Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Process.memory_maps() does not return addresses above 32 bits on 64 bit builds #863

Closed
jhumble opened this issue Jul 21, 2016 · 6 comments
Closed

Comments

@jhumble
Copy link

jhumble commented Jul 21, 2016

Using the distributed x64 version of psutil and running against a 64 bit process with memory regions higher than 0xffffffff, all bits higher than 32 are truncated.

Example:
Running a 64 bit process under x64dbg, I have msctf.dll mapped in at 0x000007FEFF020000.

If I get the memory map for this process using memory_map, the entry corresponding to msctf.dll is shown with base address 0xFF020000, cutting off the highest 32 bits of the address.

@giampaolo
Copy link
Owner

What platform are we talking about? Windows?

@jhumble
Copy link
Author

jhumble commented Jul 21, 2016

Sorry about that, don't know how I left that off. Yes, Windows. I'm submitting a pull request now which has fixed the issue for me.

@giampaolo
Copy link
Owner

Fine, looking forward to it.

@jhumble
Copy link
Author

jhumble commented Jul 21, 2016

Here's the pull request: #864

@giampaolo
Copy link
Owner

Cool. I added comments to it.

@jhumble
Copy link
Author

jhumble commented Jul 21, 2016

Closed out #864 since I messed it all up and managed to base it off some branch other than master.

This new one should be much cleaner: #865

@jhumble jhumble closed this as completed Jul 28, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants