ntmemoryapi 1.0.0__tar.gz → 1.2.0__tar.gz

{ntmemoryapi-1.0.0 → ntmemoryapi-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: ntmemoryapi
-Version: 1.0.0
+Version: 1.2.0
 Summary: Simple library for Windows to manipulate process virtual memory with stelthy syscall wraps
 Author: Xenely
 Requires-Python: >=3.10
@@ -9,6 +9,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Requires-Dist: psutil (>=7.1.0,<8.0.0)
 Description-Content-Type: text/markdown
 
 

{ntmemoryapi-1.0.0 → ntmemoryapi-1.2.0}/ntmemoryapi/__init__.py

@@ -7,6 +7,7 @@
 
 import os
 import ctypes
+import psutil
 
 # Local imports
 from .misc import *
@@ -83,35 +84,6 @@ class OBJECT_ATTRIBUTES(ctypes.Structure):
     ]
 
 
-class PROCESSENTRY32(ctypes.Structure):
-    """Process entry structure for processes enumeration."""
-
-    _fields_ = [
-        ("dw_size", ctypes.c_ulong),
-        ("cnt_usage", ctypes.c_ulong),
-        ("th32_process_id", ctypes.c_ulong),
-        ("th32_default_heap_id", ctypes.c_void_p),
-        ("th32_module_id", ctypes.c_ulong),
-        ("cnt_threads", ctypes.c_ulong),
-        ("th32_parent_process_id", ctypes.c_ulong),
-        ("pc_pri_class_base", ctypes.c_long),
-        ("dw_flags", ctypes.c_ulong),
-        ("sz_exe_file", ctypes.c_char * 260)
-    ]
-
-    @property
-    def pid(self) -> int:
-        """Process ID."""
-
-        return self.th32_process_id
-
-    @property
-    def name(self) -> str:
-        """Process name."""
-
-        return self.sz_exe_file.decode()
-
-
 class MODULEENTRY32(ctypes.Structure):
     """Module entry structure, describes an entry from a list of the modules belonging to the specified process."""
 
@@ -254,61 +226,43 @@ _nt_protect_virtual_memory = syscall("NtProtectVirtualMemory", result_type=ctype
 # ==-------------------------------------------------------------------== #
 # Functions                                                               #
 # ==-------------------------------------------------------------------== #
-def list_processes(include_id: bool = True, include_name: bool = True) -> list[dict[str, int | str]]:
+def list_processes(include_id: bool = True, include_name: bool = True, include_username: bool = True, current_username_only: bool = True) -> list[dict[str, int | str]]:
     """List all of the currently active system processes."""
 
     # If `include_id` and `include_name` disabled both
     if not include_id and not include_name:
         raise Exception("Unable to disable ID and name including at once")
 
-    # Process snapshot functions
-    close_handle = ctypes.windll.kernel32.CloseHandle
-    process32_next = ctypes.windll.kernel32.Process32Next
-    process32_first = ctypes.windll.kernel32.Process32First
-    create_tool_help32_snapshot = ctypes.windll.kernel32.CreateToolhelp32Snapshot
-
-    # Create snapshot to iterate processes
-    if (snapshot := create_tool_help32_snapshot(TH32CS_SNAPPROCESS, 0)) == -1:
-        raise Exception("Unable to create snapshot to iterate processes")
+    # Current process username
+    current_username = psutil.Process().username()
 
     # Result list of processes
     processes = list()
 
-    # Process enumeration
-    try:
-
-        # Process entry to iterate processes
-        process_entry = PROCESSENTRY32()
-        process_entry.dw_size = ctypes.sizeof(PROCESSENTRY32)
+    # Process iteration
+    for process in psutil.process_iter():
 
-        # Retrieve first process snapshot
-        if not process32_first(snapshot, ctypes.byref(process_entry)):
-            raise Exception("Unable to get first process to save to snapshot")
+        # If process started not from current username
+        if current_username_only and process.username() != current_username:
+            continue
 
-        # Iterate all of the processes using snapshot
-        while True:
+        # Save process to list
+        process_dict = dict()
 
-            # Save process to list
-            process_dict = dict()
+        # If process ID including required
+        if include_id:
+            process_dict |= {"id": process.pid}
 
-            # If process ID including required
-            if include_id:
-                process_dict |= {"id": process_entry.pid}
+        # If process ID including required
+        if include_name:
+            process_dict |= {"name": process.name()}
 
-            # If process ID including required
-            if include_name:
-                process_dict |= {"name": process_entry.name}
+        # If process username including required
+        if include_username:
+            process_dict |= {"username": process.username()}
 
-            processes.append(process_dict)
-
-            # Snapshot is over
-            if not process32_next(snapshot, ctypes.byref(process_entry)):
-                break
-
-    finally:
-
-        # Close snapshot handle
-        close_handle(snapshot)
+        # Save process information to list
+        processes.append(process_dict)
 
     return processes
 
@@ -323,17 +277,17 @@ class Process:
     # Methods                                                                 #
     # ==-------------------------------------------------------------------== #
 
-    def __init__(self, pid_or_name: int | str, access: int = PROCESS_ALL_ACCESS) -> None:
+    def __init__(self, pid_or_name: int | str, access: int = PROCESS_ALL_ACCESS, current_username_only: bool = True) -> None:
         """Initialize instance to manipulate process."""
 
         # Open process by it's ID or it's name
         match pid_or_name:
 
             case pid if type(pid_or_name) is int:
-                self.handle, self.name, self.pid = self.__init_with_pid(pid, access)
+                self.handle, self.name, self.pid = self.__init_with_pid(pid, access, current_username_only)
 
             case name if type(pid_or_name) is str:
-                self.handle, self.name, self.pid = self.__init_with_name(name, access)
+                self.handle, self.name, self.pid = self.__init_with_name(name, access, current_username_only)
 
             case _:
                 raise Exception("Invalid `pid_or_name` argument value, have to be `int` or `str` type")
@@ -398,7 +352,7 @@ class Process:
 
         return process_modules
 
-    def list_memory_regions(self, allowed_states: list[int] = list(), allowed_protects: list[int] = list(), allowed_types: list[int] = list()) -> list[MEMORY_BASIC_INFORMATION]:
+    def list_memory_regions(self, allowed_states: list[int] = list(), allowed_protects: list[int] = list(), allowed_types: list[int] = list(), memory_regions_filter: typing.Callable[[MEMORY_BASIC_INFORMATION], bool] | None = None) -> list[MEMORY_BASIC_INFORMATION]:
         """List all of the aviable process memory regions."""
 
         # Result list of memory regions
@@ -438,6 +392,9 @@ class Process:
             if allowed_types and memory_basic_information.type not in allowed_types:
                 continue
 
+            if memory_regions_filter and not memory_regions_filter(memory_basic_information):
+                continue
+
             # Save memory region information if filter passed
             memory_regions.append(memory_basic_information)
 
@@ -518,7 +475,7 @@ class Process:
 
         return memory_old_protect.value or 0
 
-    def pattern_scan(self, pattern: str, allowed_states: list[int] = [MEM_COMMIT], allowed_protects: list[int] = [PAGE_READWRITE], allowed_types: list[int] = list(), start_address: int | None = None, end_address: int | None = None, return_first: int | None = None) -> list[int]:
+    def pattern_scan(self, pattern: str, allowed_states: list[int] = [MEM_COMMIT], allowed_protects: list[int] = [PAGE_READWRITE], allowed_types: list[int] = list(), start_address: int | None = None, end_address: int | None = None, return_first: int | None = None, memory_regions_filter: typing.Callable[[MEMORY_BASIC_INFORMATION], bool] | None = None) -> list[int]:
         """Scan process and return address that validates given pattern hex byte mask, use `??` to wildcard byte, for example - "14 00 00 00 DB FF ?? ?? FF FF 00 00"."""
 
         # Validate given pattern
@@ -538,7 +495,7 @@ class Process:
         found_addresses = list()
 
         # iterate memory regions and finding addresses at them
-        for region in self.list_memory_regions(allowed_states, allowed_protects, allowed_types):
+        for region in self.list_memory_regions(allowed_states, allowed_protects, allowed_types, memory_regions_filter):
 
             # If required amount of addresses found
             if return_first is not None and return_first <= 0:
@@ -871,11 +828,11 @@ class Process:
     # ==-------------------------------------------------------------------== #
     # Private methods                                                         #
     # ==-------------------------------------------------------------------== #
-    def __init_with_pid(self, pid: int, access: int, process_name: str | None = None) -> int:
+    def __init_with_pid(self, pid: int, access: int, current_username_only: bool, process_name: str | None = None) -> int:
         """Open process handle by it's ID with desired access."""
 
         # Iterate all of the processes if name not defined
-        for process in list_processes():
+        for process in list_processes(current_username_only):
 
             # If process have a reqired name
             if process["id"] == pid:
@@ -905,14 +862,14 @@ class Process:
 
         return handle.value, process_name, pid
 
-    def __init_with_name(self, name: str, access: int) -> int:
+    def __init_with_name(self, name: str, access: int, current_username_only: bool) -> int:
         """Open process hanle by it's name with desired access."""
 
         # Iterate all of the processes using snapshot
-        for process in list_processes():
+        for process in list_processes(current_username_only):
 
             # If process have a reqired name
             if process["name"].lower() == name.strip().lower():
-                return self.__init_with_pid(process["id"], access, process["name"])
+                return self.__init_with_pid(process["id"], access, current_username_only, process["name"])
 
         raise Exception("Process with `%s` name not found" % name)

{ntmemoryapi-1.0.0 → ntmemoryapi-1.2.0}/pyproject.toml

@@ -1,14 +1,18 @@
 [project]
 name = "ntmemoryapi"
-version = "1.0.0"
+version = "1.2.0"
 description = "Simple library for Windows to manipulate process virtual memory with stelthy syscall wraps"
 authors = [
     {name = "Xenely"}
 ]
 readme = "README.md"
 requires-python = ">=3.10"
-dependencies = []
+dependencies = [
+    "psutil (>=7.1.0,<8.0.0)"
+]
 
 [build-system]
-requires = ["poetry-core>=2.0.0,<3.0.0"]
 build-backend = "poetry.core.masonry.api"
+requires = [
+    "poetry-core>=2.0.0,<3.0.0"
+]