admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #58 from hakril/improv_simple_assembly

Browse Source 
Improve handling of some instructions in simple x86/x64
This commit is contained in:
hakril
2024-06-27 15:14:20 +02:00
committed by GitHub
parent 7475c8893e cbadada375
commit 13d0b6b3b7
17 changed files with 3409 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/mypytest.yml
+3 -1
View File
@@ -31,6 +31,7 @@ jobs:
with:
python-version: ${{ matrix.python-version}}
architecture: x86
update-environment: false
## Install the 64bits version of python3 asked
- name: Set up Python3 ${{ matrix.python-version }} x64
if: ${{ matrix.python-version != '2.7' }}
@@ -38,6 +39,7 @@ jobs:
with:
python-version: ${{ matrix.python-version}}
architecture: x64
update-environment: false
# Manually install python2.7 (both version at once)
- name: Set up Python2.7 ${{ matrix.python-version }} x86 & x64
@@ -64,7 +66,7 @@ jobs:
run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -k "not known_to_fail" -v tests/
- name: Publish PyTest Results
uses: EnricoMi/publish-unit-test-result-action/composite@v1
uses: EnricoMi/publish-unit-test-result-action/windows@v2
if: always()
with:
files: junit/test-results.xml
ctypes_generation/definitions/defines/section.txt
+1
View File
@@ -0,0 +1 @@
#define MEM_EXTENDED_PARAMETER_TYPE_BITS 8
ctypes_generation/definitions/functions/syscall.txt
+25
View File
@@ -367,3 +367,28 @@ NTSTATUS NtTerminateProcess(
HANDLE ProcessHandle,
NTSTATUS ExitStatus
);
NTSTATUS NtReadFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_ PVOID Buffer,
_In_ ULONG Length,
_In_opt_ PLARGE_INTEGER ByteOffset,
_In_opt_ PULONG Key
);
NTSTATUS NtWriteFile(
[in] HANDLE FileHandle,
[in, optional] HANDLE Event,
[in, optional] PIO_APC_ROUTINE ApcRoutine,
[in, optional] PVOID ApcContext,
[out] PIO_STATUS_BLOCK IoStatusBlock,
[in] PVOID Buffer,
[in] ULONG Length,
[in, optional] PLARGE_INTEGER ByteOffset,
[in, optional] PULONG Key
);
ctypes_generation/definitions/structures/section.txt
+32
View File
@@ -0,0 +1,32 @@
typedef enum MEM_EXTENDED_PARAMETER_TYPE {
MemExtendedParameterInvalidType = 0,
MemExtendedParameterAddressRequirements = 1,
MemExtendedParameterNumaNode = 2,
MemExtendedParameterPartitionHandle = 3,
MemExtendedParameterUserPhysicalHandle = 4,
MemExtendedParameterAttributeFlags = 5,
MemExtendedParameterImageMachine = 6,
MemExtendedParameterMax
} *PMEM_EXTENDED_PARAMETER_TYPE;
typedef struct _MEM_ADDRESS_REQUIREMENTS {
PVOID LowestStartingAddress;
PVOID HighestEndingAddress;
SIZE_T Alignment;
} MEM_ADDRESS_REQUIREMENTS, *PMEM_ADDRESS_REQUIREMENTS;
typedef struct MEM_EXTENDED_PARAMETER {
struct {
ULONG64 Type : 8; // MEM_EXTENDED_PARAMETER_TYPE_BITS -> define not handled in parser here
ULONG64 Reserved : 56; // 64 - MEM_EXTENDED_PARAMETER_TYPE_BITS -> define not handled in parser here
} DUMMYSTRUCTNAME;
union {
ULONG64 ULong64;
PVOID Pointer;
SIZE_T Size;
HANDLE Handle;
ULONG ULong;
} DUMMYUNIONNAME;
} MEM_EXTENDED_PARAMETER, *PMEM_EXTENDED_PARAMETER;
