From 14b1cbcf757915e2694241eaa6714dc12eafdf18 Mon Sep 17 00:00:00 2001 From: hakril Date: Fri, 10 Nov 2017 09:04:22 +0100 Subject: [PATCH] Adding improved MEMORY_BASIC_INFORMATION structs --- .../_MEMORY_BASIC_INFORMATION32.py | 31 ++++++ .../_MEMORY_BASIC_INFORMATION64.py | 31 ++++++ windows/generated_def/windef.py | 12 ++- windows/generated_def/winfuncs.py | 37 ++++++- windows/generated_def/winstructs.py | 97 +++++++++++++++++++ 5 files changed, 206 insertions(+), 2 deletions(-) create mode 100644 ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION32.py create mode 100644 ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION64.py diff --git a/ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION32.py b/ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION32.py new file mode 100644 index 0000000..5e1fa60 --- /dev/null +++ b/ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION32.py @@ -0,0 +1,31 @@ +INITIAL_MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32 + +class _MEMORY_BASIC_INFORMATION32(INITIAL_MEMORY_BASIC_INFORMATION32): + STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE} + TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE} + PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE, + PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, + PAGE_EXECUTE_WRITECOPY]} + + + @property + def State(self): + raw_state = super(_MEMORY_BASIC_INFORMATION32, self).State + # Finally make a chooser somewhere ? + return self.STATE_MAPPER.get(raw_state, raw_state) + + @property + def Type(self): + raw_type = super(_MEMORY_BASIC_INFORMATION32, self).Type + # Finally make a chooser somewhere ? + return self.TYPE_MAPPER.get(raw_type, raw_type) + + @property + def Protect(self): + raw_protect = super(_MEMORY_BASIC_INFORMATION32, self).Protect + # Finally make a chooser somewhere ? + return self.PROTECT_MAPPER.get(raw_protect, raw_protect) + + def __repr__(self): + return "".format( + self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect) \ No newline at end of file diff --git a/ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION64.py b/ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION64.py new file mode 100644 index 0000000..2161449 --- /dev/null +++ b/ctypes_generation/extended_structs/_MEMORY_BASIC_INFORMATION64.py @@ -0,0 +1,31 @@ +INITIAL_MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64 + +class _MEMORY_BASIC_INFORMATION64(INITIAL_MEMORY_BASIC_INFORMATION64): + STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE} + TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE} + PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE, + PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, + PAGE_EXECUTE_WRITECOPY]} + + + @property + def State(self): + raw_state = super(_MEMORY_BASIC_INFORMATION64, self).State + # Finally make a chooser somewhere ? + return self.STATE_MAPPER.get(raw_state, raw_state) + + @property + def Type(self): + raw_type = super(_MEMORY_BASIC_INFORMATION64, self).Type + # Finally make a chooser somewhere ? + return self.TYPE_MAPPER.get(raw_type, raw_type) + + @property + def Protect(self): + raw_protect = super(_MEMORY_BASIC_INFORMATION64, self).Protect + # Finally make a chooser somewhere ? + return self.PROTECT_MAPPER.get(raw_protect, raw_protect) + + def __repr__(self): + return "".format( + self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect) \ No newline at end of file diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index a003550..683ed7d 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -1940,4 +1940,14 @@ RPC_RESPONSE_TYPE_FAIL = make_flag("RPC_RESPONSE_TYPE_FAIL", 2) RPC_RESPONSE_TYPE_SUCESS = make_flag("RPC_RESPONSE_TYPE_SUCESS", 3) BIND_IF_SYNTAX_NDR32 = make_flag("BIND_IF_SYNTAX_NDR32", 1) BIND_IF_SYNTAX_NDR64 = make_flag("BIND_IF_SYNTAX_NDR64", 2) -BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4) \ No newline at end of file +BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4) +EVENTLOG_SUCCESS = make_flag("EVENTLOG_SUCCESS", 0x0000) +EVENTLOG_ERROR_TYPE = make_flag("EVENTLOG_ERROR_TYPE", 0x0001) +EVENTLOG_WARNING_TYPE = make_flag("EVENTLOG_WARNING_TYPE", 0x0002) +EVENTLOG_INFORMATION_TYPE = make_flag("EVENTLOG_INFORMATION_TYPE", 0x0004) +EVENTLOG_AUDIT_SUCCESS = make_flag("EVENTLOG_AUDIT_SUCCESS", 0x0008) +EVENTLOG_AUDIT_FAILURE = make_flag("EVENTLOG_AUDIT_FAILURE", 0x0010) +EVENTLOG_SEQUENTIAL_READ = make_flag("EVENTLOG_SEQUENTIAL_READ", 0x0001) +EVENTLOG_SEEK_READ = make_flag("EVENTLOG_SEEK_READ", 0x0002) +EVENTLOG_FORWARDS_READ = make_flag("EVENTLOG_FORWARDS_READ", 0x0004) +EVENTLOG_BACKWARDS_READ = make_flag("EVENTLOG_BACKWARDS_READ", 0x0008) \ No newline at end of file diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 9788fa2..c05e705 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -6,7 +6,7 @@ from ctypes.wintypes import * from winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtCreateFile', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'NtProtectVirtualMemory', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualProtectEx', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'QueryWorkingSetEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'CreateProcessAsUserA', 'CreateProcessAsUserW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'NtReadVirtualMemory', 'WriteProcessMemory', 'NtWow64WriteVirtualMemory64', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'OpenThreadToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'LookupPrivilegeNameA', 'LookupPrivilegeNameW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'ReadFile', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'GetLengthSid', 'CreateWellKnownSid', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'RtlDecompressBuffer', 'NtCreateSection', 'NtOpenSection', 'NtMapViewOfSection', 'NtUnmapViewOfSection', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcQueryInformation', 'NtAlpcConnectPort', 'NtAlpcConnectPortEx', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'NtAlpcDisconnectPort', 'NtAlpcCreatePortSection', 'NtAlpcDeletePortSection', 'NtAlpcCreateResourceReserve', 'NtAlpcDeleteResourceReserve', 'NtAlpcCreateSectionView', 'NtAlpcDeleteSectionView', 'NtAlpcCreateSecurityContext', 'NtAlpcDeleteSecurityContext', 'NtAlpcRevokeSecurityContext', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'CloseServiceHandle', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'StartServiceA', 'StartServiceW', 'OpenServiceA', 'OpenServiceW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'ZwDuplicateObject', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject', 'GetProcessTimes', 'GetShortPathNameA', 'GetShortPathNameW', 'GetLongPathNameA', 'GetLongPathNameW', 'GetProcessDEPPolicy', 'GetCursorPos', 'WindowFromPoint', 'GetWindowRect', 'GetNamedSecurityInfoA', 'GetNamedSecurityInfoW', 'GetSecurityInfo', 'ConvertStringSidToSidA', 'ConvertStringSidToSidW', 'ConvertSidToStringSidA', 'ConvertSidToStringSidW', 'LocalFree', 'RegQueryValueExA', 'RegQueryValueExW', 'ShellExecuteA', 'ShellExecuteW', 'InitializeProcThreadAttributeList', 'UpdateProcThreadAttribute', 'DeleteProcThreadAttributeList', 'MessageBoxA', 'MessageBoxW', 'GetWindowsDirectoryA', 'GetWindowsDirectoryW', 'RtlGetUnloadEventTraceEx', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'CryptCATGetAttrInfo', 'CryptCATGetMemberInfo', 'CryptCATGetAttrInfo', 'CryptCATEnumerateCatAttr', 'CryptCATEnumerateAttr', 'CryptCATEnumerateMember', 'CryptQueryObject', 'CryptMsgGetParam', 'CryptDecodeObject', 'CertFindCertificateInStore', 'CertGetNameStringA', 