Readprocessmemory error 299

I am seeing the same issue … I was trying to access the ListView

I have also tried to use the pywinauto lib to access the component directly and below is the trace:

WindowsError Traceback (most recent call last)
in ()
—-> 1 h.ListView.GetItem(‘SEM’).Check()

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautocontrolscommon_controls.pyc in GetItem(self, item_index, subitem_index)
757 «»»
758
—> 759 return _listview_item(self, item_index, subitem_index)
760
761 Item = GetItem # this is an alias to be consistent with other content elements

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautocontrolscommon_controls.pyc in init(self, lv_ctrl, item_index, subitem_
ndex)
67 # ensure the item_index is an integer or
68 # convert it to one
—> 69 self.item_index = self.listview_ctrl._as_item_index(item_index)
70 self.subitem_index = subitem_index
71 #self.as_parameter = self.item_index

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautocontrolscommon_controls.pyc in _as_item_index(self, item)
743 index = item
744 if isinstance(item, six.string_types):
—> 745 index = int((self.Texts().index(item) — 1) / self.ColumnCount())
746
747 return index

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautocontrolscommon_controls.pyc in Texts(self)
787 «Get the texts for the ListView control»
788 texts = [self.WindowText()]
—> 789 texts.extend([item[‘text’] for item in self.Items()])
790 return texts
791

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautocontrolscommon_controls.pyc in getitem(self, key)
155 ‘Use methods Text(), State(), Image() and Indent().’, DeprecationWarning)
156
—> 157 item, text = self._readitem()
158 if key == ‘text’:
159 return text

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautocontrolscommon_controls.pyc in _readitem(self)
135 # Read the remote text string
136 char_data = self.listview_ctrl.create_buffer(2000)
—> 137 remote_mem.Read(char_data, item.pszText)
138
139 text = self.listview_ctrl.text_decode(char_data.value)

c:python27libsite-packagespywinauto-0.5.4-py2.7.eggpywinautoRemoteMemoryBlock.py in Read(self, data, address, size)
253
254 ActionLogger().log(‘lpNumberOfBytesRead =’ + str(lpNumberOfBytesRead) + ‘ nSize =’ + str(nSize))
—> 255 raise ctypes.WinError()
256 else:
257 ActionLogger().log(‘Warning! Read OK: 2nd attempt!’)

WindowsError: [Error 299] Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

ReadProcessMemory… code error 299
, Помогите справиться с кодом 299

B.V.	Сообщ. #9 , 28.08.08, 07:03

0 пользователей читают эту тему (0 гостей и 0 скрытых пользователей)

0 пользователей:

1. 02-07-2008

   
   

   #1

   

   
   Registered User
   

   ---

   ReadProcessMemory Error
   

   Hey, I am trying to use the ReadProcessMemory function but every time I call it I get the error code 299 from the function GetLastError() that means: «Only part of a ReadProcessMemory or WriteProcessMemory request was completed.».

   OS: Windows Vista.
   Code from the «reader»:

   Code:

   handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, getPid());
   
   SIZE_T bytesRead;
   std::string buffer(8, '');
   unsigned long address = 0x001cf834;
   
   if (ReadProcessMemory(handle, &address, &buffer[0], 8, &bytesRead))
   {
   	return true;
   }
   else
   {
   	cout << GetLastError() << 'n';
   	return false;
   }

   Remark: the process ID is correct, I assure you .

   Code from the «readed»:

   Code:

   #include <iostream>
   #include <fstream>
   
   using namespace std;
   
   int main()
   {
   	char t[] = "my pattern" ;
   
   	cout << "addr: " << &t << 'n';
   
   	cin.get();
   }

   1) The address chosen to be the parameter of ReadProcessMemory is the address printed in the readed program, is that right?

   2) By the way, always when i restart the readed program the address of char t changes, why? If I am allocating it statically shouldn’t it have always the same address?

   3) How can i search a program’s memory like a debugger? I have tought of scanning its memory trough ReadProcessMemory respecting the maximum and minimum base addresses provided by the function GetSystemInfo(), is it the correct way of doing that?

   4) If the last question is true, how much should be the buffer size of the ReadProcessMemory because I imagine that a call to this function should take a lot of time so implementing a buffer would help?

   Thank You

   ---

2. 02-08-2008

   
   

   #2

   

   
   Kernel hacker
   

   ---

   The error 299 is ERROR_PARTIAL_COPY — so for some reason, the OS thinks it’s fine to read parts of the memory, but not all.

   How many bytes does it report that you got?

   —
   Mats

   Compilers can produce warnings — make the compiler programmers happy: Use them!
   Please don’t PM me for help — and no, I don’t do help over instant messengers.

   ---

3. 02-08-2008

   
   

   #3

   

   
   Registered User
   

   ---

   Hey, I am trying to use the ReadProcessMemory function but every time I call it I get the error code 299 from the function GetLastError() that means: «Only part of a ReadProcessMemory or WriteProcessMemory request was completed.».

   It may be due to your not elevating the token privilege level since you’re reading memory on the system level. But even if your are elevating the privilege level, you may not be doing it correctly. The reason being is that I noticed you were not elevating the privilege level correctly in one of your other posts. You were calling it after opening the process. It must be called prior to opening the process. Also, the 0x001cf834 address is incorrect. I put some info in the sample to explain the address.

   But anyway, the following example displays the command line parms (if any) of the process in question.

   Code:

   #define UNICODE
   #define _UNICODE
   
   #include <windows.h>
   #include <stdio.h>
   #include <tchar.h>
   
   #pragma comment(lib, "advapi32.lib")
   
   // Process data block is found in an NT machine.
   // on an Intel system at 0x00020000  which is the 32
   // memory page. At offset 0x0498 is what I believe to be
   // the process' startup directory which is followed by
   // the system's PATH. Next is  process full command
   // followed by the exe name.
   #define PROCESS_DATA_BLOCK_ADDRESS      (LPVOID)0x00020498
   // align pointer
   #define ALIGNMENT(x) ( (x & 0xFFFFFFFC) ? (x & 0xFFFFFFFC) + sizeof(DWORD) : x )
   
   BOOL GetCommandLine (HANDLE hProcess, LPWSTR lpszCmdLine)
   {
   	LPBYTE lpBuffer = NULL;
   	LPBYTE lpPosition = NULL; 
   	DWORD dwBytesRead;
   	MEMORY_BASIC_INFORMATION mbi;
   	SYSTEM_INFO sysinfo;
   
   	GetSystemInfo (&sysinfo);
   	lpBuffer = (LPBYTE)malloc (sysinfo.dwPageSize);
   	if ( lpBuffer == NULL )
   		return FALSE;
   	if ( VirtualQueryEx (hProcess, PROCESS_DATA_BLOCK_ADDRESS, &mbi, sizeof(mbi) ) == 0)
   		return FALSE;
   	if (!ReadProcessMemory ( hProcess, mbi.BaseAddress, (LPVOID)lpBuffer, 
   		sysinfo.dwPageSize, &dwBytesRead))
   		return FALSE;
   	lpPosition = lpBuffer + ((DWORD)PROCESS_DATA_BLOCK_ADDRESS - (DWORD)mbi.BaseAddress);
   	lpPosition = lpPosition + (wcslen ((LPWSTR)lpPosition) + 1) * sizeof(WCHAR);
   	lpPosition = (LPBYTE)ALIGNMENT((DWORD)lpPosition);
   	lpPosition = lpPosition + (wcslen ((LPWSTR)lpPosition) + 1) * sizeof(WCHAR);
   	if ( *lpPosition == '' ) lpPosition += sizeof(WCHAR);
   	wcsncpy  ( lpszCmdLine, (LPWSTR)lpPosition, MAX_PATH );
   	lpszCmdLine[MAX_PATH-1] = L'';
   	if (lpBuffer != NULL) free(lpBuffer);
   	return TRUE;
   }
   
   BOOL EnableTokenPrivilege (LPTSTR privilege)
   {
   	HANDLE hToken;                        
   	TOKEN_PRIVILEGES token_privileges;                  
   	DWORD dwSize;                        
   	ZeroMemory (&token_privileges, sizeof (token_privileges));
   	token_privileges.PrivilegeCount = 1;
   	if ( !OpenProcessToken (GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
   		return FALSE;
   	if (!LookupPrivilegeValue ( NULL, privilege, &token_privileges.Privileges[0].Luid))
   	{ 
   		CloseHandle (hToken);
   		return FALSE;
   	}
   
   	token_privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
   	if (!AdjustTokenPrivileges ( hToken, FALSE, &token_privileges, 0, NULL, &dwSize))
   	{ 
   		CloseHandle (hToken);
   		return FALSE;
   	}
   	CloseHandle (hToken);
   	return TRUE;
   }
   
   int wmain (int argc, wchar_t *argv[])
   {
   	WCHAR      CommandLine[MAX_PATH] = {0};
   	WCHAR      *endptr;
   	DWORD      pID; 
   	HANDLE      hProcess = NULL;
   	if ( argc != 2 )
   		return 0;
   	pID = wcstoul ( argv[1], &endptr, 10 );
   
   	if ( !EnableTokenPrivilege (SE_DEBUG_NAME) )
   	{
   		printf ( "Cannot get required privilege %lun", GetLastError () );
   		return 0;
   	}
   	hProcess = OpenProcess (PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_QUERY_INFORMATION,
   		FALSE, pID);
   	if ( hProcess == NULL )
   	{
   		printf ("Cannot open process. pID: %lu, error %lun", pID, GetLastError ());
   		return 0;
   	}
   	if ( !GetCommandLine ( hProcess, CommandLine ) )
   	{
   		printf ("Cannot get process command line, error: %lun", GetLastError ());
   		return 0;
   	}
   	else
   		printf ("The command line is %Sn", CommandLine);
   	CloseHandle ( hProcess );
   	return 0;
   }

   ---

4. 02-10-2008

   
   

   #4

   

   
   Registered User
   

   ---

   @ matsp

   It says that i have read 0 bytes…

   @ BobS0327

   Even your example doesn’t work… The functions all return ok with no error messages but the CommandLine is empty….

   And im sorry to say, i haven’t understood well addressing, what I do to get and address now is do debug my application, search it for the bytes that form «my pattern» string and get its address… It is correct isn’t it?

   I have adapted your code of enabling debug privilege into mine but i still get incomplete reads.

   ---

5. 02-10-2008

   
   

   #5

   

   
   Registered User
   

   ---

   What I believe may be the problem is that you’re running the code under Vista. I’ve tested the sample under XP and Win2K without any problems.

   Unfortunately, I won’t have access to Vista until Monday morning to test the sample.

   ---

6. 02-10-2008

   
   

   #6

   

   
   Registered User
   

   ---

   Ok, i will try to find something until then, but im really lost =(

   ---

7. 02-12-2008

   
   

   #7

   

   
   Registered User
   

   ---

   I’ve encountered the same problem as you with Vista Enterprise edition.

   Vista has new security enhancements to thwart the malware folks. One feature is Address Space Load Randomization which randomly loads a process into memory. Under Vista, you have a 1 in 256 chance of finding the base address of a process. Whereas, under XP and W2K you knew exactly where in memory a process started as indicated above.

   This link will provide a more detailed explanation of Vista Address Space Load Randomization.

   BTW, you can create a hack to make the code work. You’ll need Ollydebug to get the base address of the process. then recompile the code with the acquired base address. But every time you reboot, you’ll have to execute Ollydebug for the new base address and recompile the code again with the new address.

   ---

8. 05-27-2008

   
   

   #8

   

   
   Registered User
   

   ---

   Hate to resurrect a zombie, but…
   

   this board is high enough on the search engine rankings that I think having an answer to this question would be useful. A lot of queries into the cause of this problem have been made, including Address Randomization (which only applies to system processes) and Vista’s security (which doesn’t apply if running as an administrator and not accessing a protected process). The real problem here is that people have not read the documentation for OpenProcess since Vista came out. OpenProcess is being called with PROCESS_ALL_ACCESS rights requested. On Vista, the size of PROCESS_ALL_ACCESS has changed, and is now 0x1fffff instead of 0x1f0fff, and unless you are using an updated definition for Vista and Server 2008, using PROCESS_ALL_ACCESS will request the incorrect rights, and you won’t get the results you want. If you redefine PROCESS_ALL_ACCESS or use 0x1fffff in the call to OpenProcess instead of 0x1f0fff, your code will now work.

   ---

9. 05-28-2008

   
   

   #9

   

   
   C++まいる！Cをこわせ！
   

   ---

   It’s just that many people here are mostly unfamiliar with Vista, it seems.

   Originally Posted by Adak
   

   io.h certainly IS included in some modern compilers. It is no longer part of the standard for C, but it is nevertheless, included in the very latest Pelles C versions.

   Originally Posted by Salem
   

   You mean it’s included as a crutch to help ancient programmers limp along without them having to relearn too much.

   Outside of your DOS world, your header file is meaningless.

   ---

10. 05-28-2008

    
    

    #10

    

    
    Registered User
    

    ---

    If

    you redefine PROCESS_ALL_ACCESS or use 0x1fffff in the call to OpenProcess instead of 0x1f0fff, your code will now work.

    The suggestion didn’t work for me on Vista Enterprise. Out of curiosity, I tried it on XP Pro and it does work.

    ---

11. 05-28-2008

    
    

    #11

    

    
    Registered User
    

    ---

    Worked for me on Vista Ultimate, but…
    

    according to the MSN docs, using PROCESS_ALL_ACCESS isn’t recommended procedure on Vista anyway (you should request only those rights you specifically need to do what you’re going to do, piped together of course), which would allow you to accomplish much the same task, although slightly more verbose, definitely works. I got the information from
    http://msdn.microsoft.com/en-us/libr…80(VS.85).aspx
    in case anyone cares to read up on it more, but remember, you still can’t gain certain rights when trying to use OpenProcess on protected processes anyway. Regardless, I just wanted to share what worked for me, as the issue had been bugging me and I could not find the answer in any easily searchable location, so I hope this helps somebody at least.

