admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated some doc and samples

Browse Source
This commit is contained in:
hakril
2020-07-16 23:26:59 +02:00
parent e2ff50e6a2
commit 01a59a92c4
13 changed files with 3095 additions and 854 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/generate_samples.py
+2
View File
@@ -93,6 +93,8 @@ generate_output_result(r"service\service_demo.py", "service_service_demo.txt")
generate_output_result(r"device_manager\device_manager.py", "device_manager_device_manager.txt")
generate_output_result(r"etw\etw_enumeration.py", "etw_etw_enumeration.txt")
generate_output_result(r"etw\uac_trace.py", "etw_uac_trace.txt")
# Require ADMIN / NotAdmin run
# generate_output_result(r"security\query_sacl.py", "security_query_sacl.txt")
docs/source/etw.rst
+48
View File
@@ -0,0 +1,48 @@
ETW -- Event Tracing for Windows
================================
.. module:: windows.winobject.event_trace
The :class:`EtwManager` instance is accessible via :py:attr:`windows.system.etw
<windows.winobject.system.System.etw>`
.. note::
This code is the result of my research on ``ETW`` that lead to this presentation `ETW for the lazy reverser (FR) <https://www.rump.beer/2019/slides/etw_lazy_reverser.pdf>`_
.. note::
See sample :ref:`sample_etw`
EtwManager
""""""""""
.. autoclass:: EtwManager
:members:
Tracing Events
""""""""""""""
EtwTrace
''''''''
.. autoclass:: EtwTrace
:members:
EventTraceProperties
''''''''''''''''''''
.. autoclass:: EventTraceProperties
:members:
EventRecord
'''''''''''
.. autoclass:: EventRecord
:members:
docs/source/evtlog.rst
+3
View File
@@ -10,6 +10,9 @@ I have tried to offer some abstraction without completly hidding the some underl
The current API may need some works to provide simpler/highter level API in the future.
The :class:`EvtlogManager` instance is accessible via :py:attr:`windows.system.event_log
<windows.winobject.system.System.event_log>`
For now, the best thing to do is look at the sample:
.. note::
docs/source/index.rst
+8 -4
View File
@@ -34,15 +34,19 @@ You can install PythonForWindows using the ``setup.py`` at the root of the proje
python setup.py install
In its current state the project only support Python2 and
``setup.py`` will raise an :class:`NotImplementedError` if launched from python3.
.. warning::
PythonForWindows is not available on Pypi for now and thus cannot be directly installed using ``pip``.
Python3
^^^^^^^
python3 support is still in beta.
All the tests pass on master, but I did not test it heavily on real case.
Do not hesitate report bugs and issues.
Documentation
"""""""""""""
docs/source/sample.rst
+24
View File
@@ -669,3 +669,27 @@ Query SACL
Output
.. literalinclude:: samples_output\security_query_sacl.txt
.. _sample_etw:
ETW (Event Tracing for Windows)
"""""""""""""""""""""""""""""""
Trace processing
''''''''''''''''
.. literalinclude:: ..\..\samples\etw\uac_trace.py
Output
.. literalinclude:: samples_output\etw_uac_trace.txt
Enumeration
'''''''''''
.. literalinclude:: ..\..\samples\etw\etw_enumeration.py
Output
.. literalinclude:: samples_output\etw_etw_enumeration.txt
docs/source/samples_output/etw_etw_enumeration.txt