'CertGetNameStringW', 'CertGetCertificateChain', 'CertCreateSelfSignCertificate', 'CertStrToNameA', 'CertStrToNameW', 'CertOpenStore', 'CertAddCertificateContextToStore', 'PFXExportCertStoreEx', 'PFXImportCertStore', 'CryptGenKey', 'CryptDestroyKey', 'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptReleaseContext', 'CryptExportKey', 'CertGetCertificateContextProperty', 'CertEnumCertificateContextProperties', 'CryptEncryptMessage', 'CryptDecryptMessage', 'CryptAcquireCertificatePrivateKey', 'CertDuplicateCertificateContext', 'CertEnumCertificatesInStore', 'CryptEncodeObjectEx', 'CertCreateCertificateContext', 'CertCompareCertificate', 'CertEnumCTLsInStore', 'CertDuplicateCTLContext', 'CertFreeCTLContext', 'CryptUIDlgViewContext', 'TpCallbackSendAlpcMessageOnCompletion'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtCreateFile', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'NtProtectVirtualMemory', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualProtectEx', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'QueryWorkingSetEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'CreateProcessAsUserA', 'CreateProcessAsUserW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'NtReadVirtualMemory', 'WriteProcessMemory', 'NtWow64WriteVirtualMemory64', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'OpenThreadToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'LookupPrivilegeNameA', 'LookupPrivilegeNameW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'ReadFile', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'GetLengthSid', 'CreateWellKnownSid', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'RtlDecompressBuffer', 'NtCreateSection', 'NtOpenSection', 'NtMapViewOfSection', 'NtUnmapViewOfSection', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcQueryInformation', 'NtAlpcConnectPort', 'NtAlpcConnectPortEx', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'NtAlpcDisconnectPort', 'NtAlpcCreatePortSection', 'NtAlpcDeletePortSection', 'NtAlpcCreateResourceReserve', 'NtAlpcDeleteResourceReserve', 'NtAlpcCreateSectionView', 'NtAlpcDeleteSectionView', 'NtAlpcCreateSecurityContext', 'NtAlpcDeleteSecurityContext', 'NtAlpcRevokeSecurityContext', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'CloseServiceHandle', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'StartServiceA', 'StartServiceW', 'OpenServiceA', 'OpenServiceW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'ZwDuplicateObject', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject', 'GetProcessTimes', 'GetShortPathNameA', 'GetShortPathNameW', 'GetLongPathNameA', 'GetLongPathNameW', 'GetProcessDEPPolicy', 'GetCursorPos', 'WindowFromPoint', 'GetWindowRect', 'GetNamedSecurityInfoA', 'GetNamedSecurityInfoW', 'GetSecurityInfo', 'ConvertStringSidToSidA', 'ConvertStringSidToSidW', 'ConvertSidToStringSidA', 'ConvertSidToStringSidW', 'LocalFree', 'RegQueryValueExA', 'RegQueryValueExW', 'ShellExecuteA', 'ShellExecuteW', 'InitializeProcThreadAttributeList', 'UpdateProcThreadAttribute', 'DeleteProcThreadAttributeList', 'MessageBoxA', 'MessageBoxW', 'GetWindowsDirectoryA', 'GetWindowsDirectoryW', 'RtlGetUnloadEventTraceEx', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'CryptCATGetAttrInfo', 'CryptCATGetMemberInfo', 'CryptCATGetAttrInfo', 'CryptCATEnumerateCatAttr', 'CryptCATEnumerateAttr', 'CryptCATEnumerateMember', 'CryptQueryObject', 'CryptMsgGetParam', 'CryptDecodeObject', 'CertFindCertificateInStore', 'CertGetNameStringA', 'CertGetNameStringW', 'CertGetCertificateChain', 'CertCreateSelfSignCertificate', 'CertStrToNameA', 'CertStrToNameW', 'CertOpenStore', 'CertAddCertificateContextToStore', 'PFXExportCertStoreEx', 'PFXImportCertStore', 'CryptGenKey', 'CryptDestroyKey', 'CryptAcquireContextA', 'CryptAcquireContextW', 