admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Testing of project tree rewriting

Browse Source
This commit is contained in:
hakril
2015-12-30 22:49:34 +01:00
parent c8bf7d04f8
commit 28eb4df2d0
45 changed files with 0 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/GetProcAddress_64b.asm
-151
View File
@@ -1,151 +0,0 @@
.CODE
start:
MY_FUNC PROC
call func
ret
func:
push rax ;Padding for calling alligned on 16 bytes + ret value
push rax
push rbx
push rcx
push rdx
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
;TODO save the QUEEN (and the registers !)
mov rax, 5050505050505050h ; libname
mov r11, rax
mov rax, 5151515151515151h ; function name
mov r12, rax
;String pushed !
mov rax, GS:[60h] ; PEB
mov rax, [rax + 6 * 4] ; RAX = ldr (+ 6 for 64 cause of 2 ptr)
mov rax, [rax + 8 * 4] ; RAX on the first elt of the list (first module)
mov rdx, rax
a_dest:
mov rax, rdx
mov rbx, [rax + 4 * 8] ;RBX : first base ! (base of current module)
and rbx, rbx ;If no more Module : not fail = fail
jz a_fail
mov rcx, [rax + 10 * 8] ;RCX = NAME (UNICODE_STRING.Buffer)
mov rdi, rcx
call strlen
mov rdi, rcx ; set RDI to good value
mov rcx, rax
mov rsi, r11
repe cmpsw ;cmp with current dll name (unicode)
test rcx, rcx
jz dll_found
mov rdx, [rdx]
jmp a_dest
a_fail:
push 42424242h
ret
dll_found: ;Cool ! : here rbx = base
mov eax, [rbx + 15 * 4] ;rax = PEBASE RVA
add rax, rbx ;RAX = PEBASE
add rax, 24 ;OPTIONAL HEADER
mov ecx, [rax + 112] ;rcx = RVA export dir
add rcx, rbx ;rcx = export_dir
mov rax, rcx ;RAX = export_dir
push rax ;Save it for after function search
; EBX = BASE | EAX = EXPORT DIR
mov ecx, [rax + 6 * 4]
mov r13, rcx ;r13 = NB names
mov edx, [rax + 8 * 4] ; EDX = names array RVA
add rdx, rbx
xor rcx, rcx
search_loop:
mov esi, [rdx + rcx * 4] ;Get function name RVA
add rsi, rbx ;Get name addr
push rcx ;Save current index (could use x64 register)
mov rdi, r11
mov rcx, 17 ;We know we want NtCreateThreadEx
repe cmpsb ;cmp with current export
mov eax, ecx
pop rcx ;Restore current function index
inc rcx
test eax, eax
jnz search_loop ;If not found not handled : WTF GetProcAddress not in Kernel32...
; Func found !
dec rcx
; rcx is offset of the name, need to find the offset of the function
pop rax ;Restore export_dir addr
mov edx, [rax + 9 * 4] ;EDX = AddressOfNameOrdinals RVX
add rdx, rbx ;AddressOfNameOrdinals + base
mov cx, [rdx + rcx * 2] ; ecx = Ieme ordinal (short array)
and rcx, 0ffffh
mov edx, [rax + 7 * 4] ; AddressOfFunctions RVA
add rdx, rbx ; AddressOfFunctions + base
mov edx, [rdx + rcx * 4] ;functions[ecx] -> functions[ordinals[i]]
add rdx, rbx
mov r13, rdx ; r13 : REAL FUNC ADD
; room for the thread handle
push 0
mov rcx, rsp ; arg1
mov rdx, 1fffffh ; arg2
mov r8, 0h ; arg3
mov r9, 4040404040404040h ; arg4 (handle)
mov rax, 0h
push rax ; arg11
push rax ; arg10
push rax ; arg9
push rax ; arg8
push rax ; arg7
mov rax, 4242424242424242h
push rax ; arg6 (param)
mov rax, 4141414141414141h
push rax ; arg5 (addr)
; reserve space for register (calling convention)
push r9
push r8
push rdx
push rcx
call r13
; Write return value in first stack value pushed
mov [rsp + 29 * 8], rax
; TODO CLEAN stack :D
add rsp, 8 * 8
add rsp, 32 + 8
add rsp, 32
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rdx
pop rcx
pop rbx
pop rax
pop rax ; Return value
ret
strlen:; arg in RDI
push rcx
xor rax, rax
xor rcx, rcx
dec rcx
repne scasw
not rcx
dec rcx
mov rax, rcx
pop rcx
ret
MY_FUNC ENDP
END
doc/make.bat
-263
View File
@@ -1,263 +0,0 @@
@ECHO OFF
REM Command file for Sphinx documentation
if "%SPHINXBUILD%" == "" (
set SPHINXBUILD=sphinx-build
)
set BUILDDIR=build
set ALLSPHINXOPTS=-d %BUILDDIR%/doctrees %SPHINXOPTS% source
set I18NSPHINXOPTS=%SPHINXOPTS% source
if NOT "%PAPER%" == "" (
set ALLSPHINXOPTS=-D latex_paper_size=%PAPER% %ALLSPHINXOPTS%
set I18NSPHINXOPTS=-D latex_paper_size=%PAPER% %I18NSPHINXOPTS%
)
if "%1" == "" goto help
if "%1" == "help" (
:help
echo.Please use `make ^<target^>` where ^<target^> is one of
echo. html to make standalone HTML files
echo. dirhtml to make HTML files named index.html in directories
echo. singlehtml to make a single large HTML file
echo. pickle to make pickle files
echo. json to make JSON files
echo. htmlhelp to make HTML files and a HTML help project
echo. qthelp to make HTML files and a qthelp project
echo. devhelp to make HTML files and a Devhelp project
echo. epub to make an epub
echo. latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter
echo. text to make text files
echo. man to make manual pages
echo. texinfo to make Texinfo files
echo. gettext to make PO message catalogs
echo. changes to make an overview over all changed/added/deprecated items
echo. xml to make Docutils-native XML files
echo. pseudoxml to make pseudoxml-XML files for display purposes
echo. linkcheck to check all external links for integrity
echo. doctest to run all doctests embedded in the documentation if enabled
echo. coverage to run coverage check of the documentation if enabled
goto end
)
if "%1" == "clean" (
for /d %%i in (%BUILDDIR%\*) do rmdir /q /s %%i
del /q /s %BUILDDIR%\*
goto end
)
REM Check if sphinx-build is available and fallback to Python version if any
%SPHINXBUILD% 2> nul
if errorlevel 9009 goto sphinx_python
goto sphinx_ok
:sphinx_python
set SPHINXBUILD=python -m sphinx.__init__
%SPHINXBUILD% 2> nul
if errorlevel 9009 (
echo.
echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
echo.installed, then set the SPHINXBUILD environment variable to point
echo.to the full path of the 'sphinx-build' executable. Alternatively you
echo.may add the Sphinx directory to PATH.
echo.
echo.If you don't have Sphinx installed, grab it from
echo.http://sphinx-doc.org/
exit /b 1
)
:sphinx_ok
if "%1" == "html" (
%SPHINXBUILD% -b html %ALLSPHINXOPTS% %BUILDDIR%/html
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The HTML pages are in %BUILDDIR%/html.
goto end
)
if "%1" == "dirhtml" (
%SPHINXBUILD% -b dirhtml %ALLSPHINXOPTS% %BUILDDIR%/dirhtml
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The HTML pages are in %BUILDDIR%/dirhtml.
goto end
)
if "%1" == "singlehtml" (
%SPHINXBUILD% -b singlehtml %ALLSPHINXOPTS% %BUILDDIR%/singlehtml
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The HTML pages are in %BUILDDIR%/singlehtml.
goto end
)
if "%1" == "pickle" (
%SPHINXBUILD% -b pickle %ALLSPHINXOPTS% %BUILDDIR%/pickle
if errorlevel 1 exit /b 1
echo.
echo.Build finished; now you can process the pickle files.
goto end
)
if "%1" == "json" (
%SPHINXBUILD% -b json %ALLSPHINXOPTS% %BUILDDIR%/json
if errorlevel 1 exit /b 1
echo.
echo.Build finished; now you can process the JSON files.
goto end
)
if "%1" == "htmlhelp" (
%SPHINXBUILD% -b htmlhelp %ALLSPHINXOPTS% %BUILDDIR%/htmlhelp
if errorlevel 1 exit /b 1
echo.
echo.Build finished; now you can run HTML Help Workshop with the ^
.hhp project file in %BUILDDIR%/htmlhelp.
goto end
)
if "%1" == "qthelp" (
%SPHINXBUILD% -b qthelp %ALLSPHINXOPTS% %BUILDDIR%/qthelp
if errorlevel 1 exit /b 1
echo.
echo.Build finished; now you can run "qcollectiongenerator" with the ^
.qhcp project file in %BUILDDIR%/qthelp, like this:
echo.^> qcollectiongenerator %BUILDDIR%\qthelp\PyWindows.qhcp
echo.To view the help file:
echo.^> assistant -collectionFile %BUILDDIR%\qthelp\PyWindows.ghc
goto end
)
if "%1" == "devhelp" (
%SPHINXBUILD% -b devhelp %ALLSPHINXOPTS% %BUILDDIR%/devhelp
if errorlevel 1 exit /b 1
echo.
echo.Build finished.
goto end
)
if "%1" == "epub" (
%SPHINXBUILD% -b epub %ALLSPHINXOPTS% %BUILDDIR%/epub
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The epub file is in %BUILDDIR%/epub.
goto end
)
if "%1" == "latex" (
%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
if errorlevel 1 exit /b 1
echo.
echo.Build finished; the LaTeX files are in %BUILDDIR%/latex.
goto end
)
if "%1" == "latexpdf" (
%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
cd %BUILDDIR%/latex
make all-pdf
cd %~dp0
echo.
echo.Build finished; the PDF files are in %BUILDDIR%/latex.
goto end
)
if "%1" == "latexpdfja" (
%SPHINXBUILD% -b latex %ALLSPHINXOPTS% %BUILDDIR%/latex
cd %BUILDDIR%/latex
make all-pdf-ja
cd %~dp0
echo.
echo.Build finished; the PDF files are in %BUILDDIR%/latex.
goto end
)
if "%1" == "text" (
%SPHINXBUILD% -b text %ALLSPHINXOPTS% %BUILDDIR%/text
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The text files are in %BUILDDIR%/text.
goto end
)
if "%1" == "man" (
%SPHINXBUILD% -b man %ALLSPHINXOPTS% %BUILDDIR%/man
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The manual pages are in %BUILDDIR%/man.
goto end
)
if "%1" == "texinfo" (
%SPHINXBUILD% -b texinfo %ALLSPHINXOPTS% %BUILDDIR%/texinfo
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The Texinfo files are in %BUILDDIR%/texinfo.
goto end
)
if "%1" == "gettext" (
%SPHINXBUILD% -b gettext %I18NSPHINXOPTS% %BUILDDIR%/locale
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The message catalogs are in %BUILDDIR%/locale.
goto end
)
if "%1" == "changes" (
%SPHINXBUILD% -b changes %ALLSPHINXOPTS% %BUILDDIR%/changes
if errorlevel 1 exit /b 1
echo.
echo.The overview file is in %BUILDDIR%/changes.
goto end
)
if "%1" == "linkcheck" (
%SPHINXBUILD% -b linkcheck %ALLSPHINXOPTS% %BUILDDIR%/linkcheck
if errorlevel 1 exit /b 1
echo.
echo.Link check complete; look for any errors in the above output ^
or in %BUILDDIR%/linkcheck/output.txt.
goto end
)
if "%1" == "doctest" (
%SPHINXBUILD% -b doctest %ALLSPHINXOPTS% %BUILDDIR%/doctest
if errorlevel 1 exit /b 1
echo.
echo.Testing of doctests in the sources finished, look at the ^
results in %BUILDDIR%/doctest/output.txt.
goto end
)
if "%1" == "coverage" (
%SPHINXBUILD% -b coverage %ALLSPHINXOPTS% %BUILDDIR%/coverage
if errorlevel 1 exit /b 1
echo.
echo.Testing of coverage in the sources finished, look at the ^
results in %BUILDDIR%/coverage/python.txt.
goto end
)
if "%1" == "xml" (
%SPHINXBUILD% -b xml %ALLSPHINXOPTS% %BUILDDIR%/xml
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The XML files are in %BUILDDIR%/xml.
goto end
)
if "%1" == "pseudoxml" (
%SPHINXBUILD% -b pseudoxml %ALLSPHINXOPTS% %BUILDDIR%/pseudoxml
if errorlevel 1 exit /b 1
echo.
echo.Build finished. The pseudo-XML files are in %BUILDDIR%/pseudoxml.
goto end
)
:end
doc/source/conf.py
-364
View File
@@ -1,364 +0,0 @@
# -*- coding: utf-8 -*-
#
# PyWindows documentation build configuration file, created by
# sphinx-quickstart on Tue Apr 07 11:39:41 2015.
#
# This file is execfile()d with the current directory set to its
# containing dir.
#
# Note that not all possible configuration values are present in this
# autogenerated file.
#
# All configuration values have a default; values that are commented out
# serve to show the default.
import sys
import os
# If extensions (or modules to document with autodoc) are in another directory,
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
#sys.path.insert(0, os.path.abspath('.'))
sys.path.append(r"C:\Users\hakril\Documents\Work\PythonForWindows")
# -- General configuration ------------------------------------------------
# If your documentation needs a minimal Sphinx version, state it here.
#needs_sphinx = '1.0'
# Add any Sphinx extension module names here, as strings. They can be
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
# ones.
extensions = [
'sphinx.ext.intersphinx',
'sphinx.ext.coverage',
'sphinx.ext.ifconfig',
'sphinx.ext.viewcode',
'sphinx.ext.autodoc',
]
autodoc_default_flags = ['show-inheritance', 'inherited-members']
# Add any paths that contain templates here, relative to this directory.
templates_path = ['_templates']
# The suffix of source filenames.
source_suffix = '.rst'
# The encoding of source files.
#source_encoding = 'utf-8-sig'
# The master toctree document.
master_doc = 'index'
# General information about the project.
project = u'PyWindows'
copyright = u'2015, Clement Rouault'
# The version info for the project you're documenting, acts as replacement for
# |version| and |release|, also used in various other places throughout the
# built documents.
#
# The short X.Y version.
version = '0.1'
# The full version, including alpha/beta/rc tags.
release = '0.1'
# The language for content autogenerated by Sphinx. Refer to documentation
# for a list of supported languages.
#
# This is also used if you do content translation via gettext catalogs.
# Usually you set "language" from the command line for these cases.
language = None
# There are two options for replacing |today|: either, you set today to some
# non-false value, then it is used:
#today = ''
# Else, today_fmt is used as the format for a strftime call.
#today_fmt = '%B %d, %Y'
# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
exclude_patterns = []
# The reST default role (used for this markup: `text`) to use for all
# documents.
#default_role = None
# If true, '()' will be appended to :func: etc. cross-reference text.
#add_function_parentheses = True
# If true, the current module name will be prepended to all description
# unit titles (such as .. function::).
#add_module_names = True
# If true, sectionauthor and moduleauthor directives will be shown in the
# output. They are ignored by default.
#show_authors = False
# The name of the Pygments (syntax highlighting) style to use.
pygments_style = 'sphinx'
# A list of ignored prefixes for module index sorting.
#modindex_common_prefix = []
# If true, keep warnings as "system message" paragraphs in the built documents.
#keep_warnings = False
# -- Options for HTML output ----------------------------------------------
# The theme to use for HTML and HTML Help pages. See the documentation for
# a list of builtin themes.
html_theme = 'default'
# Theme options are theme-specific and customize the look and feel of a theme
# further. For a list of options available for each theme, see the
# documentation.
#html_theme_options = {}
# Add any paths that contain custom themes here, relative to this directory.
#html_theme_path = []
# The name for this set of Sphinx documents. If None, it defaults to
# "<project> v<release> documentation".
#html_title = None
# A shorter title for the navigation bar. Default is the same as html_title.
#html_short_title = None
# The name of an image file (relative to this directory) to place at the top
# of the sidebar.
#html_logo = None
# The name of an image file (within the static path) to use as favicon of the
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
# pixels large.
#html_favicon = None
# Add any paths that contain custom static files (such as style sheets) here,
# relative to this directory. They are copied after the builtin static files,
# so a file named "default.css" will overwrite the builtin "default.css".
html_static_path = ['_static']
# Add any extra paths that contain custom files (such as robots.txt or
# .htaccess) here, relative to this directory. These files are copied
# directly to the root of the documentation.
#html_extra_path = []
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
# using the given strftime format.
#html_last_updated_fmt = '%b %d, %Y'
# If true, SmartyPants will be used to convert quotes and dashes to
# typographically correct entities.
#html_use_smartypants = True
# Custom sidebar templates, maps document names to template names.
#html_sidebars = {}
# Additional templates that should be rendered to pages, maps page names to
# template names.
#html_additional_pages = {}
# If false, no module index is generated.
#html_domain_indices = True
# If false, no index is generated.
#html_use_index = True
# If true, the index is split into individual pages for each letter.
#html_split_index = False
# If true, links to the reST sources are added to the pages.
#html_show_sourcelink = True
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
#html_show_sphinx = True
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
#html_show_copyright = True
# If true, an OpenSearch description file will be output, and all pages will
# contain a <link> tag referring to it. The value of this option must be the
# base URL from which the finished HTML is served.
#html_use_opensearch = ''
# This is the file name suffix for HTML files (e.g. ".xhtml").
#html_file_suffix = None
# Language to be used for generating the HTML full-text search index.
# Sphinx supports the following languages:
# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja'
# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr'
#html_search_language = 'en'
# A dictionary with options for the search language support, empty by default.
# Now only 'ja' uses this config value
#html_search_options = {'type': 'default'}
# The name of a javascript file (relative to the configuration directory) that
# implements a search results scorer. If empty, the default will be used.
#html_search_scorer = 'scorer.js'
# Output file base name for HTML help builder.
htmlhelp_basename = 'PyWindowsdoc'
# -- Options for LaTeX output ---------------------------------------------
latex_elements = {
# The paper size ('letterpaper' or 'a4paper').
#'papersize': 'letterpaper',
# The font size ('10pt', '11pt' or '12pt').
#'pointsize': '10pt',
# Additional stuff for the LaTeX preamble.
#'preamble': '',
# Latex figure (float) alignment
#'figure_align': 'htbp',
}
# Grouping the document tree into LaTeX files. List of tuples
# (source start file, target name, title,
# author, documentclass [howto, manual, or own class]).
latex_documents = [
('index', 'PyWindows.tex', u'PyWindows Documentation',
u'Clement Rouault', 'manual'),
]
# The name of an image file (relative to this directory) to place at the top of
# the title page.
#latex_logo = None
# For "manual" documents, if this is true, then toplevel headings are parts,
# not chapters.
#latex_use_parts = False
# If true, show page references after internal links.
#latex_show_pagerefs = False
# If true, show URL addresses after external links.
#latex_show_urls = False
# Documents to append as an appendix to all manuals.
#latex_appendices = []
# If false, no module index is generated.
#latex_domain_indices = True
# -- Options for manual page output ---------------------------------------
# One entry per manual page. List of tuples
# (source start file, name, description, authors, manual section).
man_pages = [
('index', 'pywindows', u'PyWindows Documentation',
[u'Clement Rouault'], 1)
]
# If true, show URL addresses after external links.
#man_show_urls = False
# -- Options for Texinfo output -------------------------------------------
# Grouping the document tree into Texinfo files. List of tuples
# (source start file, target name, title, author,
# dir menu entry, description, category)
texinfo_documents = [
('index', 'PyWindows', u'PyWindows Documentation',
u'Clement Rouault', 'PyWindows', 'One line description of project.',
'Miscellaneous'),
]
# Documents to append as an appendix to all manuals.
#texinfo_appendices = []
# If false, no module index is generated.
#texinfo_domain_indices = True
# How to display URL addresses: 'footnote', 'no', or 'inline'.
#texinfo_show_urls = 'footnote'
# If true, do not generate a @detailmenu in the "Top" node's menu.
#texinfo_no_detailmenu = False
# -- Options for Epub output ----------------------------------------------
# Bibliographic Dublin Core info.
epub_title = u'PyWindows'
epub_author = u'Clement Rouault'
epub_publisher = u'Clement Rouault'
epub_copyright = u'2015, Clement Rouault'
# The basename for the epub file. It defaults to the project name.
#epub_basename = u'PyWindows'
# The HTML theme for the epub output. Since the default themes are not optimized
# for small screen space, using the same theme for HTML and epub output is
# usually not wise. This defaults to 'epub', a theme designed to save visual
# space.
#epub_theme = 'epub'
# The language of the text. It defaults to the language option
# or 'en' if the language is not set.
#epub_language = ''
# The scheme of the identifier. Typical schemes are ISBN or URL.
#epub_scheme = ''
# The unique identifier of the text. This can be a ISBN number
# or the project homepage.
#epub_identifier = ''
# A unique identification for the text.
#epub_uid = ''
# A tuple containing the cover image and cover page html template filenames.
#epub_cover = ()
# A sequence of (type, uri, title) tuples for the guide element of content.opf.
#epub_guide = ()
# HTML files that should be inserted before the pages created by sphinx.
# The format is a list of tuples containing the path and title.
#epub_pre_files = []
# HTML files shat should be inserted after the pages created by sphinx.
# The format is a list of tuples containing the path and title.
#epub_post_files = []
# A list of files that should not be packed into the epub file.
epub_exclude_files = ['search.html']
# The depth of the table of contents in toc.ncx.
#epub_tocdepth = 3
# Allow duplicate toc entries.
#epub_tocdup = True
# Choose between 'default' and 'includehidden'.
#epub_tocscope = 'default'
# Fix unsupported image types using the PIL.
#epub_fix_images = False
# Scale large images.
#epub_max_image_width = 0
# How to display URL addresses: 'footnote', 'no', or 'inline'.
#epub_show_urls = 'inline'
# If false, no index is generated.
#epub_use_index = True
# Example configuration for intersphinx: refer to the Python standard library.
intersphinx_mapping = {'http://docs.python.org/': None}
doc/source/generated_doc.rst
-19
View File
@@ -1,19 +0,0 @@
GENERATED Documentation test
****************************
Testing1
********
.. automodule:: windows.generated_def.winstructs
Testing2
********
.. autoclass:: _PEB_LDR_DATA
.. autoclass:: _PEB
.. autoclass:: _LIST_ENTRY
doc/source/index.rst
-26
View File
@@ -1,26 +0,0 @@
.. PyWindows documentation master file, created by
sphinx-quickstart on Tue Apr 07 11:39:41 2015.
You can adapt this file completely to your liking, but it should at least
contain the root `toctree` directive.
Welcome to PyWindows's documentation!
=====================================
Contents:
.. toctree::
:maxdepth: 2
test.rst
pe_parse.rst
native_exec.rst
rem_python.rst
utils.rst
Indices and tables
==================
* :ref:`modindex`
* :ref:`search`
doc/source/native_exec.rst
-79
View File
@@ -1,79 +0,0 @@
Native code execution
***********************
.. automodule:: windows.native_exec
:members: generate_callback_stub, create_function
The native_function submodule
"""""""""""""""""""""""""""""
.. automodule:: windows.native_exec.native_function
:members: create_function
Simple machine code generation
""""""""""""""""""""""""""""""
These modules allow you to write some simple x86 / x64 shellcode. This is useful to use in adequation to :func:`create_function`.
The instruction name are as explicit as possible with the following convention:
* This is `intel syntax` so `dest, src`
* X specify a value passed as parameters::
Mov_EAX_X(0x42) # mov eax, 0x42
* D is for `dereference`::
Mov_EAX_DX(0x42424242) # mov EAX, [0x42424242]
Mov_DEAX_EDI() # mov [EAX], EDI
All instructions follow this interface:
.. py:class:: Instruction
.. py:method:: get_code(self)
:returns: :class:`str`: The raw code of the instruction
.. py:method:: get_mnemo(self)
:returns: :class:`str`: The mnemonic of the instruction
Example::
import windows.native_exec.simple_x86 as x86
i = x86.Mov_EAX_X(0x42434445)
i.get_code()
# '\xb8EDCB'
i.get_mnemo()
# 'mov EAX, 0x42434445'
You can also use a :class:`MultipleInstr` instance to merge instructions
Example::
import windows.native_exec.simple_x86 as x86
code = x86.MultipleInstr()
code += x86.Mov_EAX_X(0x42434445)
code += x86.Push_EAX()
code += x86.Ret()
code.get_code()
# '\xb8EDCBP\xc3'
print(code.get_mnemo())
# mov EAX, 0x42434445
# push EAX
# ret
simple_x86 instructions
-----------------------
.. automodule:: windows.native_exec.simple_x86
simple_x64 instructions
-----------------------
.. automodule:: windows.native_exec.simple_x64
doc/source/pe_parse.rst
-179
View File
@@ -1,179 +0,0 @@
Loaded DLL Exploration and IAT hooks
************************************
List of loaded modules
""""""""""""""""""""""
Accessible using::
import windows
windows.current_process.peb.modules[int].pe
..note::
See: :class:`windows.winobject.PEB` and :class:`windows.winobject.LoadedModule`
DLL Import and IAT
""""""""""""""""""
.. py:class:: PEFile
.. py:attribute:: imports
The imports of the PE
.. note::
This is a :class:`dict` DLLName -> [:class:`IATEntry`]
Example::
import windows
k32 = windows.current_process.peb.modules[2]
# <LoadedModule "KERNEL32.DLL" at 0x2deca30>
k32.pe.imports.keys()
# ['kernelbase.dll', 'api-ms-win-core-profile-l1-1-0.dll', ...]
k32.pe.imports['kernelbase.dll']
# [<IATEntry "EnumLanguageGroupLocalesW" ordinal 58>, <IATEntry "GetNamedPipeAttribute" ordinal 93>, ...]
[entry for entry in k32.pe.imports['kernelbase.dll'] if entry.name == "lstrcmpiW"][0]
# <IATEntry "lstrcmpiW" ordinal 244>
.. py:class:: IATEntry
| Reprensent An entry in the IAT of a module
| Can be used to get resolved value and setup hook
.. py:attribute:: name
| :class:`int` : The name of the import
.. py:attribute:: ord
| :class:`int` : The ordinal of the import
.. py:attribute:: addr
| :class:`int` : The address of the IAT entry
.. py:attribute:: value
| :class:`int` : The destination of the IAT entry
.. warning::
`value` is a descriptor. Setting its value will actually CHANGE THE IAT ENTRY, resulting in a segfault if no VirtualProtect have been done.
.. note::
See: :class:`windows.utils.VirtualProtected`
.. py:method:: set_hook(self, callback, types=None)
Setup a hook, `callback` should respect the :ref:`hook_protocol`. If `callback` have no :ref:`type_information`, `types` should provide them.
IAT Hooking
"""""""""""
.. _hook_protocol:
The hook protocol
-----------------
Callback arguments
''''''''''''''''''
A hook callback must have the same number of argument as the hooked API, PLUS a last argument `real_function`.
The `real_function` argument is a callable that represent the hooked API, it can be called in two ways:
* Without argument, the call will be done with the argument originaly passed to your callback. This allow simple redirection to the real API.
* With arguments it will simply call the API with these.
Example::
def createfile_callback(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, real_function):
print("Trying to open {0}".format(lpFileName))
if "secret" in lpFileName:
return 0xffffffff
# Perform the real call
return real_function()
.. _type_information:
Type information
''''''''''''''''
In order make the magic behind Python Hook Callback, :mod:`ctypes` need to have type information about the API parameters.
There is (again) two ways to give those informations to your hook callback. Both techniques use a decorator to setup type information to the callback.
* Giving the type manualy using the decorator :class:`windows.hooks.Callback`::
from windows.hooks import *
# First type is return type, others are parameters types
@Callback(ctypes.c_void_p, ctypes.c_ulong)
def exit_callback(x, real_function):
print("Try to quit with {0} | {1}".format(x, type(x)))
if x == 3:
print("TRYING TO REAL EXIT")
return real_function(1234)
return 0x4242424243444546
* Using the `Callback` decorator generated from known functions::
from windows.hooks import *
# Decorator name is always API_NAME + "CallBack"
@CreateFileACallback
def createfile_callback(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, real_function):
print("Trying to open {0}".format(lpFileName))
if "secret" in lpFileName:
return 0xffffffff
return real_function()
.. note::
See the list of known functions
Put the hook
------------
To setup your IAT hook you just need:
* A callback that respect the :ref:`hook_protocol`
* The :class:`IATEntry` to hook
You just need to use the function :func:`IATEntry.set_hook`
Full Example::
import windows
from windows.hooks import *
@CreateFileACallback
def createfile_callback(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, real_function):
print("Trying to open {0}".format(lpFileName))
if "secret" in lpFileName:
return 0xffffffff
return real_function()
my_exe = windows.current_process.peb.modules[0]
imp = my_exe.pe.imports
iat_create_file = [entry for entry in imp['kernel32.dll'] if entry.name == "CreateFileA"]
iat_create_file.set_hook(createfile_callback)
doc/source/rem_python.rst
-77
View File
@@ -1,77 +0,0 @@
Remote Python Injection
***********************
It's possible to inject the python interpreter into remote process. All you need to do is to use the method :func:`windows.winobject.WinProcess.execute_python`.
Calling this function will trigger the interpreter injection and the python code execution.
For simpler interaction interaction with the remote python, you can an RPC master linked to the remote interpreter.
RPython 101
'''''''''''
RPython is a very simple Pythonic (I hope so) RPC slave-master. It's goal is to allow easy manipulation of a remote interpreter.
The only action up to the `slave` is the creation of it's `name_pool`: a namespace of object accessible by the `master`.
After that the `slave` will just wait for request and return the desired object.
All slave object seen by the master are proxy that redirect operation to the slave.
RPython RPC to remote process
'''''''''''''''''''''''''''''
For easy manipulation of a remote Python interpreter, you can use the RPCInjection module::
import windows
import RPCInjection
calc = [x for x in windows.system.processes if x.name == "calc.exe"][0]
master = RPCInjection.launch_remote_slave(calc)
# Master is a RPC-master to a python interpreter in calc.exe
master['windows']
# <RemoteObj |<module 'windows' from 'C:\Users\hakril\Documents\Work\PythonForWindows\windows\__init__.pyc'>|>
# This is a way to get our own (python.exe) pid
windows.current_process.pid
3624
# This is a way to get the pid of calc.exe
master['windows'].current_process
# <RemoteObj |<windows.winobject.CurrentProcess object at 0x055E6250>|>
master['windows'].current_process.pid
5052
# We can also play with the peb of the remote process
master['windows'].current_process.peb
# <RemoteObj |<windows.winobject.PEB object at 0x054A3DF0>|>
master['windows'].current_process.peb.commandline
# <RemoteObj |<WinUnicodeString ""C:\Windows\SysWOW64\calc.exe" " at 0x55e9850>|>
# we can import new stuff
x['json']
# ...
# RPython.exchange.RemoteKeyError:
# ....
# KeyError: u'json'
x.imp('json')
# <RemoteObj |None|>
x['json']
# <RemoteObj |<module 'json' from 'C:\Python27\Lib\json\__init__.pyc'>|>
.. note::
The slave `name_pool` in RPCInjection is filled with :mod:`windows`, :mod:`__import__`, :mod:`ctypes` and :mod:`self` (the RemotePythonSlave object)
The master.RemotePython
'''''''''''''''''''''''
.. autoclass:: RPython.master.RemotePython
.. py:method:: __getitem__
Alias to :func:`ask_by_name`
Remote IAT Hooking
''''''''''''''''''
See Examples directory
doc/source/test.rst
-13
View File
@@ -1,13 +0,0 @@
Overwiew of the `windows` objects
**************************
object exported by `windows`
""""""""""""""""""""""""""""
.. automodule:: windows
Principal classes for process exploration
"""""""""""""""""""""""""""""""""""""""""
.. automodule:: windows.winobject
:members:
doc/source/utils.rst
-4
View File
@@ -1,4 +0,0 @@
Helpers
*******
.. automodule:: windows.utils