mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Testing of project tree rewriting
This commit is contained in:
hakril
@@ -1,364 +0,0 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# PyWindows documentation build configuration file, created by
|
||||
# sphinx-quickstart on Tue Apr 07 11:39:41 2015.
|
||||
#
|
||||
# This file is execfile()d with the current directory set to its
|
||||
# containing dir.
|
||||
#
|
||||
# Note that not all possible configuration values are present in this
|
||||
# autogenerated file.
|
||||
#
|
||||
# All configuration values have a default; values that are commented out
|
||||
# serve to show the default.
|
||||
|
||||
import sys
|
||||
import os
|
||||
|
||||
# If extensions (or modules to document with autodoc) are in another directory,
|
||||
# add these directories to sys.path here. If the directory is relative to the
|
||||
# documentation root, use os.path.abspath to make it absolute, like shown here.
|
||||
#sys.path.insert(0, os.path.abspath('.'))
|
||||
|
||||
|
||||
|
||||
sys.path.append(r"C:\Users\hakril\Documents\Work\PythonForWindows")
|
||||
|
||||
|
||||
# -- General configuration ------------------------------------------------
|
||||
|
||||
# If your documentation needs a minimal Sphinx version, state it here.
|
||||
#needs_sphinx = '1.0'
|
||||
|
||||
# Add any Sphinx extension module names here, as strings. They can be
|
||||
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
|
||||
# ones.
|
||||
extensions = [
|
||||
'sphinx.ext.intersphinx',
|
||||
'sphinx.ext.coverage',
|
||||
'sphinx.ext.ifconfig',
|
||||
'sphinx.ext.viewcode',
|
||||
'sphinx.ext.autodoc',
|
||||
]
|
||||
|
||||
autodoc_default_flags = ['show-inheritance', 'inherited-members']
|
||||
|
||||
# Add any paths that contain templates here, relative to this directory.
|
||||
templates_path = ['_templates']
|
||||
|
||||
# The suffix of source filenames.
|
||||
source_suffix = '.rst'
|
||||
|
||||
# The encoding of source files.
|
||||
#source_encoding = 'utf-8-sig'
|
||||
|
||||
# The master toctree document.
|
||||
master_doc = 'index'
|
||||
|
||||
# General information about the project.
|
||||
project = u'PyWindows'
|
||||
copyright = u'2015, Clement Rouault'
|
||||
|
||||
# The version info for the project you're documenting, acts as replacement for
|
||||
# |version| and |release|, also used in various other places throughout the
|
||||
# built documents.
|
||||
#
|
||||
# The short X.Y version.
|
||||
version = '0.1'
|
||||
# The full version, including alpha/beta/rc tags.
|
||||
release = '0.1'
|
||||
|
||||
# The language for content autogenerated by Sphinx. Refer to documentation
|
||||
# for a list of supported languages.
|
||||
#
|
||||
# This is also used if you do content translation via gettext catalogs.
|
||||
# Usually you set "language" from the command line for these cases.
|
||||
language = None
|
||||
|
||||
# There are two options for replacing |today|: either, you set today to some
|
||||
# non-false value, then it is used:
|
||||
#today = ''
|
||||
# Else, today_fmt is used as the format for a strftime call.
|
||||
#today_fmt = '%B %d, %Y'
|
||||
|
||||
# List of patterns, relative to source directory, that match files and
|
||||
# directories to ignore when looking for source files.
|
||||
exclude_patterns = []
|
||||
|
||||
# The reST default role (used for this markup: `text`) to use for all
|
||||
# documents.
|
||||
#default_role = None
|
||||
|
||||
# If true, '()' will be appended to :func: etc. cross-reference text.
|
||||
#add_function_parentheses = True
|
||||
|
||||
# If true, the current module name will be prepended to all description
|
||||
# unit titles (such as .. function::).
|
||||
#add_module_names = True
|
||||
|
||||
# If true, sectionauthor and moduleauthor directives will be shown in the
|
||||
# output. They are ignored by default.
|
||||
#show_authors = False
|
||||
|
||||
# The name of the Pygments (syntax highlighting) style to use.
|
||||
pygments_style = 'sphinx'
|
||||
|
||||
# A list of ignored prefixes for module index sorting.
|
||||
#modindex_common_prefix = []
|
||||
|
||||
# If true, keep warnings as "system message" paragraphs in the built documents.
|
||||
#keep_warnings = False
|
||||
|
||||
|
||||
# -- Options for HTML output ----------------------------------------------
|
||||
|
||||
# The theme to use for HTML and HTML Help pages. See the documentation for
|
||||
# a list of builtin themes.
|
||||
html_theme = 'default'
|
||||
|
||||
# Theme options are theme-specific and customize the look and feel of a theme
|
||||
# further. For a list of options available for each theme, see the
|
||||
# documentation.
|
||||
#html_theme_options = {}
|
||||
|
||||
# Add any paths that contain custom themes here, relative to this directory.
|
||||
#html_theme_path = []
|
||||
|
||||
# The name for this set of Sphinx documents. If None, it defaults to
|
||||
# "<project> v<release> documentation".
|
||||
#html_title = None
|
||||
|
||||
# A shorter title for the navigation bar. Default is the same as html_title.
|
||||
#html_short_title = None
|
||||
|
||||
# The name of an image file (relative to this directory) to place at the top
|
||||
# of the sidebar.
|
||||
#html_logo = None
|
||||
|
||||
# The name of an image file (within the static path) to use as favicon of the
|
||||
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
|
||||
# pixels large.
|
||||
#html_favicon = None
|
||||
|
||||
# Add any paths that contain custom static files (such as style sheets) here,
|
||||
# relative to this directory. They are copied after the builtin static files,
|
||||
# so a file named "default.css" will overwrite the builtin "default.css".
|
||||
html_static_path = ['_static']
|
||||
|
||||
# Add any extra paths that contain custom files (such as robots.txt or
|
||||
# .htaccess) here, relative to this directory. These files are copied
|
||||
# directly to the root of the documentation.
|
||||
#html_extra_path = []
|
||||
|
||||
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
|
||||
# using the given strftime format.
|
||||
#html_last_updated_fmt = '%b %d, %Y'
|
||||
|
||||
# If true, SmartyPants will be used to convert quotes and dashes to
|
||||
# typographically correct entities.
|
||||
#html_use_smartypants = True
|
||||
|
||||
# Custom sidebar templates, maps document names to template names.
|
||||
#html_sidebars = {}
|
||||
|
||||
# Additional templates that should be rendered to pages, maps page names to
|
||||
# template names.
|
||||
#html_additional_pages = {}
|
||||
|
||||
# If false, no module index is generated.
|
||||
#html_domain_indices = True
|
||||
|
||||
# If false, no index is generated.
|
||||
#html_use_index = True
|
||||
|
||||
# If true, the index is split into individual pages for each letter.
|
||||
#html_split_index = False
|
||||
|
||||
# If true, links to the reST sources are added to the pages.
|
||||
#html_show_sourcelink = True
|
||||
|
||||
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
|
||||
#html_show_sphinx = True
|
||||
|
||||
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
|
||||
#html_show_copyright = True
|
||||
|
||||
# If true, an OpenSearch description file will be output, and all pages will
|
||||
# contain a <link> tag referring to it. The value of this option must be the
|
||||
# base URL from which the finished HTML is served.
|
||||
#html_use_opensearch = ''
|
||||
|
||||
# This is the file name suffix for HTML files (e.g. ".xhtml").
|
||||
#html_file_suffix = None
|
||||
|
||||
# Language to be used for generating the HTML full-text search index.
|
||||
# Sphinx supports the following languages:
|
||||
# 'da', 'de', 'en', 'es', 'fi', 'fr', 'hu', 'it', 'ja'
|
||||
# 'nl', 'no', 'pt', 'ro', 'ru', 'sv', 'tr'
|
||||
#html_search_language = 'en'
|
||||
|
||||
# A dictionary with options for the search language support, empty by default.
|
||||
# Now only 'ja' uses this config value
|
||||
#html_search_options = {'type': 'default'}
|
||||
|
||||
# The name of a javascript file (relative to the configuration directory) that
|
||||
# implements a search results scorer. If empty, the default will be used.
|
||||
#html_search_scorer = 'scorer.js'
|
||||
|
||||
# Output file base name for HTML help builder.
|
||||
htmlhelp_basename = 'PyWindowsdoc'
|
||||
|
||||
# -- Options for LaTeX output ---------------------------------------------
|
||||
|
||||
latex_elements = {
|
||||
# The paper size ('letterpaper' or 'a4paper').
|
||||
#'papersize': 'letterpaper',
|
||||
|
||||
# The font size ('10pt', '11pt' or '12pt').
|
||||
#'pointsize': '10pt',
|
||||
|
||||
# Additional stuff for the LaTeX preamble.
|
||||
#'preamble': '',
|
||||
|
||||
# Latex figure (float) alignment
|
||||
#'figure_align': 'htbp',
|
||||
}
|
||||
|
||||
# Grouping the document tree into LaTeX files. List of tuples
|
||||
# (source start file, target name, title,
|
||||
# author, documentclass [howto, manual, or own class]).
|
||||
latex_documents = [
|
||||
('index', 'PyWindows.tex', u'PyWindows Documentation',
|
||||
u'Clement Rouault', 'manual'),
|
||||
]
|
||||
|
||||
# The name of an image file (relative to this directory) to place at the top of
|
||||
# the title page.
|
||||
#latex_logo = None
|
||||
|
||||
# For "manual" documents, if this is true, then toplevel headings are parts,
|
||||
# not chapters.
|
||||
#latex_use_parts = False
|
||||
|
||||
# If true, show page references after internal links.
|
||||
#latex_show_pagerefs = False
|
||||
|
||||
# If true, show URL addresses after external links.
|
||||
#latex_show_urls = False
|
||||
|
||||
# Documents to append as an appendix to all manuals.
|
||||
#latex_appendices = []
|
||||
|
||||
# If false, no module index is generated.
|
||||
#latex_domain_indices = True
|
||||
|
||||
|
||||
# -- Options for manual page output ---------------------------------------
|
||||
|
||||
# One entry per manual page. List of tuples
|
||||
# (source start file, name, description, authors, manual section).
|
||||
man_pages = [
|
||||
('index', 'pywindows', u'PyWindows Documentation',
|
||||
[u'Clement Rouault'], 1)
|
||||
]
|
||||
|
||||
# If true, show URL addresses after external links.
|
||||
#man_show_urls = False
|
||||
|
||||
|
||||
# -- Options for Texinfo output -------------------------------------------
|
||||
|
||||
# Grouping the document tree into Texinfo files. List of tuples
|
||||
# (source start file, target name, title, author,
|
||||
# dir menu entry, description, category)
|
||||
texinfo_documents = [
|
||||
('index', 'PyWindows', u'PyWindows Documentation',
|
||||
u'Clement Rouault', 'PyWindows', 'One line description of project.',
|
||||
'Miscellaneous'),
|
||||
]
|
||||
|
||||
# Documents to append as an appendix to all manuals.
|
||||
#texinfo_appendices = []
|
||||
|
||||
# If false, no module index is generated.
|
||||
#texinfo_domain_indices = True
|
||||
|
||||
# How to display URL addresses: 'footnote', 'no', or 'inline'.
|
||||
#texinfo_show_urls = 'footnote'
|
||||
|
||||
# If true, do not generate a @detailmenu in the "Top" node's menu.
|
||||
#texinfo_no_detailmenu = False
|
||||
|
||||
|
||||
# -- Options for Epub output ----------------------------------------------
|
||||
|
||||
# Bibliographic Dublin Core info.
|
||||
epub_title = u'PyWindows'
|
||||
epub_author = u'Clement Rouault'
|
||||
epub_publisher = u'Clement Rouault'
|
||||
epub_copyright = u'2015, Clement Rouault'
|
||||
|
||||
# The basename for the epub file. It defaults to the project name.
|
||||
#epub_basename = u'PyWindows'
|
||||
|
||||
# The HTML theme for the epub output. Since the default themes are not optimized
|
||||
# for small screen space, using the same theme for HTML and epub output is
|
||||
# usually not wise. This defaults to 'epub', a theme designed to save visual
|
||||
# space.
|
||||
#epub_theme = 'epub'
|
||||
|
||||
# The language of the text. It defaults to the language option
|
||||
# or 'en' if the language is not set.
|
||||
#epub_language = ''