+28
View File
@@ -0,0 +1,28 @@
(cmd) python etw\etw_enumeration.py
ETW Manager is: <windows.winobject.event_trace.EtwManager object at 0x03AFBF70>
Listing some ETW sessions:
* <EventTraceProperties name="AppModel" guid=A922A8BE-2450-438E-9520-FBCDFB46B0BD>
* name: AppModel
* guid: A922A8BE-2450-438E-9520-FBCDFB46B0BD
* id: 4
* logfile:
* <EventTraceProperties name="LwtNetLog" guid=603BA31E-EC5A-4CDE-BE87-ED0A16C3B170>
* name: LwtNetLog
* guid: 603BA31E-EC5A-4CDE-BE87-ED0A16C3B170
* id: 14
* logfile: C:\WINDOWS\System32\LogFiles\WMI\LwtNetLog.etl
Looking for providers for: <EventTraceProperties name="LwtNetLog" guid=603BA31E-EC5A-4CDE-BE87-ED0A16C3B170>
Found a provider/session for target:
* Provider: <TraceProvider for "43D1A55C-76D6-4F7E-995C-64C711E5CAFE">
* Instance: <TraceProviderInstanceInfo Pid=5256 EnableCount=1>
* Process: <WinProcess "RuntimeBroker.exe" pid 5256 at 0x54c39d0>
Found a provider/session for target:
* Provider: <TraceProvider for "43D1A55C-76D6-4F7E-995C-64C711E5CAFE">
* Instance: <TraceProviderInstanceInfo Pid=10768 EnableCount=1>
* Process: <WinProcess "chrome.exe" pid 10768 at 0x54c3930>
Found a provider/session for target:
* Provider: <TraceProvider for "43D1A55C-76D6-4F7E-995C-64C711E5CAFE">
* Instance: <TraceProviderInstanceInfo Pid=10236 EnableCount=1>
* Process: <WinProcess "YourPhone.exe" pid 10236 at 0x54c37d0>
docs/source/samples_output/etw_uac_trace.txt
+53
View File
@@ -0,0 +1,53 @@
(cmd) python etw\uac_trace.py
Recording UAC event in file <uac.trace> using session named <MY_UAC_MONITOR>
0x1d65bb1febaceea: <EventRecord provider="68FDD900-4A3E-11D1-84F4-0000F80464E3" id=0>
guid: 68FDD900-4A3E-11D1-84F4-0000F80464E3
id: 0
opcode: 0
level: 0
data: '\x01\n\x01\x05\xbbG\x04-D\xd5\xff\xb1[\xd6\x01Zb\x02\t\x01\x04\xf0\x0c\t\x06\xc4\xff\xff\xff@tzres.dll,-302\n\x05\x03@tzres.dll,-301\x03\x05\x02\xc4\xff\xff\xff\xc0\x92\x1c\xd2D[\xd6\x01\x80\x96\x98\xea\xce\xba\xfe\xb1[\xd6\x01\x01MY_UAC_MONITORC:\\Users\\hakril\\Documents\\projets\\PythonForWindows\\samples\\uac.trace'
[...]
0x1d65bb1fec4c011: <EventRecord provider="DEB74A23-5444-3F3B-924B-0E653973F55A" id=11>
guid: DEB74A23-5444-3F3B-924B-0E653973F55A
id: 11
opcode: 0
level: 0
data: '\x9e\x06\x04\x19\x14\x04\x08\x04\xff\xff\xff\xffWinSta0\\DefaultC:\\Windows\\System32\\mmc.exe"C:\\Windows\\System32\\mmc.exe" BAD_MMC_FILENAMEC:\\Users\\hakril\\Documents\\projets\\PythonForWindows\\samples'
0x1d65bb1fec4e48b: <EventRecord provider="C0B508D3-5459-339F-A213-889C238CA5B1" id=10>
guid: C0B508D3-5459-339F-A213-889C238CA5B1
id: 10
opcode: 0
level: 0
data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe"C:\\WINDOWS\\SysWOW64\\mmc.exe" BAD_MMC_FILENAME` '
0x1d65bb1fec7c8eb: <EventRecord provider="C0B508D3-5459-339F-A213-889C238CA5B1" id=13>
guid: C0B508D3-5459-339F-A213-889C238CA5B1
id: 13
opcode: 0
level: 0
data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe'
0x1d65bb1fec7c8f0: <EventRecord provider="C0B508D3-5459-339F-A213-889C238CA5B1" id=14>
guid: C0B508D3-5459-339F-A213-889C238CA5B1
id: 14
opcode: 0
level: 0
data: '"C:\\WINDOWS\\SysWOW64\\mmc.exe" BAD_MMC_FILENAME'
[...]
