirtualQueryEx(Process, \
> >current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))
> >
> >if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
> >
> >if ReadProcessMemory(Process, current_address,
> >ctypes.byref(buffer), \
> >   ctypes.sizeof(buffer), ctypes.byref(nread)):
> >print('buffer is: ',buffer)
> >else:
> >raise ctypes.WinError(ctypes.get_last_error())
> >
> >current_address += mbi.RegionSize
> >___
> >Tutor maillist  -  Tutor@python.org
> >To unsubscribe or change subscription options:
> >https://mail.python.org/mailman/listinfo/tutor
>
> --
> Sent from my Android device with K-9 Mail. Please excuse my brevity.
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] using while loop for read process memory

[Michael C]

Hi all:

I have the following code, and somehow I must have fed the read process
Memory incorrectly. what the code does is to check a region of memory to
see
whether or not it can be scanned.

mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT

If this is true,then it proceeds to scan the memory fro current_address to
current_address + mbi.RegionSize.

However, a strange thing happens: The loop runs twice successfully, and
then it
pops:

raise ctypes.WinError(ctypes.get_last_error())
OSError: [WinError 299] Only part of a ReadProcessMemory or
WriteProcessMemory request was completed.

Now, I know the problem is not with VirtualQueryEx, because if I comment out
the red part and just run VirtualQueryEx, it would actually skim through
all regions
without a single error.

The red part is the problem. I have tried to modify the loop.

Somehow, if I use this:

index = current_address
end = current_address + mbi.RegionSize - 7

Where the end is less by 7, the loop would not pop any error and it would
finish
the loop

What did I do wrong?

thanks!




>code starts



current_address = sysinfo.lpMinimumApplicationAddress
end_address = sysinfo.lpMaximumApplicationAddress

while current_address < end_address:
Kernel32.VirtualQueryEx(Process, \
current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))

if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
print('This region can be scanned!')
index = current_address
end = current_address + mbi.RegionSize

while index < end:
if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
 ctypes.sizeof(buffer),
ctypes.byref(nread)):
## value comparison to be implemented.
pass
else:
raise ctypes.WinError(ctypes.get_last_error())

index += 1

current_address += mbi.RegionSize
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

I'll explain better when I get on a pc.

On Oct 8, 2017 12:18 PM, "Michael C" <mysecretrobotfact...@gmail.com> wrote:

> This is the red part
>   index = current_address
> end = current_address + mbi.RegionSize
>
> while index < end:
> if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
>  ctypes.sizeof(buffer),
> ctypes.byref(nread)):
> ## value comparison to be implemented.
> pass
> else:
> raise ctypes.WinError(ctypes.get_last_error())
>
> index += 1
>
> On Oct 8, 2017 12:16 PM, "Mats Wichmann" <m...@wichmann.us> wrote:
>
>> On 10/08/2017 11:20 AM, Michael C wrote:
>> > Hi all:
>>
>> > Now, I know the problem is not with VirtualQueryEx, because if I
>> comment out
>> > the red part and just run VirtualQueryEx, it would actually skim through
>> > all regions
>> > without a single error.
>> >
>> > The red part is the problem.
>>
>> what red part?  colors don't come through mailers that use text-based
>> settings.  This is an example of what your mail looks like to many of us:
>>
>> https://mail-archive.com/tutor@python.org/msg77570.html
>>
>> please explain in words.
>>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

This is the red part
  index = current_address
end = current_address + mbi.RegionSize

while index < end:
if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
 ctypes.sizeof(buffer),
ctypes.byref(nread)):
## value comparison to be implemented.
pass
else:
raise ctypes.WinError(ctypes.get_last_error())

index += 1

On Oct 8, 2017 12:16 PM, "Mats Wichmann" <m...@wichmann.us> wrote:

> On 10/08/2017 11:20 AM, Michael C wrote:
> > Hi all:
>
> > Now, I know the problem is not with VirtualQueryEx, because if I comment
> out
> > the red part and just run VirtualQueryEx, it would actually skim through
> > all regions
> > without a single error.
> >
> > The red part is the problem.
>
> what red part?  colors don't come through mailers that use text-based
> settings.  This is an example of what your mail looks like to many of us:
>
> https://mail-archive.com/tutor@python.org/msg77570.html
>
> please explain in words.
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

Is there a module that does this for me?
If it exists, how do I find it?

thanks

On Tue, Oct 3, 2017 at 5:04 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> i see i see.
>
> On Tue, Oct 3, 2017 at 4:50 PM, Alan Gauld via Tutor <tutor@python.org>
> wrote:
>
>> On 03/10/17 22:30, Michael C wrote:
>>
>> > I am trying to create SYSTEM_INFO structure  and
>> MEMORY_BASIC_INFORMATION
>> > structure
>> >
>> > I think there are modules for this purpose? Is it the ctypes.wintypes?
>>
>> wintypes does define many of the standard Win32 API types
>> but sadly neither of the two you mention seem to be included.
>>
>> Since the module consists entirely of type definitions
>> the easiest way to find out what it holds is probably
>> just to open the module source code and search/look.
>>
>> On my system(Linux) it lives in:
>>
>> /usr/lib/python3.4/ctypes/wintypes.py
>>
>> You might be able to create your own definition based
>> on the Windows type data and combining the more primitive
>> types that are declared in wintypes.
>>
>> --
>> Alan G
>> Author of the Learn to Program web site
>> http://www.alan-g.me.uk/
>> http://www.amazon.com/author/alan_gauld
>> Follow my photo-blog on Flickr at:
>> http://www.flickr.com/photos/alangauldphotos
>>
>>
>> ___
>> Tutor maillist  -  Tutor@python.org
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

First of all, thanks for the reply.


How do I see the values of each field? This doesn't work.

print(PMEMORY_BASIC_INFORMATION.Protect)

thanks!

On Thu, Oct 5, 2017 at 11:34 AM, eryk sun <eryk...@gmail.com> wrote:

> On Tue, Oct 3, 2017 at 10:30 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> >
> > I am trying to create SYSTEM_INFO structure  and MEMORY_BASIC_INFORMATION
> > structure
>
> First, avoid relying on constants, enumerations, and structures
> published on MSDN. It's not always right. Get the SDK and use the
> header files instead. MEMORY_BASIC_INFORMATION is defined in winnt.h,
> and SYSTEM_INFO is defined in sysinfoapi.h.
>
> MEMORY_BASIC_INFORMATION is simple. Don't worry about the
> MEMORY_BASIC_INFORMATION32 and MEMORY_BASIC_INFORMATION64 versions.
> Those are meant for a debugger that's reading this structure directly
> from the memory of another process.
>
> SYSTEM_INFO is a bit tricky, given the anonymous struct and union. I
> prefer to nest the definitions, but you could flatten it as separate
> definitions if you like. Refer to the docs for how to use _anonymous_:
>
> https://docs.python.org/3/library/ctypes#ctypes.Structure._anonymous_
>
> Here are the definitions. Please don't mindlessly copy and paste.
> Recreate them on your own and use this example as a reference.
>
> import ctypes
> from ctypes.wintypes import WORD, DWORD, LPVOID
>
> PVOID = LPVOID
> SIZE_T = ctypes.c_size_t
>
> # https://msdn.microsoft.com/en-us/library/aa383751#DWORD_PTR
> if ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulonglong):
> DWORD_PTR = ctypes.c_ulonglong
> elif ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulong):
> DWORD_PTR = ctypes.c_ulong
>
> class MEMORY_BASIC_INFORMATION(ctypes.Structure):
> """https://msdn.microsoft.com/en-us/library/aa366775"";
> _fields_ = (('BaseAddress', PVOID),
> ('AllocationBase',PVOID),
> ('AllocationProtect', DWORD),
> ('RegionSize', SIZE_T),
> ('State',   DWORD),
> ('Protect', DWORD),
> ('Type',DWORD))
>
> PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)
>
> class SYSTEM_INFO(ctypes.Structure):
> """https://msdn.microsoft.com/en-us/library/ms724958"";
> class _U(ctypes.Union):
> class _S(ctypes.Structure):
> _fields_ = (('wProcessorArchitecture', WORD),
> ('wReserved', WORD))
> _fields_ = (('dwOemId', DWORD), # obsolete
> ('_s', _S))
> _anonymous_ = ('_s',)
> _fields_ = (('_u', _U),
> ('dwPageSize', DWORD),
> ('lpMinimumApplicationAddress', LPVOID),
> ('lpMaximumApplicationAddress', LPVOID),
> ('dwActiveProcessorMask',   DWORD_PTR),
> ('dwNumberOfProcessors',DWORD),
> ('dwProcessorType', DWORD),
> ('dwAllocationGranularity', DWORD),
> ('wProcessorLevel',WORD),
> ('wProcessorRevision', WORD))
> _anonymous_ = ('_u',)
>
> LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO)
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Windows Memory Basics

[Michael C]

ah, i am bummed completely haha.

Is there a way to tell which parts a variables so I can scan it?
Maybe you could point me to some reading materials?

thanks :)

On Mon, Oct 16, 2017 at 4:48 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 16/10/17 21:04, Michael C wrote:
>
> > I don't understand this part about the memory:
>
> And I'm not sure I understand your question but...
>
> > if I used VirtualQueryEx to find out if a region of memory is ok to scan,
> > and it
> > says it's ok, are the values in the region arranged like this:
> >
> > short,int,double,long,char, double, short in
> >
> > as in, random?
>
> They won't be random, they'll be in the order that the
> program that wrote the memory chose them to be in. For
> example the memory might contain some program variables
> and those variables may be of different types (assuming
> a compiled language like C++, say). Or it may be holding
> a complex data structure, like a class, that has fields
> of different types.
>
> What those types are will not be obvious and unless you
> know what you are reading will be impossible to guess
> in most cases since it is just a sequence of bytes and
> one set of 8 bits looks a lot like any other.
>
> > I am asking this because, if it's random, then I'd have to run
> > ReadProcessMemory
> >  by increasing  the value of of my loop by ONE (1) at a time, like this
>
> That doesn't really help, you need to know what each
> chunk of data represents and then increment the index
> by the size of each corresponding data type.
>
> For example if you have a string of 8 UTF8 characters
> that will probably be 8 bytes long(some UTF characters
> are more than 8 bits). But those 8 bytes could equally
> be a floating point number or a long integer or a
> struct containing 2 32 bit ints. You have absolutely
> no way to tell.
>
> And if you increment your index by one you will then
> look at the first 7 bytes plus one other. What is
> the 8th byte? It could be the start of another float,
> another UTF8 character or something else entirely.
>
> Things are then further complicated by the tendency
> to store data on word boundaries, so either 4 or
> 8 byte chunks, but even that can't be guaranteed
> since it could be a compressed memory scheme in
> action or a piece of assembler code taking the
> 'law' into its own hands.
>
> And of course it may not represent anything since
> many programs set aside memory spaqce for later use
> and either fill it with zeros or some other arbitrary
> pattern, or just leave it with whatever bits happened
> to already be there.
>
> > for i in range(start_of_region, end_of_region, 1):
> >   ReadProcessMemory(Process, i, ctypes.byref(buffer),
> > ctypes.sizeof(buffer), ctypes.byref(nread))
> >
> > Is that correct?
>
> Probably not. If you know what data you are reading you
> can do what you want, but if it's just a random block
> of memory you are scanning then its almost impossible
> to determine for certain what the raw data represents.
>
> If you have access to a *nix system (or cygwin
> on windows) it may help you to see the nature
> of the problem by running od -x on a text file
> You can find out what is in it by looking at it
> in a text editor but the hex listing will be
> meaningless. If that's what simple text looks
> like imagine what a binary file containing
> mixed data is like.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Windows Memory Basics

[Michael C]

Hold on, supposed by using Openprocess and VirtualQueryEx, I have the
locations of all the memory the application is using, wouldn't this to be
true?

Say, a 8 byte data is somewhere in the region i am scanning. Ok, I know by
scanning it like this
for n in range(start,end,1)

will read into another variable and mostly nothing, but unless a variable,
that is, one number, can be truncated and exist in multiple locations like
this

double = 12345678

123 is at x001
45 is at x005
678 is at x010

unless a number can be broken up like that, wouldn't I, while use the silly
'increment by one' approach,  actually luck out and get that value in it's
actual position?




