Closed rishubil closed 3 years ago
Yeah, looking at the code it points towards:
for process in processes:
if name in process.szExeFile.decode('utf-8').lower():
return process
The ProcessEntry32 structure reference szExeFile
as a c_char:
class ProcessEntry32(ctypes.Structure):
"""Describes an entry from a list of the processes residing in the system address space when a snapshot was taken.
https://msdn.microsoft.com/en-us/library/windows/desktop/ms684839(v=vs.85).aspx
"""
_fields_ = [
( 'dwSize' , ctypes.c_ulong ) ,
( 'cntUsage' , ctypes.c_ulong) ,
( 'th32ProcessID' , ctypes.c_ulong) ,
( 'th32DefaultHeapID' , ctypes.POINTER(ctypes.c_ulong) ) ,
( 'th32ModuleID' , ctypes.c_ulong) ,
( 'cntThreads' , ctypes.c_ulong) ,
( 'th32ParentProcessID' , ctypes.c_ulong) ,
( 'pcPriClassBase' , ctypes.c_ulong) ,
( 'dwFlags' , ctypes.c_ulong) ,
( 'szExeFile' , ctypes.c_char * ctypes.wintypes.MAX_PATH )
]
From as far as I can remember the ProcessEntry32 will return the szExeFile
as bytes when the given string to compare against is of type str
, so in order to compare them we have to decode the szExeFile
to compare strings against strings.
It depends on the version of Python you are using then, is it Python3 ? I'm testing pymem only against:
I am using Python 3.7 as defined in the project's Pipfile. The user who reported the error used an x64 binary created with pyinstaller.
Since most users use the same x64 binaries but the same problem has never been reported, I think this is an issue that only occurs in certain environments.
The user who reported this issue said that the problem was with a "public" computer, not his or her own computer, and did not accurately describe the environment in which the problem occurred.
So, unfortunately, I don't currently have detailed information about the environment in which the problem occurred.
I can only guess that bytes of szExeFile
can use encodings other than utf-8 in certain environments.
Maybe we'll have to wait for the same error again to get more information.
Alright, let s wait for more context. I ll let this open so google can eventually index this more easily and point other users to it.
closing because it s outdated by now.
I'm using this library in my project called TrickyTowersUtils. Just before, some user of my project reported the following error message:
Perhaps an error occurred while decoding the user's process name.