Develop Reference

Read Process Memory doesn't seem to give the right value

I am trying to read memory from a process (gameboy advance emulator) in Python using ReadProcessMemory. There is a memory viewer and I am supposed to get 81 at 0xD273 (see picture). I am new to this, I tried to do everything correctly by adding reference in the ReadProcessMemory, but there might be some things that are wrong. I am pretty sure I have the right process id since it matches the one in the task manager.
When I run my code, I get random byte values that are different everytime. 15, 255, 11, 195, but I think I should be getting 81.
I need to use python 32-bit to run the script otherwise I get error 299 (ERROR_PARTIAL_COPY).
Is there something that I'm doing wrong? I don’t specify the base address but I assumed it’s handled by the processHandle.
Here is my code and an example of the output:
result: 1, err code: 0, bytesRead: 1
data: 0000000000000015h
21
import ctypes as c
from ctypes import wintypes as w
import psutil
# Must use py -3-32 vba_script.py
vba_process_id = [p.pid for p in psutil.process_iter() if "visualboyadvance" in p.name()][0]
pid = vba_process_id # I assume you have this from somewhere.
k32 = c.WinDLL('kernel32', use_last_error=True)
OpenProcess = k32.OpenProcess
ReadProcessMemory = k32.ReadProcessMemory
CloseHandle = k32.CloseHandle
processHandle = OpenProcess(0x10, False, pid)
addr = c.c_void_p(0xD273)
dataLen = 8
data = c.c_byte()
bytesRead = c.c_byte()
result = ReadProcessMemory(processHandle, c.byref(addr), c.byref(data), c.sizeof(data), c.byref(bytesRead))
e = c.get_last_error()
print('result: {}, err code: {}, bytesRead: {}'.format(result,e,bytesRead.value))
print('data: {:016X}h'.format(data.value))
print(data.value)
CloseHandle(processHandle)

After reading #jasonharper answer, I found a way to get the actual address in the memory.
To get them, I used Cheat Engine, here was my procedure:
In Cheat Engine, search for 87949181 (hex for BRUH, which is trainer's name). Any data that you know will not change is also fine.
Find the address that really corresponds to it. Should have 0x00000050, 0x01000000, 0x0000FF99, 0x99000000, 0x00001600, 0x212D0316, DC00002D after (see picture 1). This address is a pointer. In my case, it's 0x07D2F370 (picture 2).
Double click on the address and do a pointer scan. In my case, the pointer address 0x07D2F218. This is a dynamic address that will change everytime, so you need to find the static address.
You can find that "visualboyadvance-m.exe"+02224064 -> 07D2F218. The base address is therefore 0x07D2F218 - 0x02224064 = 0x9a0000. The static address offset for the data I'm searching for is 0x02224064. The offset for the trainer's name data is 0x158.
After opening the process, to search in the memory, you can have a code like this:
base_addr = 0x9a0000 # "visualboyadvance-m.exe"
static_addr_offset = 0x02224064
address = base_addr + static_addr_offset + 0x158
k32 = c.WinDLL('kernel32', use_last_error=True)
buffer = c.create_string_buffer(buffer_size)
buffer_size=32
bytes_read = c.c_ulong(0)
if k32.ReadProcessMemory(processHandle, address, buffer, buffer_size, c.byref(bytes_read)):
data = c.c_uint32.from_buffer(buffer)
print(f"data: {data .value:X}")
This returns the right data that I'm looking for: data: 87949181.
Here are the pictures:
================================================================
================================================================
Bonus:
The base address will change if you close the game and you will need to find it back everytime. There is some way of doing way it by getting the module with the name of the process pname. You can get it easily with psutil.
import win32process
import psutils
vba_process = [p for p in psutil.process_iter() if "visualboyadvance" in p.name()][0]
pid = vba_process.pid
pname = vba_process.name
k32 = c.WinDLL('kernel32', use_last_error=True)
processHandle = k32.OpenProcess(0x10, False, pid)
modules = win32process.EnumProcessModules(processHandle)
for module in modules:
moduleFileName = win32process.GetModuleFileNameEx(processHandle, module)
if pname in moduleFileName:
base_address = module
print("Success: Got Base Address:", hex(base_address))
Success: Got Base Address: 0x9a0000
Edit: Found how to get base address of process automatically

get audio device GUID in Python

I am trying to get GUID of audio device. The GUID can be found in registry Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\ the guid should look like {0.0.0.00000000}.{37e73048-025a-47ea-bf9f-59d5ef8f2b43}
basically like this. but I want in python Getting GUID of audio output device (speaker,headphones)
I've tried myself but only thing I can find is to use command line and parse it in Python
import subprocess
sd = subprocess.run(
["pnputil", "/enum-devices", "/connected", "/class", "AudioEndpoint"],
capture_output=True,
text=True,
)
output = sd.stdout.split("\n")[1:-1]
def getDevices(devices):
deviceList = {}
for device in range(len(devices)):
if "Instance ID:" in devices[device]:
deviceList[devices[device+1].split(":")[-1].strip()] = devices[device].split("\\")[-1].strip()
return deviceList
print(getDevices(output))
which got me
{'Headset (Soundcore Life Q30 Hands-Free)': '{0.0.0.00000000}.{4ac89ef7-f00d-4069-b96b-421bd3276295}', 'Speakers (Echo Dot-BQP)': '{0.0.0.00000000}.{8085b216-297a-4d02-bc3d-83b997b79524}', 'Headphones (Soundcore Life Q30)': '{0.0.0.00000000}.{37e73048-025a-47ea-bf9f-59d5ef8f2b43}'}
Hopping there is better way

from __future__ import print_function
import comtypes
from pycaw.pycaw import AudioUtilities, IMMDeviceEnumerator, EDataFlow, DEVICE_STATE
from pycaw.constants import CLSID_MMDeviceEnumerator
def MyGetAudioDevices(direction="in", State = DEVICE_STATE.ACTIVE.value):
devices = []
# for all use EDataFlow.eAll.value
if direction == "in":
Flow = EDataFlow.eCapture.value # 1
else:
Flow = EDataFlow.eRender.value # 0
deviceEnumerator = comtypes.CoCreateInstance(
CLSID_MMDeviceEnumerator,
IMMDeviceEnumerator,
comtypes.CLSCTX_INPROC_SERVER)
if deviceEnumerator is None:
return devices
collection = deviceEnumerator.EnumAudioEndpoints(Flow, State)
if collection is None:
return devices
count = collection.GetCount()
for i in range(count):
dev = collection.Item(i)
if dev is not None:
if not ": None" in str(AudioUtilities.CreateDevice(dev)):
devices.append(AudioUtilities.CreateDevice(dev))
return devices
output_device = MyGetAudioDevices("out")
input_device = MyGetAudioDevices("in")
print(output_device)
print(input_device)
This worked for me

Python Module snmpSessionBaseClass: Where to download

I am trying to import the snmpSessionBaseClass python module in a script I am running, but I do not have the module installed and I can't seem to find where to download it. Does anyone know the pip or yum command to download and install this module? Thanks!
import netsnmp
sys.path.insert(1, os.path.join(sys.path[0], os.pardir))
from snmpSessionBaseClass import add_common_options, get_common_options, verify_host, get_data
from pynag.Plugins import PluginHelper,ok,critical

The following code needs to be added to a file called snmpSessionBaseClass.py and that file needs to be placed in a directory that is in pythons path.
#!/usr/bin/env python
# Copyright (C) 2016 rsmuc <rsmuc#mailbox.org>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with health_monitoring_plugins. If not, see <http://www.gnu.org/licenses/>.
import pynag
import netsnmp
import os
import sys
dev_null = os.open(os.devnull, os.O_WRONLY)
tmp_stdout = os.dup(sys.stdout.fileno())
def dev_null_wrapper(func, *a, **kwargs):
"""
Temporarily swap stdout with /dev/null, and execute given function while stdout goes to /dev/null.
This is useful because netsnmp writes to stdout and disturbes Icinga result in some cases.
"""
os.dup2(dev_null, sys.stdout.fileno())
return_object = func(*a, **kwargs)
sys.stdout.flush()
os.dup2(tmp_stdout, sys.stdout.fileno())
return return_object
def add_common_options(helper):
# Define the common command line parameters
helper.parser.add_option('-H', help="Hostname or ip address", dest="hostname")
helper.parser.add_option('-C', '--community', dest='community', help='SNMP community of the SNMP service on target host.', default='public')
helper.parser.add_option('-V', '--snmpversion', dest='version', help='SNMP version. (1 or 2)', default=2, type='int')
def get_common_options(helper):
# get the common options
host = helper.options.hostname
version = helper.options.version
community = helper.options.community
return host, version, community
def verify_host(host, helper):
if host == "" or host is None:
helper.exit(summary="Hostname must be specified"
, exit_code=pynag.Plugins.unknown
, perfdata='')
netsnmp_session = dev_null_wrapper(netsnmp.Session,
DestHost=helper.options.hostname,
Community=helper.options.community,
Version=helper.options.version)
try:
# Works around lacking error handling in netsnmp package.
if netsnmp_session.sess_ptr == 0:
helper.exit(summary="SNMP connection failed"
, exit_code=pynag.Plugins.unknown
, perfdata='')
except ValueError as error:
helper.exit(summary=str(error)
, exit_code=pynag.Plugins.unknown
, perfdata='')
# make a snmp get, if it fails (or returns nothing) exit the plugin
def get_data(session, oid, helper, empty_allowed=False):
var = netsnmp.Varbind(oid)
varl = netsnmp.VarList(var)
data = session.get(varl)
value = data[0]
if value is None:
helper.exit(summary="snmpget failed - no data for host "
+ session.DestHost + " OID: " +oid
, exit_code=pynag.Plugins.unknown
, perfdata='')
if not empty_allowed and not value:
helper.exit(summary="snmpget failed - no data for host "
+ session.DestHost + " OID: " +oid
, exit_code=pynag.Plugins.unknown
, perfdata='')
return value
# make a snmp get, but do not exit the plugin, if it returns nothing
# be careful! This funciton does not exit the plugin, if snmp get fails!
def attempt_get_data(session, oid):
var = netsnmp.Varbind(oid)
varl = netsnmp.VarList(var)
data = session.get(varl)
value = data[0]
return value
# make a snmp walk, if it fails (or returns nothing) exit the plugin
def walk_data(session, oid, helper):
tag = []
var = netsnmp.Varbind(oid)
varl = netsnmp.VarList(var)
data = list(session.walk(varl))
if len(data) == 0:
helper.exit(summary="snmpwalk failed - no data for host " + session.DestHost
+ " OID: " +oid
, exit_code=pynag.Plugins.unknown
, perfdata='')
for x in range(0, len(data)):
tag.append(varl[x].tag)
return data, tag
# make a snmp walk, but do not exit the plugin, if it returns nothing
# be careful! This function does not exit the plugin, if snmp walk fails!
def attempt_walk_data(session, oid):
tag = []
var = netsnmp.Varbind(oid)
varl = netsnmp.VarList(var)
data = list(session.walk(varl))
for x in range(0, len(data)):
tag.append(varl[x].tag)
return data, tag
def state_summary(value, name, state_list, helper, ok_value = 'ok', info = None):
"""
Always add the status to the long output, and if the status is not ok (or ok_value),
we show it in the summary and set the status to critical
"""
# translate the value (integer) we receive to a human readable value (e.g. ok, critical etc.) with the given state_list
state_value = state_list[int(value)]
summary_output = ''
long_output = ''
if not info:
info = ''
if state_value != ok_value:
summary_output += ('%s status: %s %s ' % (name, state_value, info))
helper.status(pynag.Plugins.critical)
long_output += ('%s status: %s %s\n' % (name, state_value, info))
return (summary_output, long_output)
def add_output(summary_output, long_output, helper):
"""
if the summary output is empty, we don't add it as summary, otherwise we would have empty spaces (e.g.: '. . . . .') in our summary report
"""
if summary_output != '':
helper.add_summary(summary_output)
helper.add_long_output(long_output)

Copying files from SMB server to local drive(Linux/Windows) in python

I am using smb module to connect to smb server. I am unable to figure out what exactly I could do to copy files from smb to my local drive as I am using linux machine.
import tempfile
from smb.SMBConnection import SMBConnection
from nmb.NetBIOS import NetBIOS
conn = SMBConnection('salead',
'repo#2k12',
'192.168.14.1',
'SERVER',
use_ntlm_v2=True)
assert conn.connect('192.168.1.41', 139)
if conn:
print "successfull",conn
else:
print "failed to connect"
If anyone can help me out it would be a great help for me. Thanks

According to some documentation, SMBConnection.retrieveFile() is the function you are searching for.
Example:
# UNTESTED
conn = SMBConnection('salead',
'repo#2k12',
'192.168.14.1',
'SERVER',
use_ntlm_v2 = True)
assert conn.connect('192.168.1.41', 139)
with open('local_file', 'wb') as fp:
conn.retrieveFile('share', '/path/to/remote_file', fp)
Documentation: http://pysmb.readthedocs.io/en/latest/api/smb_SMBConnection.html
Example (in Japanese): http://symfoware.blog68.fc2.com/blog-entry-999.html

The documentation referenced above by #Rob should get you there. Here is an idea that works using an abstracted class:
> pip install pysmb
import subprocess
from smb import SMBConnection
class SMBClient:
def __init__(self, ip, username, password, servername, share_name):
self._ip = ip
self._username = username
self._password = password
self._port = 445
self._share_name = share_name
self._servername = servername
self._server = ''
def _connect(self):
""" Connect and authenticate to the SMB share. """
self._server = SMBConnection(username=self._username,
password=self._password,
my_name=self._get_localhost(),
remote_name=self._servername,
use_ntlm_v2=True)
self._server.connect(self._ip, port=self._port)
def _download(self, files: list):
""" Download files from the remote share. """
for file in files:
with open(file, 'wb') as file_obj:
self._server.retrieveFile(service_name=self._share_name,
path=file,
file_obj=file_obj)
def _get_localhost(self):
self._host = subprocess.Popen(['hostname'],stdout=subprocess.PIPE).communicate()[0].strip()
Then, all you need to do is this:
filename = [the file you want to download]
smb_client = SMBClient(ip='192.168.14.1', username='salead', password='repo#2k12', servername='SERVER', share_name='SHARE_NAME')
smb_client._connect()
response = smb_client._download(filename)
Main Documentation: https://pysmb.readthedocs.io/en/latest/index.html
SMBConnection Documentation: https://pysmb.readthedocs.io/en/latest/api/smb_SMBConnection.html

