title: Python 64bit, Ctypes ReadProcessMemory ERROR_PARTIAL_COPY, Windows 7 64bit
body: <p>My examples are base on the book "Gray Hat Python" (<a href="http://expect-us.net/files/Gray%20Hat%20Python%20=rwt911=.pdf" rel="nofollow">http://expect-us.net/files/Gray%20Hat%20Python%20=rwt911=.pdf</a>)</p>
  
  <p>There is a small example application printf_loop:</p>
  
  <pre><code>from ctypes import *
  import time
  
  msvcrt = cdll.msvcrt
  counter = 0
  
  while True:
      msvcrt.printf("Loop iteration %d!\n" % counter)
      time.sleep(2)
      counter += 1
  </code></pre>
  
  <p>Now I am trying to get the address of printf used in this application. But my ReadProcessMemory call is always returning ERROR_PARTIAL_COPY.</p>
  
  <pre><code>def read_process_memory(self, address, length):
      data = ""
      read_buff = create_string_buffer(length)
      count = c_ulong(0)
      if not kernel32.ReadProcessMemory(self.h_process, address, read_buff, length, byref(count)):
          print "[*] Error Code: 0x%08x" % kernel32.GetLastError()
          print read_buff.raw
          return False
      else:
          data += read_buff.raw
          return data
  </code></pre>
  
  <p>I am getting the address throughout the following function, where dll='msvcrt.dll' and function='printf':</p>
  
  <pre><code> def func_resolve(self, dll, function):
      handle = c_void_p()
      kernel32.GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, dll, byref(handle))
      address = kernel32.GetProcAddress(handle, function)
      kernel32.CloseHandle(handle)
  
      return address
  </code></pre>
  
  <p>Do you have any suggestions why I am not able to read the memory?</p>