Python ctypes.create_string_buffer Problem
The ReadProcessMemory function of kernel32.dll appears to be returning Unicode.
kernel32 = ctypes.windll.kernel32
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_VM_READ = 0x0010
pid = int(raw_input("Enter PID: "))
hproc = kernel32.OpenProcess(PROCESS_QUERY_INFORMATION |PROCESS_VM_READ, False, pid)
lpbaseaddr = 16799644
read_buff = ctypes.create_string_buffer(4)
bytread = ctypes.c_ulong(0)
kernel32.ReadProcessMemory(hproc, lpbaseaddr, read_buff,
4, ctypes.byref(bytread))
print read_buff.raw #i also tried read_buff.value
I know the value at that addre开发者_如何学Pythonss is 80 because I used cheat engine to make it 80. The print read_buff
line returns
P
. If I make the value of that address 81 with cheat engine and run my program it returns the value Q
. I have been messing around and unichr(80)
returns P
and unichr(81)
returns Q
. There is obviously a problem with create_string_buff
. Should I be using a byte buffer or integer buffer and how would I do that? Using unichr()
works for a few values but say the address value is 800
, unichr(800)
obviously won't work. I'm looking for read_buff
to return 50
or 60
or 800
, etc.
It is not returning Unicode, but four bytes as a string (probably '\x80\x00\x00\x00') Pass a pointer to an integer not a string buffer:
read_buff = ctypes.c_uint()
kernel32.ReadProcessMemory(hproc, lpbaseaddr, ctypes.byref(read_buff),
ctypes.sizeof(read_buff), ctypes.byref(bytread))
print read_buff.value
精彩评论