|
||||
|
||||
# The scheme of the identifier. Typical schemes are ISBN or URL.
|
||||
#epub_scheme = ''
|
||||
|
||||
# The unique identifier of the text. This can be a ISBN number
|
||||
# or the project homepage.
|
||||
#epub_identifier = ''
|
||||
|
||||
# A unique identification for the text.
|
||||
#epub_uid = ''
|
||||
|
||||
# A tuple containing the cover image and cover page html template filenames.
|
||||
#epub_cover = ()
|
||||
|
||||
# A sequence of (type, uri, title) tuples for the guide element of content.opf.
|
||||
#epub_guide = ()
|
||||
|
||||
# HTML files that should be inserted before the pages created by sphinx.
|
||||
# The format is a list of tuples containing the path and title.
|
||||
#epub_pre_files = []
|
||||
|
||||
# HTML files shat should be inserted after the pages created by sphinx.
|
||||
# The format is a list of tuples containing the path and title.
|
||||
#epub_post_files = []
|
||||
|
||||
# A list of files that should not be packed into the epub file.
|
||||
epub_exclude_files = ['search.html']
|
||||
|
||||
# The depth of the table of contents in toc.ncx.
|
||||
#epub_tocdepth = 3
|
||||
|
||||
# Allow duplicate toc entries.
|
||||
#epub_tocdup = True
|
||||
|
||||
# Choose between 'default' and 'includehidden'.
|
||||
#epub_tocscope = 'default'
|
||||
|
||||
# Fix unsupported image types using the PIL.
|
||||
#epub_fix_images = False
|
||||
|
||||
# Scale large images.
|
||||
#epub_max_image_width = 0
|
||||
|
||||
# How to display URL addresses: 'footnote', 'no', or 'inline'.
|
||||
#epub_show_urls = 'inline'
|
||||
|
||||
# If false, no index is generated.
|
||||
#epub_use_index = True
|
||||
|
||||
|
||||
# Example configuration for intersphinx: refer to the Python standard library.
|
||||
intersphinx_mapping = {'http://docs.python.org/': None}
|
||||
@@ -1,19 +0,0 @@
|
||||
GENERATED Documentation test
|
||||
****************************
|
||||
|
||||
Testing1
|
||||
********
|
||||
|
||||
.. automodule:: windows.generated_def.winstructs
|
||||
|
||||
|
||||
|
||||
Testing2
|
||||
********
|
||||
|
||||
.. autoclass:: _PEB_LDR_DATA
|
||||
.. autoclass:: _PEB
|
||||
.. autoclass:: _LIST_ENTRY
|
||||
|
||||
|
||||
|
||||
@@ -1,26 +0,0 @@
|
||||
.. PyWindows documentation master file, created by
|
||||
sphinx-quickstart on Tue Apr 07 11:39:41 2015.
|
||||
You can adapt this file completely to your liking, but it should at least
|
||||
contain the root `toctree` directive.
|
||||
|
||||
Welcome to PyWindows's documentation!
|
||||
=====================================
|
||||
|
||||
Contents:
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 2
|
||||
|
||||
test.rst
|
||||
pe_parse.rst
|
||||
native_exec.rst
|
||||
rem_python.rst
|
||||
utils.rst
|
||||
|
||||
|
||||
Indices and tables
|
||||
==================
|
||||
|
||||
* :ref:`modindex`
|
||||
* :ref:`search`
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
Native code execution
|
||||
***********************
|
||||
|
||||
.. automodule:: windows.native_exec
|
||||
:members: generate_callback_stub, create_function
|
||||
|
||||
|
||||
The native_function submodule
|
||||
"""""""""""""""""""""""""""""
|
||||
|
||||
.. automodule:: windows.native_exec.native_function
|
||||
:members: create_function
|
||||
|
||||
|
||||
Simple machine code generation
|
||||
""""""""""""""""""""""""""""""
|
||||
|
||||
These modules allow you to write some simple x86 / x64 shellcode. This is useful to use in adequation to :func:`create_function`.
|
||||
The instruction name are as explicit as possible with the following convention:
|
||||
|
||||
* This is `intel syntax` so `dest, src`
|
||||
* X specify a value passed as parameters::
|
||||
|
||||
Mov_EAX_X(0x42) # mov eax, 0x42
|
||||
|
||||
* D is for `dereference`::
|
||||
|
||||
Mov_EAX_DX(0x42424242) # mov EAX, [0x42424242]
|
||||
Mov_DEAX_EDI() # mov [EAX], EDI
|
||||
|
||||
All instructions follow this interface:
|
||||
|
||||
.. py:class:: Instruction
|
||||
|
||||
.. py:method:: get_code(self)
|
||||
|
||||
:returns: :class:`str`: The raw code of the instruction
|
||||
|
||||
.. py:method:: get_mnemo(self)
|
||||
|
||||
:returns: :class:`str`: The mnemonic of the instruction
|
||||
|
||||
Example::
|
||||
|
||||
import windows.native_exec.simple_x86 as x86
|
||||
|
||||
i = x86.Mov_EAX_X(0x42434445)
|
||||
i.get_code()
|
||||
# '\xb8EDCB'
|
||||
i.get_mnemo()
|
||||
# 'mov EAX, 0x42434445'
|
||||
|
||||
|
||||
You can also use a :class:`MultipleInstr` instance to merge instructions
|
||||
|
||||
Example::
|
||||
|
||||
import windows.native_exec.simple_x86 as x86
|
||||
|
||||
code = x86.MultipleInstr()
|
||||
code += x86.Mov_EAX_X(0x42434445)
|
||||
code += x86.Push_EAX()
|
||||
code += x86.Ret()
|
||||
code.get_code()
|
||||
# '\xb8EDCBP\xc3'
|
||||
print(code.get_mnemo())
|
||||
# mov EAX, 0x42434445
|
||||
# push EAX
|
||||
# ret
|
||||
|
||||
simple_x86 instructions
|
||||
-----------------------
|
||||
|
||||
.. automodule:: windows.native_exec.simple_x86
|
||||
|
||||
simple_x64 instructions
|
||||
-----------------------
|
||||
|
||||
.. automodule:: windows.native_exec.simple_x64
|
||||
@@ -1,179 +0,0 @@
|
||||
Loaded DLL Exploration and IAT hooks
|
||||
************************************
|
||||
|
||||
List of loaded modules
|
||||
""""""""""""""""""""""
|
||||
|
||||
Accessible using::
|
||||
|
||||
import windows
|
||||
windows.current_process.peb.modules[int].pe
|
||||
|
||||
..note::
|
||||
See: :class:`windows.winobject.PEB` and :class:`windows.winobject.LoadedModule`
|
||||
|
||||
|
||||
|
||||
DLL Import and IAT
|
||||
""""""""""""""""""
|
||||
|
||||
.. py:class:: PEFile
|
||||
|
||||
.. py:attribute:: imports
|
||||
|
||||
The imports of the PE
|
||||
|
||||
.. note::
|
||||
This is a :class:`dict` DLLName -> [:class:`IATEntry`]
|
||||
|
||||
Example::
|
||||
|
||||
import windows
|
||||
k32 = windows.current_process.peb.modules[2]
|
||||
# <LoadedModule "KERNEL32.DLL" at 0x2deca30>
|
||||
k32.pe.imports.keys()
|
||||
# ['kernelbase.dll', 'api-ms-win-core-profile-l1-1-0.dll', ...]
|
||||
k32.pe.imports['kernelbase.dll']
|
||||
# [<IATEntry "EnumLanguageGroupLocalesW" ordinal 58>, <IATEntry "GetNamedPipeAttribute" ordinal 93>, ...]
|
||||
[entry for entry in k32.pe.imports['kernelbase.dll'] if entry.name == "lstrcmpiW"][0]
|
||||
# <IATEntry "lstrcmpiW" ordinal 244>
|
||||
|
||||
|
||||
.. py:class:: IATEntry
|
||||
|
||||
| Reprensent An entry in the IAT of a module
|
||||
| Can be used to get resolved value and setup hook
|
||||
|
||||
.. py:attribute:: name
|
||||
|
||||
| :class:`int` : The name of the import
|
||||
|
||||
|
||||
.. py:attribute:: ord
|
||||
|
||||
| :class:`int` : The ordinal of the import
|
||||
|
||||
|
||||
.. py:attribute:: addr
|
||||
|
||||
| :class:`int` : The address of the IAT entry
|
||||
|
||||
.. py:attribute:: value
|
||||
|
||||
| :class:`int` : The destination of the IAT entry
|
||||
|
||||
.. warning::
|
||||
|
||||
`value` is a descriptor. Setting its value will actually CHANGE THE IAT ENTRY, resulting in a segfault if no VirtualProtect have been done.
|
||||
|
||||
.. note::
|
||||
|
||||
See: :class:`windows.utils.VirtualProtected`
|
||||
|
||||
|
||||
.. py:method:: set_hook(self, callback, types=None)
|
||||
|
||||
Setup a hook, `callback` should respect the :ref:`hook_protocol`. If `callback` have no :ref:`type_information`, `types` should provide them.
|
||||
|
||||
|
||||
IAT Hooking
|
||||
"""""""""""
|
||||
|
||||
.. _hook_protocol:
|
||||
|
||||
The hook protocol
|
||||
-----------------
|
||||
|
||||
Callback arguments
|
||||
''''''''''''''''''
|
||||
|
||||
A hook callback must have the same number of argument as the hooked API, PLUS a last argument `real_function`.
|
||||
|
||||
The `real_function` argument is a callable that represent the hooked API, it can be called in two ways:
|
||||
|
||||
* Without argument, the call will be done with the argument originaly passed to your callback. This allow simple redirection to the real API.
|
||||
|
||||
* With arguments it will simply call the API with these.
|
||||
|
||||
Example::
|
||||
|
||||
def createfile_callback(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, real_function):
|
||||
print("Trying to open {0}".format(lpFileName))
|
||||
if "secret" in lpFileName:
|
||||
return 0xffffffff
|
||||
# Perform the real call
|
||||
return real_function()
|
||||
|
||||
|
||||
.. _type_information:
|
||||
|
||||
Type information
|
||||
''''''''''''''''
|
||||
|
||||
In order make the magic behind Python Hook Callback, :mod:`ctypes` need to have type information about the API parameters.
|
||||
|
||||
There is (again) two ways to give those informations to your hook callback. Both techniques use a decorator to setup type information to the callback.
|
||||
|
||||
* Giving the type manualy using the decorator :class:`windows.hooks.Callback`::
|
||||
|
||||
from windows.hooks import *
|
||||
# First type is return type, others are parameters types
|
||||
@Callback(ctypes.c_void_p, ctypes.c_ulong)
|
||||
def exit_callback(x, real_function):
|
||||
print("Try to quit with {0} | {1}".format(x, type(x)))
|
||||
if x == 3:
|
||||
print("TRYING TO REAL EXIT")
|
||||
return real_function(1234)
|
||||
return 0x4242424243444546
|
||||
|
||||
* Using the `Callback` decorator generated from known functions::
|
||||
|
||||
from windows.hooks import *
|
||||
# Decorator name is always API_NAME + "CallBack"
|
||||
@CreateFileACallback
|
||||
def createfile_callback(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, real_function):
|
||||
print("Trying to open {0}".format(lpFileName))
|
||||
if "secret" in lpFileName:
|
||||
return 0xffffffff
|
||||
return real_function()
|
||||
|
||||
.. note::
|
||||
|
||||
See the list of known functions
|
||||
|
||||
|
||||
Put the hook
|
||||
------------
|
||||
|
||||
To setup your IAT hook you just need:
|
||||
|
||||
* A callback that respect the :ref:`hook_protocol`
|
||||
* The :class:`IATEntry` to hook
|
||||
|
||||
|
||||
You just need to use the function :func:`IATEntry.set_hook`
|
||||
|
||||
|
||||
Full Example::
|
||||
|
||||
import windows
|
||||
from windows.hooks import *
|
||||
|
||||
@CreateFileACallback
|
||||
def createfile_callback(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, real_function):
|
||||
print("Trying to open {0}".format(lpFileName))
|
||||
if "secret" in lpFileName:
|
||||
return 0xffffffff
|
||||
return real_function()
|
||||
|
||||
my_exe = windows.current_process.peb.modules[0]
|
||||
imp = my_exe.pe.imports
|
||||
|
||||
iat_create_file = [entry for entry in imp['kernel32.dll'] if entry.name == "CreateFileA"]
|
||||
iat_create_file.set_hook(createfile_callback)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
Remote Python Injection
|
||||
***********************
|
||||
|
||||
It's possible to inject the python interpreter into remote process. All you need to do is to use the method :func:`windows.winobject.WinProcess.execute_python`.
|
||||
|
||||
Calling this function will trigger the interpreter injection and the python code execution.
|
||||
|
||||
For simpler interaction interaction with the remote python, you can an RPC master linked to the remote interpreter.
|
||||
|
||||
RPython 101
|
||||
'''''''''''
|
||||
|
||||
RPython is a very simple Pythonic (I hope so) RPC slave-master. It's goal is to allow easy manipulation of a remote interpreter.
|
||||
|
||||
The only action up to the `slave` is the creation of it's `name_pool`: a namespace of object accessible by the `master`.
|
||||
After that the `slave` will just wait for request and return the desired object.
|
||||
|
||||
All slave object seen by the master are proxy that redirect operation to the slave.
|
||||
|
||||
RPython RPC to remote process
|
||||
'''''''''''''''''''''''''''''
|
||||
|
||||
For easy manipulation of a remote Python interpreter, you can use the RPCInjection module::
|
||||
|
||||
import windows
|
||||
import RPCInjection
|
||||
calc = [x for x in windows.system.processes if x.name == "calc.exe"][0]
|
||||
master = RPCInjection.launch_remote_slave(calc)
|
||||
# Master is a RPC-master to a python interpreter in calc.exe
|
||||
master['windows']
|
||||
# <RemoteObj |<module 'windows' from 'C:\Users\hakril\Documents\Work\PythonForWindows\windows\__init__.pyc'>|>
|
||||
|
||||
# This is a way to get our own (python.exe) pid
|
||||
windows.current_process.pid
|
||||
3624
|
||||
# This is a way to get the pid of calc.exe
|
||||
master['windows'].current_process
|
||||
# <RemoteObj |<windows.winobject.CurrentProcess object at 0x055E6250>|>
|
||||
master['windows'].current_process.pid
|
||||
5052
|
||||
# We can also play with the peb of the remote process
|
||||
master['windows'].current_process.peb
|
||||
# <RemoteObj |<windows.winobject.PEB object at 0x054A3DF0>|>
|
||||
master['windows'].current_process.peb.commandline
|
||||
# <RemoteObj |<WinUnicodeString ""C:\Windows\SysWOW64\calc.exe" " at 0x55e9850>|>
|
||||
|
||||
|
||||
# we can import new stuff
|
||||
|
||||
x['json']
|
||||
# ...
|
||||
# RPython.exchange.RemoteKeyError:
|
||||
# ....
|
||||
# KeyError: u'json'
|
||||
x.imp('json')
|
||||
# <RemoteObj |None|>
|
||||
x['json']
|
||||
# <RemoteObj |<module 'json' from 'C:\Python27\Lib\json\__init__.pyc'>|>
|
||||
|
||||
|
||||
.. note::
|
||||
|
||||
The slave `name_pool` in RPCInjection is filled with :mod:`windows`, :mod:`__import__`, :mod:`ctypes` and :mod:`self` (the RemotePythonSlave object)
|
||||
|
||||
The master.RemotePython
|
||||
'''''''''''''''''''''''
|
||||
|
||||
.. autoclass:: RPython.master.RemotePython
|
||||
|
||||
.. py:method:: __getitem__
|
||||
|
||||
Alias to :func:`ask_by_name`
|
||||
|
||||
Remote IAT Hooking
|
||||
''''''''''''''''''
|
||||
|
||||
See Examples directory
|
||||
@@ -1,13 +0,0 @@
|
||||
Overwiew of the `windows` objects
|
||||
**************************
|
||||
|
||||
object exported by `windows`
|
||||
""""""""""""""""""""""""""""
|
||||
|
||||
.. automodule:: windows
|
||||
|
||||
Principal classes for process exploration
|
||||
"""""""""""""""""""""""""""""""""""""""""
|
||||
|
||||
.. automodule:: windows.winobject
|
||||
:members:
|
||||
@@ -1,4 +0,0 @@
|
||||
Helpers
|
||||
*******
|
||||
|
||||
.. automodule:: windows.utils
|
||||
Reference in New Issue
Block a user