In my case, it was necessary to copy files from one remote machine to another remote machine. Both remote machines are managed by Windows OS
import tempfile
from smb.SMBConnection import SMBConnection
client_machine_name = 'mylocalmachinename'
# first domen settings
userID_1 = 'admin_1'
password_1 = '123'
server_name_1 = 'SERVER_1'
server_ip_1 = '192.168.1.1'
# path to remote file in windows format we want to read
# "D:\myfiles\dir\somefile.txt". In this case, full access
# to disk d is open. But if you have published only a separate
# catalog, in our example "myfiles", then:
# share_resource_1 = 'myfiles'
# path_to_file_1 = '/dir/somefile.txt'
share_resource_1 = 'd'
path_to_file_1 = '/myfiles/dir/somefile.txt'
# second domen settings
userID_2 = 'admin_2'
password_2 = '123'
server_name_2 = 'SERVER_2'
server_ip_2 = '192.168.1.2'
# path to remote file we want to save in windows format "D:\myfiles\dir\somefile_copy.txt"
share_resource_2 = 'd'
path_to_file_2 = '/myfiles/dir/somefile_copy.txt'
conn_1 = SMBConnection(
userID_1, password_1, client_machine_name, server_name_1, use_ntlm_v2 = True
)
conn_2 = SMBConnection(
userID_2, password_2, client_machine_name, server_name_2, use_ntlm_v2 = True
)
conn_1.connect(server_ip_1, 139)
conn_2.connect(server_ip_2, 139)
with tempfile.NamedTemporaryFile() as file_obj:
conn_1.retrieveFile(share_resource_1, path_to_file_1, file_obj)
# Note that the file obj is positioned at the end-of-file,
# so you might need to perform a file_obj.seek() if you need
# to read from the beginning
file_obj.seek(0)
conn_2.storeFile(share_resource_2, path_to_file_2, file_obj)

Error setting status to empathy with dbus

I'm getting error when I try setting status to empathy with dbus using python,
this is the code I've got from different sources
## getting status from clementine music player
import dbus
# Clementine lives on the Session bus
session_bus = dbus.SessionBus()
# Get Clementine's player object, and then get an interface from that object,
# otherwise we'd have to type out the full interface name on every method call.
player = session_bus.get_object('org.mpris.clementine', '/Player')
iface = dbus.Interface(player, dbus_interface='org.freedesktop.MediaPlayer')
# Call a method on the interface
metadata = iface.GetMetadata()
print metadata["title"]+' - '+metadata["artist"]
status = metadata["title"]+' - '+metadata["artist"]
## the below code is from https://github.com/engla/kupfer/blob/master/kupfer/plugin/empathy.py
import os
import subprocess
import sys
import time
import pynotify as pn
# it takes a long time before empathy is willing to accept statuses
EMPATHY_STARTUP_SECONDS = 20
def show_usage():
print "\nUsage:"
print sys.argv[0], "|".join(_STATUSES.keys())
def set_status(status):
try:
activate(status)
notify_set_status(status)
except IndexError:
print "Missing required parameter."
show_usage()
except ValueError as err:
print err
show_usage()
def notify_set_status(status):
success = pn.init("icon-summary-body")
if not success:
raise Error()
# I like this icon, even if it's not relevant
icon = 'notification-keyboard-brightness-low'
pn.Notification("Empathy", "Tried to set status to "+ status, icon).show()
def main():# give empathy some time to start up
set_status(status)
def _(text):
return text
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# All code below was derived from https://github.com/engla/kupfer/blob/master/kupfer/plugin/empathy.py
ACCOUNTMANAGER_PATH = "/org/freedesktop/Telepathy/AccountManager"
ACCOUNTMANAGER_IFACE = "org.freedesktop.Telepathy.AccountManager"
ACCOUNT_IFACE = "org.freedesktop.Telepathy.Account"
CHANNEL_GROUP_IFACE = "org.freedesktop.Telepathy.Channel.Interface.Group"
CONTACT_IFACE = "org.freedesktop.Telepathy.Connection.Interface.Contacts"
SIMPLE_PRESENCE_IFACE = "org.freedesktop.Telepathy.Connection.Interface.SimplePresence"
DBUS_PROPS_IFACE = "org.freedesktop.DBus.Properties"
CHANNELDISPATCHER_IFACE = "org.freedesktop.Telepathy.ChannelDispatcher"
CHANNELDISPATCHER_PATH = "/org/freedesktop/Telepathy/ChannelDispatcher"
CHANNEL_TYPE = "org.freedesktop.Telepathy.Channel.ChannelType"
CHANNEL_TYPE_TEXT = "org.freedesktop.Telepathy.Channel.Type.Text"
CHANNEL_TARGETHANDLE = "org.freedesktop.Telepathy.Channel.TargetHandle"
CHANNEL_TARGETHANDLETYPE = "org.freedesktop.Telepathy.Channel.TargetHandleType"
EMPATHY_CLIENT_IFACE = "org.freedesktop.Telepathy.Client.Empathy"
EMPATHY_ACCOUNT_KEY = "EMPATHY_ACCOUNT"
EMPATHY_CONTACT_ID = "EMPATHY_CONTACT_ID"
_ATTRIBUTES = {
'alias': 'org.freedesktop.Telepathy.Connection.Interface.Aliasing/alias',
'presence': 'org.freedesktop.Telepathy.Connection.Interface.SimplePresence/presence',
'contact_caps': 'org.freedesktop.Telepathy.Connection.Interface.ContactCapabilities.DRAFT/caps',
'jid': 'org.freedesktop.Telepathy.Connection/contact-id',
'caps': 'org.freedesktop.Telepathy.Connection.Interface.Capabilities/caps',
}
def _create_dbus_connection():
sbus = dbus.SessionBus()
proxy_obj = sbus.get_object(ACCOUNTMANAGER_IFACE, ACCOUNTMANAGER_PATH)
dbus_iface = dbus.Interface(proxy_obj, DBUS_PROPS_IFACE)
return dbus_iface
def activate(status):
bus = dbus.SessionBus()
interface = _create_dbus_connection()
for valid_account in interface.Get(ACCOUNTMANAGER_IFACE, "ValidAccounts"):
account = bus.get_object(ACCOUNTMANAGER_IFACE, valid_account)
connection_status = account.Get(ACCOUNT_IFACE, "ConnectionStatus")
if connection_status != 0:
continue
connection_path = account.Get(ACCOUNT_IFACE, "Connection")
connection_iface = connection_path.replace("/", ".")[1:]
connection = bus.get_object(connection_iface, connection_path)
simple_presence = dbus.Interface(connection, SIMPLE_PRESENCE_IFACE)
try:
simple_presence.SetPresence(status, _(status))
except dbus.exceptions.DBusException:
print(status + ' is not supported by ' + valid_account)
print simple_presence
main()
when I run this script,
I get the following error.
phanindra#phanindra:~$ python clementine.py
onelove - Blue
(clementine.py:6142): Gtk-WARNING **: Unable to locate theme engine in module_path: "pixmap",
onelove - Blue is not supported by /org/freedesktop/Telepathy/Account/gabble/jabber/abcd_40gmail_2ecom0
I did something wrong? or the functions are deprecated?

Try this to update the status of Empathy with the current track playing in Clementine:
import dbus
session_bus = dbus.SessionBus()
player = session_bus.get_object('org.mpris.clementine', '/Player')
iface = dbus.Interface(player, dbus_interface='org.freedesktop.MediaPlayer')
metadata = iface.GetMetadata()
status = "♫ ".decode('utf8')+metadata["title"]+' - '+metadata["album"]+" ♫".decode('utf8')
print status
from gi.repository import TelepathyGLib as Tp
from gi.repository import GObject
loop = GObject.MainLoop()
am = Tp.AccountManager.dup()
am.prepare_async(None, lambda *args: loop.quit(), None)
loop.run()
am.set_all_requested_presences(Tp.ConnectionPresenceType.AVAILABLE,
'available', status)
Thank you for updating the Format in my original post !
- Harsha

Here is the API specification for the SimplePresence API's SetPresence call: http://telepathy.freedesktop.org/spec/Connection_Interface_Simple_Presence.html#Method:SetPresence
I think the problem is that you're trying to set the presence to an invalid status - you are only allow to set the status to one which the connection manager recognises - e.g. Available. You can set whatever you like for the message.
So your code should read something like:
simple_presence.SetPresence("Available", status)