Adding improved MEMORY_BASIC_INFORMATION structs

2026-06-08 14:31:45 +00:00 · 2017-11-10 09:04:22 +01:00
parent 5a79e15440
commit 14b1cbcf75
5 changed files with 206 additions and 2 deletions
@@ -0,0 +1,31 @@
+INITIAL_MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32
+
+class _MEMORY_BASIC_INFORMATION32(INITIAL_MEMORY_BASIC_INFORMATION32):
+    STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE}
+    TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE}
+    PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE,
+                                    PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE,
+                                    PAGE_EXECUTE_WRITECOPY]}
+
+
+    @property
+    def State(self):
+        raw_state = super(_MEMORY_BASIC_INFORMATION32, self).State
+        # Finally make a chooser somewhere ?
+        return self.STATE_MAPPER.get(raw_state, raw_state)
+
+    @property
+    def Type(self):
+        raw_type = super(_MEMORY_BASIC_INFORMATION32, self).Type
+        # Finally make a chooser somewhere ?
+        return self.TYPE_MAPPER.get(raw_type, raw_type)
+
+    @property
+    def Protect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION32, self).Protect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER.get(raw_protect, raw_protect)
+
+    def __repr__(self):
+        return "<MEMORY_BASIC_INFORMATION32 BaseAddress={0:#08x} RegionSize={1:#08x} State={2} Type={3} Protect={4}>".format(
+            self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect)
@@ -0,0 +1,31 @@
+INITIAL_MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64
+
+class _MEMORY_BASIC_INFORMATION64(INITIAL_MEMORY_BASIC_INFORMATION64):
+    STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE}
+    TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE}
+    PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE,
+                                    PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE,
+                                    PAGE_EXECUTE_WRITECOPY]}
+
+
+    @property
+    def State(self):
+        raw_state = super(_MEMORY_BASIC_INFORMATION64, self).State
+        # Finally make a chooser somewhere ?
+        return self.STATE_MAPPER.get(raw_state, raw_state)
+
+    @property
+    def Type(self):
+        raw_type = super(_MEMORY_BASIC_INFORMATION64, self).Type
+        # Finally make a chooser somewhere ?
+        return self.TYPE_MAPPER.get(raw_type, raw_type)
+
+    @property
+    def Protect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION64, self).Protect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER.get(raw_protect, raw_protect)
+
+    def __repr__(self):
+        return "<MEMORY_BASIC_INFORMATION64 BaseAddress={0:#08x} RegionSize={1:#08x} State={2} Type={3} Protect={4}>".format(
+            self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect)
@@ -1940,4 +1940,14 @@ RPC_RESPONSE_TYPE_FAIL = make_flag("RPC_RESPONSE_TYPE_FAIL", 2)
 RPC_RESPONSE_TYPE_SUCESS = make_flag("RPC_RESPONSE_TYPE_SUCESS", 3)
 BIND_IF_SYNTAX_NDR32 = make_flag("BIND_IF_SYNTAX_NDR32", 1)
 BIND_IF_SYNTAX_NDR64 = make_flag("BIND_IF_SYNTAX_NDR64", 2)
-BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4)
+BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4)
+EVENTLOG_SUCCESS = make_flag("EVENTLOG_SUCCESS", 0x0000)
+EVENTLOG_ERROR_TYPE = make_flag("EVENTLOG_ERROR_TYPE", 0x0001)
+EVENTLOG_WARNING_TYPE = make_flag("EVENTLOG_WARNING_TYPE", 0x0002)
+EVENTLOG_INFORMATION_TYPE = make_flag("EVENTLOG_INFORMATION_TYPE", 0x0004)
+EVENTLOG_AUDIT_SUCCESS = make_flag("EVENTLOG_AUDIT_SUCCESS", 0x0008)
+EVENTLOG_AUDIT_FAILURE = make_flag("EVENTLOG_AUDIT_FAILURE", 0x0010)
+EVENTLOG_SEQUENTIAL_READ = make_flag("EVENTLOG_SEQUENTIAL_READ", 0x0001)
+EVENTLOG_SEEK_READ = make_flag("EVENTLOG_SEEK_READ", 0x0002)
+EVENTLOG_FORWARDS_READ = make_flag("EVENTLOG_FORWARDS_READ", 0x0004)
+EVENTLOG_BACKWARDS_READ = make_flag("EVENTLOG_BACKWARDS_READ", 0x0008)
@@ -1355,6 +1355,40 @@ class _MEMORY_BASIC_INFORMATION32(Structure):
 MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32
 PMEMORY_BASIC_INFORMATION32 = POINTER(_MEMORY_BASIC_INFORMATION32)

+INITIAL_MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32
+
+class _MEMORY_BASIC_INFORMATION32(INITIAL_MEMORY_BASIC_INFORMATION32):
+    STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE}
+    TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE}
+    PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE,
+                                    PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE,
+                                    PAGE_EXECUTE_WRITECOPY]}
+
+
+    @property
+    def State(self):
+        raw_state = super(_MEMORY_BASIC_INFORMATION32, self).State
+        # Finally make a chooser somewhere ?
+        return self.STATE_MAPPER.get(raw_state, raw_state)
+
+    @property
+    def Type(self):
+        raw_type = super(_MEMORY_BASIC_INFORMATION32, self).Type
+        # Finally make a chooser somewhere ?
+        return self.TYPE_MAPPER.get(raw_type, raw_type)
+
+    @property
+    def Protect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION32, self).Protect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER.get(raw_protect, raw_protect)
+
+    def __repr__(self):
+        return "<MEMORY_BASIC_INFORMATION32 BaseAddress={0:#08x} RegionSize={1:#08x} State={2} Type={3} Protect={4}>".format(
+            self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect)
+MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32
+PMEMORY_BASIC_INFORMATION32 = POINTER(_MEMORY_BASIC_INFORMATION32)
+
 class _MEMORY_BASIC_INFORMATION64(Structure):
    _fields_ = [
        ("BaseAddress", ULONGLONG),
@@ -1370,6 +1404,40 @@ class _MEMORY_BASIC_INFORMATION64(Structure):
 PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64)
 MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64

+INITIAL_MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64
+
+class _MEMORY_BASIC_INFORMATION64(INITIAL_MEMORY_BASIC_INFORMATION64):
+    STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE}
+    TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE}
+    PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE,
+                                    PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE,
+                                    PAGE_EXECUTE_WRITECOPY]}
+
+
+    @property
+    def State(self):
+        raw_state = super(_MEMORY_BASIC_INFORMATION64, self).State
+        # Finally make a chooser somewhere ?
+        return self.STATE_MAPPER.get(raw_state, raw_state)
+
+    @property
+    def Type(self):
+        raw_type = super(_MEMORY_BASIC_INFORMATION64, self).Type
+        # Finally make a chooser somewhere ?
+        return self.TYPE_MAPPER.get(raw_type, raw_type)
+
+    @property
+    def Protect(self):
+        raw_protect = super(_MEMORY_BASIC_INFORMATION64, self).Protect
+        # Finally make a chooser somewhere ?
+        return self.PROTECT_MAPPER.get(raw_protect, raw_protect)
+
+    def __repr__(self):
+        return "<MEMORY_BASIC_INFORMATION64 BaseAddress={0:#08x} RegionSize={1:#08x} State={2} Type={3} Protect={4}>".format(
+            self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect)
+PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64)
+MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64
+
 class _PSAPI_WORKING_SET_BLOCK(Union):
    _fields_ = [
        ("Flags", PVOID),
@@ -4342,3 +4410,32 @@ class _RPC_IF_ID(INITIAL_RPC_IF_ID):
    def __repr__(self):
        return '<RPC_IF_ID "{0}" ({1}, {2})>'.format(self.Uuid.to_string(), self.VersMajor, self.VersMinor)
 RPC_IF_ID = _RPC_IF_ID
+
+class _EVENTLOGRECORD(Structure):
+    _fields_ = [
+        ("Length", DWORD),
+        ("Reserved", DWORD),
+        ("RecordNumber", DWORD),
+        ("TimeGenerated", DWORD),
+        ("TimeWritten", DWORD),
+        ("EventID", DWORD),
+        ("EventType", WORD),
+        ("NumStrings", WORD),
+        ("EventCategory", WORD),
+        ("ReservedFlags", WORD),
+        ("ClosingRecordNumber", DWORD),
+        ("StringOffset", DWORD),
+        ("UserSidLength", DWORD),
+        ("UserSidOffset", DWORD),
+        ("DataLength", DWORD),
+        ("DataOffset", DWORD),
+    ]
+PEVENTLOGRECORD = POINTER(_EVENTLOGRECORD)
+EVENTLOGRECORD = _EVENTLOGRECORD
+
+class _EVENTLOG_FULL_INFORMATION(Structure):
+    _fields_ = [
+        ("dwFull", DWORD),
+    ]
+EVENTLOG_FULL_INFORMATION = _EVENTLOG_FULL_INFORMATION
+LPEVENTLOG_FULL_INFORMATION = POINTER(_EVENTLOG_FULL_INFORMATION)