admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Unifor the import / use of winproxy

Browse Source
This commit is contained in:
Clement Rouault
2016-03-21 13:27:23 +01:00
parent fb0171b8b9
commit 16ef768f3f
6 changed files with 28 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/__init__.py
+1
View File
@@ -32,6 +32,7 @@ import windows.utils
import windows.debug
import windows.service
import windows.wintrust
import windows.volumes
__all__ = ["system", 'current_process', 'current_thread']
windows/network.py
+1 -1
View File
@@ -1,5 +1,5 @@
import windows
import windows.winproxy
from windows import winproxy
import ctypes
import socket
import struct
windows/syswow64.py
+11 -10
View File
@@ -7,7 +7,8 @@ import functools
import windows
import windows.native_exec.simple_x64 as x64
from generated_def.winstructs import *
from windows.winproxy import NeededParameter, OptionalExport, NtdllProxy, error_ntstatus
from windows import winproxy
from winproxy import NeededParameter, OptionalExport, NtdllProxy, error_ntstatus
# Special code for syswow64 process
CS_32bits = 0x23
@@ -181,7 +182,7 @@ def get_current_process_syswow_peb():
bitness = 64
def read_memory(self, addr, size):
buffer_addr = ctypes.create_string_buffer(size)
windows.winproxy.NtWow64ReadVirtualMemory64(current_process.handle, addr, buffer_addr, size)
winproxy.NtWow64ReadVirtualMemory64(current_process.handle, addr, buffer_addr, size)
return buffer_addr[:]
peb_addr = get_current_process_syswow_peb_addr()
return windows.winobject.RemotePEB64(peb_addr, CurrentProcessReadSyswow())
@@ -194,7 +195,7 @@ class ReadSyswow64Process(object):
def read_memory(self, addr, size):
buffer_addr = ctypes.create_string_buffer(size)
windows.winproxy.NtWow64ReadVirtualMemory64(self.target.handle, addr, buffer_addr, size)
winproxy.NtWow64ReadVirtualMemory64(self.target.handle, addr, buffer_addr, size)
return buffer_addr[:]
@@ -237,7 +238,7 @@ class Syswow64ApiProxy(object):
return python_proxy
@Syswow64ApiProxy(windows.winproxy.NtCreateThreadEx)
@Syswow64ApiProxy(winproxy.NtCreateThreadEx)
def NtCreateThreadEx_32_to_64(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown3=0):
if ThreadHandle is None:
ThreadHandle = byref(HANDLE())
@@ -245,7 +246,7 @@ def NtCreateThreadEx_32_to_64(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectA
ProcessBasicInformation = 0
@Syswow64ApiProxy(windows.winproxy.NtQueryInformationProcess)
@Syswow64ApiProxy(winproxy.NtQueryInformationProcess)
def NtQueryInformationProcess_32_to_64(ProcessHandle, ProcessInformationClass=ProcessBasicInformation, ProcessInformation=NeededParameter, ProcessInformationLength=0, ReturnLength=None):
if ProcessInformation is not None and ProcessInformationLength == 0:
ProcessInformationLength = ctypes.sizeof(ProcessInformation)
@@ -256,7 +257,7 @@ def NtQueryInformationProcess_32_to_64(ProcessHandle, ProcessInformationClass=Pr
return NtQueryInformationProcess_32_to_64.ctypes_function(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength)
@Syswow64ApiProxy(windows.winproxy.NtQueryInformationThread)
@Syswow64ApiProxy(winproxy.NtQueryInformationThread)
def NtQueryInformationThread_32_to_64(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength=0, ReturnLength=None):
if ReturnLength is None:
ReturnLength = byref(ULONG())
@@ -266,7 +267,7 @@ def NtQueryInformationThread_32_to_64(ThreadHandle, ThreadInformationClass, Thre
@Syswow64ApiProxy(windows.winproxy.NtQueryVirtualMemory)
@Syswow64ApiProxy(winproxy.NtQueryVirtualMemory)
def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None):
if ReturnLength is None:
ReturnLength = byref(ULONG())
@@ -277,16 +278,16 @@ def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationC
return NtQueryVirtualMemory_32_to_64.ctypes_function(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength)
@Syswow64ApiProxy(windows.winproxy.NtGetContextThread)
@Syswow64ApiProxy(winproxy.NtGetContextThread)
def NtGetContextThread_32_to_64(hThread, lpContext):
if type(lpContext) == windows.exception.ECONTEXT64:
lpContext = byref(lpContext)
return NtGetContextThread_32_to_64.ctypes_function(hThread, lpContext)
@Syswow64ApiProxy(windows.winproxy.LdrLoadDll)
@Syswow64ApiProxy(winproxy.LdrLoadDll)
def LdrLoadDll_32_to_64(PathToFile, Flags, ModuleFileName, ModuleHandle):
return LdrLoadDll_32_to_64.ctypes_function(PathToFile, Flags, ModuleFileName, ModuleHandle)
@Syswow64ApiProxy(windows.winproxy.NtSetContextThread)
@Syswow64ApiProxy(winproxy.NtSetContextThread)
def NtSetContextThread_32_to_64(hThread, lpContext):
return NtSetContextThread_32_to_64.ctypes_function(hThread, lpContext)
windows/volumes.py
+2 -2
View File
@@ -16,7 +16,7 @@ class LogicalDrive(object):
@property
def type(self):
t = windows.winproxy.GetDriveTypeA(self.name)
t = winproxy.GetDriveTypeA(self.name)
return self.DRIVE_TYPE.get(t,t)
@property
@@ -48,5 +48,5 @@ def get_info(drivename):
def query_dos_device(name):
size = 0x1000
buffer = ctypes.c_buffer(size)
rsize = windows.winproxy.QueryDosDeviceA(name, buffer, size)
rsize = winproxy.QueryDosDeviceA(name, buffer, size)
return buffer[:rsize].rstrip("\x00").split("\x00")
windows/winobject.py
+2 -1
View File
@@ -15,12 +15,13 @@ import windows.exception
import windows.service
import windows.volumes
import windows.wmi
import windows.winproxy as winproxy
import windows.injection as injection
import windows.native_exec as native_exec
import windows.native_exec.simple_x86 as x86
import windows.native_exec.simple_x64 as x64
from windows import winproxy
from . import utils
from windows.dbgprint import dbgprint
from windows.generated_def.winstructs import *
windows/wintrust.py
+11 -11
View File
@@ -3,7 +3,7 @@ import struct
import windows
from collections import namedtuple
from windows.generated_def.winstructs import *
from windows.winproxy import WinVerifyTrust
from windows import winproxy
IID_PACK = "<I", "<H", "<H", "<B", "<B", "<B", "<B", "<B", "<B", "<B", "<B"
def get_IID_from_raw(raw):
@@ -70,25 +70,25 @@ def check_signature(filename):
#win_trust_data.dwProvFlags = 0x1000 + 0x10 + 0x800
win_trust_data.tmp_union.pFile = ctypes.pointer(file_data)
x = WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data))
x = winproxy.WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data))
win_trust_data.dwStateAction = WTD_STATEACTION_CLOSE
WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data))
winproxy.WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data))
return x & 0xffffffff
def get_catalog_for_filename(filename):
ctx = HCATADMIN()
windows.winproxy.CryptCATAdminAcquireContext(ctypes.byref(ctx), DRIVER_ACTION_VERIFY, 0)
winproxy.CryptCATAdminAcquireContext(ctypes.byref(ctx), DRIVER_ACTION_VERIFY, 0)
hash = get_file_hash(filename)
t = windows.winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, None)
t = winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, None)
if t is None:
return None
tname = get_catalog_name_from_handle(t)
while t is not None:
t = windows.winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, ctypes.byref(HCATINFO(t)))
windows.winproxy.CryptCATAdminReleaseCatalogContext(ctx, t, 0)
windows.winproxy.CryptCATAdminReleaseContext(ctx, 0)
t = winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, ctypes.byref(HCATINFO(t)))
winproxy.CryptCATAdminReleaseCatalogContext(ctx, t, 0)
winproxy.CryptCATAdminReleaseContext(ctx, 0)
return tname
@@ -97,17 +97,17 @@ def get_file_hash(filename):
handle = windows.utils.get_handle_from_file(f)
size = DWORD(0)
x = windows.winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), None, 0)
x = winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), None, 0)
buffer = (BYTE * size.value)()
x = windows.winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), buffer, 0)
x = winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), buffer, 0)
return buffer
def get_catalog_name_from_handle(handle):
cat_info = CATALOG_INFO()
cat_info.cbStruct = ctypes.sizeof(cat_info)
windows.winproxy.CryptCATCatalogInfoFromContext(handle, ctypes.byref(cat_info), 0)
winproxy.CryptCATCatalogInfoFromContext(handle, ctypes.byref(cat_info), 0)
return cat_info.wszCatalogFile
SignatureData = namedtuple("SignatureData", ["signed", "catalog", "catalogsigned"])