Python ctypes.wintypes.LARGE_INTEGER Examples
The following are 1
code examples of ctypes.wintypes.LARGE_INTEGER().
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example.
You may also want to check out all available functions/classes of the module
ctypes.wintypes
, or try the search function
.
Example #1
Source File: win_vmmap.py From IDAngr with BSD 2-Clause "Simplified" License | 5 votes |
def vmmap(pid, is_64=True): base = 0 if is_64: mbi = MEMORY_BASIC_INFORMATION_64() addr_type = wintypes.LARGE_INTEGER else: mbi = MEMORY_BASIC_INFORMATION_32() addr_type = wintypes.DWORD proc = win32api.OpenProcess(win32con.PROCESS_QUERY_INFORMATION, 0, pid) maps = [] while windll.kernel32.VirtualQueryEx(proc.handle, addr_type(base), ctypes.byref(mbi), ctypes.sizeof(mbi)) > 0: mapperm = 0 if mbi.Protect & win32con.PAGE_EXECUTE: mapperm = SEG_PROT_X elif mbi.Protect & win32con.PAGE_EXECUTE_READ: mapperm = SEG_PROT_X | SEG_PROT_R elif mbi.Protect & win32con.PAGE_EXECUTE_READWRITE: mapperm = SEG_PROT_X | SEG_PROT_R | SEG_PROT_W elif mbi.Protect & win32con.PAGE_EXECUTE_WRITECOPY: mapperm = SEG_PROT_X | SEG_PROT_R elif mbi.Protect & win32con.PAGE_NOACCESS: mapperm = 0 elif mbi.Protect & win32con.PAGE_READONLY: mapperm = SEG_PROT_R elif mbi.Protect & win32con.PAGE_READWRITE: mapperm = SEG_PROT_R | SEG_PROT_W elif mbi.Protect & win32con.PAGE_WRITECOPY: mapperm = SEG_PROT_R #print hex(mbi.BaseAddress) +"\t"+ hex(mbi.BaseAddress + mbi.RegionSize) +"\t"+ hex(mapperm) maps.append((mbi.BaseAddress, mbi.BaseAddress + mbi.RegionSize, mapperm, "")) base += mbi.RegionSize win32api.CloseHandle(proc) return maps