开发者

Python ctypes.create_string_buffer Problem

The ReadProcessMemory function of kernel32.dll appears to be returning Unicode.

kernel32 = ctypes.windll.kernel32
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010

pid = int(raw_input("Enter PID: "))
hproc = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |PROCESS_VM_READ, False, pid)
lpbaseaddr = 16799644
read_buff = ctypes.create_string_buffer(4)
bytread = ctypes.c_ulong(0)
kernel32.ReadProcessMemory(hproc, lpbaseaddr, read_buff,
                               4, ctypes.byref(bytread))
print read_buff.raw #i also tried read_buff.value

I know the value at that addre开发者_如何学Pythonss is 80 because I used cheat engine to make it 80. The print read_buff line returns P. If I make the value of that address 81 with cheat engine and run my program it returns the value Q. I have been messing around and unichr(80) returns P and unichr(81) returns Q. There is obviously a problem with create_string_buff. Should I be using a byte buffer or integer buffer and how would I do that? Using unichr() works for a few values but say the address value is 800, unichr(800) obviously won't work. I'm looking for read_buff to return 50 or 60 or 800, etc.


It is not returning Unicode, but four bytes as a string (probably '\x80\x00\x00\x00') Pass a pointer to an integer not a string buffer:

read_buff = ctypes.c_uint()
kernel32.ReadProcessMemory(hproc, lpbaseaddr, ctypes.byref(read_buff),
                           ctypes.sizeof(read_buff), ctypes.byref(bytread))
print read_buff.value
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