From 085c36c7061ba2fd57221b97424e39d7d5c84e14 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Thu, 21 Apr 2016 10:47:00 +0200 Subject: [PATCH] fix/simplify get_string in pe_parse / adapt syswow.py --- windows/pe_parse.py | 4 +--- windows/syswow64.py | 3 ++- windows/test/mytest.py | 26 +++++++++++++++++++++++--- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/windows/pe_parse.py b/windows/pe_parse.py index 8a1a37d..c430771 100644 --- a/windows/pe_parse.py +++ b/windows/pe_parse.py @@ -88,9 +88,7 @@ def GetPEFile(baseaddr, target=None, force_bitness=None): def get_string(addr): if target is None: return ctypes.c_char_p(addr).value - if target.bitness == 32: - return rctypes.transform_type_to_remote32bits(ctypes.c_char_p)(addr, target).value - return rctypes.transform_type_to_remote64bits(ctypes.c_char_p)(addr, target).value + return target.read_string(addr) class RVA(DWORD): @property diff --git a/windows/syswow64.py b/windows/syswow64.py index baced55..01f520d 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -7,6 +7,7 @@ import functools import windows import windows.native_exec.simple_x64 as x64 from generated_def.winstructs import * +from windows.winobject import process from windows import winproxy from winproxy import NeededParameter, OptionalExport, NtdllProxy, error_ntstatus @@ -181,7 +182,7 @@ def get_current_process_syswow_peb_addr(): def get_current_process_syswow_peb(): current_process = windows.current_process - class CurrentProcessReadSyswow(object): + class CurrentProcessReadSyswow(process.Process): bitness = 64 def read_memory(self, addr, size): buffer_addr = ctypes.create_string_buffer(size) diff --git a/windows/test/mytest.py b/windows/test/mytest.py index 3453c3f..f1f5e8d 100644 --- a/windows/test/mytest.py +++ b/windows/test/mytest.py @@ -264,7 +264,8 @@ class WindowsTestCase(unittest.TestCase): mods = [m for m in calc.peb.modules if m.name == "kernel32.dll"] self.assertTrue(mods, 'Could not find "kernel32.dll" in calc32') k32 = mods[0] - mods[0].pe.sections # Just see if it's parse + mods[0].pe.sections[0].name # Just see if it's parse + self.assertEqual(mods[0].pe.export_name.lower(), "kernel32.dll") get_current_proc_id = k32.pe.exports['GetCurrentProcessId'] # TODO: check get_current_proc_id value (but we cannot do 64->32 injection for now) #if is_process_64_bits: @@ -289,7 +290,8 @@ class WindowsTestCase(unittest.TestCase): mods = [m for m in calc.peb.modules if m.name == "kernel32.dll"] self.assertTrue(mods, 'Could not find "kernel32.dll" in calc32') k32 = mods[0] - mods[0].pe.sections + mods[0].pe.sections[0].name + self.assertEqual(mods[0].pe.export_name.lower(), "kernel32.dll") get_current_proc_id = k32.pe.exports['GetCurrentProcessId'] data = calc.virtual_alloc(0x1000) remote_python_code = """ @@ -558,12 +560,30 @@ class WindowsTestCase(unittest.TestCase): else: raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target)) - def test_mapped_filename(self): + def test_mapped_filename_32(self): with Calc32() as calc: k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0] mapped_filname = calc.get_mapped_filename(k32.baseaddr) self.assertTrue(mapped_filname.endswith("kernel32.dll")) + @windows_64bit_only + def test_mapped_filename_64(self): + with Calc64() as calc: + k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0] + mapped_filname = calc.get_mapped_filename(k32.baseaddr) + self.assertTrue(mapped_filname.endswith("kernel32.dll")) + + def test_thread_teb_base_32(self): + with Calc32() as calc: + t = calc.threads[0] + self.assertNotEqual(t.teb_base, 0) + + @windows_64bit_only + def test_thread_teb_base_64(self): + with Calc64() as calc: + t = calc.threads[0] + self.assertNotEqual(t.teb_base, 0) + class WindowsAPITestCase(unittest.TestCase): def test_createfileA_fail(self): with self.assertRaises(WindowsError) as ar: