mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Added utils.query_file_informations wrapper arround new winproxy.NtQueryInformationFile
This commit is contained in:
hakril
@@ -1758,4 +1758,28 @@ VOID WINAPI RtlGetUnloadEventTraceEx(
|
||||
_Out_ PULONG *ElementSize,
|
||||
_Out_ PULONG *ElementCount,
|
||||
_Out_ PVOID *EventTrace
|
||||
);
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtQueryInformationFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FileInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FILE_INFORMATION_CLASS FileInformationClass
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryDirectoryFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_In_opt_ HANDLE Event,
|
||||
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
|
||||
_In_opt_ PVOID ApcContext,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FileInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FILE_INFORMATION_CLASS FileInformationClass,
|
||||
_In_ BOOLEAN ReturnSingleEntry,
|
||||
_In_opt_ PUNICODE_STRING FileName,
|
||||
_In_ BOOLEAN RestartScan
|
||||
);
|
||||
|
||||
|
||||
@@ -785,6 +785,7 @@ typedef enum _SE_OBJECT_TYPE {
|
||||
SE_REGISTRY_WOW64_32KEY = 12,
|
||||
} SE_OBJECT_TYPE;
|
||||
|
||||
|
||||
typedef struct _CLIENT_ID{
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
|
||||
@@ -102,6 +102,7 @@ TYPE_EQUIVALENCE = [
|
||||
('LPPROC_THREAD_ATTRIBUTE_LIST', 'PVOID'),
|
||||
('LPUNKNOWN', 'POINTER(PVOID)'),
|
||||
('SPC_UUID', 'BYTE * 16'),
|
||||
('PIO_APC_ROUTINE', 'PVOID'),
|
||||
#STUFF FOR COM (will be replace at runtime
|
||||
# real def in com_interface_header
|
||||
# ('GUID', 'PVOID'),
|
||||
@@ -790,6 +791,7 @@ structs.append_input_file(from_here("definitions\\display_struct.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_bits.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_alpc.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_evtlog.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_file_info.txt"))
|
||||
|
||||
functions = FuncGenerator(from_here("definitions\\winfunc.txt"), from_here(r"..\windows\generated_def\\winfuncs.py"), dependances=[structs])
|
||||
functions.append_input_file(from_here("definitions\\winfunc_crypto_wintrust.txt"))
|
||||
|
||||
@@ -11019,6 +11019,350 @@ _EVENTLOG_FULL_INFORMATION
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
_FILE_INTERNAL_INFORMATION
|
||||
''''''''''''''''''''''''''
|
||||
.. class:: FILE_INTERNAL_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_INTERNAL_INFORMATION`
|
||||
|
||||
.. class:: PFILE_INTERNAL_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_INTERNAL_INFORMATION`
|
||||
|
||||
.. class:: _FILE_INTERNAL_INFORMATION
|
||||
|
||||
.. attribute:: IndexNumber
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
_FILE_ALIGNMENT_INFORMATION
|
||||
'''''''''''''''''''''''''''
|
||||
.. class:: PFILE_ALIGNMENT_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_ALIGNMENT_INFORMATION`
|
||||
|
||||
.. class:: FILE_ALIGNMENT_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_ALIGNMENT_INFORMATION`
|
||||
|
||||
.. class:: _FILE_ALIGNMENT_INFORMATION
|
||||
|
||||
.. attribute:: AlignmentRequirement
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_ATTRIBUTE_TAG_INFORMATION
|
||||
'''''''''''''''''''''''''''''''
|
||||
.. class:: PFILE_ATTRIBUTE_TAG_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_ATTRIBUTE_TAG_INFORMATION`
|
||||
|
||||
.. class:: FILE_ATTRIBUTE_TAG_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_ATTRIBUTE_TAG_INFORMATION`
|
||||
|
||||
.. class:: _FILE_ATTRIBUTE_TAG_INFORMATION
|
||||
|
||||
.. attribute:: FileAttributes
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: ReparseTag
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_BASIC_INFORMATION
|
||||
'''''''''''''''''''''''
|
||||
.. class:: FILE_BASIC_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_BASIC_INFORMATION`
|
||||
|
||||
.. class:: PFILE_BASIC_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_BASIC_INFORMATION`
|
||||
|
||||
.. class:: _FILE_BASIC_INFORMATION
|
||||
|
||||
.. attribute:: CreationTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: LastAccessTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: LastWriteTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: ChangeTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: FileAttributes
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_EA_INFORMATION
|
||||
''''''''''''''''''''
|
||||
.. class:: PFILE_EA_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_EA_INFORMATION`
|
||||
|
||||
.. class:: FILE_EA_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_EA_INFORMATION`
|
||||
|
||||
.. class:: _FILE_EA_INFORMATION
|
||||
|
||||
.. attribute:: EaSize
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_IO_PRIORITY_HINT_INFORMATION
|
||||
''''''''''''''''''''''''''''''''''
|
||||
.. class:: PFILE_IO_PRIORITY_HINT_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_IO_PRIORITY_HINT_INFORMATION`
|
||||
|
||||
.. class:: FILE_IO_PRIORITY_HINT_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_IO_PRIORITY_HINT_INFORMATION`
|
||||
|
||||
.. class:: _FILE_IO_PRIORITY_HINT_INFORMATION
|
||||
|
||||
.. attribute:: PriorityHint
|
||||
|
||||
:class:`IO_PRIORITY_HINT`
|
||||
|
||||
_FILE_MODE_INFORMATION
|
||||
''''''''''''''''''''''
|
||||
.. class:: PFILE_MODE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_MODE_INFORMATION`
|
||||
|
||||
.. class:: FILE_MODE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_MODE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_MODE_INFORMATION
|
||||
|
||||
.. attribute:: Mode
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_NAME_INFORMATION
|
||||
''''''''''''''''''''''
|
||||
.. class:: PFILE_NAME_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_NAME_INFORMATION`
|
||||
|
||||
.. class:: FILE_NAME_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_NAME_INFORMATION`
|
||||
|
||||
.. class:: _FILE_NAME_INFORMATION
|
||||
|
||||
.. attribute:: FileNameLength
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: FileName
|
||||
|
||||
:class:`WCHAR` ``[1]``
|
||||
|
||||
_FILE_NETWORK_OPEN_INFORMATION
|
||||
''''''''''''''''''''''''''''''
|
||||
.. class:: PFILE_NETWORK_OPEN_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_NETWORK_OPEN_INFORMATION`
|
||||
|
||||
.. class:: FILE_NETWORK_OPEN_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_NETWORK_OPEN_INFORMATION`
|
||||
|
||||
.. class:: _FILE_NETWORK_OPEN_INFORMATION
|
||||
|
||||
.. attribute:: CreationTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: LastAccessTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: LastWriteTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: ChangeTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: AllocationSize
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: EndOfFile
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: FileAttributes
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_STANDARD_INFORMATION
|
||||
''''''''''''''''''''''''''
|
||||
.. class:: FILE_STANDARD_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_STANDARD_INFORMATION`
|
||||
|
||||
.. class:: PFILE_STANDARD_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_STANDARD_INFORMATION`
|
||||
|
||||
.. class:: _FILE_STANDARD_INFORMATION
|
||||
|
||||
.. attribute:: AllocationSize
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: EndOfFile
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: NumberOfLinks
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: DeletePending
|
||||
|
||||
:class:`BOOLEAN`
|
||||
|
||||
|
||||
.. attribute:: Directory
|
||||
|
||||
:class:`BOOLEAN`
|
||||
|
||||
_FILE_ACCESS_INFORMATION
|
||||
''''''''''''''''''''''''
|
||||
.. class:: FILE_ACCESS_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_ACCESS_INFORMATION`
|
||||
|
||||
.. class:: PFILE_ACCESS_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_ACCESS_INFORMATION`
|
||||
|
||||
.. class:: _FILE_ACCESS_INFORMATION
|
||||
|
||||
.. attribute:: AccessFlags
|
||||
|
||||
:class:`ACCESS_MASK`
|
||||
|
||||
_FILE_POSITION_INFORMATION
|
||||
''''''''''''''''''''''''''
|
||||
.. class:: PFILE_POSITION_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_POSITION_INFORMATION`
|
||||
|
||||
.. class:: FILE_POSITION_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_POSITION_INFORMATION`
|
||||
|
||||
.. class:: _FILE_POSITION_INFORMATION
|
||||
|
||||
.. attribute:: CurrentByteOffset
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
_FILE_IS_REMOTE_DEVICE_INFORMATION
|
||||
''''''''''''''''''''''''''''''''''
|
||||
.. class:: FILE_IS_REMOTE_DEVICE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_IS_REMOTE_DEVICE_INFORMATION`
|
||||
|
||||
.. class:: PFILE_IS_REMOTE_DEVICE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_IS_REMOTE_DEVICE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_IS_REMOTE_DEVICE_INFORMATION
|
||||
|
||||
.. attribute:: IsRemote
|
||||
|
||||
:class:`BOOLEAN`
|
||||
|
||||
_FILE_ALL_INFORMATION
|
||||
'''''''''''''''''''''
|
||||
.. class:: PFILE_ALL_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_ALL_INFORMATION`
|
||||
|
||||
.. class:: FILE_ALL_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_ALL_INFORMATION`
|
||||
|
||||
.. class:: _FILE_ALL_INFORMATION
|
||||
|
||||
.. attribute:: BasicInformation
|
||||
|
||||
:class:`FILE_BASIC_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: StandardInformation
|
||||
|
||||
:class:`FILE_STANDARD_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: InternalInformation
|
||||
|
||||
:class:`FILE_INTERNAL_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: EaInformation
|
||||
|
||||
:class:`FILE_EA_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: AccessInformation
|
||||
|
||||
:class:`FILE_ACCESS_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: PositionInformation
|
||||
|
||||
:class:`FILE_POSITION_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: ModeInformation
|
||||
|
||||
:class:`FILE_MODE_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: AlignmentInformation
|
||||
|
||||
:class:`FILE_ALIGNMENT_INFORMATION`
|
||||
|
||||
|
||||
.. attribute:: NameInformation
|
||||
|
||||
:class:`FILE_NAME_INFORMATION`
|
||||
|
||||
WinEnums
|
||||
--------
|
||||
_SYSTEM_INFORMATION_CLASS
|
||||
@@ -13379,3 +13723,245 @@ _ALPC_MESSAGE_INFORMATION_CLASS
|
||||
|
||||
.. attribute:: AlpcMessageHandleInformation(3)
|
||||
|
||||
_FILE_INFORMATION_CLASS
|
||||
'''''''''''''''''''''''
|
||||
.. class:: FILE_INFORMATION_CLASS
|
||||
|
||||
Alias for :class:`_FILE_INFORMATION_CLASS`
|
||||
|
||||
.. class:: PFILE_INFORMATION_CLASS
|
||||
|
||||
Pointer to :class:`_FILE_INFORMATION_CLASS`
|
||||
|
||||
.. class:: _FILE_INFORMATION_CLASS
|
||||
|
||||
|
||||
.. attribute:: FakeFileInformationZero(0)
|
||||
|
||||
|
||||
.. attribute:: FileDirectoryInformation(1)
|
||||
|
||||
|
||||
.. attribute:: FileFullDirectoryInformation(2)
|
||||
|
||||
|
||||
.. attribute:: FileBothDirectoryInformation(3)
|
||||
|
||||
|
||||
.. attribute:: FileBasicInformation(4)
|
||||
|
||||
|
||||
.. attribute:: FileStandardInformation(5)
|
||||
|
||||
|
||||
.. attribute:: FileInternalInformation(6)
|
||||
|
||||
|
||||
.. attribute:: FileEaInformation(7)
|
||||
|
||||
|
||||
.. attribute:: FileAccessInformation(8)
|
||||
|
||||
|
||||
.. attribute:: FileNameInformation(9)
|
||||
|
||||
|
||||
.. attribute:: FileRenameInformation(10)
|
||||
|
||||
|
||||
.. attribute:: FileLinkInformation(11)
|
||||
|
||||
|
||||
.. attribute:: FileNamesInformation(12)
|
||||
|
||||
|
||||
.. attribute:: FileDispositionInformation(13)
|
||||
|
||||
|
||||
.. attribute:: FilePositionInformation(14)
|
||||
|
||||
|
||||
.. attribute:: FileFullEaInformation(15)
|
||||
|
||||
|
||||
.. attribute:: FileModeInformation(16)
|
||||
|
||||
|
||||
.. attribute:: FileAlignmentInformation(17)
|
||||
|
||||
|
||||
.. attribute:: FileAllInformation(18)
|
||||
|
||||
|
||||
.. attribute:: FileAllocationInformation(19)
|
||||
|
||||
|
||||
.. attribute:: FileEndOfFileInformation(20)
|
||||
|
||||
|
||||
.. attribute:: FileAlternateNameInformation(21)
|
||||
|
||||
|
||||
.. attribute:: FileStreamInformation(22)
|
||||
|
||||
|
||||
.. attribute:: FilePipeInformation(23)
|
||||
|
||||
|
||||
.. attribute:: FilePipeLocalInformation(24)
|
||||
|
||||
|
||||
.. attribute:: FilePipeRemoteInformation(25)
|
||||
|
||||
|
||||
.. attribute:: FileMailslotQueryInformation(26)
|
||||
|
||||
|
||||
.. attribute:: FileMailslotSetInformation(27)
|
||||
|
||||
|
||||
.. attribute:: FileCompressionInformation(28)
|
||||
|
||||
|
||||
.. attribute:: FileObjectIdInformation(29)
|
||||
|
||||
|
||||
.. attribute:: FileCompletionInformation(30)
|
||||
|
||||
|
||||
.. attribute:: FileMoveClusterInformation(31)
|
||||
|
||||
|
||||
.. attribute:: FileQuotaInformation(32)
|
||||
|
||||
|
||||
.. attribute:: FileReparsePointInformation(33)
|
||||
|
||||
|
||||
.. attribute:: FileNetworkOpenInformation(34)
|
||||
|
||||
|
||||
.. attribute:: FileAttributeTagInformation(35)
|
||||
|
||||
|
||||
.. attribute:: FileTrackingInformation(36)
|
||||
|
||||
|
||||
.. attribute:: FileIdBothDirectoryInformation(37)
|
||||
|
||||
|
||||
.. attribute:: FileIdFullDirectoryInformation(38)
|
||||
|
||||
|
||||
.. attribute:: FileValidDataLengthInformation(39)
|
||||
|
||||
|
||||
.. attribute:: FileShortNameInformation(40)
|
||||
|
||||
|
||||
.. attribute:: FileIoCompletionNotificationInformation(41)
|
||||
|
||||
|
||||
.. attribute:: FileIoStatusBlockRangeInformation(42)
|
||||
|
||||
|
||||
.. attribute:: FileIoPriorityHintInformation(43)
|
||||
|
||||
|
||||
.. attribute:: FileSfioReserveInformation(44)
|
||||
|
||||
|
||||
.. attribute:: FileSfioVolumeInformation(45)
|
||||
|
||||
|
||||
.. attribute:: FileHardLinkInformation(46)
|
||||
|
||||
|
||||
.. attribute:: FileProcessIdsUsingFileInformation(47)
|
||||
|
||||
|
||||
.. attribute:: FileNormalizedNameInformation(48)
|
||||
|
||||
|
||||
.. attribute:: FileNetworkPhysicalNameInformation(49)
|
||||
|
||||
|
||||
.. attribute:: FileIdGlobalTxDirectoryInformation(50)
|
||||
|
||||
|
||||
.. attribute:: FileIsRemoteDeviceInformation(51)
|
||||
|
||||
|
||||
.. attribute:: FileUnusedInformation(52)
|
||||
|
||||
|
||||
.. attribute:: FileNumaNodeInformation(53)
|
||||
|
||||
|
||||
.. attribute:: FileStandardLinkInformation(54)
|
||||
|
||||
|
||||
.. attribute:: FileRemoteProtocolInformation(55)
|
||||
|
||||
|
||||
.. attribute:: FileRenameInformationBypassAccessCheck(56)
|
||||
|
||||
|
||||
.. attribute:: FileLinkInformationBypassAccessCheck(57)
|
||||
|
||||
|
||||
.. attribute:: FileVolumeNameInformation(58)
|
||||
|
||||
|
||||
.. attribute:: FileIdInformation(59)
|
||||
|
||||
|
||||
.. attribute:: FileIdExtdDirectoryInformation(60)
|
||||
|
||||
|
||||
.. attribute:: FileReplaceCompletionInformation(61)
|
||||
|
||||
|
||||
.. attribute:: FileHardLinkFullIdInformation(62)
|
||||
|
||||
|
||||
.. attribute:: FileIdExtdBothDirectoryInformation(63)
|
||||
|
||||
|
||||
.. attribute:: FileDispositionInformationEx(64)
|
||||
|
||||
|
||||
.. attribute:: FileRenameInformationEx(65)
|
||||
|
||||
|
||||
.. attribute:: FileRenameInformationExBypassAccessCheck(66)
|
||||
|
||||
|
||||
.. attribute:: FileMaximumInformation(67)
|
||||
|
||||
_IO_PRIORITY_HINT
|
||||
'''''''''''''''''
|
||||
.. class:: IO_PRIORITY_HINT
|
||||
|
||||
Alias for :class:`_IO_PRIORITY_HINT`
|
||||
|
||||
.. class:: _IO_PRIORITY_HINT
|
||||
|
||||
|
||||
.. attribute:: IoPriorityVeryLow(0)
|
||||
|
||||
|
||||
.. attribute:: IoPriorityLow(1)
|
||||
|
||||
|
||||
.. attribute:: IoPriorityNormal(2)
|
||||
|
||||
|
||||
.. attribute:: IoPriorityHigh(3)
|
||||
|
||||
|
||||
.. attribute:: IoPriorityCritical(4)
|
||||
|
||||
|
||||
.. attribute:: MaxIoPriorityTypes(5)
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -85,6 +85,7 @@ PSECURITY_DESCRIPTOR = PVOID
|
||||
LPPROC_THREAD_ATTRIBUTE_LIST = PVOID
|
||||
LPUNKNOWN = POINTER(PVOID)
|
||||
SPC_UUID = BYTE * 16
|
||||
PIO_APC_ROUTINE = PVOID
|
||||
PWINDBG_EXTENSION_APIS32 = PVOID
|
||||
PWINDBG_EXTENSION_APIS64 = PVOID
|
||||
LPCONTEXT = PVOID
|
||||
@@ -1026,6 +1027,93 @@ ALPC_MESSAGE_INFORMATION_CLASS = _ALPC_MESSAGE_INFORMATION_CLASS
|
||||
PALPC_MESSAGE_INFORMATION_CLASS = POINTER(_ALPC_MESSAGE_INFORMATION_CLASS)
|
||||
|
||||
|
||||
FakeFileInformationZero = EnumValue("_FILE_INFORMATION_CLASS", "FakeFileInformationZero", 0x0)
|
||||
FileDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileDirectoryInformation", 0x1)
|
||||
FileFullDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileFullDirectoryInformation", 0x2)
|
||||
FileBothDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileBothDirectoryInformation", 0x3)
|
||||
FileBasicInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileBasicInformation", 0x4)
|
||||
FileStandardInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileStandardInformation", 0x5)
|
||||
FileInternalInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileInternalInformation", 0x6)
|
||||
FileEaInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileEaInformation", 0x7)
|
||||
FileAccessInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileAccessInformation", 0x8)
|
||||
FileNameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileNameInformation", 0x9)
|
||||
FileRenameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileRenameInformation", 0xa)
|
||||
FileLinkInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileLinkInformation", 0xb)
|
||||
FileNamesInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileNamesInformation", 0xc)
|
||||
FileDispositionInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileDispositionInformation", 0xd)
|
||||
FilePositionInformation = EnumValue("_FILE_INFORMATION_CLASS", "FilePositionInformation", 0xe)
|
||||
FileFullEaInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileFullEaInformation", 0xf)
|
||||
FileModeInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileModeInformation", 0x10)
|
||||
FileAlignmentInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileAlignmentInformation", 0x11)
|
||||
FileAllInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileAllInformation", 0x12)
|
||||
FileAllocationInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileAllocationInformation", 0x13)
|
||||
FileEndOfFileInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileEndOfFileInformation", 0x14)
|
||||
FileAlternateNameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileAlternateNameInformation", 0x15)
|
||||
FileStreamInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileStreamInformation", 0x16)
|
||||
FilePipeInformation = EnumValue("_FILE_INFORMATION_CLASS", "FilePipeInformation", 0x17)
|
||||
FilePipeLocalInformation = EnumValue("_FILE_INFORMATION_CLASS", "FilePipeLocalInformation", 0x18)
|
||||
FilePipeRemoteInformation = EnumValue("_FILE_INFORMATION_CLASS", "FilePipeRemoteInformation", 0x19)
|
||||
FileMailslotQueryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileMailslotQueryInformation", 0x1a)
|
||||
FileMailslotSetInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileMailslotSetInformation", 0x1b)
|
||||
FileCompressionInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileCompressionInformation", 0x1c)
|
||||
FileObjectIdInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileObjectIdInformation", 0x1d)
|
||||
FileCompletionInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileCompletionInformation", 0x1e)
|
||||
FileMoveClusterInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileMoveClusterInformation", 0x1f)
|
||||
FileQuotaInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileQuotaInformation", 0x20)
|
||||
FileReparsePointInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileReparsePointInformation", 0x21)
|
||||
FileNetworkOpenInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileNetworkOpenInformation", 0x22)
|
||||
FileAttributeTagInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileAttributeTagInformation", 0x23)
|
||||
FileTrackingInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileTrackingInformation", 0x24)
|
||||
FileIdBothDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIdBothDirectoryInformation", 0x25)
|
||||
FileIdFullDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIdFullDirectoryInformation", 0x26)
|
||||
FileValidDataLengthInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileValidDataLengthInformation", 0x27)
|
||||
FileShortNameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileShortNameInformation", 0x28)
|
||||
FileIoCompletionNotificationInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIoCompletionNotificationInformation", 0x29)
|
||||
FileIoStatusBlockRangeInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIoStatusBlockRangeInformation", 0x2a)
|
||||
FileIoPriorityHintInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIoPriorityHintInformation", 0x2b)
|
||||
FileSfioReserveInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileSfioReserveInformation", 0x2c)
|
||||
FileSfioVolumeInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileSfioVolumeInformation", 0x2d)
|
||||
FileHardLinkInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileHardLinkInformation", 0x2e)
|
||||
FileProcessIdsUsingFileInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileProcessIdsUsingFileInformation", 0x2f)
|
||||
FileNormalizedNameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileNormalizedNameInformation", 0x30)
|
||||
FileNetworkPhysicalNameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileNetworkPhysicalNameInformation", 0x31)
|
||||
FileIdGlobalTxDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIdGlobalTxDirectoryInformation", 0x32)
|
||||
FileIsRemoteDeviceInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIsRemoteDeviceInformation", 0x33)
|
||||
FileUnusedInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileUnusedInformation", 0x34)
|
||||
FileNumaNodeInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileNumaNodeInformation", 0x35)
|
||||
FileStandardLinkInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileStandardLinkInformation", 0x36)
|
||||
FileRemoteProtocolInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileRemoteProtocolInformation", 0x37)
|
||||
FileRenameInformationBypassAccessCheck = EnumValue("_FILE_INFORMATION_CLASS", "FileRenameInformationBypassAccessCheck", 0x38)
|
||||
FileLinkInformationBypassAccessCheck = EnumValue("_FILE_INFORMATION_CLASS", "FileLinkInformationBypassAccessCheck", 0x39)
|
||||
FileVolumeNameInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileVolumeNameInformation", 0x3a)
|
||||
FileIdInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIdInformation", 0x3b)
|
||||
FileIdExtdDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIdExtdDirectoryInformation", 0x3c)
|
||||
FileReplaceCompletionInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileReplaceCompletionInformation", 0x3d)
|
||||
FileHardLinkFullIdInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileHardLinkFullIdInformation", 0x3e)
|
||||
FileIdExtdBothDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileIdExtdBothDirectoryInformation", 0x3f)
|
||||
FileDispositionInformationEx = EnumValue("_FILE_INFORMATION_CLASS", "FileDispositionInformationEx", 0x40)
|
||||
FileRenameInformationEx = EnumValue("_FILE_INFORMATION_CLASS", "FileRenameInformationEx", 0x41)
|
||||
FileRenameInformationExBypassAccessCheck = EnumValue("_FILE_INFORMATION_CLASS", "FileRenameInformationExBypassAccessCheck", 0x42)
|
||||
FileMaximumInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileMaximumInformation", 0x43)
|
||||
class _FILE_INFORMATION_CLASS(EnumType):
|
||||
values = [FakeFileInformationZero, FileDirectoryInformation, FileFullDirectoryInformation, FileBothDirectoryInformation, FileBasicInformation, FileStandardInformation, FileInternalInformation, FileEaInformation, FileAccessInformation, FileNameInformation, FileRenameInformation, FileLinkInformation, FileNamesInformation, FileDispositionInformation, FilePositionInformation, FileFullEaInformation, FileModeInformation, FileAlignmentInformation, FileAllInformation, FileAllocationInformation, FileEndOfFileInformation, FileAlternateNameInformation, FileStreamInformation, FilePipeInformation, FilePipeLocalInformation, FilePipeRemoteInformation, FileMailslotQueryInformation, FileMailslotSetInformation, FileCompressionInformation, FileObjectIdInformation, FileCompletionInformation, FileMoveClusterInformation, FileQuotaInformation, FileReparsePointInformation, FileNetworkOpenInformation, FileAttributeTagInformation, FileTrackingInformation, FileIdBothDirectoryInformation, FileIdFullDirectoryInformation, FileValidDataLengthInformation, FileShortNameInformation, FileIoCompletionNotificationInformation, FileIoStatusBlockRangeInformation, FileIoPriorityHintInformation, FileSfioReserveInformation, FileSfioVolumeInformation, FileHardLinkInformation, FileProcessIdsUsingFileInformation, FileNormalizedNameInformation, FileNetworkPhysicalNameInformation, FileIdGlobalTxDirectoryInformation, FileIsRemoteDeviceInformation, FileUnusedInformation, FileNumaNodeInformation, FileStandardLinkInformation, FileRemoteProtocolInformation, FileRenameInformationBypassAccessCheck, FileLinkInformationBypassAccessCheck, FileVolumeNameInformation, FileIdInformation, FileIdExtdDirectoryInformation, FileReplaceCompletionInformation, FileHardLinkFullIdInformation, FileIdExtdBothDirectoryInformation, FileDispositionInformationEx, FileRenameInformationEx, FileRenameInformationExBypassAccessCheck, FileMaximumInformation]
|
||||
mapper = {x:x for x in values}
|
||||
FILE_INFORMATION_CLASS = _FILE_INFORMATION_CLASS
|
||||
PFILE_INFORMATION_CLASS = POINTER(_FILE_INFORMATION_CLASS)
|
||||
|
||||
|
||||
IoPriorityVeryLow = EnumValue("_IO_PRIORITY_HINT", "IoPriorityVeryLow", 0x0)
|
||||
IoPriorityLow = EnumValue("_IO_PRIORITY_HINT", "IoPriorityLow", 0x1)
|
||||
IoPriorityNormal = EnumValue("_IO_PRIORITY_HINT", "IoPriorityNormal", 0x2)
|
||||
IoPriorityHigh = EnumValue("_IO_PRIORITY_HINT", "IoPriorityHigh", 0x3)
|
||||
IoPriorityCritical = EnumValue("_IO_PRIORITY_HINT", "IoPriorityCritical", 0x4)
|
||||
MaxIoPriorityTypes = EnumValue("_IO_PRIORITY_HINT", "MaxIoPriorityTypes", 0x5)
|
||||
class _IO_PRIORITY_HINT(EnumType):
|
||||
values = [IoPriorityVeryLow, IoPriorityLow, IoPriorityNormal, IoPriorityHigh, IoPriorityCritical, MaxIoPriorityTypes]
|
||||
mapper = {x:x for x in values}
|
||||
IO_PRIORITY_HINT = _IO_PRIORITY_HINT
|
||||
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _LIST_ENTRY(Structure): pass
|
||||
PLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
@@ -4516,3 +4604,125 @@ class _EVENTLOG_FULL_INFORMATION(Structure):
|
||||
]
|
||||
EVENTLOG_FULL_INFORMATION = _EVENTLOG_FULL_INFORMATION
|
||||
LPEVENTLOG_FULL_INFORMATION = POINTER(_EVENTLOG_FULL_INFORMATION)
|
||||
|
||||
class _FILE_INTERNAL_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("IndexNumber", LARGE_INTEGER),
|
||||
]
|
||||
FILE_INTERNAL_INFORMATION = _FILE_INTERNAL_INFORMATION
|
||||
PFILE_INTERNAL_INFORMATION = POINTER(_FILE_INTERNAL_INFORMATION)
|
||||
|
||||
class _FILE_ALIGNMENT_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("AlignmentRequirement", ULONG),
|
||||
]
|
||||
PFILE_ALIGNMENT_INFORMATION = POINTER(_FILE_ALIGNMENT_INFORMATION)
|
||||
FILE_ALIGNMENT_INFORMATION = _FILE_ALIGNMENT_INFORMATION
|
||||
|
||||
class _FILE_ATTRIBUTE_TAG_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("FileAttributes", ULONG),
|
||||
("ReparseTag", ULONG),
|
||||
]
|
||||
PFILE_ATTRIBUTE_TAG_INFORMATION = POINTER(_FILE_ATTRIBUTE_TAG_INFORMATION)
|
||||
FILE_ATTRIBUTE_TAG_INFORMATION = _FILE_ATTRIBUTE_TAG_INFORMATION
|
||||
|
||||
class _FILE_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("CreationTime", LARGE_INTEGER),
|
||||
("LastAccessTime", LARGE_INTEGER),
|
||||
("LastWriteTime", LARGE_INTEGER),
|
||||
("ChangeTime", LARGE_INTEGER),
|
||||
("FileAttributes", ULONG),
|
||||
]
|
||||
FILE_BASIC_INFORMATION = _FILE_BASIC_INFORMATION
|
||||
PFILE_BASIC_INFORMATION = POINTER(_FILE_BASIC_INFORMATION)
|
||||
|
||||
class _FILE_EA_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("EaSize", ULONG),
|
||||
]
|
||||
PFILE_EA_INFORMATION = POINTER(_FILE_EA_INFORMATION)
|
||||
FILE_EA_INFORMATION = _FILE_EA_INFORMATION
|
||||
|
||||
class _FILE_IO_PRIORITY_HINT_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("PriorityHint", IO_PRIORITY_HINT),
|
||||
]
|
||||
PFILE_IO_PRIORITY_HINT_INFORMATION = POINTER(_FILE_IO_PRIORITY_HINT_INFORMATION)
|
||||
FILE_IO_PRIORITY_HINT_INFORMATION = _FILE_IO_PRIORITY_HINT_INFORMATION
|
||||
|
||||
class _FILE_MODE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Mode", ULONG),
|
||||
]
|
||||
PFILE_MODE_INFORMATION = POINTER(_FILE_MODE_INFORMATION)
|
||||
FILE_MODE_INFORMATION = _FILE_MODE_INFORMATION
|
||||
|
||||
class _FILE_NAME_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("FileNameLength", ULONG),
|
||||
("FileName", WCHAR * 1),
|
||||
]
|
||||
PFILE_NAME_INFORMATION = POINTER(_FILE_NAME_INFORMATION)
|
||||
FILE_NAME_INFORMATION = _FILE_NAME_INFORMATION
|
||||
|
||||
class _FILE_NETWORK_OPEN_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("CreationTime", LARGE_INTEGER),
|
||||
("LastAccessTime", LARGE_INTEGER),
|
||||
("LastWriteTime", LARGE_INTEGER),
|
||||
("ChangeTime", LARGE_INTEGER),
|
||||
("AllocationSize", LARGE_INTEGER),
|
||||
("EndOfFile", LARGE_INTEGER),
|
||||
("FileAttributes", ULONG),
|
||||
]
|
||||
PFILE_NETWORK_OPEN_INFORMATION = POINTER(_FILE_NETWORK_OPEN_INFORMATION)
|
||||
FILE_NETWORK_OPEN_INFORMATION = _FILE_NETWORK_OPEN_INFORMATION
|
||||
|
||||
class _FILE_STANDARD_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("AllocationSize", LARGE_INTEGER),
|
||||
("EndOfFile", LARGE_INTEGER),
|
||||
("NumberOfLinks", ULONG),
|
||||
("DeletePending", BOOLEAN),
|
||||
("Directory", BOOLEAN),
|
||||
]
|
||||
FILE_STANDARD_INFORMATION = _FILE_STANDARD_INFORMATION
|
||||
PFILE_STANDARD_INFORMATION = POINTER(_FILE_STANDARD_INFORMATION)
|
||||
|
||||
class _FILE_ACCESS_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("AccessFlags", ACCESS_MASK),
|
||||
]
|
||||
FILE_ACCESS_INFORMATION = _FILE_ACCESS_INFORMATION
|
||||
PFILE_ACCESS_INFORMATION = POINTER(_FILE_ACCESS_INFORMATION)
|
||||
|
||||
class _FILE_POSITION_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("CurrentByteOffset", LARGE_INTEGER),
|
||||
]
|
||||
PFILE_POSITION_INFORMATION = POINTER(_FILE_POSITION_INFORMATION)
|
||||
FILE_POSITION_INFORMATION = _FILE_POSITION_INFORMATION
|
||||
|
||||
class _FILE_IS_REMOTE_DEVICE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("IsRemote", BOOLEAN),
|
||||
]
|
||||
FILE_IS_REMOTE_DEVICE_INFORMATION = _FILE_IS_REMOTE_DEVICE_INFORMATION
|
||||
PFILE_IS_REMOTE_DEVICE_INFORMATION = POINTER(_FILE_IS_REMOTE_DEVICE_INFORMATION)
|
||||
|
||||
class _FILE_ALL_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("BasicInformation", FILE_BASIC_INFORMATION),
|
||||
("StandardInformation", FILE_STANDARD_INFORMATION),
|
||||
("InternalInformation", FILE_INTERNAL_INFORMATION),
|
||||
("EaInformation", FILE_EA_INFORMATION),
|
||||
("AccessInformation", FILE_ACCESS_INFORMATION),
|
||||
("PositionInformation", FILE_POSITION_INFORMATION),
|
||||
("ModeInformation", FILE_MODE_INFORMATION),
|
||||
("AlignmentInformation", FILE_ALIGNMENT_INFORMATION),
|
||||
("NameInformation", FILE_NAME_INFORMATION),
|
||||
]
|
||||
PFILE_ALL_INFORMATION = POINTER(_FILE_ALL_INFORMATION)
|
||||
FILE_ALL_INFORMATION = _FILE_ALL_INFORMATION
|
||||
|
||||
@@ -8,8 +8,9 @@ from collections import namedtuple
|
||||
|
||||
import windows
|
||||
from windows.dbgprint import dbgprint
|
||||
import windows.generated_def as gdef
|
||||
|
||||
from .. import winproxy
|
||||
from ..generated_def import windef
|
||||
from ..generated_def.winstructs import *
|
||||
|
||||
|
||||
@@ -62,15 +63,15 @@ def create_console():
|
||||
"""Create a new console displaying STDOUT.
|
||||
Useful in injection of GUI process"""
|
||||
winproxy.AllocConsole()
|
||||
stdout_handle = winproxy.GetStdHandle(windef.STD_OUTPUT_HANDLE)
|
||||
stdout_handle = winproxy.GetStdHandle(gdef.STD_OUTPUT_HANDLE)
|
||||
console_stdout = create_file_from_handle(stdout_handle, "w")
|
||||
sys.stdout = console_stdout
|
||||
|
||||
stdin_handle = winproxy.GetStdHandle(windef.STD_INPUT_HANDLE)
|
||||
stdin_handle = winproxy.GetStdHandle(gdef.STD_INPUT_HANDLE)
|
||||
console_stdin = create_file_from_handle(stdin_handle, "r+")
|
||||
sys.stdin = console_stdin
|
||||
|
||||
stderr_handle = winproxy.GetStdHandle(windef.STD_ERROR_HANDLE)
|
||||
stderr_handle = winproxy.GetStdHandle(gdef.STD_ERROR_HANDLE)
|
||||
console_stderr = create_file_from_handle(stderr_handle, "w")
|
||||
sys.stderr = console_stderr
|
||||
|
||||
@@ -129,7 +130,7 @@ def enable_privilege(lpszPrivilege, bEnablePrivilege):
|
||||
tp.Privileges[0].Attributes = 0
|
||||
winproxy.AdjustTokenPrivileges(hToken, False, byref(tp), sizeof(TOKEN_PRIVILEGES))
|
||||
winproxy.CloseHandle(hToken)
|
||||
if winproxy.GetLastError() == windef.ERROR_NOT_ALL_ASSIGNED:
|
||||
if winproxy.GetLastError() == gdef.ERROR_NOT_ALL_ASSIGNED:
|
||||
raise ValueError("Failed to get privilege {0}".format(lpszPrivilege))
|
||||
return True
|
||||
|
||||
@@ -214,6 +215,50 @@ def get_kernel_modules_syswow64():
|
||||
return list(modules)
|
||||
|
||||
|
||||
# Split winutils.py ?
|
||||
|
||||
ntqueryinformationfile_info_structs = {
|
||||
gdef.FileAccessInformation: gdef.FILE_ACCESS_INFORMATION,
|
||||
gdef.FileAlignmentInformation: gdef.FILE_ALIGNMENT_INFORMATION,
|
||||
gdef.FileAllInformation: gdef.FILE_ALL_INFORMATION,
|
||||
gdef.FileAttributeTagInformation: gdef.FILE_ATTRIBUTE_TAG_INFORMATION,
|
||||
gdef.FileBasicInformation: gdef.FILE_BASIC_INFORMATION,
|
||||
gdef.FileEaInformation: gdef.FILE_EA_INFORMATION ,
|
||||
gdef.FileInternalInformation: gdef.FILE_INTERNAL_INFORMATION,
|
||||
gdef.FileIoPriorityHintInformation: gdef.FILE_IO_PRIORITY_HINT_INFORMATION,
|
||||
gdef.FileModeInformation: gdef.FILE_MODE_INFORMATION,
|
||||
gdef.FileNetworkOpenInformation: gdef.FILE_NETWORK_OPEN_INFORMATION,
|
||||
gdef.FileNameInformation: gdef.FILE_NAME_INFORMATION,
|
||||
gdef.FilePositionInformation: gdef.FILE_POSITION_INFORMATION,
|
||||
gdef.FileStandardInformation: gdef.FILE_STANDARD_INFORMATION,
|
||||
gdef.FileIsRemoteDeviceInformation: gdef.FILE_IS_REMOTE_DEVICE_INFORMATION,
|
||||
}
|
||||
|
||||
def query_file_informations(handle, file_info_class):
|
||||
io_status = gdef.IO_STATUS_BLOCK()
|
||||
info = ntqueryinformationfile_info_structs[file_info_class]()
|
||||
# Do helper for 'is_pointer' / get pointed_size & co ? (useful for winproxy)
|
||||
pinfo = ctypes.pointer(info)
|
||||
try:
|
||||
windows.winproxy.NtQueryInformationFile(handle, io_status, pinfo, ctypes.sizeof(info), FileInformationClass=file_info_class)
|
||||
except Exception as e:
|
||||
if not (e.winerror & 0xffffffff) == gdef.STATUS_BUFFER_OVERFLOW:
|
||||
raise
|
||||
# STATUS_BUFFER_OVERFLOW -> Guess we have a FILE_NAME_INFORMATION somewhere that need a bigger buffer
|
||||
if file_info_class == gdef.FileNameInformation:
|
||||
file_name_length = pinfo[0].FileNameLength
|
||||
elif file_info_class == gdef.FileAllInformation:
|
||||
file_name_length = pinfo[0].NameInformation.FileNameLength
|
||||
else:
|
||||
raise
|
||||
full_size = ctypes.sizeof(info) + file_name_length # We add a little too much size for the sake of simplicity
|
||||
buffer = ctypes.c_buffer(full_size)
|
||||
windows.winproxy.NtQueryInformationFile(handle, io_status, buffer, full_size, FileInformationClass=file_info_class)
|
||||
pinfo = ctypes.cast(buffer, ctypes.POINTER(ntqueryinformationfile_info_structs[file_info_class]))
|
||||
info = pinfo[0]
|
||||
return info
|
||||
|
||||
|
||||
# String stuff
|
||||
def ntstatus(code):
|
||||
return windows.generated_def.ntstatus.NtStatusException(code)
|
||||
@@ -229,6 +274,7 @@ def get_long_path(path):
|
||||
rsize = winproxy.GetLongPathNameA(path, buffer, size)
|
||||
return buffer[:rsize]
|
||||
|
||||
|
||||
def get_short_path(path):
|
||||
"""Return the short path form for ``path``
|
||||
|
||||
@@ -239,6 +285,7 @@ def get_short_path(path):
|
||||
rsize = winproxy.GetShortPathNameA(path, buffer, size)
|
||||
return buffer[:rsize]
|
||||
|
||||
|
||||
def get_shared_mapping(name, size=0x1000):
|
||||
# TODO: real code
|
||||
h = windows.winproxy.CreateFileMappingA(INVALID_HANDLE_VALUE, dwMaximumSizeLow=size, lpName=name)
|
||||
@@ -285,7 +332,7 @@ class VirtualProtected(object):
|
||||
"""
|
||||
A context manager usable like `VirtualProtect` that will restore the old protection at exit ::
|
||||
|
||||
with utils.VirtualProtected(IATentry.addr, ctypes.sizeof(PVOID), windef.PAGE_EXECUTE_READWRITE):
|
||||
with utils.VirtualProtected(IATentry.addr, ctypes.sizeof(PVOID), gdef.PAGE_EXECUTE_READWRITE):
|
||||
IATentry.value = 0x42424242
|
||||
"""
|
||||
def __init__(self, addr, size, new_protect):
|
||||
|
||||
@@ -944,10 +944,26 @@ def NtOpenSymbolicLinkObject(LinkHandle, DesiredAccess, ObjectAttributes):
|
||||
return NtOpenSymbolicLinkObject.ctypes_function(LinkHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
|
||||
@NtdllProxy("NtQueryInformationFile", error_ntstatus)
|
||||
def NtQueryInformationFile(FileHandle, IoStatusBlock, FileInformation, Length=None, FileInformationClass=NeededParameter):
|
||||
if Length is None:
|
||||
Length = ctypes.sizeof(FileInformation)
|
||||
return NtQueryInformationFile.ctypes_function(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass)
|
||||
|
||||
|
||||
@NtdllProxy("NtQueryDirectoryFile", error_ntstatus)
|
||||
def NtQueryDirectoryFile(FileHandle, Event=None, ApcRoutine=None, ApcContext=None, IoStatusBlock=NeededParameter, FileInformation=NeededParameter, Length=None, FileInformationClass=NeededParameter, ReturnSingleEntry=NeededParameter, FileName=None, RestartScan=NeededParameter):
|
||||
if Length is None:
|
||||
Length = ctypes.sizeof(FileInformation)
|
||||
return NtQueryDirectoryFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, FileInformation, Length, FileInformationClass, ReturnSingleEntry, FileName, RestartScan)
|
||||
|
||||
|
||||
|
||||
@NtdllProxy("RtlDecompressBuffer", error_ntstatus)
|
||||
def RtlDecompressBuffer(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize):
|
||||
return RtlDecompressBuffer.ctypes_function(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize)
|
||||
|
||||
|
||||
# Section stuff
|
||||
|
||||
@NtdllProxy("NtCreateSection", error_ntstatus)
|
||||
|
||||
Reference in New Issue
Block a user