Working on RtlGetUnloadEventTraceEx - adding function and struct + fix remotectypes char-array in struct

ctypes_generation/definitions/winfunc.txt

@@ -1766,3 +1766,9 @@ UINT WINAPI GetWindowsDirectoryW(
   _Out_ LPWSTR lpBuffer,
   _In_  UINT   uSize
 );
+
+VOID WINAPI RtlGetUnloadEventTraceEx(
+  _Out_ PULONG *ElementSize,
+  _Out_ PULONG *ElementCount,
+  _Out_ PVOID  *EventTrace
+);

ctypes_generation/definitions/winstruct.txt

@@ -2945,4 +2945,36 @@ typedef struct _SYSTEM_MANDATORY_LABEL_ACE {
     ACE_HEADER Header;
     ACCESS_MASK Mask;
     DWORD SidStart;
-} SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
+} SYSTEM_MANDATORY_LABEL_ACE, *PSYSTEM_MANDATORY_LABEL_ACE;
+
+
+typedef struct _RTL_UNLOAD_EVENT_TRACE {
+    PVOID BaseAddress;
+    SIZE_T SizeOfImage;
+    ULONG Sequence;
+    ULONG TimeDateStamp;
+    ULONG CheckSum;
+    WCHAR ImageName[32];
+    ULONG Version[2];
+} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;
+
+typedef struct _RTL_UNLOAD_EVENT_TRACE32 {
+    DWORD BaseAddress;
+    DWORD SizeOfImage;
+    ULONG Sequence;
+    ULONG TimeDateStamp;
+    ULONG CheckSum;
+    WCHAR ImageName[32];
+    ULONG Version[2];
+} RTL_UNLOAD_EVENT_TRACE32, *PRTL_UNLOAD_EVENT_TRACE32;
+
+
+typedef struct _RTL_UNLOAD_EVENT_TRACE64 {
+    ULONGLONG BaseAddress;
+    ULONGLONG SizeOfImage;
+    ULONG Sequence;
+    ULONG TimeDateStamp;
+    ULONG CheckSum;
+    WCHAR ImageName[32];
+    ULONG Version[2];
+} RTL_UNLOAD_EVENT_TRACE64, *PRTL_UNLOAD_EVENT_TRACE64;

docs/source/winstructs_generated.rst

@@ -9150,6 +9150,144 @@ _SYSTEM_MANDATORY_LABEL_ACE
 
         :class:`DWORD`
 
+_RTL_UNLOAD_EVENT_TRACE
+'''''''''''''''''''''''
+.. class:: PRTL_UNLOAD_EVENT_TRACE
+
+    Pointer to :class:`_RTL_UNLOAD_EVENT_TRACE`
+
+.. class:: RTL_UNLOAD_EVENT_TRACE
+
+    Alias for :class:`_RTL_UNLOAD_EVENT_TRACE`
+
+.. class:: _RTL_UNLOAD_EVENT_TRACE
+
+    .. attribute:: BaseAddress
+
+        :class:`PVOID`
+
+
+    .. attribute:: SizeOfImage
+
+        :class:`SIZE_T`
+
+
+    .. attribute:: Sequence
+
+        :class:`ULONG`
+
+
+    .. attribute:: TimeDateStamp
+
+        :class:`ULONG`
+
+
+    .. attribute:: CheckSum
+
+        :class:`ULONG`
+
+
+    .. attribute:: ImageName
+
+        :class:`WCHAR` ``[32]``
+
+
+    .. attribute:: Version
+
+        :class:`ULONG` ``[2]``
+
+_RTL_UNLOAD_EVENT_TRACE32
+'''''''''''''''''''''''''
+.. class:: RTL_UNLOAD_EVENT_TRACE32
+
+    Alias for :class:`_RTL_UNLOAD_EVENT_TRACE32`
+
+.. class:: PRTL_UNLOAD_EVENT_TRACE32
+
+    Pointer to :class:`_RTL_UNLOAD_EVENT_TRACE32`
+
+.. class:: _RTL_UNLOAD_EVENT_TRACE32
+
+    .. attribute:: BaseAddress
+
+        :class:`DWORD`
+
+
+    .. attribute:: SizeOfImage
+
+        :class:`DWORD`
+
+
+    .. attribute:: Sequence
+
+        :class:`ULONG`
+
+
+    .. attribute:: TimeDateStamp
+
+        :class:`ULONG`
+
+
+    .. attribute:: CheckSum
+
+        :class:`ULONG`
+
+
+    .. attribute:: ImageName
+
+        :class:`WCHAR` ``[32]``
+
+
+    .. attribute:: Version
+
+        :class:`ULONG` ``[2]``
+
+_RTL_UNLOAD_EVENT_TRACE64
+'''''''''''''''''''''''''
+.. class:: PRTL_UNLOAD_EVENT_TRACE64
+
+    Pointer to :class:`_RTL_UNLOAD_EVENT_TRACE64`
+
+.. class:: RTL_UNLOAD_EVENT_TRACE64
+
+    Alias for :class:`_RTL_UNLOAD_EVENT_TRACE64`
+
+.. class:: _RTL_UNLOAD_EVENT_TRACE64
+
+    .. attribute:: BaseAddress
+
+        :class:`ULONGLONG`
+
+
+    .. attribute:: SizeOfImage
+
+        :class:`ULONGLONG`
+
+
+    .. attribute:: Sequence
+
+        :class:`ULONG`
+
+
+    .. attribute:: TimeDateStamp
+
+        :class:`ULONG`
+
+
+    .. attribute:: CheckSum
+
+        :class:`ULONG`
+
+
+    .. attribute:: ImageName
+
+        :class:`WCHAR` ``[32]``
+
+
+    .. attribute:: Version
+
+        :class:`ULONG` ``[2]``
+
 tagRECT
 '''''''
 .. class:: LPRECT

windows/generated_def/winstructs.py

@@ -3740,6 +3740,45 @@ class _SYSTEM_MANDATORY_LABEL_ACE(Structure):
 SYSTEM_MANDATORY_LABEL_ACE = _SYSTEM_MANDATORY_LABEL_ACE
 PSYSTEM_MANDATORY_LABEL_ACE = POINTER(_SYSTEM_MANDATORY_LABEL_ACE)
 
+class _RTL_UNLOAD_EVENT_TRACE(Structure):
+    _fields_ = [
+        ("BaseAddress", PVOID),
+        ("SizeOfImage", SIZE_T),
+        ("Sequence", ULONG),
+        ("TimeDateStamp", ULONG),
+        ("CheckSum", ULONG),
+        ("ImageName", WCHAR * 32),
+        ("Version", ULONG * 2),
+    ]
+PRTL_UNLOAD_EVENT_TRACE = POINTER(_RTL_UNLOAD_EVENT_TRACE)
+RTL_UNLOAD_EVENT_TRACE = _RTL_UNLOAD_EVENT_TRACE
+
+class _RTL_UNLOAD_EVENT_TRACE32(Structure):
+    _fields_ = [
+        ("BaseAddress", DWORD),
+        ("SizeOfImage", DWORD),
+        ("Sequence", ULONG),
+        ("TimeDateStamp", ULONG),
+        ("CheckSum", ULONG),
+        ("ImageName", WCHAR * 32),
+        ("Version", ULONG * 2),
+    ]
+RTL_UNLOAD_EVENT_TRACE32 = _RTL_UNLOAD_EVENT_TRACE32
+PRTL_UNLOAD_EVENT_TRACE32 = POINTER(_RTL_UNLOAD_EVENT_TRACE32)
+
+class _RTL_UNLOAD_EVENT_TRACE64(Structure):
+    _fields_ = [
+        ("BaseAddress", ULONGLONG),
+        ("SizeOfImage", ULONGLONG),
+        ("Sequence", ULONG),
+        ("TimeDateStamp", ULONG),
+        ("CheckSum", ULONG),
+        ("ImageName", WCHAR * 32),
+        ("Version", ULONG * 2),
+    ]
+PRTL_UNLOAD_EVENT_TRACE64 = POINTER(_RTL_UNLOAD_EVENT_TRACE64)
+RTL_UNLOAD_EVENT_TRACE64 = _RTL_UNLOAD_EVENT_TRACE64
+
 class tagRECT(Structure):
     _fields_ = [
         ("left", LONG),

