From 09e9b7efbbb4e4dce13472458be920fc9d915151 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Tue, 19 Apr 2016 11:49:33 +0200 Subject: [PATCH] Fix get_mapped_filename 32 -> 64 (use NtQueryVirtualMemory) --- windows/winobject/process.py | 20 +++++++++++++++++--- windows/winproxy.py | 4 ++-- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/windows/winobject/process.py b/windows/winobject/process.py index ff05a36..75eb58a 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -412,10 +412,24 @@ class Process(AutoHandle): :rtype: :class:`str` or ``None`` """ - buffer = ctypes.c_buffer(0x1024) + buffer_size = 0x1000 + buffer = ctypes.c_buffer(buffer_size) + + if windows.current_process.bitness == 32 and self.bitness == 64: + target_size = ctypes.c_buffer(buffer_size) + try: + windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, addr, 2, buffer, buffer_size, target_size) + except NtStatusException as e: + if e.code not in [STATUS_FILE_INVALID, STATUS_INVALID_ADDRESS]: + raise + return None + remote_winstring = rctypes.transform_type_to_remote64bits(WinUnicodeString) + mapped_filename = remote_winstring(ctypes.addressof(buffer), windows.current_process) + return mapped_filename.str + try: - size = winproxy.GetMappedFileNameA(self.handle, addr, buffer) - except winproxy.Kernel32Error: + size = winproxy.GetMappedFileNameA(self.handle, addr, buffer, buffer_size) + except winproxy.Kernel32Error as e: return None return buffer[:size] diff --git a/windows/winproxy.py b/windows/winproxy.py index 3a62a7d..8a622c9 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -529,14 +529,14 @@ def DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, l def GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None): if nSize is None: nSize = ctypes.sizeof(lpFilename) - return GetMappedFileNameW.ctypes_function(hProcess, lpv, lpFilename, nSize) + return GetMappedFileNameWWrapper.ctypes_function(hProcess, lpv, lpFilename, nSize) GetMappedFileNameW = OptionalExport(Kernel32Proxy("GetMappedFileNameW"))(GetMappedFileNameWWrapper) def GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None): if nSize is None: nSize = ctypes.sizeof(lpFilename) - return GetMappedFileNameA.ctypes_function(hProcess, lpv, lpFilename, nSize) + return GetMappedFileNameAWrapper.ctypes_function(hProcess, lpv, lpFilename, nSize) GetMappedFileNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetMappedFileNameAWrapper) def QueryWorkingSetWrapper(hProcess, pv, cb):