Ctypes- Can't get PEB Address using NtQueryInformationProcess

Question

I am using ctypes and trying to get the PEB address using the NtQueryInformationProcess function.

The return value is 0, meaning that the function was completed successfully. But the PROCESS_BASIC_INFORMATION structure (given as the third argument) doesn't contain the PEB address.

class PROCESS_BASIC_INFORMATION(Structure):
    _fields_ = [
        ("Reserved1", c_void_p),
        ("PebBaseAddress", DWORD),
        ("Reserved2", c_void_p * 2),
        ("UniqueProcessId", DWORD),
        ("Reserved3", c_void_p)]

ntdll = WinDLL('ntdll')
NTSTATUS = LONG
ntdll.argtypes = [HANDLE, DWORD, c_void_p, DWORD, PDWORD]
ntdll.restype = NTSTATUS
processInformation = PROCESS_BASIC_INFORMATION()
processInformationLength = sizeof(PROCESS_BASIC_INFORMATION)
result = ntdll.NtQueryInformationProcess(hProcess, 0, processInformation, processInformationLength, byref(DWORD(0)))

Consider the fact that the return value is 0, what can be the problem?

What does the PEB field contain after the function returns? – Anders Aug 31 '19 at 20:00 — Anders, Aug 31 '19 at 20:00

CristiFati · Accepted Answer · 2019-09-01T08:36:59.913

Listing [Python 3.Docs]: ctypes - A foreign function library for Python.

You defined argtypes and restype for the wrong object (ntdll). You should define them for ntdll.NtQueryInformationProcess. While we are here, it's obvious that you like DWORD. Even if in this case it makes no difference, keep function signatures consistent with the ones from C:
```
ntdll.NtQueryInformationProcess.argtypes = [HANDLE, c_int, c_void_p, ULONG, PULONG]
ntdll.NtQueryInformationProcess.restype = NTSTATUS
```
Failing to define argtypes and restype (or doing it incorrectly) on a function, an may (, and most likely will) lead to:
- [SO]: Python ctypes cdll.LoadLibrary, instantiate an object, execute its method, private variable address truncated (@CristiFati's answer)
- [SO]: python ctypes issue on different OSes (@CristiFati's answer)
According to [MS.Docs]: NtQueryInformationProcess function (emphasis is mine):

ProcessInformation

A pointer to a buffer supplied by the calling application into which the function writes the requested information.

So, your call should look like (pass processInformation by reference):
```
result = ntdll.NtQueryInformationProcess(hProcess, 0, byref(processInformation), processInformationLength, byref(DWORD(0)))
```
According to the same page, your structure definition is incorrect. It should be:
```
class PROCESS_BASIC_INFORMATION(Structure):
    _fields_ = [
        ("Reserved1", c_void_p),
        ("PebBaseAddress", c_void_p),
        ("Reserved2", c_void_p * 2),
        ("UniqueProcessId", c_void_p),
        ("Reserved3", c_void_p),
    ]
```
Your version (on 64bit) is 8 bytes shorter (because of (the 2) size differences between DWORD and pointer), resulting in a too short buffer being passed to the function, which is Undefined Behavior (it can lead to crashes).

Ctypes- Can't get PEB Address using NtQueryInformationProcess

1 Answers1