On Mon, Oct 16, 2017 at 4:53 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> ah, i am bummed completely haha.
>
> Is there a way to tell which parts a variables so I can scan it?
> Maybe you could point me to some reading materials?
>
> thanks :)
>
> On Mon, Oct 16, 2017 at 4:48 PM, Alan Gauld via Tutor <tutor@python.org>
> wrote:
>
>> On 16/10/17 21:04, Michael C wrote:
>>
>> > I don't understand this part about the memory:
>>
>> And I'm not sure I understand your question but...
>>
>> > if I used VirtualQueryEx to find out if a region of memory is ok to
>> scan,
>> > and it
>> > says it's ok, are the values in the region arranged like this:
>> >
>> > short,int,double,long,char, double, short in
>> >
>> > as in, random?
>>
>> They won't be random, they'll be in the order that the
>> program that wrote the memory chose them to be in. For
>> example the memory might contain some program variables
>> and those variables may be of different types (assuming
>> a compiled language like C++, say). Or it may be holding
>> a complex data structure, like a class, that has fields
>> of different types.
>>
>> What those types are will not be obvious and unless you
>> know what you are reading will be impossible to guess
>> in most cases since it is just a sequence of bytes and
>> one set of 8 bits looks a lot like any other.
>>
>> > I am asking this because, if it's random, then I'd have to run
>> > ReadProcessMemory
>> >  by increasing  the value of of my loop by ONE (1) at a time, like this
>>
>> That doesn't really help, you need to know what each
>> chunk of data represents and then increment the index
>> by the size of each corresponding data type.
>>
>> For example if you have a string of 8 UTF8 characters
>> that will probably be 8 bytes long(some UTF characters
>> are more than 8 bits). But those 8 bytes could equally
>> be a floating point number or a long integer or a
>> struct containing 2 32 bit ints. You have absolutely
>> no way to tell.
>>
>> And if you increment your index by one you will then
>> look at the first 7 bytes plus one other. What is
>> the 8th byte? It could be the start of another float,
>> another UTF8 character or something else entirely.
>>
>> Things are then further complicated by the tendency
>> to store data on word boundaries, so either 4 or
>> 8 byte chunks, but even that can't be guaranteed
>> since it could be a compressed memory scheme in
>> action or a piece of assembler code taking the
>> 'law' into its own hands.
>>
>> And of course it may not represent anything since
>> many programs set aside memory spaqce for later use
>> and either fill it with zeros or some other arbitrary
>> pattern, or just leave it with whatever bits happened
>> to already be there.
>>
>> > for i in range(start_of_region, end_of_region, 1):
>> >   ReadProcessMemory(Process, i, ctypes.byref(buffer),
>> > ctypes.sizeof(buffer), ctypes.byref(nread))
>> >
>> > Is that correct?
>>
>> Probably not. If you know what data you are reading you
>> can do what you want, but if it's just a random block
>> of memory you are scanning then its almost impossible
>> to determine for certain what the raw data represents.
>>
>> If you have access to a *nix system (or cygwin
>> on windows) it may help you to see the nature
>> of the problem by running od -x on a text file
>> You can find out what is in it by looking at it
>> in a text editor but the hex listing will be
>> meaningless. If that's what simple text looks
>> like imagine what a binary file containing
>> mixed data is like.
>>
>> --
>> Alan G
>> Author of the Learn to Program web site
>> http://www.alan-g.me.uk/
>> http://www.amazon.com/author/alan_gauld
>> Follow my photo-blog on Flickr at:
>> http://www.flickr.com/photos/alangauldphotos
>>
>>
>> ___
>> Tutor maillist  -  Tutor@python.org
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

Sorry Alan, Steve, everyone

Can you take a look of this please?



Here is my question about the memory:

So I have a base address of a chunk of memory from it's size, from
VirtualQueryEx
(if you dont use windows, it's ok, it's not about how u get these values,
because I think
the base concept is the same)

start = mbi.BaseAddress
finish = mbi.RegionSize

So at this time, I use while and this is how it looks like

while index < finish:
   # access the memory here:
   while memory function( index)
   # then index += 1, for the inner loop

## this line complete the outer while loop
index += mbi.RegionSize


so Why did I put down index += 1  ?

That's because what I think about the memory looks like this
(short)(int)(double)(int)(int)(int)(double)  and so on,

since I can't predict which address is the beginning of a double, the only
way
to deal with that is to use increment by 1.

Now, from what I have been reading, it seems there is a better way to do it,
for instance, a for loop.

for(start,finish, 8)

why 8? because double begins at exact 0 or multiple of 8 bytes, right?

On Thu, Oct 12, 2017 at 6:54 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Here is my question about the memory:
>
> So I have a base address of a chunk of memory from it's size, from
> VirtualQueryEx
> (if you dont use windows, it's ok, it's not about how u get these values,
> because I think
> the base concept is the same)
>
> start = mbi.BaseAddress
> finish = mbi.RegionSize
>
> So at this time, I use while and this is how it looks like
>
> while index < finish:
># access the memory here:
>while memory function( index)
># then index += 1, for the inner loop
>
> ## this line complete the outer while loop
> index += mbi.RegionSize
>
>
> so Why did I put down index += 1  ?
>
> That's because what I think about the memory looks like this
> (short)(int)(double)(int)(int)(int)(double)  and so on,
>
> since I can't predict which address is the beginning of a double, the only
> way
> to deal with that is to use increment by 1.
>
> Now, from what I have been reading, it seems there is a better way to do
> it,
> for instance, a for loop.
>
> for(start,finish, 8)
>
> why 8? because double begins at exact 0 or multiple of 8 bytes, right?
>
>
>
> On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <tutor@python.org>
> wrote:
>
>> On 08/10/17 20:18, Michael C wrote:
>> > This is the red part
>> >   index = current_address
>> > end = current_address + mbi.RegionSize
>> >
>> > while index < end:
>> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
>> >  ctypes.sizeof(buffer),
>> > ctypes.byref(nread)):
>> > ## value comparison to be implemented.
>> > pass
>> > else:
>> > raise ctypes.WinError(ctypes.get_last_error())
>> >
>> > index += 1
>>
>> I haven't been following this closely so may be way off here,
>> but does this mean you are incrementing the memory address
>> by 1? If so you are only increasing the pointer by 1 byte
>> but you are, presumably, reading multiple bytes at a time
>> (the size of the buffer presumably).
>>
>> Do you perhaps need to treat the buffer as a byte array
>> and use something like the struct module to decode it?
>> (assuming you know what you are reading...?)
>>
>> But I may be way off, I'm just going on a cursory look.
>>
>> --
>> Alan G
>> Author of the Learn to Program web site
>> http://www.alan-g.me.uk/
>> http://www.amazon.com/author/alan_gauld
>> Follow my photo-blog on Flickr at:
>> http://www.flickr.com/photos/alangauldphotos
>>
>>
>> ___
>> Tutor maillist  -  Tutor@python.org
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] Windows Memory Basics

[Michael C]

Hi all:


I don't understand this part about the memory:

if I used VirtualQueryEx to find out if a region of memory is ok to scan,
and it
says it's ok, are the values in the region arranged like this:

short,int,double,long,char, double, short in

as in, random?


