Search code examples
pythonc++functionraw-pointer

Python ctype directly call a function with raw offset

Is it possible to call a RAW function pointer inside python?

for example: 

ctypes.windll.kernel32.GetModuleHandleA(None)

will call the API, Python resolves the DLL + Function pointer to make it work. but if I have a raw function pointer, for example 0xDEADBEEF (which corresponds to the function header) how do I create a funciton instance passing this raw pointer?

I can't just export the function since its located on a compiled executable, but I want to be able to do something like this:

To make it clear... in C++ I can call RAW function with something like this:

#define myfunction ((void(*)(int a, int b, int c)) 0x00402383)

myfunction(1, 2, 3);

I python I wanted to make something similar, maybe using ctypes library? I've digged inside the library but I couldn't find how they initialize the function instance.

Notes:

  • The python engine is embedded inside a DLL.
  • The DLL is injected into the process I want to call the function address.
Solution

  • If the function is located in a compiled executable, then you can't, neither in C++ because you'll get an access violation. You can't call functions from another process.

    If you have C++ knowledge then create a DLL and inject it into the executable. You'll be able to call it.

    Since you've already injected your DLL into the target process, it seems to be possible to achieve what you want using ctypes.

    >>> functype = ctypes.CFUNCTYPE(ctypes.c_int, ctypes.c_int, ctypes.c_int)
>>> func = functype(raw_address)
>>> func
<CFunctionType object at 0x1006816d0>