docs/source/interfaces_generated.rst
+1429
View File
File diff suppressed because it is too large Load Diff
docs/source/windef_generated.rst
+1
View File
@@ -1127,6 +1127,7 @@ WinDef
.. autodata:: REG_STANDARD_FORMAT
.. autodata:: REG_LATEST_FORMAT
.. autodata:: REG_NO_COMPRESSION
.. autodata:: MEM_EXTENDED_PARAMETER_TYPE_BITS
.. autodata:: ACCESS_MIN_MS_ACE_TYPE
.. autodata:: ACCESS_ALLOWED_ACE_TYPE
.. autodata:: ACCESS_DENIED_ACE_TYPE
docs/source/winfuncs_generated.rst
+1678
View File
File diff suppressed because it is too large Load Diff
docs/source/winstructs_generated.rst
+76
View File
@@ -6224,6 +6224,49 @@ _IMAGE_LOAD_CONFIG_DIRECTORY64
:class:`ULONGLONG`
_MEM_ADDRESS_REQUIREMENTS
'''''''''''''''''''''''''
.. class:: MEM_ADDRESS_REQUIREMENTS
Alias for :class:`_MEM_ADDRESS_REQUIREMENTS`
.. class:: PMEM_ADDRESS_REQUIREMENTS
Pointer to :class:`_MEM_ADDRESS_REQUIREMENTS`
.. class:: _MEM_ADDRESS_REQUIREMENTS
.. attribute:: LowestStartingAddress
:class:`PVOID`
.. attribute:: HighestEndingAddress
:class:`PVOID`
.. attribute:: Alignment
:class:`SIZE_T`
MEM_EXTENDED_PARAMETER
''''''''''''''''''''''
.. class:: PMEM_EXTENDED_PARAMETER
Pointer to :class:`MEM_EXTENDED_PARAMETER`
.. class:: MEM_EXTENDED_PARAMETER
.. attribute:: DUMMYSTRUCTNAME
:class:`_ANON_MEM_EXTENDED_PARAMETER_SUB_STRUCTURE_1`
.. attribute:: DUMMYUNIONNAME
:class:`_ANON_MEM_EXTENDED_PARAMETER_SUB_UNION_2`
_SERVICE_STATUS
'''''''''''''''
.. class:: LPSERVICE_STATUS
@@ -27355,6 +27398,39 @@ _KEY_INFORMATION_CLASS
.. attribute:: MaxKeyInfoClass(10)
MEM_EXTENDED_PARAMETER_TYPE
'''''''''''''''''''''''''''
.. class:: PMEM_EXTENDED_PARAMETER_TYPE
Pointer to :class:`MEM_EXTENDED_PARAMETER_TYPE`
.. class:: MEM_EXTENDED_PARAMETER_TYPE
.. attribute:: MemExtendedParameterInvalidType(0)
.. attribute:: MemExtendedParameterAddressRequirements(1)
.. attribute:: MemExtendedParameterNumaNode(2)
.. attribute:: MemExtendedParameterPartitionHandle(3)
.. attribute:: MemExtendedParameterUserPhysicalHandle(4)
.. attribute:: MemExtendedParameterAttributeFlags(5)
.. attribute:: MemExtendedParameterImageMachine(6)
.. attribute:: MemExtendedParameterMax(7)
_SC_STATUS_TYPE
'''''''''''''''
.. class:: SC_STATUS_TYPE
tests/test_simple_x64.py
+16
View File
@@ -222,6 +222,7 @@ def test_assembler():
CheckInstr(Push)('RAX')
CheckInstr(Push, must_fail=True)('EAX')
assert len(Push("RAX").get_code()) == 1
CheckInstr(Push)('R15')
CheckInstr(Push)(0x42)
@@ -231,10 +232,16 @@ def test_assembler():
CheckInstr(Pop)('RAX')
CheckInstr(Push, must_fail=True)('EAX')
CheckInstr(Pop)('R15')
CheckInstr(Pop)(mem("[ECX]"))
CheckInstr(Pop)(mem("[RCX]"))
assert len(Pop("RAX").get_code()) == 1
CheckInstr(Call, must_fail=True)('EAX')
CheckInstr(Call)('RAX')
CheckInstr(Call)('R14')
CheckInstr(Call)(mem('[RAX + RCX * 8]'))
CheckInstr(Cpuid)()
CheckInstr(Xchg)('RAX', 'RSP')
@@ -296,6 +303,15 @@ def test_assembler():
CheckInstr(Add, must_fail=True)('RAX', 0xffffffff)
CheckInstr(Jmp, must_fail=True)('EAX')
CheckInstr(Jmp)('RAX')
CheckInstr(Jmp)('R12')
CheckInstr(Jmp)(mem('[RAX]'))
CheckInstr(Jmp)(mem('[RAX + 2]'))
CheckInstr(Jmp)(mem('[0x12345678]'))
CheckInstr(Jmp)(mem('[R15 + 0x12345678]'))
# Test some prefix / REP
assert (x64.Rep + x64.Nop()).get_code() == b"\xf3\x90"
assert (x64.GSPrefix + x64.Nop()).get_code() == b"\x65\x90"
tests/test_simple_x86.py
+6
View File
@@ -230,6 +230,12 @@ def test_assembler():
CheckInstr(x86.Test, immediat_accepted=-1)('EAX', 0xffffffff)
CheckInstr(x86.Test)('ECX', 0x42)
CheckInstr(Jmp)('EAX')
CheckInstr(Jmp)('EDX')
CheckInstr(Jmp)('EDI')
CheckInstr(Jmp)(mem('[EAX]'))
CheckInstr(Jmp)(mem('[EAX + 2]'))
CheckInstr(Jmp)(mem('[0x12345678]'))
assert x86.Test(mem('[ECX + 0x100]'), 'ECX').get_code() == x86.Test('ECX', mem('[ECX + 0x100]')).get_code()
assert Xchg('EAX', 'ECX').get_code() == Xchg('ECX', 'EAX').get_code()
windows/generated_def/meta.py
+10
View File
@@ -1900,6 +1900,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
'MEM_4MB_PAGES',
'MEM_COMMIT',
'MEM_DECOMMIT',
'MEM_EXTENDED_PARAMETER_TYPE_BITS',
'MEM_FREE',
'MEM_IMAGE',
'MEM_LARGE_PAGES',
@@ -12619,7 +12620,9 @@ structs = {'ACCESS_ALLOWED_ACE',
'MEMORY_BASIC_INFORMATION',
'MEMORY_BASIC_INFORMATION32',
'MEMORY_BASIC_INFORMATION64',
'MEM_ADDRESS_REQUIREMENTS',
'MEM_DES',
'MEM_EXTENDED_PARAMETER',
'MEM_LARGE_DES',
'MEM_LARGE_RANGE',
'MEM_LARGE_RESOURCE',
@@ -13046,7 +13049,9 @@ structs = {'ACCESS_ALLOWED_ACE',
'PMEMORY_BASIC_INFORMATION',
'PMEMORY_BASIC_INFORMATION32',
'PMEMORY_BASIC_INFORMATION64',
'PMEM_ADDRESS_REQUIREMENTS',
'PMEM_DES',
'PMEM_EXTENDED_PARAMETER',
'PMEM_LARGE_DES',
'PMEM_LARGE_RANGE',
'PMEM_LARGE_RESOURCE',
@@ -13781,6 +13786,7 @@ structs = {'ACCESS_ALLOWED_ACE',
'_MEMORY_BASIC_INFORMATION',
'_MEMORY_BASIC_INFORMATION32',
'_MEMORY_BASIC_INFORMATION64',
'_MEM_ADDRESS_REQUIREMENTS',
'_MIB_IFROW',
'_MIB_IFTABLE',
'_MIB_IPADDRROW_XP',
@@ -14107,6 +14113,7 @@ enums = {'ACCESS_MODE',
'KEY_INFORMATION_CLASS',
'KEY_VALUE_INFORMATION_CLASS',
'MEMORY_INFORMATION_CLASS',
'MEM_EXTENDED_PARAMETER_TYPE',
'MIB_TCP_STATE',
'MSHLFLAGS',
'MULTIPLE_TRUSTEE_OPERATION',
@@ -14128,6 +14135,7 @@ enums = {'ACCESS_MODE',
'PACKAGE_EXECUTION_STATE',
'PALPC_MESSAGE_INFORMATION_CLASS',
'PFILE_INFORMATION_CLASS',
'PMEM_EXTENDED_PARAMETER_TYPE',
'PNT_PRODUCT_TYPE',
'POLICY_INFORMATION_CLASS',
'POLICY_LSA_SERVER_ROLE',
@@ -14826,6 +14834,7 @@ functions = {'AccessCheck',
'NtQueryValueKey',
'NtQueryVirtualMemory',
'NtQueryVolumeInformationFile',
'NtReadFile',
'NtReadVirtualMemory',
'NtSetContextThread',
'NtSetEaFile',
@@ -14836,6 +14845,7 @@ functions = {'AccessCheck',
'NtUnmapViewOfSection',
'NtWow64ReadVirtualMemory64',
'NtWow64WriteVirtualMemory64',
'NtWriteFile',
'NtWriteVirtualMemory',
'ObjectFromLresult',
'OpenBackupEventLogA',
windows/generated_def/windef.py
+1
View File
@@ -1144,6 +1144,7 @@ REG_LEGAL_OPTION = make_flag("REG_LEGAL_OPTION", ( REG_OPTION_RESERVED | REG_OPT
REG_STANDARD_FORMAT = make_flag("REG_STANDARD_FORMAT", 1)
REG_LATEST_FORMAT = make_flag("REG_LATEST_FORMAT", 2)