I am asking this because, if it's random, then I'd have to run
ReadProcessMemory
 by increasing  the value of of my loop by ONE (1) at a time, like this

for i in range(start_of_region, end_of_region, 1):
  ReadProcessMemory(Process, i, ctypes.byref(buffer),
ctypes.sizeof(buffer), ctypes.byref(nread))


Is that correct?
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

Here is my question about the memory:

So I have a base address of a chunk of memory from it's size, from
VirtualQueryEx
(if you dont use windows, it's ok, it's not about how u get these values,
because I think
the base concept is the same)

start = mbi.BaseAddress
finish = mbi.RegionSize

So at this time, I use while and this is how it looks like

while index < finish:
   # access the memory here:
   while memory function( index)
   # then index += 1, for the inner loop

## this line complete the outer while loop
index += mbi.RegionSize


so Why did I put down index += 1  ?

That's because what I think about the memory looks like this
(short)(int)(double)(int)(int)(int)(double)  and so on,

since I can't predict which address is the beginning of a double, the only
way
to deal with that is to use increment by 1.

Now, from what I have been reading, it seems there is a better way to do it,
for instance, a for loop.

for(start,finish, 8)

why 8? because double begins at exact 0 or multiple of 8 bytes, right?



On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 08/10/17 20:18, Michael C wrote:
> > This is the red part
> >   index = current_address
> > end = current_address + mbi.RegionSize
> >
> > while index < end:
> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
> >  ctypes.sizeof(buffer),
> > ctypes.byref(nread)):
> > ## value comparison to be implemented.
> > pass
> > else:
> > raise ctypes.WinError(ctypes.get_last_error())
> >
> > index += 1
>
> I haven't been following this closely so may be way off here,
> but does this mean you are incrementing the memory address
> by 1? If so you are only increasing the pointer by 1 byte
> but you are, presumably, reading multiple bytes at a time
> (the size of the buffer presumably).
>
> Do you perhaps need to treat the buffer as a byte array
> and use something like the struct module to decode it?
> (assuming you know what you are reading...?)
>
> But I may be way off, I'm just going on a cursory look.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

in fact, when I am using this:

end = start + mbi.RegionSize

I was getting error from the ReadProcessMemory function, and I couldn't
figure it out why.
Until I did this:
end = current_address + mbi.RegionSize - 7

then it doesn't complain anymore. I think it's because I ran this in a
while loop with start += 1
so in the last 7 bytes, I'd be reading past the end of this memory chunk.

Is this right?

On Thu, Oct 12, 2017 at 6:54 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> Here is my question about the memory:
>
> So I have a base address of a chunk of memory from it's size, from
> VirtualQueryEx
> (if you dont use windows, it's ok, it's not about how u get these values,
> because I think
> the base concept is the same)
>
> start = mbi.BaseAddress
> finish = mbi.RegionSize
>
> So at this time, I use while and this is how it looks like
>
> while index < finish:
># access the memory here:
>while memory function( index)
># then index += 1, for the inner loop
>
> ## this line complete the outer while loop
> index += mbi.RegionSize
>
>
> so Why did I put down index += 1  ?
>
> That's because what I think about the memory looks like this
> (short)(int)(double)(int)(int)(int)(double)  and so on,
>
> since I can't predict which address is the beginning of a double, the only
> way
> to deal with that is to use increment by 1.
>
> Now, from what I have been reading, it seems there is a better way to do
> it,
> for instance, a for loop.
>
> for(start,finish, 8)
>
> why 8? because double begins at exact 0 or multiple of 8 bytes, right?
>
>
>
> On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <tutor@python.org>
> wrote:
>
>> On 08/10/17 20:18, Michael C wrote:
>> > This is the red part
>> >   index = current_address
>> > end = current_address + mbi.RegionSize
>> >
>> > while index < end:
>> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
>> >  ctypes.sizeof(buffer),
>> > ctypes.byref(nread)):
>> > ## value comparison to be implemented.
>> > pass
>> > else:
>> > raise ctypes.WinError(ctypes.get_last_error())
>> >
>> > index += 1
>>
>> I haven't been following this closely so may be way off here,
>> but does this mean you are incrementing the memory address
>> by 1? If so you are only increasing the pointer by 1 byte
>> but you are, presumably, reading multiple bytes at a time
>> (the size of the buffer presumably).
>>
>> Do you perhaps need to treat the buffer as a byte array
>> and use something like the struct module to decode it?
>> (assuming you know what you are reading...?)
>>
>> But I may be way off, I'm just going on a cursory look.
>>
>> --
>> Alan G
>> Author of the Learn to Program web site
>> http://www.alan-g.me.uk/
>> http://www.amazon.com/author/alan_gauld
>> Follow my photo-blog on Flickr at:
>> http://www.flickr.com/photos/alangauldphotos
>>
>>
>> ___
>> Tutor maillist  -  Tutor@python.org
>> To unsubscribe or change subscription options:
>> https://mail.python.org/mailman/listinfo/tutor
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] windows specific: read process memory

[Michael C]

Hi all, I have a few questions about memory scanning!
The following code attempts to print out all addresses whose value is
int(-143)!

1. I am using a for loop to go through all the addresses! Is this the right
thing to do?
2. I feed the read process memory function with hex(i), correct?

3. I am a little bummed by what to put down for my buffer and buffer size,
is
what I did proper?

4. This is not in the code, but if I actually know the value I want in the
memory is
a Double, how do i modify my code to look at only doubles?

thanks all!

> code starts


User32 = ctypes.WinDLL('User32', use_last_error=True)
Kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
PROCESS_VM_READ = 0x0010
PID = 'given'


Process = Kernel32.OpenProcess(PROCESS_VM_READ, 0, PID)
ReadProcessMemory = Kernel32.ReadProcessMemory


buffer_size = 1000
buffer = ctypes.create_string_buffer(buffer_size)

# looking for the addresses where the values are -143, for example
# I used 1000 as an abitrary number, I need to scan the entire
application
# memory space, but I am not sure how to acquire that value.

for i in range(1,1000):
if ReadProcessMemory(Process, hex(i), buffer, buffer_size, None):
if float(buffer) == int(-143) :
print(float(buffer))


print('Done.')
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] I want to learn how memory works!

[Michael C]

Hi all, after 1 week of on and off hacking, I realized I simply don't know
enough about how memory works fundamentally!

Could you point me to a source of information about all the things someone
should know before he starts writing a memory scanner?  Attached is my
current code, which doesn't work and can't figure out why. That's where I
am at.



> code starts.





import ctypes


User32 = ctypes.WinDLL('User32', use_last_error=True)
Kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

PID = 5924

PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010


Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
False, PID)
ReadProcessMemory = Kernel32.ReadProcessMemory

buffer = ctypes.create_string_buffer(4)
bufferSize = (ctypes.sizeof(buffer))


# I think instead of using 10, I should use the size of the total
# memory used. but I don't know how to find this value.
for n in range(10):
if ReadProcessMemory(Process, n, buffer, bufferSize, None):
print('buffer: ',buffer)
else:
print('something is wrong!')



print('Done.')
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] ctypes wintypes

[Michael C]

Hi all:

I am trying to create SYSTEM_INFO structure  and MEMORY_BASIC_INFORMATION
structure

I think there are modules for this purpose? Is it the ctypes.wintypes?

if so, please point me to a documentation for it.

Thanks!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

i see i see.

On Tue, Oct 3, 2017 at 4:50 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 03/10/17 22:30, Michael C wrote:
>
> > I am trying to create SYSTEM_INFO structure  and MEMORY_BASIC_INFORMATION
> > structure
> >
> > I think there are modules for this purpose? Is it the ctypes.wintypes?
>
> wintypes does define many of the standard Win32 API types
> but sadly neither of the two you mention seem to be included.
>
> Since the module consists entirely of type definitions
> the easiest way to find out what it holds is probably
> just to open the module source code and search/look.
>
> On my system(Linux) it lives in:
>
> /usr/lib/python3.4/ctypes/wintypes.py
>
> You might be able to create your own definition based
> on the Windows type data and combining the more primitive
> types that are declared in wintypes.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

like this?

buffer = ctypes.byref(ctypes.create_string_buffer(4))

On Fri, Oct 6, 2017 at 1:55 PM, eryk sun <eryk...@gmail.com> wrote:

> On Fri, Oct 6, 2017 at 9:12 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> >
> > How do I create a buffer, or rather, is a buffer just a variable?
>
> A buffer is a block of memory for an I/O operation. For example, if
> you need to read a 4-byte (32-bit) integer at an address in another
> process, the 'buffer' could be ctypes.c_int32(). In general, to read
> an arbitrary-sized block of memory, use ctypes.create_string_buffer()
> to create a char array.
>
> > How do I create a pointer to it?
>
> Pass it byref().
>
> > print('mbi.State: ',mbi.State)
>
> Check whether mbi.State is MEM_COMMIT before trying to read it. If
> it's MEM_FREE or MEM_RESERVE, then ReadProcessMemory will fail.
>
> > buffer = ctypes.create_string_buffer(4)
> > bufferSize = (ctypes.sizeof(buffer))
> >
> > ReadProcessMemory = Kernel32.ReadProcessMemory
> >
> > if ReadProcessMemory(Process, ctypes.byref(mbi), buffer, bufferSize,
> None):
> > print('buffer is: ',buffer)
> > else:
> > print('something is wrong')
>
> Don't print "something is wrong". You're capturing the thread's last
> error value, so use it to raise an informative exception. For example:
>
> if not success:
> raise ctypes.WinError(ctypes.get_last_error())
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

This is my updated version, it still doesn't work :(


base = mbi.BaseAddress
buffer = ctypes.c_int32()
buffer_pointer = ctypes.byref(buffer)

ReadProcessMemory = Kernel32.ReadProcessMemory

if ReadProcessMemory(Process, base, buffer_pointer, mbi.RegionSize, None):
print('buffer is: ',buffer)
else:
raise ctypes.WinError(ctypes.get_last_error())

On Fri, Oct 6, 2017 at 2:06 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> like this?
>
> buffer = ctypes.byref(ctypes.create_string_buffer(4))
>
> On Fri, Oct 6, 2017 at 1:55 PM, eryk sun <eryk...@gmail.com> wrote:
>
>> On Fri, Oct 6, 2017 at 9:12 PM, Michael C
>> <mysecretrobotfact...@gmail.com> wrote:
>> >
>> > How do I create a buffer, or rather, is a buffer just a variable?
>>
>> A buffer is a block of memory for an I/O operation. For example, if
>> you need to read a 4-byte (32-bit) integer at an address in another
>> process, the 'buffer' could be ctypes.c_int32(). In general, to read
>> an arbitrary-sized block of memory, use ctypes.create_string_buffer()
>> to create a char array.
>>
>> > How do I create a pointer to it?
>>
>> Pass it byref().
>>
>> > print('mbi.State: ',mbi.State)
>>
>> Check whether mbi.State is MEM_COMMIT before trying to read it. If
>> it's MEM_FREE or MEM_RESERVE, then ReadProcessMemory will fail.
>>
>> > buffer = ctypes.create_string_buffer(4)
>> > bufferSize = (ctypes.sizeof(buffer))
>> >
>> > ReadProcessMemory = Kernel32.ReadProcessMemory
>> >
>> > if ReadProcessMemory(Process, ctypes.byref(mbi), buffer, bufferSize,
>> None):
>> > print('buffer is: ',buffer)
>> > else:
>> > print('something is wrong')
>>
>> Don't print "something is wrong". You're capturing the thread's last
>> error value, so use it to raise an informative exception. For example:
>>
>> if not success:
>> raise ctypes.WinError(ctypes.get_last_error())
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

I think I pieced together what you have been helping me with, but this
still raise a error
I have been loosely following this guide:
https://www.codeproject.com/articles/716227/csharp-how-to-scan-a-process-memory



>code start.


import ctypes
from ctypes.wintypes import WORD, DWORD, LPVOID

PVOID = LPVOID
SIZE_T = ctypes.c_size_t

# https://msdn.microsoft.com/en-us/library/aa383751#DWORD_PTR
if ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulonglong):
DWORD_PTR = ctypes.c_ulonglong
elif ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulong):
DWORD_PTR = ctypes.c_ulong

class SYSTEM_INFO(ctypes.Structure):
"""https://msdn.microsoft.com/en-us/library/ms724958"";
class _U(ctypes.Union):
class _S(ctypes.Structure):
_fields_ = (('wProcessorArchitecture', WORD),
('wReserved', WORD))
_fields_ = (('dwOemId', DWORD), # obsolete
('_s', _S))
_anonymous_ = ('_s',)
_fields_ = (('_u', _U),
('dwPageSize', DWORD),
('lpMinimumApplicationAddress', LPVOID),
('lpMaximumApplicationAddress', LPVOID),
('dwActiveProcessorMask',   DWORD_PTR),
('dwNumberOfProcessors',DWORD),
('dwProcessorType', DWORD),
('dwAllocationGranularity', DWORD),
('wProcessorLevel',WORD),
('wProcessorRevision', WORD))
_anonymous_ = ('_u',)

LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO)



Kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
Kernel32.GetSystemInfo.restype = None
Kernel32.GetSystemInfo.argtypes = (LPSYSTEM_INFO,)

sysinfo = SYSTEM_INFO()
Kernel32.GetSystemInfo(ctypes.byref(sysinfo))

print(sysinfo.lpMinimumApplicationAddress)
print(sysinfo.lpMaximumApplicationAddress)