    ---

299 (0x12B)

Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

#include <windows.h>
#include <TlHelp32.h>
#include <iostream>
#include <string>
#include <time.h>
#include <tchar.h>using namespace std;

DWORD dwGetModuleBaseAddress(DWORD dwProcessIdentifier, TCHAR *lpszModuleName);
string readName(HANDLE handlez, DWORD base, DWORD bp, DWORD ofset1, DWORD ofset2, DWORD ofsetInc);int main()
{
DWORD baseOfset = 0x60DE90;
DWORD ofset1 = 0x4c4;
DWORD ofset2 = 0x6a0;
DWORD ofset3 = 0x18;HWND window = NULL;//FindWindow(0, _TEXT("Gothic II - 2.6 (pol)"));
DWORD pID = 0;
DWORD dwBP = NULL;
HANDLE handle = NULL;// OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
string gameStatus;
int refresher = clock();
gameStatus = "Waiting for game";window = FindWindow(0, _TEXT("Gothic II - 2.6 (pol)")); // window title
if (window)
{
GetWindowThreadProcessId(window, &pID);
if (pID != 0)
{
handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
dwBP = dwGetModuleBaseAddress(pID, _T("Gothic2.exe"));  // proc name

if (handle == INVALID_HANDLE_VALUE || handle == NULL || dwBP == NULL)
{
gameStatus = "No handle";
}
else
{
gameStatus = "OK";
}
}
else
{
gameStatus = "No access";
}
}
else
{
gameStatus = "No window";

}while (!GetAsyncKeyState(VK_DELETE))
{
if (clock() - refresher > 1000)
{
refresher = clock();cout << gameStatus << endl;
string elo="a";elo = readName(handle,  dwBP, baseOfset, ofset1, ofset2, ofset3);
if (elo == "a")
{
cout << ":(n";
}

cout << "Name: " <<  elo <<".n";

cout << "Name: " << &elo << ".n" << endl;
system("pause");

}
}CloseHandle(handle);
}

string readName(HANDLE handlez, DWORD base, DWORD bp, DWORD ofset1, DWORD ofset2, DWORD ofsetInc)
{

DWORD adresik;

ReadProcessMemory(handlez, (LPCVOID)(base + bp), &adresik, sizeof(DWORD), NULL); // base adress + base pointer
adresik += ofset1;          //1st lvl pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += ofset2;          // 2nd lvl pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += ofsetInc;            // 3rd lvl pointer this goes up +=20
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += 0x12c;                   // 4th static pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += 0x0;                     // 5th static pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);string papa;

ReadProcessMemory(handlez, (LPCVOID)adresik, &papa, sizeof(string), NULL); // get name
DWORD ero = GetLastError();
cout << ero << endl;
return papa;  // return name}DWORD dwGetModuleBaseAddress(DWORD dwProcessIdentifier, TCHAR *lpszModuleName)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessIdentifier);
DWORD dwModuleBaseAddress = 0;
if (hSnapshot != INVALID_HANDLE_VALUE)
{
MODULEENTRY32 ModuleEntry32 = { 0 };
ModuleEntry32.dwSize = sizeof(MODULEENTRY32);
if (Module32First(hSnapshot, &ModuleEntry32))
{
do
{
if (_tcscmp(ModuleEntry32.szModule, lpszModuleName) == 0)
{
dwModuleBaseAddress = (DWORD)ModuleEntry32.modBaseAddr;
break;
}
} while (Module32Next(hSnapshot, &ModuleEntry32));
}
CloseHandle(hSnapshot);
}
return dwModuleBaseAddress;
}

Решение

const int MAX_SIZE = 512;
const char buffer[MAX_SIZE];
string papa;

ReadProcessMemory(handlez, (LPCVOID)adresik, buffer, MAX_SIZE, NULL); // get name

papa = buffer;

Другие решения

    DWORD adresik;

ReadProcessMemory(handlez, (LPCVOID)(base + bp), &adresik, sizeof(DWORD), NULL); // base adress + base pointer
adresik += ofset1;          //1st lvl pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += ofset2;          // 2nd lvl pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += ofsetInc;            // 3rd lvl pointer this goes up +=20
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += 0x12c;                   // 4th static pointer
ReadProcessMemory(handlez, (LPCVOID)adresik, &adresik, sizeof(DWORD), NULL);
adresik += 0x0;                     // 5th static pointerstring papa;
const int max_size = 15;
const char buffer[max_size] = { 'b' };ReadProcessMemory(handlez, (LPCVOID)adresik, (void*)&buffer, sizeof(buffer), NULL); // get name

papa = buffer;

DWORD ero = GetLastError();
cout << ero << endl;
return papa;  // return name}