winappdbg:使用kernel32函数

Question

我尝试使用函数GetProcessTimes(hprocess)。

我使用以下代码：

p = debug.excel(argv,bFollow=True)
win32.kernel32.GetProcessTimes(p)

但这行不通..。

此函数采用4个参数(5个给定)

有人能帮忙吗？我忘了什么？

谢谢

Answer 1

我可以建议你自己打电话吗？(取自python 长椅本身)：

# if you have win32 process
import win32process
def getprocesstimes_systimes():
    d = win32process.GetProcessTimes(win32process.GetCurrentProcess())
    return (d['UserTime'] / WIN32_PROCESS_TIMES_TICKS_PER_SECOND,
        d['KernelTime'] / WIN32_PROCESS_TIMES_TICKS_PER_SECOND)

# otherwise, ctypes approach
import ctypes
def getprocesstimes_systimes():
    creationtime = ctypes.c_ulonglong()
    exittime = ctypes.c_ulonglong()
    kerneltime = ctypes.c_ulonglong()
    usertime = ctypes.c_ulonglong()
    rc = ctypes.windll.kernel32.GetProcessTimes(
        ctypes.windll.kernel32.GetCurrentProcess(),
        ctypes.byref(creationtime),
        ctypes.byref(exittime),
        ctypes.byref(kerneltime),
        ctypes.byref(usertime))
    if not rc:
        raise TypeError('GetProcessTimes() returned an error')
    return (usertime.value / WIN32_PROCESS_TIMES_TICKS_PER_SECOND,
            kerneltime.value / WIN32_PROCESS_TIMES_TICKS_PER_SECOND)