# maybe it will change, maybe it won't. Assuming it won't.

# 2nd, get Open process.



PID = 1234
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

Process = Kernel32.OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
False, PID)
print('process:', Process)



# 3rd

class MEMORY_BASIC_INFORMATION(ctypes.Structure):
"""https://msdn.microsoft.com/en-us/library/aa366775"";
_fields_ = (('BaseAddress', PVOID),
('AllocationBase',PVOID),
('AllocationProtect', DWORD),
('RegionSize', SIZE_T),
('State',   DWORD),
('Protect', DWORD),
('Type',DWORD))

##PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)

mbi = MEMORY_BASIC_INFORMATION()
##sysinfo.lpMinimumApplicationAddress

print('VirtualQueryEx ran properly?',Kernel32.VirtualQueryEx(Process, \
None, ctypes.byref(mbi),ctypes.sizeof(mbi)))
# sysinfo.lpMinimumApplicationAddress replaced by None

print('')
print('mbi start')
print('mbi.BaseAddress: ',mbi.BaseAddress)
print('mbi.AllocationBase: ',mbi.AllocationBase)
print('mbi.AllocationProtect: ',mbi.AllocationProtect)
print('mbi.RegionSize: ',mbi.RegionSize)
print('mbi.State: ',mbi.State)
print('mbi.Protect: ', mbi.Protect)
print('mbi.Type: ',mbi.Type)


buffer = ctypes.create_string_buffer(mbi.RegionSize)
nread = SIZE_T()

start = ctypes.c_void_p(mbi.BaseAddress)
##start_pointer = ctypes.byref(start)

ReadProcessMemory = Kernel32.ReadProcessMemory

if ReadProcessMemory(Process, start, ctypes.byref(buffer), \
 ctypes.sizeof(buffer), ctypes.byref(nread)):
print('buffer is: ',buffer)
else:
raise ctypes.WinError(ctypes.get_last_error())


# once I figure out read process memory, I'll combine it with virtual
process memory.

# if they don't equal to that, then it's time to move to the next thing?
# Don't do read memory yet.
# make it traverse through all memory and print out when protect and state
# are both true.
##
##MEM_COMMIT = 0x1000;
##PAGE_READWRITE = 0x04;
##
##current_address = sysinfo.lpMinimumApplicationAddress
##end_address = sysinfo.lpMaximumApplicationAddress
##
##while current_address < end_address:
##Kernel32.VirtualQueryEx(Process, \
##current_address, ctypes.byref(mbi),ctypes.sizeof(mbi))
##
##if mbi.Protect == PAGE_READWRITE and mbi.State == MEM_COMMIT :
##print(current_address)
##print('Both are true')
##
##
##current_address += mbi.RegionSize


On Fri, Oct 6, 2017 at 3:29 PM, eryk sun <eryk...@gmail.com> wrote:

> On Fri, Oct 6, 2017 at 11:05 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> > For this read process memory, if I am trying compose a LPCVOID
> > lpBaseAddress, am I not making a variable that equals to
> mbi.BaseAddress,
> > and then making a pointer pointing to it?
> >
> > start_address = mbi.BaseAddress
> >  LPCVOID = ctypes.byref(start_address)
>
> LPCVOID is a pointer type; don't use it as a variable name because
> it's confu

Re: [Tutor] ctypes wintypes

[Michael C]

For this read process memory, if I am trying compose a LPCVOID
lpBaseAddress, am I not making a variable that equals to  mbi.BaseAddress,
and then making a pointer pointing to it?

start_address = mbi.BaseAddress
 LPCVOID = ctypes.byref(start_address)

?

But I get this

start = ctypes.byref(mbi.BaseAddress)
TypeError: byref() argument must be a ctypes instance, not 'int'


On Fri, Oct 6, 2017 at 2:53 PM, eryk sun <eryk...@gmail.com> wrote:

> On Fri, Oct 6, 2017 at 10:26 PM, Michael C
> <mysecretrobotfact...@gmail.com> wrote:
> >
> > base = mbi.BaseAddress
> > buffer = ctypes.c_int32()
> > buffer_pointer = ctypes.byref(buffer)
> > ReadProcessMemory = Kernel32.ReadProcessMemory
> >
> > if ReadProcessMemory(Process, base, buffer_pointer, mbi.RegionSize,
> None):
> > print('buffer is: ',buffer)
> > else:
> > raise ctypes.WinError(ctypes.get_last_error())
>
> If you need to read RegionSize bytes, then you have to allocate a
> buffer that's RegionSize bytes:
>
> buffer = ctypes.create_string_buffer(mbi.RegionSize)
>
> Or use a smaller buffer and loop until the total number of bytes read
> is RegionSize.
>
> Also, remember to check that the state is MEM_COMMIT. You cannot read
> an address range that's free or reserved. It must be committed, i.e.
> backed by physical storage.
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] ctypes wintypes

[Michael C]

Sorry about asking these super obvious little things, I am actually a 1st
student, but I acing my programming 101 at the moment lol

On Thu, Oct 5, 2017 at 12:27 PM, Michael C <mysecretrobotfact...@gmail.com>
wrote:

> First of all, thanks for the reply.
>
>
> How do I see the values of each field? This doesn't work.
>
> print(PMEMORY_BASIC_INFORMATION.Protect)
>
> thanks!
>
> On Thu, Oct 5, 2017 at 11:34 AM, eryk sun <eryk...@gmail.com> wrote:
>
>> On Tue, Oct 3, 2017 at 10:30 PM, Michael C
>> <mysecretrobotfact...@gmail.com> wrote:
>> >
>> > I am trying to create SYSTEM_INFO structure  and
>> MEMORY_BASIC_INFORMATION
>> > structure
>>
>> First, avoid relying on constants, enumerations, and structures
>> published on MSDN. It's not always right. Get the SDK and use the
>> header files instead. MEMORY_BASIC_INFORMATION is defined in winnt.h,
>> and SYSTEM_INFO is defined in sysinfoapi.h.
>>
>> MEMORY_BASIC_INFORMATION is simple. Don't worry about the
>> MEMORY_BASIC_INFORMATION32 and MEMORY_BASIC_INFORMATION64 versions.
>> Those are meant for a debugger that's reading this structure directly
>> from the memory of another process.
>>
>> SYSTEM_INFO is a bit tricky, given the anonymous struct and union. I
>> prefer to nest the definitions, but you could flatten it as separate
>> definitions if you like. Refer to the docs for how to use _anonymous_:
>>
>> https://docs.python.org/3/library/ctypes#ctypes.Structure._anonymous_
>>
>> Here are the definitions. Please don't mindlessly copy and paste.
>> Recreate them on your own and use this example as a reference.
>>
>> import ctypes
>> from ctypes.wintypes import WORD, DWORD, LPVOID
>>
>> PVOID = LPVOID
>> SIZE_T = ctypes.c_size_t
>>
>> # https://msdn.microsoft.com/en-us/library/aa383751#DWORD_PTR
>> if ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulonglong):
>> DWORD_PTR = ctypes.c_ulonglong
>> elif ctypes.sizeof(ctypes.c_void_p) == ctypes.sizeof(ctypes.c_ulong):
>> DWORD_PTR = ctypes.c_ulong
>>
>> class MEMORY_BASIC_INFORMATION(ctypes.Structure):
>> """https://msdn.microsoft.com/en-us/library/aa366775"";
>> _fields_ = (('BaseAddress', PVOID),
>> ('AllocationBase',PVOID),
>> ('AllocationProtect', DWORD),
>> ('RegionSize', SIZE_T),
>> ('State',   DWORD),
>> ('Protect', DWORD),
>> ('Type',DWORD))
>>
>> PMEMORY_BASIC_INFORMATION = ctypes.POINTER(MEMORY_BASIC_INFORMATION)
>>
>> class SYSTEM_INFO(ctypes.Structure):
>> """https://msdn.microsoft.com/en-us/library/ms724958"";
>> class _U(ctypes.Union):
>> class _S(ctypes.Structure):
>> _fields_ = (('wProcessorArchitecture', WORD),
>> ('wReserved', WORD))
>> _fields_ = (('dwOemId', DWORD), # obsolete
>> ('_s', _S))
>> _anonymous_ = ('_s',)
>> _fields_ = (('_u', _U),
>> ('dwPageSize', DWORD),
>> ('lpMinimumApplicationAddress', LPVOID),
>> ('lpMaximumApplicationAddress', LPVOID),
>> ('dwActiveProcessorMask',   DWORD_PTR),
>> ('dwNumberOfProcessors',DWORD),
>> ('dwProcessorType', DWORD),
>> ('dwAllocationGranularity', DWORD),
>> ('wProcessorLevel',WORD),
>> ('wProcessorRevision', WORD))
>> _anonymous_ = ('_u',)
>>
>> LPSYSTEM_INFO = ctypes.POINTER(SYSTEM_INFO)
>>
>
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] using while loop for read process memory

[Michael C]

thank for replying, but I am toast, so I'll reply tomorrow,
thanks!

On Sun, Oct 8, 2017 at 4:46 PM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 08/10/17 20:18, Michael C wrote:
> > This is the red part
> >   index = current_address
> > end = current_address + mbi.RegionSize
> >
> > while index < end:
> > if ReadProcessMemory(Process, index, ctypes.byref(buffer), \
> >  ctypes.sizeof(buffer),
> > ctypes.byref(nread)):
> > ## value comparison to be implemented.
> > pass
> > else:
> > raise ctypes.WinError(ctypes.get_last_error())
> >
> > index += 1
>
> I haven't been following this closely so may be way off here,
> but does this mean you are incrementing the memory address
> by 1? If so you are only increasing the pointer by 1 byte
> but you are, presumably, reading multiple bytes at a time
> (the size of the buffer presumably).
>
> Do you perhaps need to treat the buffer as a byte array
> and use something like the struct module to decode it?
> (assuming you know what you are reading...?)
>
> But I may be way off, I'm just going on a cursory look.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

[Tutor] I found something nice!

[Michael C]

Hi all!

My project needs to use MEMORY_BASIC_INFORMATION() and SYSTEM_INFO()
structures, and previously I thought there wasn't a way
(thanks to ErykSun, who wrote it for me, which I have been using)

Now I found out someone actually wrote a long time ago, so all I have to do
is to download and install it!

Now, I installed my numpy with pip install numpy and that worked like a
charm

but how do I get this?


https://stackoverflow.com/questions/21401663/python-windows-api-dump-process-in-buffer-then-regex-search

https://github.com/jaimeblasco/Open-Source-Hackers/blob/master/memYara/constants/structures.py



Thanks for reading!
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Windows Memory Basics

[Michael C]

cool stuff!

On Tue, Oct 17, 2017 at 2:17 AM, Alan Gauld via Tutor <tutor@python.org>
wrote:

> On 17/10/17 01:02, Michael C wrote:
>
> > that is, one number, can be truncated and exist in multiple locations
> like
> > this
> >
> > double = 12345678
> >
> > 123 is at x001
> > 45 is at x005
> > 678 is at x010
>
> That won't happen, a single variable will always be in a a single
> area.
>
> But the representation won't be anything like you suggested. A
> single number 12345678(assuming its a decimal integer) will be
> stored as 0xbc614e, which is 3 bytes, so it will be part of
> a 4byte (assuming a 32bit integer) chunk of storage.
> Of course if the program declared the variable to be a long
> then the same 3 bytes will be stored within an 8 byte chunk.
> And if it was stored as a double floating point value then
> the byte representation will be entirely different (and
> I don't even know what that would be).
>
> > unless a number can be broken up like that, wouldn't I,
> > while use the silly 'increment by one' approach,
> > actually luck out and get that value in it's actual position?
>
> Yes, if you know that the decimal number 12345678 is stored
> somewhere in memory, you can scan looking for the 3 bytes 0xbc,
> 0x61,0x4e. And if you also know it was stored in a 32 bit int
> you can check for zero before the first byte (or second, or last)
> depending on the endian storage system used by your OS).
>
> But you still don't know for sure that you didn't just find a
> byte of 0xbc followed by the start of a UTF8 string beginning
> with the characters 'aN'...  And there are likely to be several
> hits not just one. You need to figure out which are your number
> and which are just groups of 3 bytes that happen to look like it.
>
> If you are very clever you can look at the data surrounding
> each set of bytes and make a fair guess about ones which
> are not likely to be your variable (as above you might look
> to see if the following bytes are all viable ascii characters
> which might indicate that it was indeed a string and not
> your number). But that may still leave several candidates,
> and its all fraught with difficulty.
>
> If you do know the data types involved you can read your
> memory into a buffer and apply the struct module to
> interpret it (possibly in multiple ways) to extract
> the values but you must know the nature of what you are
> reading to be able to interpret it. ie. you need to know
> the types.
>
> Reading the bytes in memory is one thing, and relatively easy.
> Interpreting those bytes as actual data is nigh impossible
> unless you know in advance what data types you are looking at.
>
> --
> Alan G
> Author of the Learn to Program web site
> http://www.alan-g.me.uk/
> http://www.amazon.com/author/alan_gauld
> Follow my photo-blog on Flickr at:
> http://www.flickr.com/photos/alangauldphotos
>
>
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Windows Memory Basics

[Michael C]

I am going to put your reply in a special place, for the day I can
understand it :)