REG_NO_COMPRESSION = make_flag("REG_NO_COMPRESSION", 4)
MEM_EXTENDED_PARAMETER_TYPE_BITS = make_flag("MEM_EXTENDED_PARAMETER_TYPE_BITS", 8)
ACCESS_MIN_MS_ACE_TYPE = make_flag("ACCESS_MIN_MS_ACE_TYPE", ( 0x0 ))
ACCESS_ALLOWED_ACE_TYPE = make_flag("ACCESS_ALLOWED_ACE_TYPE", ( 0x0 ))
ACCESS_DENIED_ACE_TYPE = make_flag("ACCESS_DENIED_ACE_TYPE", ( 0x1 ))
windows/generated_def/winfuncs.py
+10
View File
@@ -2905,6 +2905,16 @@ NtDelayExecutionParams = ((1, 'Alertable'), (1, 'DelayInterval'))
NtTerminateProcessPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, NTSTATUS)
NtTerminateProcessParams = ((1, 'ProcessHandle'), (1, 'ExitStatus'))
#def NtReadFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key):
# return NtReadFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
NtReadFilePrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG)
NtReadFileParams = ((1, 'FileHandle'), (1, 'Event'), (1, 'ApcRoutine'), (1, 'ApcContext'), (1, 'IoStatusBlock'), (1, 'Buffer'), (1, 'Length'), (1, 'ByteOffset'), (1, 'Key'))
#def NtWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key):
# return NtWriteFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
NtWriteFilePrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG)
NtWriteFileParams = ((1, 'FileHandle'), (1, 'Event'), (1, 'ApcRoutine'), (1, 'ApcContext'), (1, 'IoStatusBlock'), (1, 'Buffer'), (1, 'Length'), (1, 'ByteOffset'), (1, 'Key'))
#def GetComputerNameExA(NameType, lpBuffer, nSize):
# return GetComputerNameExA.ctypes_function(NameType, lpBuffer, nSize)
GetComputerNameExAPrototype = WINFUNCTYPE(BOOL, COMPUTER_NAME_FORMAT, LPSTR, LPDWORD)
windows/generated_def/winstructs.py
+47
View File
@@ -2836,6 +2836,53 @@ class _IMAGE_LOAD_CONFIG_DIRECTORY64(Structure):
IMAGE_LOAD_CONFIG_DIRECTORY64 = _IMAGE_LOAD_CONFIG_DIRECTORY64
PIMAGE_LOAD_CONFIG_DIRECTORY64 = POINTER(_IMAGE_LOAD_CONFIG_DIRECTORY64)
MemExtendedParameterInvalidType = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterInvalidType", 0x0)
MemExtendedParameterAddressRequirements = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAddressRequirements", 0x1)
MemExtendedParameterNumaNode = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterNumaNode", 0x2)
MemExtendedParameterPartitionHandle = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterPartitionHandle", 0x3)
MemExtendedParameterUserPhysicalHandle = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterUserPhysicalHandle", 0x4)
MemExtendedParameterAttributeFlags = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAttributeFlags", 0x5)
MemExtendedParameterImageMachine = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterImageMachine", 0x6)
MemExtendedParameterMax = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterMax", 0x7)
class MEM_EXTENDED_PARAMETER_TYPE(EnumType):
values = [MemExtendedParameterInvalidType, MemExtendedParameterAddressRequirements, MemExtendedParameterNumaNode, MemExtendedParameterPartitionHandle, MemExtendedParameterUserPhysicalHandle, MemExtendedParameterAttributeFlags, MemExtendedParameterImageMachine, MemExtendedParameterMax]
mapper = FlagMapper(*values)
PMEM_EXTENDED_PARAMETER_TYPE = POINTER(MEM_EXTENDED_PARAMETER_TYPE)
class _MEM_ADDRESS_REQUIREMENTS(Structure):
_fields_ = [
("LowestStartingAddress", PVOID),
("HighestEndingAddress", PVOID),
("Alignment", SIZE_T),
]
MEM_ADDRESS_REQUIREMENTS = _MEM_ADDRESS_REQUIREMENTS
PMEM_ADDRESS_REQUIREMENTS = POINTER(_MEM_ADDRESS_REQUIREMENTS)
class _ANON_MEM_EXTENDED_PARAMETER_SUB_STRUCTURE_1(Structure):
_fields_ = [
("Type", ULONG64, 8),
("Reserved", ULONG64, 56),
]
class _ANON_MEM_EXTENDED_PARAMETER_SUB_UNION_2(Union):
_fields_ = [
("ULong64", ULONG64),
("Pointer", PVOID),
("Size", SIZE_T),
("Handle", HANDLE),
("ULong", ULONG),
]
class MEM_EXTENDED_PARAMETER(Structure):
_anonymous_ = ("DUMMYSTRUCTNAME","DUMMYUNIONNAME")
_fields_ = [
("DUMMYSTRUCTNAME", _ANON_MEM_EXTENDED_PARAMETER_SUB_STRUCTURE_1),
("DUMMYUNIONNAME", _ANON_MEM_EXTENDED_PARAMETER_SUB_UNION_2),
]
PMEM_EXTENDED_PARAMETER = POINTER(MEM_EXTENDED_PARAMETER)
SC_STATUS_PROCESS_INFO = EnumValue("_SC_STATUS_TYPE", "SC_STATUS_PROCESS_INFO", 0x0)
class _SC_STATUS_TYPE(EnumType):
values = [SC_STATUS_PROCESS_INFO]
windows/native_exec/simple_x64.py
+57 -6
View File
@@ -153,7 +153,7 @@ class X64(object):
@staticmethod
def is_reg(name):
try:
return (name.upper() in reg_order) or X64.is_new_reg(name) or X64.is_32b_reg(name)
return X64.is_64b_reg(name) or X64.is_32b_reg(name)
except AttributeError: # Not a string
return False
@@ -164,6 +164,13 @@ class X64(object):
except AttributeError: # Not a string
return False
@staticmethod
def is_64b_reg(name):
try:
return (name.upper() in x64_regs)
except AttributeError: # Not a string
return False
@staticmethod
def is_32b_reg(name):
try:
@@ -656,6 +663,38 @@ class ModRM_REG__REG(SubModRM):
self.setup_rm_as_register(arg1)
self.direction = 0
class ModRM_REG64__REG64(SubModRM):
"""handle Reg64 Only, used by slash(x) that do not allow 32bits/rex (push / call / jmp)"""
@classmethod
def match(cls, arg1, arg2):
return X64.is_64b_reg(arg1) and X64.is_64b_reg(arg2)
def setup_reg_as_register(self, name):
name = name.upper()
# register IS a 64b register
self.setup_as_64bit_operation()
self.reg = X64RegisterSelector.get_reg_bits(name)
if X64.is_new_reg(name):
self.is_rex_needed = True
self.rex[5] = 1
def setup_rm_as_register(self, name):
name = name.upper()
# register IS a 64b register
self.setup_as_64bit_operation()
self.rm = X64RegisterSelector.get_reg_bits(name)
if X64.is_new_reg(name):
self.is_rex_needed = True
self.rex[7] = 1
def __init__(self, arg1, arg2, reversed, instr_state):
super(ModRM_REG64__REG64, self).__init__()
self.mod = BitArray(2, "11")
self.setup_reg_as_register(arg2)
self.setup_rm_as_register(arg1)
self.direction = 0
class ModRM_REG64__MEM(SubModRM):
@classmethod
@@ -772,10 +811,13 @@ class REG64__MEM_Slash(ModRM_REG64__MEM):
class Slash(object):
"No idea for the name: represent the modRM for single args + encoding in reg (/7 in cmp in man intel)"
def __init__(self, reg_num):
# only64b seems to be the contrary ok Instr.default_32_bits use this as a base ?
# Make a Slash64 () ?
def __init__(self, reg_num, only64b=False):
"reg = 7 for /7"
self.reg = reg_order[reg_num]
self.reg_num = reg_num
self.only64b = only64b
def accept_arg(self, args, instr_state):
if len(args) < 1:
@@ -785,8 +827,13 @@ class Slash(object):
injected_reg = self.reg
if X64.is_32b_reg(args[0]):
injected_reg = registers_64_to_32_bits[injected_reg]
if self.only64b:
modrm_reg_reg_type = ModRM_REG64__REG64
else:
modrm_reg_reg_type = ModRM_REG__REG
try:
arg_consum, value, rex = ModRM([ModRM_REG__REG, REG64__MEM_Slash], has_direction_bit=False).accept_arg(args[:1] + [injected_reg] + args[1:], instr_state)
arg_consum, value, rex = ModRM([modrm_reg_reg_type, REG64__MEM_Slash], has_direction_bit=False).accept_arg(args[:1] + [injected_reg] + args[1:], instr_state)
except ValueError as e:
# Size mismatch
return None, None, None
@@ -868,11 +915,14 @@ class JmpType(Instruction):
class Push(Instruction):
encoding = [(RawBits.from_int(5, 0x50 >> 3), X64RegisterSelector()),
(RawBits.from_int(8, 0x68), AnyImm32()),
(RawBits.from_int(8, 0xff), Slash(6))]
(RawBits.from_int(8, 0xff), Slash(6, only64b=True))]
class Pop(Instruction):
encoding = [(RawBits.from_int(5, 0x58 >> 3), X64RegisterSelector())]
encoding = [(RawBits.from_int(5, 0x58 >> 3), X64RegisterSelector()),
(RawBits.from_int(8, 0x8f), Slash(0, only64b=True))
]
@@ -976,12 +1026,13 @@ class JmpImm32(JmpImm):
class Call(JmpType):
encoding = [(RawBits.from_int(8, 0xe8), JmpImm32(5)),
(RawBits.from_int(8, 0xff), Slash(2))]
(RawBits.from_int(8, 0xff), Slash(2, only64b=True))]
class Jmp(JmpType):
encoding = [(RawBits.from_int(8, 0xeb), JmpImm8(2)),
(RawBits.from_int(8, 0xe9), JmpImm32(5)),
(RawBits.from_int(8, 0xff), Slash(4, only64b=True)),
(RawBits.from_int(13, 0xffe0 >> 3), X64RegisterSelector())]
windows/native_exec/simple_x86.py
+1 -1
View File
@@ -698,7 +698,6 @@ class JmpImm8(JmpImm):
class JmpImm32(JmpImm):
accept_as_Ximmediat = staticmethod(accept_as_32immediat)
# Instructions
class Call(JmpType):
@@ -709,6 +708,7 @@ class Call(JmpType):
class Jmp(JmpType):
encoding = [(RawBits.from_int(8, 0xeb), JmpImm8(2)),
(RawBits.from_int(8, 0xe9), JmpImm32(5)),
(RawBits.from_int(8, 0xff), Slash(4)),
(RawBits.from_int(8, 0xea), SegmentSelectorAbsoluteAddr())]
windows/winproxy/apis/ntdll.py
+16
View File
@@ -80,6 +80,22 @@ def NtQueryEaFile(FileHandle, IoStatusBlock, Buffer, Length, ReturnSingleEntry,
def NtSetEaFile(FileHandle, IoStatusBlock, Buffer, Length):
return NtSetEaFile.ctypes_function(FileHandle, IoStatusBlock, Buffer, Length)
@NtdllProxy()
def NtReadFile(FileHandle, Event=None, ApcRoutine=None, ApcContext=None, IoStatusBlock=None, Buffer=NeededParameter, Length=None, ByteOffset=None, Key=None):
if Length is None:
Length = ctypes.sizeof(Buffer)
if IoStatusBlock is None:
IoStatusBlock = gdef.IO_STATUS_BLOCK()
return NtReadFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
@NtdllProxy()
def NtWriteFile(FileHandle, Event=None, ApcRoutine=None, ApcContext=None, IoStatusBlock=None, Buffer=NeededParameter, Length=None, ByteOffset=None, Key=None):
if Length is None:
Length = ctypes.sizeof(Buffer)
if IoStatusBlock is None:
IoStatusBlock = gdef.IO_STATUS_BLOCK()
return NtWriteFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
# Process