'CryptReleaseContext', 'CryptExportKey', 'CertGetCertificateContextProperty', 'CertEnumCertificateContextProperties', 'CryptEncryptMessage', 'CryptDecryptMessage', 'CryptAcquireCertificatePrivateKey', 'CertDuplicateCertificateContext', 'CertEnumCertificatesInStore', 'CryptEncodeObjectEx', 'CertCreateCertificateContext', 'CertCompareCertificate', 'CertEnumCTLsInStore', 'CertDuplicateCTLContext', 'CertFreeCTLContext', 'CryptUIDlgViewContext', 'TpCallbackSendAlpcMessageOnCompletion', 'OpenEventLogA', 'OpenEventLogW', 'ReadEventLogA', 'ReadEventLogW', 'GetEventLogInformation', 'GetNumberOfEventLogRecords', 'CloseEventLog'] #def ExitProcess(uExitCode): @@ -1553,3 +1553,38 @@ CryptUIDlgViewContextParams = ((1, 'dwContextType'), (1, 'pvContext'), (1, 'hwnd # return TpCallbackSendAlpcMessageOnCompletion.ctypes_function(TpHandle, PortHandle, Flags, SendMessage) TpCallbackSendAlpcMessageOnCompletionPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, ULONG, PPORT_MESSAGE) TpCallbackSendAlpcMessageOnCompletionParams = ((1, 'TpHandle'), (1, 'PortHandle'), (1, 'Flags'), (1, 'SendMessage')) + +#def OpenEventLogA(lpUNCServerName, lpSourceName): +# return OpenEventLogA.ctypes_function(lpUNCServerName, lpSourceName) +OpenEventLogAPrototype = WINFUNCTYPE(HANDLE, LPCSTR, LPCSTR) +OpenEventLogAParams = ((1, 'lpUNCServerName'), (1, 'lpSourceName')) + +#def OpenEventLogW(lpUNCServerName, lpSourceName): +# return OpenEventLogW.ctypes_function(lpUNCServerName, lpSourceName) +OpenEventLogWPrototype = WINFUNCTYPE(HANDLE, LPWSTR, LPWSTR) +OpenEventLogWParams = ((1, 'lpUNCServerName'), (1, 'lpSourceName')) + +#def ReadEventLogA(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded): +# return ReadEventLogA.ctypes_function(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded) +ReadEventLogAPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, DWORD, LPVOID, DWORD, POINTER(DWORD), POINTER(DWORD)) +ReadEventLogAParams = ((1, 'hEventLog'), (1, 'dwReadFlags'), (1, 'dwRecordOffset'), (1, 'lpBuffer'), (1, 'nNumberOfBytesToRead'), (1, 'pnBytesRead'), (1, 'pnMinNumberOfBytesNeeded')) + +#def ReadEventLogW(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded): +# return ReadEventLogW.ctypes_function(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded) +ReadEventLogWPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, DWORD, LPVOID, DWORD, POINTER(DWORD), POINTER(DWORD)) +ReadEventLogWParams = ((1, 'hEventLog'), (1, 'dwReadFlags'), (1, 'dwRecordOffset'), (1, 'lpBuffer'), (1, 'nNumberOfBytesToRead'), (1, 'pnBytesRead'), (1, 'pnMinNumberOfBytesNeeded')) + +#def GetEventLogInformation(hEventLog, dwInfoLevel, lpBuffer, cbBufSize, pcbBytesNeeded): +# return GetEventLogInformation.ctypes_function(hEventLog, dwInfoLevel, lpBuffer, cbBufSize, pcbBytesNeeded) +GetEventLogInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, LPVOID, DWORD, LPDWORD) +GetEventLogInformationParams = ((1, 'hEventLog'), (1, 'dwInfoLevel'), (1, 'lpBuffer'), (1, 'cbBufSize'), (1, 'pcbBytesNeeded')) + +#def GetNumberOfEventLogRecords(hEventLog, NumberOfRecords): +# return GetNumberOfEventLogRecords.ctypes_function(hEventLog, NumberOfRecords) +GetNumberOfEventLogRecordsPrototype = WINFUNCTYPE(BOOL, HANDLE, PDWORD) +GetNumberOfEventLogRecordsParams = ((1, 'hEventLog'), (1, 'NumberOfRecords')) + +#def CloseEventLog(hEventLog): +# return CloseEventLog.ctypes_function(hEventLog) +CloseEventLogPrototype = WINFUNCTYPE(BOOL, HANDLE) +CloseEventLogParams = ((1, 'hEventLog'),) diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index efd66b7..5a65e04 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -1355,6 +1355,40 @@ class _MEMORY_BASIC_INFORMATION32(Structure): MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32 PMEMORY_BASIC_INFORMATION32 = POINTER(_MEMORY_BASIC_INFORMATION32) +INITIAL_MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32 + +class _MEMORY_BASIC_INFORMATION32(INITIAL_MEMORY_BASIC_INFORMATION32): + STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE} + TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE} + PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE, + PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, + PAGE_EXECUTE_WRITECOPY]} + + + @property + def State(self): + raw_state = super(_MEMORY_BASIC_INFORMATION32, self).State + # Finally make a chooser somewhere ? + return self.STATE_MAPPER.get(raw_state, raw_state) + + @property + def Type(self): + raw_type = super(_MEMORY_BASIC_INFORMATION32, self).Type + # Finally make a chooser somewhere ? + return self.TYPE_MAPPER.get(raw_type, raw_type) + + @property + def Protect(self): + raw_protect = super(_MEMORY_BASIC_INFORMATION32, self).Protect + # Finally make a chooser somewhere ? + return self.PROTECT_MAPPER.get(raw_protect, raw_protect) + + def __repr__(self): + return "".format( + self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect) +MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32 +PMEMORY_BASIC_INFORMATION32 = POINTER(_MEMORY_BASIC_INFORMATION32) + class _MEMORY_BASIC_INFORMATION64(Structure): _fields_ = [ ("BaseAddress", ULONGLONG), @@ -1370,6 +1404,40 @@ class _MEMORY_BASIC_INFORMATION64(Structure): PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64) MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64 +INITIAL_MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64 + +class _MEMORY_BASIC_INFORMATION64(INITIAL_MEMORY_BASIC_INFORMATION64): + STATE_MAPPER = {MEM_COMMIT: MEM_COMMIT, MEM_FREE: MEM_FREE, MEM_RESERVE:MEM_RESERVE} + TYPE_MAPPER = {MEM_IMAGE: MEM_IMAGE, MEM_MAPPED: MEM_MAPPED, MEM_PRIVATE:MEM_PRIVATE} + PROTECT_MAPPER = {x:x for x in [PAGE_NOACCESS, PAGE_READONLY, PAGE_READWRITE, + PAGE_WRITECOPY, PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, + PAGE_EXECUTE_WRITECOPY]} + + + @property + def State(self): + raw_state = super(_MEMORY_BASIC_INFORMATION64, self).State + # Finally make a chooser somewhere ? + return self.STATE_MAPPER.get(raw_state, raw_state) + + @property + def Type(self): + raw_type = super(_MEMORY_BASIC_INFORMATION64, self).Type + # Finally make a chooser somewhere ? + return self.TYPE_MAPPER.get(raw_type, raw_type) + + @property + def Protect(self): + raw_protect = super(_MEMORY_BASIC_INFORMATION64, self).Protect + # Finally make a chooser somewhere ? + return self.PROTECT_MAPPER.get(raw_protect, raw_protect) + + def __repr__(self): + return "".format( + self.BaseAddress, self.RegionSize, self.State, self.Type, self.Protect) +PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64) +MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64 + class _PSAPI_WORKING_SET_BLOCK(Union): _fields_ = [ ("Flags", PVOID), @@ -4342,3 +4410,32 @@ class _RPC_IF_ID(INITIAL_RPC_IF_ID): def __repr__(self): return ''.format(self.Uuid.to_string(), self.VersMajor, self.VersMinor) RPC_IF_ID = _RPC_IF_ID + +class _EVENTLOGRECORD(Structure): + _fields_ = [ + ("Length", DWORD), + ("Reserved", DWORD), + ("RecordNumber", DWORD), + ("TimeGenerated", DWORD), + ("TimeWritten", DWORD), + ("EventID", DWORD), + ("EventType", WORD), + ("NumStrings", WORD), + ("EventCategory", WORD), + ("ReservedFlags", WORD), + ("ClosingRecordNumber", DWORD), + ("StringOffset", DWORD), + ("UserSidLength", DWORD), + ("UserSidOffset", DWORD), + ("DataLength", DWORD), + ("DataOffset", DWORD), + ] +PEVENTLOGRECORD = POINTER(_EVENTLOGRECORD) +EVENTLOGRECORD = _EVENTLOGRECORD + +class _EVENTLOG_FULL_INFORMATION(Structure): + _fields_ = [ + ("dwFull", DWORD), + ] +EVENTLOG_FULL_INFORMATION = _EVENTLOG_FULL_INFORMATION +LPEVENTLOG_FULL_INFORMATION = POINTER(_EVENTLOG_FULL_INFORMATION)