title: Python :: ctypes :: GetProcAddress() returns error
body: <p>The following is a part of a debugger class. I've got the following code for enumerating processes in debugee. First it enumerates and loads handles of the existing debugee's processes into an array. Then I'm trying to get an address of particular function in particular module. In this case i'm trying to get address of <strong>printf()</strong> out of <strong>msvcr100.dll</strong>
  <pre><code>
  def enumerate_module(self,pid):</p>
  
  <pre><code>    lphModule = (c_void_p * 1024)()
      lpcbNeeded = c_ulong(0)
  
      if psapi.EnumProcessModules(self.h_process,lphModule,sizeof(c_void_p)*1024, byref(lpcbNeeded)):
          print "[*] EnumProcessModules: %d modules detected" % int(lpcbNeeded.value / sizeof(c_void_p))
          for i in range(int(lpcbNeeded.value / sizeof(c_void_p))):
              FileName = ""
              ReadBuffer = create_string_buffer(MAX_PATH)
              psapi.GetModuleFileNameExA(self.h_process,lphModule[i],ReadBuffer,MAX_PATH)
              FileName += ReadBuffer.value
              print "[*] %d - 0x%08x - %s" % (i,lphModule[i],FileName)
          address = kernel32.GetProcAddress(lphModule[3],"printf")
          if address == False:
              error = GetLastError()
              print "[*] GetProcAddress() ERROR: %d - %s" % (error, FormatError(error))    
          print "[**] Getting printf() address is: 0x%008x" % address
          return True
      else:
          error = GetLastError()
          print "[*] GetModuleHandleA: %d - %s" % (error, FormatError(error))
          return False
  </code></pre>
  
  <p></pre></code></p>
  
  <p>For some odd reason I cannot get it to work. GetPorcAddress() returns:
  <pre>
  <strong>ERROR: 126 - The specified module could not be found.</strong></p>
  
  <p>Any ideas???</p>
  
  <p>PS.
  This might clarify my question a little:
  Script output</p>
  
  
  Enter the PID of the process to attach to: 2476
  Opening process: 2476
  [*] DebugActiveProcess: 0 - The operation completed successfully.
  [*] EnumProcessModules: 4 modules detected
  [*] 0 - 0x00400000 - printf.exe
  [*] 1 - 0x7c900000 - ntdll.dll
  [*] 2 - 0x7c800000 - kernel32.dll
  [*] 3 - 0x78aa0000 - MSVCR100.dll
  [*] GetProcAddress() ERROR: 126 - The specified module could not be found.
  [**] Getting printf() address is: 0x00000000
  [*] Finished debugging. Exitng...
  </pre>
  
  <p>As you can see msvcr100.dll is loaded at <strong>0x78aa0000</strong>. As far as I understand 
  it should have printf() within its address spaces, where I should be able to 
  get its address. Moreover, I loaded up printf.exe in OllyDbg and it showed the same
  thing that you see on my script's output, and I was able to see printf() in 
  msvcr100.dll's exports list.</p>