ctypes WriteProcessMemory() fails, help!

Question

I have been trying to get this function working for some time now with no luck.

def write_memory(self, address, data):
    PROCESS_ALL_ACCESS = 0x001F0FFF
    count = c_ulong(0)
    length = len(data)
    c_data = c_char_p(data[count.value:])
    null = c_int(0)
    windll.kernel32.SetLastError(10000)
    if not windll.kernel32.WriteProcessMemory(self.h_process, address, c_data, length, byref(count)):
        print "Failed to write memory."
        print  "Error Code: ", windll.kernel32.GetLastError()
    else:
        return True

GetLastError() returns 87 (0x57), which is ERROR_INVALID_PARAMETER. For this function I copied it straight from Gray Hat Python by Justin Seitz. Not sure what I'm doing wrong, ReadProcessMemory() works great and returns the appropriate value.

For address I'm picking a random location at the moment, 0x00050000, and passing data like "\x61" reading the location before and after with no change.

I have the feeling It's a simple error, Thanks in advance for the help. Nav.

Answer 1

There's nothing obviously wrong with the call. Most likely there just aren't any pages at 0x00050000 or the pages there aren't writable.

Why don't you try doing a VirtualQuery on the bytes you are trying to write to and see if it's actually writable? Most random addresses aren't.

Answer 2

While you were right It's a privilege thing. I still can't seem to figure out what I'm looking for. Here's my launch process code:

class SECURITY_ATTRIBUTES(Structure):
    _fields_ = [("Length", DWORD),
                ("SecDescriptor", LPVOID),
                ("InheritHandle", BOOL)]

def launch(self, path_to_exe):
    CREATE_NEW_CONSOLE = 0x0000010

    startupinfo = STARTUPINFO()
    process_information = PROCESS_INFORMATION()
    security_attributes = SECURITY_ATTRIBUTES()

    startupinfo.dwFlags = 0x1
    startupinfo.wShowWindow = 0x0


    startupinfo.cb = sizeof(startupinfo)
    security_attributes.Length = sizeof(security_attributes)
    security_attributes.SecDescriptior = None
    security_attributes.InheritHandle = True



    if windll.kernel32.CreateProcessA(path_to_exe,
                               None,
                               byref(security_attributes),
                               byref(security_attributes),
                               True,
                               CREATE_NEW_CONSOLE,
                               None,
                               None,
                               byref(startupinfo),
                               byref(process_information)):

        self.pid = process_information.dwProcessId
    else:
        print "Couldnt launch: %d" %path_to_exe
        print windll.kernel32.GetLastError()

Do I need to create the process a different way? What should I be putting in the SecDescriptor struct? MSDN isn't very helpful going on about DACL's and ACE's? Thanks for all the help so far.

PS - Just an idea, how does a debugger or some other program not spawn a process and is able to alter memory?