fix/simplify get_string in pe_parse / adapt syswow.py

windows/pe_parse.py

@@ -88,9 +88,7 @@ def GetPEFile(baseaddr, target=None, force_bitness=None):
     def get_string(addr):
         if target is None:
             return ctypes.c_char_p(addr).value
-        if target.bitness == 32:
-            return rctypes.transform_type_to_remote32bits(ctypes.c_char_p)(addr, target).value
-        return rctypes.transform_type_to_remote64bits(ctypes.c_char_p)(addr, target).value
+        return target.read_string(addr)
 
     class RVA(DWORD):
         @property

windows/syswow64.py

@@ -7,6 +7,7 @@ import functools
 import windows
 import windows.native_exec.simple_x64 as x64
 from generated_def.winstructs import *
+from windows.winobject import process
 from windows import winproxy
 from winproxy import NeededParameter, OptionalExport, NtdllProxy, error_ntstatus
 
@@ -181,7 +182,7 @@ def get_current_process_syswow_peb_addr():
 def get_current_process_syswow_peb():
     current_process = windows.current_process
 
-    class CurrentProcessReadSyswow(object):
+    class CurrentProcessReadSyswow(process.Process):
         bitness = 64
         def read_memory(self, addr, size):
             buffer_addr = ctypes.create_string_buffer(size)

windows/test/mytest.py

@@ -264,7 +264,8 @@ class WindowsTestCase(unittest.TestCase):
             mods = [m for m in calc.peb.modules if m.name == "kernel32.dll"]
             self.assertTrue(mods, 'Could not find "kernel32.dll" in calc32')
             k32 = mods[0]
-            mods[0].pe.sections # Just see if it's parse
+            mods[0].pe.sections[0].name # Just see if it's parse
+            self.assertEqual(mods[0].pe.export_name.lower(), "kernel32.dll")
             get_current_proc_id = k32.pe.exports['GetCurrentProcessId']
             # TODO: check get_current_proc_id value (but we cannot do 64->32 injection for now)
             #if is_process_64_bits:
@@ -289,7 +290,8 @@ class WindowsTestCase(unittest.TestCase):
             mods = [m for m in calc.peb.modules if m.name == "kernel32.dll"]
             self.assertTrue(mods, 'Could not find "kernel32.dll" in calc32')
             k32 = mods[0]
-            mods[0].pe.sections
+            mods[0].pe.sections[0].name
+            self.assertEqual(mods[0].pe.export_name.lower(), "kernel32.dll")
             get_current_proc_id = k32.pe.exports['GetCurrentProcessId']
             data = calc.virtual_alloc(0x1000)
             remote_python_code = """
@@ -558,12 +560,30 @@ class WindowsTestCase(unittest.TestCase):
             else:
                 raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target))
 
-    def test_mapped_filename(self):
+    def test_mapped_filename_32(self):
         with Calc32() as calc:
             k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0]
             mapped_filname = calc.get_mapped_filename(k32.baseaddr)
             self.assertTrue(mapped_filname.endswith("kernel32.dll"))
 
+    @windows_64bit_only
+    def test_mapped_filename_64(self):
+        with Calc64() as calc:
+            k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0]
+            mapped_filname = calc.get_mapped_filename(k32.baseaddr)
+            self.assertTrue(mapped_filname.endswith("kernel32.dll"))
+
+    def test_thread_teb_base_32(self):
+        with Calc32() as calc:
+            t = calc.threads[0]
+            self.assertNotEqual(t.teb_base, 0)
+
+    @windows_64bit_only
+    def test_thread_teb_base_64(self):
+        with Calc64() as calc:
+            t = calc.threads[0]
+            self.assertNotEqual(t.teb_base, 0)
+
 class WindowsAPITestCase(unittest.TestCase):
     def test_createfileA_fail(self):
         with self.assertRaises(WindowsError) as ar: