Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #79797 > unrolled thread

memory, PE files, etc...

Back to article view | Back to comp.lang.python

Contents

  memory, PE files, etc... kiuhnm03@yahoo.it - 2014-10-27 10:16 -0700
    Re: memory, PE files, etc... Tim Golden <mail@timgolden.me.uk> - 2014-10-27 17:23 +0000
      Re: memory, PE files, etc... kiuhnm03@yahoo.it - 2014-10-27 12:11 -0700
        Re: memory, PE files, etc... Rustom Mody <rustompmody@gmail.com> - 2014-10-27 19:37 -0700
          Re: memory, PE files, etc... gandalf23@mail.com - 2014-10-28 05:15 -0700
    Re: memory, PE files, etc... Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-29 02:18 +0000
      Re: memory, PE files, etc... Chris Angelico <rosuav@gmail.com> - 2014-10-29 13:25 +1100
      Re: memory, PE files, etc... Tim Golden <mail@timgolden.me.uk> - 2014-10-29 09:29 +0000

#79797 — memory, PE files, etc...

Hi!
I'd like to write one or more scripts that analyze processes in memory on Windows 7. I used to do these things in C++ by using native Win32 API calls.
How should I proceed in python? Any pointers?

[toc] | [next] | [standalone]

#79798

On 27/10/2014 17:16, kiuhnm03@yahoo.it wrote:
> Hi! I'd like to write one or more scripts that analyze processes in
> memory on Windows 7. I used to do these things in C++ by using native
> Win32 API calls. How should I proceed in python? Any pointers?
> 

psutil is definitely your friend:

  https://github.com/giampaolo/psutil

Although WMI can be quite handy too, depending on what you're trying to do:

  http://timgolden.me.uk/python/wmi/

TJG

[toc] | [prev] | [next] | [standalone]

#79801

On Monday, October 27, 2014 6:24:19 PM UTC+1, Tim Golden wrote:
> psutil is definitely your friend:
> 
>   https://github.com/giampaolo/psutil
> 
> Although WMI can be quite handy too, depending on what you're trying to do:
> 
>   http://timgolden.me.uk/python/wmi/
> 
> TJG

Thanks for answering.
I don't know if psutil is what I'm looking for.
What I need to do is more related to debugging than to administration.
Let's say I want to search for a sequence of bytes in the .text section of a given module. Can I do that with psutil?
Maybe I should buy this book:
http://www.amazon.com/Gray-Hat-Python-Programming-Engineers/dp/1593271921

[toc] | [prev] | [next] | [standalone]

#79818

On Tuesday, October 28, 2014 12:41:40 AM UTC+5:30, kiuh...@yahoo.it wrote:
> On Monday, October 27, 2014 6:24:19 PM UTC+1, Tim Golden wrote:
> > psutil is definitely your friend:
> > 
> >   https://github.com/giampaolo/psutil
> > 
> > Although WMI can be quite handy too, depending on what you're trying to do:
> > 
> >   http://timgolden.me.uk/python/wmi/
> > 
> > TJG
> 
> Thanks for answering.
> I don't know if psutil is what I'm looking for.
> What I need to do is more related to debugging than to administration.
> Let's say I want to search for a sequence of bytes in the .text section of a given module. Can I do that with psutil?

https://code.google.com/p/pefile/

?

[toc] | [prev] | [next] | [standalone]

#79837

On Tuesday, October 28, 2014 3:37:19 AM UTC+1, Rustom Mody wrote:
> On Tuesday, October 28, 2014 12:41:40 AM UTC+5:30, kiuh...@yahoo.it wrote:
> > On Monday, October 27, 2014 6:24:19 PM UTC+1, Tim Golden wrote:
> > > psutil is definitely your friend:
> > > 
> > >   https://github.com/giampaolo/psutil
> > > 
> > > Although WMI can be quite handy too, depending on what you're trying to do:
> > > 
> > >   http://timgolden.me.uk/python/wmi/
> > > 
> > > TJG
> > 
> > Thanks for answering.
> > I don't know if psutil is what I'm looking for.
> > What I need to do is more related to debugging than to administration.
> > Let's say I want to search for a sequence of bytes in the .text section of a given module. Can I do that with psutil?
> 
> https://code.google.com/p/pefile/
> 
> ?

I need to analyze the memory of running processes.
The answer is PyDbg or direct access to the API of Windows.

[toc] | [prev] | [next] | [standalone]

#79870

On Mon, 27 Oct 2014 10:16:43 -0700, kiuhnm03 wrote:

> I'd like to write one or more scripts that analyze processes in memory
> on Windows 7. I used to do these things in C++ by using native Win32 API
> calls.
> How should I proceed in python? Any pointers?

This seems to be a very common request. Does anyone know why?

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#79872

On Wed, Oct 29, 2014 at 1:18 PM, Denis McMahon <denismfmcmahon@gmail.com> wrote:
> On Mon, 27 Oct 2014 10:16:43 -0700, kiuhnm03 wrote:
>
>> I'd like to write one or more scripts that analyze processes in memory
>> on Windows 7. I used to do these things in C++ by using native Win32 API
>> calls.
>> How should I proceed in python? Any pointers?
>
> This seems to be a very common request. Does anyone know why?

I hadn't noticed it as hugely common, but in any case... I'd say it's
because ctypes and pywin32 are (rightly) obscure, so people don't know
they can basically do the same thing in Python as in C++. That's what
python-list is for, I think.

ChrisA

[toc] | [prev] | [next] | [standalone]

#79902

On 29/10/2014 02:18, Denis McMahon wrote:
> On Mon, 27 Oct 2014 10:16:43 -0700, kiuhnm03 wrote:
> 
>> I'd like to write one or more scripts that analyze processes in memory
>> on Windows 7. I used to do these things in C++ by using native Win32 API
>> calls.
>> How should I proceed in python? Any pointers?
> 
> This seems to be a very common request. Does anyone know why?
> 

I certainly wouldn't have called it common, assuming you're referring to
the specific request of analyzing processes in memory. I admit we do see
on and off the more general request of "How do I do in Python on Windows
this thing I can do in C/C++?".

TJG

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.python

csiph-web