0x1d65bb1feca018d: <EventRecord provider="172FF31C-2D80-31A6-FCA8-EB000D380666" id=11>
guid: 172FF31C-2D80-31A6-FCA8-EB000D380666
id: 11
opcode: 0
level: 0
data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe'
0x1d65bb1feca030d: <EventRecord provider="172FF31C-2D80-31A6-FCA8-EB000D380666" id=25>
guid: 172FF31C-2D80-31A6-FCA8-EB000D380666
id: 25
opcode: 0
level: 0
data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe\x08\x02TRUEFALSE\x10'
0x1d65bb1fecfcdc0: <EventRecord provider="172FF31C-2D80-31A6-FCA8-EB000D380666" id=27>
guid: 172FF31C-2D80-31A6-FCA8-EB000D380666
id: 27
opcode: 0
level: 0
data: '\x05TRUETRUE'
[...]
docs/source/windef_generated.rst
+982 -655
View File
File diff suppressed because it is too large Load Diff
docs/source/winerror_generated.rst
+1 -1
View File
@@ -1,7 +1,7 @@
.. currentmodule:: windows.generated_def
WinError
------
--------
.. autodata:: FACILITY_NULL
.. autodata:: FACILITY_RPC
.. autodata:: FACILITY_DISPATCH
docs/source/winobject.rst
+2 -1
View File
@@ -22,4 +22,5 @@ This sections describes them by group of relation.
object_manager.rst
device_manager.rst
task_scheduler.rst
evtlog.rst
evtlog.rst
etw.rst
docs/source/winstructs_generated.rst
+1872 -193
View File
File diff suppressed because it is too large Load Diff
samples/etw/etw_enumeration.py
+36
View File
@@ -0,0 +1,36 @@
import windows
etwmgr = windows.system.etw
print("ETW Manager is: {0}".format(etwmgr))
print("")
print("Listing some ETW sessions:")
for sess in etwmgr.sessions[:2]:
print(" * {0}".format(sess))
print(" * name: {0}".format(sess.name))
print(" * guid: {0}".format(sess.guid))
print(" * id: {0}".format(sess.id))
print(" * logfile: {0}".format(sess.logfile))
target_id = sess.id
NB_MATCH = 0
print("")
print("Looking for providers for: {0}".format(sess))
for provider in windows.system.etw.providers:
if NB_MATCH == 3:
break
for instance in provider.instances:
if NB_MATCH == 3:
break
for session in instance.sessions:
if session.LoggerId == target_id and instance.Pid:
proc = [p for p in windows.system.processes if p.pid == instance.Pid][0]
print("Found a provider/session for target:")
print(" * Provider: {0}".format(provider))
print(" * Instance: {0}".format(instance))
print(" * Process: {0}".format(proc))
NB_MATCH += 1
if NB_MATCH == 3:
break
break
samples/etw/uac_trace.py
+36
View File
@@ -0,0 +1,36 @@
import ctypes
import struct
import windows
import windows.generated_def as gdef
makeg = gdef.GUID.from_string
# This sample record the ETW event of provider CBB61B6D-A2CF-471A-9A58-A4CD5C08FFBA
# related to the UAC (service AppInfo)
# The ETW session is called MY_UAC_MONITOR
# Is then trigger the UAC and display the retrieved event afterward
def show(event):
print("{0:#x}: {1}".format(event.EventHeader.TimeStamp, event))
print(" guid: {0}".format(event.guid))
print(" id: {0}".format(event.id))
print(" opcode: {0}".format(event.opcode))
print(" level: {0}".format(event.level))
print(" data: {0!r}".format(event.user_data.replace("\x00", "")))
return 0
session_name = "MY_UAC_MONITOR"
logfile_name = "uac.trace"
print("Recording UAC event in file <{0}> using session named <{1}>".format(logfile_name, session_name))
my_trace = windows.system.etw.open_trace(session_name, logfile=logfile_name)
my_trace.stop(soft=True) # Stop previous trace with this name if exists
my_trace.start()
my_trace.enable("CBB61B6D-A2CF-471A-9A58-A4CD5C08FFBA", 0xff, 0xff)
# Trigger UAC
windows.winproxy.ShellExecuteA(None, "runas", "mmc.exe", "BAD_MMC_FILENAME", None , 5)
my_trace.stop()
my_trace.process(show) #: Process the events registered in the trace (and logfile)