windows/remotectypes.py

@@ -167,6 +167,7 @@ def create_remote_array(subtype, len):
             self.target = target
 
         def __getitem__(self, slice):
+            # import pdb;pdb.set_trace()
             if not isinstance(slice, (int, long)):
                 raise NotImplementedError("RemoteArray slice __getitem__")
             if slice >= len:
@@ -177,6 +178,13 @@ def create_remote_array(subtype, len):
             class TST(ctypes.Structure):
                 _fields_ = [("TST", subtype)]
             return RemoteStructure.from_structure(TST)(item_addr, target=self.target).TST
+
+        def __getslice__(self, start, stop): # Still used even for python 2.7 wtf :F
+            stop = min(stop, len)
+            start = max(start, 0)
+            # dummy implementation
+            return [self[i] for i in range(start, stop)]
+
     return RemoteArray
 
 
@@ -344,6 +352,13 @@ class RemoteStructureUnion(object):
         if issubclass(ftype, ctypes.Union):  # Union that must be transfomed
             return RemoteUnion.from_structure(ftype)(self._base_addr + fosset, self._target)
         if issubclass(ftype, _ctypes.Array):  # Arrays
+            # if this is a string: just cast the read value to string
+            if ftype._type_ == ctypes.c_char: # Use issubclass instead ?
+                return s.split("\x00", 1)[0]
+            elif ftype._type_ == ctypes.c_wchar: # Use issubclass instead ?
+                # Decode from utf16 -> size /=2 | put it in a wchar array | split at the first "\x00"
+                return (ftype._type_ * (fsize / 2)).from_buffer_copy(s.decode('utf16'))[:].split("\x00", 1)[0] # Sorry..
+            # I am pretty sur something smarter is possible..
             return create_remote_array(ftype._type_, ftype._length_)(self._base_addr + fosset, self._target)
         # Normal types
         # Follow the ctypes usage: if it's not directly inherited from _SimpleCData

windows/utils/winutils.py

@@ -4,6 +4,7 @@ import os
 import sys
 import code
 import datetime
+from collections import namedtuple
 
 import windows
 from windows.dbgprint import dbgprint
@@ -271,6 +272,15 @@ def get_known_sid(sid_type):
     windows.winproxy.CreateWellKnownSid(sid_type, None, buffer, size)
     return ctypes.cast(buffer, PSID)
 
+UnloadEventTraceInfo = namedtuple("UnloadEventTraceInfo", ["size", "nb_elt", "array_ptr"])
+
+def get_unload_event_trace():
+    x = PULONG()
+    y = PULONG()
+    z = PVOID()
+    windows.winproxy.RtlGetUnloadEventTraceEx(x, y, z)
+    return UnloadEventTraceInfo(x[0], y[0], z.value)
+
 class VirtualProtected(object):
     """
     A context manager usable like `VirtualProtect` that will restore the old protection at exit ::

windows/winproxy.py

@@ -950,6 +950,10 @@ def NtMapViewOfSection(SectionHandle, ProcessHandle, BaseAddress, ZeroBits, Comm
 def NtUnmapViewOfSection(ProcessHandle, BaseAddress):
     return NtUnmapViewOfSection.ctypes_function(ProcessHandle, BaseAddress)
 
+@NtdllProxy("RtlGetUnloadEventTraceEx", no_error_check)
+def RtlGetUnloadEventTraceEx(ElementSize, ElementCount, EventTrace):
+    return RtlGetUnloadEventTraceEx.ctypes_function(ElementSize, ElementCount, EventTrace)
+
 
 
 # ##### ADVAPI32 ####### #