On Tue, Oct 17, 2017 at 2:37 AM, James Chapman <ja...@uplinkzero.com> wrote:

> We're heading into advanced territory here and I might get told off but...
> Consider this C++ program for a second, it has a struct with different
> types of variables which sit next to each other in memory. When you print
> the byte values of the struct, you can see that there is no easy way to
> know which byte value belongs to which variable unless you already know the
> layout.
>
> -
> #include 
>
> typedef unsigned char  BYTE;
> typedef unsigned short WORD;
> typedef unsigned long  DWORD;
>
> #pragma pack(1)
> struct mem
> {
> char c; // 1 byte
> WORD wn;// 2 byte
> DWORD dwn;  // 4 byte
> int i;  // 4 byte
> BYTE b; // 1 byte
> };
>
> int main()
> {
> mem s;
> s.c = 0xFF;
> s.wn = 0xF;
> s.dwn = 0x;
> s.i = 0x;
> s.b = 0xFF;
>
> BYTE * memPointer = reinterpret_cast();
>
> for (int i = 0; i < sizeof(mem); i++)
> printf("%02d [0x%08x] = %x \n", i, memPointer, *memPointer++);
>
> return 0;
> }
> -
>
> Prints
>
> 00 [0xecf0f789] = ff
> 01 [0xecf0f78a] = ff
> 02 [0xecf0f78b] = ff
> 03 [0xecf0f78c] = ff
> 04 [0xecf0f78d] = ff
> 05 [0xecf0f78e] = ff
> 06 [0xecf0f78f] = ff
> 07 [0xecf0f790] = ff
> 08 [0xecf0f791] = ff
> 09 [0xecf0f792] = ff
> 10 [0xecf0f793] = ff
> 11 [0xecf0f794] = ff
>
> Packing can also come into play. If you change the packing to 2, you get
> this:
>
> 00 [0x7d4ffcd9] = ff
> 01 [0x7d4ffcda] = cc
> 02 [0x7d4ffcdb] = ff
> 03 [0x7d4ffcdc] = ff
> 04 [0x7d4ffcdd] = ff
> 05 [0x7d4ffcde] = ff
> 06 [0x7d4ffcdf] = ff
> 07 [0x7d4ffce0] = ff
> 08 [0x7d4ffce1] = ff
> 09 [0x7d4ffce2] = ff
> 10 [0x7d4ffce3] = ff
> 11 [0x7d4ffce4] = ff
> 12 [0x7d4ffce5] = ff
> 13 [0x7d4ffce6] = cc
>
> And if you change it to 4, you get this:
>
> 00 [0xf4f5fbf9] = ff
> 01 [0xf4f5fbfa] = cc
> 02 [0xf4f5fbfb] = ff
> 03 [0xf4f5fbfc] = ff
> 04 [0xf4f5fbfd] = ff
> 05 [0xf4f5fbfe] = ff
> 06 [0xf4f5fbff] = ff
> 07 [0xf4f5fc00] = ff
> 08 [0xf4f5fc01] = ff
> 09 [0xf4f5fc02] = ff
> 10 [0xf4f5fc03] = ff
> 11 [0xf4f5fc04] = ff
> 12 [0xf4f5fc05] = ff
> 13 [0xf4f5fc06] = cc
> 14 [0xf4f5fc07] = cc
> 15 [0xf4f5fc08] = cc
>
>
> In other words, even if you have the source code for the program you want
> to scan in memory, depending on the compiler settings the memory layout
> could have changed, or rather not be what you expected due to packing and
> alignment.
>
> Probably not the answer you were hoping for but I hope this helps.
>
> --
> James
>
>
>
>
> On 17 October 2017 at 01:02, Michael C <mysecretrobotfact...@gmail.com>
> wrote:
>
>> Hold on, supposed by using Openprocess and VirtualQueryEx, I have the
>> locations of all the memory the application is using, wouldn't this to be
>> true?
>>
>> Say, a 8 byte data is somewhere in the region i am scanning. Ok, I know by
>> scanning it like this
>> for n in range(start,end,1)
>>
>> will read into another variable and mostly nothing, but unless a variable,
>> that is, one number, can be truncated and exist in multiple locations like
>> this
>>
>> double = 12345678
>>
>> 123 is at x001
>> 45 is at x005
>> 678 is at x010
>>
>> unless a number can be broken up like that, wouldn't I, while use the
>> silly
>> 'increment by one' approach,  actually luck out and get that value in it's
>> actual position?
>>
>>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor

Re: [Tutor] Python C extension - which method?

[Michael C]

Sorry I don't understand your suggestion.

Use "ctypes.CDLL" and "ctypes.WinDLL"

this works,
mydll = cdll.LoadLibrary('test.dll')
print(mydll.sum(3,2))

and this doens't
mydll = cdll('test.dll')
print(mydll.sum(3,2))

What's the syntax of what you suggested?

Thanks

On Mon, May 7, 2018 at 3:15 AM, eryk sun  wrote:

> On Sun, May 6, 2018 at 12:49 AM, Brad M  wrote:
> > If I may ask, what's the difference between these two?
> >
> > 1)
> > import ctypes
> > hello = ctypes.WinDLL('hello', use_last_error=True)
> >
> > 2)
> > from ctypes import cdll
> > hello = cdll.LoadLibrary('hello.dll')
>
> Use ctypes.CDLL and ctypes.WinDLL instead of cdll.LoadLibrary and
> windll.LoadLibrary. The latter is more typing for no benefit and
> prevents using the constructor arguments: handle, mode (POSIX),
> use_errno, and use_last_error (Windows). You need the latter two
> options if the library requires C errno or Windows GetLastError(), in
> which case you should use ctypes.get_errno() or
> ctypes.get_last_error() to get the error values after a C function
> call.
>
> > Both of them can return "1980" from  this:
> >
> > hello.c
> >
> > #include 
> >
> > __declspec(dllexport) int say_something()
> > {
> > return 1980;
> > }
>
> CDLL is the cdecl calling convention, and WinDLL is stdcall. There is
> no difference in 64-bit Windows (x64 ABI). In 32-bit Windows (x86
> ABI), cdecl has the caller clean the stack (i.e. pop arguments), and
> stdcall has the callee (the called function) clean the stack. cdecl
> allows functions with a variable number of arguments, such as the CRT
> printf function. In MSVC, cdecl is the default convention if you don't
> declare a function as __stdcall. A library can export functions with
> varying calling conventions, so in general you may need to mix CDLL
> and WinDLL.
> ___
> Tutor maillist  -  Tutor@python.org
> To unsubscribe or change subscription options:
> https://mail.python.org/mailman/listinfo/tutor
>
___
Tutor maillist  -  Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor