mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Add definition for _TEB
This commit is contained in:
hakril
@@ -0,0 +1,29 @@
|
||||
/* Structures that do not depends on anything other that basic type
|
||||
Simplify structure dependancy file graph
|
||||
*/
|
||||
|
||||
typedef struct _LIST_ENTRY {
|
||||
struct _LIST_ENTRY *Flink;
|
||||
struct _LIST_ENTRY *Blink;
|
||||
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
|
||||
|
||||
typedef struct _LSA_UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0
|
||||
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
|
||||
|
||||
typedef struct _CLIENT_ID{
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID, *PCLIENT_ID;
|
||||
|
||||
typedef struct _CLIENT_ID64{
|
||||
ULONG64 UniqueProcess;
|
||||
ULONG64 UniqueThread;
|
||||
} CLIENT_ID64, *PCLIENT_ID64;
|
||||
|
||||
typedef struct _CLIENT_ID32{
|
||||
ULONG UniqueProcess;
|
||||
ULONG UniqueThread;
|
||||
} CLIENT_ID32, *PCLIENT_ID32;
|
||||
@@ -0,0 +1,227 @@
|
||||
/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10
|
||||
http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html
|
||||
*/
|
||||
|
||||
typedef struct _CURDIR
|
||||
{
|
||||
UNICODE_STRING DosPath;
|
||||
PVOID Handle;
|
||||
} CURDIR, *PCURDIR;
|
||||
|
||||
typedef struct _RTL_DRIVE_LETTER_CURDIR
|
||||
{
|
||||
WORD Flags;
|
||||
WORD Length;
|
||||
ULONG TimeStamp;
|
||||
UNICODE_STRING DosPath;
|
||||
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
|
||||
|
||||
typedef struct _RTL_USER_PROCESS_PARAMETERS
|
||||
{
|
||||
ULONG MaximumLength;
|
||||
ULONG Length;
|
||||
ULONG Flags;
|
||||
ULONG DebugFlags;
|
||||
PVOID ConsoleHandle;
|
||||
ULONG ConsoleFlags;
|
||||
PVOID StandardInput;
|
||||
PVOID StandardOutput;
|
||||
PVOID StandardError;
|
||||
CURDIR CurrentDirectory;
|
||||
UNICODE_STRING DllPath;
|
||||
UNICODE_STRING ImagePathName;
|
||||
UNICODE_STRING CommandLine;
|
||||
PVOID Environment;
|
||||
ULONG StartingX;
|
||||
ULONG StartingY;
|
||||
ULONG CountX;
|
||||
ULONG CountY;
|
||||
ULONG CountCharsX;
|
||||
ULONG CountCharsY;
|
||||
ULONG FillAttribute;
|
||||
ULONG WindowFlags;
|
||||
ULONG ShowWindowFlags;
|
||||
UNICODE_STRING WindowTitle;
|
||||
UNICODE_STRING DesktopInfo;
|
||||
UNICODE_STRING ShellInfo;
|
||||
UNICODE_STRING RuntimeData;
|
||||
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
|
||||
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
|
||||
|
||||
// PEB: Thank to
|
||||
// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx
|
||||
// http://blog.rewolf.pl/blog/?p=573
|
||||
// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
PVOID Reserved1[2];
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
PVOID Reserved2[2];
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
PVOID SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
PVOID Reserved5[3];
|
||||
ULONG CheckSum;
|
||||
ULONG TimeDateStamp;
|
||||
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
typedef struct _PEB_LDR_DATA {
|
||||
BYTE Reserved1[8];
|
||||
PVOID Reserved2[3];
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
} PEB_LDR_DATA, *PPEB_LDR_DATA;
|
||||
|
||||
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 {
|
||||
PVOID FastPebLockRoutine;
|
||||
PVOID SparePtr1;
|
||||
PVOID AtlThunkSListPtr;
|
||||
};
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 {
|
||||
PVOID FastPebUnlockRoutine;
|
||||
PVOID SparePtr2;
|
||||
PVOID IFEOKey;
|
||||
};
|
||||
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 {
|
||||
PVOID FreeList;
|
||||
PVOID SparePebPtr0;
|
||||
PVOID ApiSetMap;
|
||||
};
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 {
|
||||
PVOID ReadOnlySharedMemoryHeap;
|
||||
PVOID HotpatchInformation;
|
||||
PVOID SparePvoid0;
|
||||
};
|
||||
|
||||
|
||||
typedef union _ANON_PEB_UNION_1 {
|
||||
PVOID KernelCallbackTable;
|
||||
PVOID UserSharedInfoPtr;
|
||||
};
|
||||
|
||||
typedef union _ANON_PEB_UNION_2 {
|
||||
PVOID ImageProcessAffinityMask;
|
||||
PVOID ActiveProcessAffinityMask;
|
||||
};
|
||||
|
||||
typedef struct _PEB {
|
||||
BYTE Reserved1[2];
|
||||
BYTE BeingDebugged;
|
||||
BYTE Reserved2[1];
|
||||
PVOID Mutant;
|
||||
PVOID ImageBaseAddress;
|
||||
PPEB_LDR_DATA Ldr;
|
||||
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
||||
PVOID SubSystemData;
|
||||
PVOID ProcessHeap;
|
||||
PVOID FastPebLock;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03;
|
||||
PVOID _SYSTEM_DEPENDENT_04;
|
||||
union {
|
||||
PVOID KernelCallbackTable;
|
||||
PVOID UserSharedInfoPtr;
|
||||
};
|
||||
DWORD SystemReserved;
|
||||
DWORD _SYSTEM_DEPENDENT_05;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06;
|
||||
PVOID TlsExpansionCounter;
|
||||
PVOID TlsBitmap;
|
||||
DWORD TlsBitmapBits[2];
|
||||
PVOID ReadOnlySharedMemoryBase;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07;
|
||||
PVOID ReadOnlyStaticServerData;
|
||||
PVOID AnsiCodePageData;
|
||||
PVOID OemCodePageData;
|
||||
PVOID UnicodeCaseTableData;
|
||||
DWORD NumberOfProcessors;
|
||||
DWORD NtGlobalFlag;
|
||||
LARGE_INTEGER CriticalSectionTimeout;
|
||||
PVOID HeapSegmentReserve;
|
||||
PVOID HeapSegmentCommit;
|
||||
PVOID HeapDeCommitTotalFreeThreshold;
|
||||
PVOID HeapDeCommitFreeBlockThreshold;
|
||||
DWORD NumberOfHeaps;
|
||||
DWORD MaximumNumberOfHeaps;
|
||||
PVOID ProcessHeaps;
|
||||
PVOID GdiSharedHandleTable;
|
||||
PVOID ProcessStarterHelper;
|
||||
PVOID GdiDCAttributeList;
|
||||
PVOID LoaderLock;
|
||||
DWORD OSMajorVersion;
|
||||
DWORD OSMinorVersion;
|
||||
WORD OSBuildNumber;
|
||||
WORD OSCSDVersion;
|
||||
DWORD OSPlatformId;
|
||||
DWORD ImageSubsystem;
|
||||
DWORD ImageSubsystemMajorVersion;
|
||||
PVOID ImageSubsystemMinorVersion;
|
||||
union {
|
||||
PVOID ImageProcessAffinityMask;
|
||||
PVOID ActiveProcessAffinityMask;
|
||||
};
|
||||
PVOID GdiHandleBuffer[26];
|
||||
BYTE GdiHandleBuffer2[32];
|
||||
PVOID PostProcessInitRoutine;
|
||||
PVOID TlsExpansionBitmap;
|
||||
DWORD TlsExpansionBitmapBits[32];
|
||||
PVOID SessionId;
|
||||
ULARGE_INTEGER AppCompatFlags;
|
||||
ULARGE_INTEGER AppCompatFlagsUser;
|
||||
PVOID pShimData;
|
||||
PVOID AppCompatInfo;
|
||||
UNICODE_STRING CSDVersion;
|
||||
PVOID ActivationContextData;
|
||||
PVOID ProcessAssemblyStorageMap;
|
||||
PVOID SystemDefaultActivationContextData;
|
||||
PVOID SystemAssemblyStorageMap;
|
||||
PVOID MinimumStackCommit;
|
||||
} PEB, *PPEB;
|
||||
|
||||
|
||||
/* Partial TEB description
|
||||
Based on:
|
||||
- fields that did not move since XP
|
||||
- https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
|
||||
*/
|
||||
|
||||
typedef struct _EXCEPTION_REGISTRATION_RECORD {
|
||||
_EXCEPTION_REGISTRATION_RECORD *Next;
|
||||
PVOID Handler;
|
||||
};
|
||||
|
||||
typedef struct _NT_TIB {
|
||||
_EXCEPTION_REGISTRATION_RECORD *ExceptionList;
|
||||
PVOID StackBase;
|
||||
PVOID StackLimit;
|
||||
PVOID SubSystemTib;
|
||||
PVOID FiberData;
|
||||
ULONG Version;
|
||||
PVOID ArbitraryUserPointer;
|
||||
_NT_TIB *Self;
|
||||
};
|
||||
|
||||
typedef struct _TEB {
|
||||
_NT_TIB NtTib;
|
||||
PVOID EnvironmentPointer;
|
||||
_CLIENT_ID ClientId;
|
||||
PVOID ActiveRpcHandle;
|
||||
PVOID ThreadLocalStoragePointer;
|
||||
_PEB *ProcessEnvironmentBlock;
|
||||
ULONG LastErrorValue;
|
||||
ULONG CountOfOwnedCriticalSections;
|
||||
PVOID CsrClientThread;
|
||||
PVOID Win32ThreadInfo;
|
||||
ULONG User32Reserved[26];
|
||||
ULONG UserReserved[5];
|
||||
PVOID WOW32Reserved;
|
||||
ULONG CurrentLocale;
|
||||
ULONG FpSoftwareStatusRegister;
|
||||
} TEB;
|
||||
@@ -1,195 +1,3 @@
|
||||
typedef struct _LIST_ENTRY {
|
||||
struct _LIST_ENTRY *Flink;
|
||||
struct _LIST_ENTRY *Blink;
|
||||
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
|
||||
|
||||
|
||||
/* Definition of WinXP : Still same base in win11 with some extra field */
|
||||
typedef struct _PEB_LDR_DATA {
|
||||
ULONG Length;
|
||||
BYTE Initialized;
|
||||
PVOID SsHandle;
|
||||
_LIST_ENTRY InLoadOrderModuleList;
|
||||
_LIST_ENTRY InMemoryOrderModuleList;
|
||||
_LIST_ENTRY InInitializationOrderModuleList;
|
||||
PVOID EntryInProgress;
|
||||
// BYTE ShutdownInProgress; // New field
|
||||
// PVOID ShutdownThreadId; // New field
|
||||
}PEB_LDR_DATA, *PPEB_LDR_DATA;
|
||||
|
||||
|
||||
typedef struct _LSA_UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0
|
||||
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
|
||||
|
||||
typedef struct _CURDIR
|
||||
{
|
||||
UNICODE_STRING DosPath;
|
||||
PVOID Handle;
|
||||
} CURDIR, *PCURDIR;
|
||||
|
||||
typedef struct _RTL_DRIVE_LETTER_CURDIR
|
||||
{
|
||||
WORD Flags;
|
||||
WORD Length;
|
||||
ULONG TimeStamp;
|
||||
UNICODE_STRING DosPath;
|
||||
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
|
||||
|
||||
/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10
|
||||
http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html
|
||||
*/
|
||||
typedef struct _RTL_USER_PROCESS_PARAMETERS
|
||||
{
|
||||
ULONG MaximumLength;
|
||||
ULONG Length;
|
||||
ULONG Flags;
|
||||
ULONG DebugFlags;
|
||||
PVOID ConsoleHandle;
|
||||
ULONG ConsoleFlags;
|
||||
PVOID StandardInput;
|
||||
PVOID StandardOutput;
|
||||
PVOID StandardError;
|
||||
CURDIR CurrentDirectory;
|
||||
UNICODE_STRING DllPath;
|
||||
UNICODE_STRING ImagePathName;
|
||||
UNICODE_STRING CommandLine;
|
||||
PVOID Environment;
|
||||
ULONG StartingX;
|
||||
ULONG StartingY;
|
||||
ULONG CountX;
|
||||
ULONG CountY;
|
||||
ULONG CountCharsX;
|
||||
ULONG CountCharsY;
|
||||
ULONG FillAttribute;
|
||||
ULONG WindowFlags;
|
||||
ULONG ShowWindowFlags;
|
||||
UNICODE_STRING WindowTitle;
|
||||
UNICODE_STRING DesktopInfo;
|
||||
UNICODE_STRING ShellInfo;
|
||||
UNICODE_STRING RuntimeData;
|
||||
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
|
||||
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
|
||||
|
||||
|
||||
// Thank to:
|
||||
// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx
|
||||
// http://blog.rewolf.pl/blog/?p=573
|
||||
// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 {
|
||||
PVOID FastPebLockRoutine;
|
||||
PVOID SparePtr1;
|
||||
PVOID AtlThunkSListPtr;
|
||||
};
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 {
|
||||
PVOID FastPebUnlockRoutine;
|
||||
PVOID SparePtr2;
|
||||
PVOID IFEOKey;
|
||||
};
|
||||
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 {
|
||||
PVOID FreeList;
|
||||
PVOID SparePebPtr0;
|
||||
PVOID ApiSetMap;
|
||||
};
|
||||
|
||||
typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 {
|
||||
PVOID ReadOnlySharedMemoryHeap;
|
||||
PVOID HotpatchInformation;
|
||||
PVOID SparePvoid0;
|
||||
};
|
||||
|
||||
|
||||
typedef union _ANON_PEB_UNION_1 {
|
||||
PVOID KernelCallbackTable;
|
||||
PVOID UserSharedInfoPtr;
|
||||
};
|
||||
|
||||
typedef union _ANON_PEB_UNION_2 {
|
||||
PVOID ImageProcessAffinityMask;
|
||||
PVOID ActiveProcessAffinityMask;
|
||||
};
|
||||
|
||||
typedef struct _PEB {
|
||||
BYTE Reserved1[2];
|
||||
BYTE BeingDebugged;
|
||||
BYTE Reserved2[1];
|
||||
PVOID Mutant;
|
||||
PVOID ImageBaseAddress;
|
||||
PPEB_LDR_DATA Ldr;
|
||||
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
||||
PVOID SubSystemData;
|
||||
PVOID ProcessHeap;
|
||||
PVOID FastPebLock;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03;
|
||||
PVOID _SYSTEM_DEPENDENT_04;
|
||||
union {
|
||||
PVOID KernelCallbackTable;
|
||||
PVOID UserSharedInfoPtr;
|
||||
};
|
||||
DWORD SystemReserved;
|
||||
DWORD _SYSTEM_DEPENDENT_05;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06;
|
||||
PVOID TlsExpansionCounter;
|
||||
PVOID TlsBitmap;
|
||||
DWORD TlsBitmapBits[2];
|
||||
PVOID ReadOnlySharedMemoryBase;
|
||||
_ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07;
|
||||
PVOID ReadOnlyStaticServerData;
|
||||
PVOID AnsiCodePageData;
|
||||
PVOID OemCodePageData;
|
||||
PVOID UnicodeCaseTableData;
|
||||
DWORD NumberOfProcessors;
|
||||
DWORD NtGlobalFlag;
|
||||
LARGE_INTEGER CriticalSectionTimeout;
|
||||
PVOID HeapSegmentReserve;
|
||||
PVOID HeapSegmentCommit;
|
||||
PVOID HeapDeCommitTotalFreeThreshold;
|
||||
PVOID HeapDeCommitFreeBlockThreshold;
|
||||
DWORD NumberOfHeaps;
|
||||
DWORD MaximumNumberOfHeaps;
|
||||
PVOID ProcessHeaps;
|
||||
PVOID GdiSharedHandleTable;
|
||||
PVOID ProcessStarterHelper;
|
||||
PVOID GdiDCAttributeList;
|
||||
PVOID LoaderLock;
|
||||
DWORD OSMajorVersion;
|
||||
DWORD OSMinorVersion;
|
||||
WORD OSBuildNumber;
|
||||
WORD OSCSDVersion;
|
||||
DWORD OSPlatformId;
|
||||
DWORD ImageSubsystem;
|
||||
DWORD ImageSubsystemMajorVersion;
|
||||
PVOID ImageSubsystemMinorVersion;
|
||||
union {
|
||||
PVOID ImageProcessAffinityMask;
|
||||
PVOID ActiveProcessAffinityMask;
|
||||
};
|
||||
PVOID GdiHandleBuffer[26];
|
||||
BYTE GdiHandleBuffer2[32];
|
||||
PVOID PostProcessInitRoutine;
|
||||
PVOID TlsExpansionBitmap;
|
||||
DWORD TlsExpansionBitmapBits[32];
|
||||
PVOID SessionId;
|
||||
ULARGE_INTEGER AppCompatFlags;
|
||||
ULARGE_INTEGER AppCompatFlagsUser;
|
||||
PVOID pShimData;
|
||||
PVOID AppCompatInfo;
|
||||
UNICODE_STRING CSDVersion;
|
||||
PVOID ActivationContextData;
|
||||
PVOID ProcessAssemblyStorageMap;
|
||||
PVOID SystemDefaultActivationContextData;
|
||||
PVOID SystemAssemblyStorageMap;
|
||||
PVOID MinimumStackCommit;
|
||||
} PEB, *PPEB;
|
||||
|
||||
|
||||
typedef struct _SECURITY_ATTRIBUTES {
|
||||
DWORD nLength;
|
||||
LPVOID lpSecurityDescriptor;
|
||||
@@ -870,34 +678,7 @@ typedef enum _SE_OBJECT_TYPE {
|
||||
} SE_OBJECT_TYPE;
|
||||
|
||||
|
||||
typedef struct _CLIENT_ID{
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID, *PCLIENT_ID;
|
||||
|
||||
typedef struct _CLIENT_ID64{
|
||||
ULONG64 UniqueProcess;
|
||||
ULONG64 UniqueThread;
|
||||
} CLIENT_ID64, *PCLIENT_ID64;
|
||||
|
||||
typedef struct _CLIENT_ID32{
|
||||
ULONG UniqueProcess;
|
||||
ULONG UniqueThread;
|
||||
} CLIENT_ID32, *PCLIENT_ID32;
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
PVOID Reserved1[2];
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
PVOID Reserved2[2];
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
PVOID SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
PVOID Reserved5[3];
|
||||
ULONG CheckSum;
|
||||
ULONG TimeDateStamp;
|
||||
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
|
||||
typedef struct _MEMORY_BASIC_INFORMATION {
|
||||
|
||||
+1254
-1136
File diff suppressed because it is too large
Load Diff
@@ -13471,6 +13471,7 @@ structs = {'ACCESS_ALLOWED_ACE',
|
||||
'SYSTEM_RESOURCE_ATTRIBUTE_ACE',
|
||||
'SYSTEM_SCOPED_POLICY_ID_ACE',
|
||||
'SYSTEM_VERIFIER_INFORMATION',
|
||||
'TEB',
|
||||
'THREADENTRY32',
|
||||
'THREAD_BASIC_INFORMATION',
|
||||
'TIME_ZONE_INFORMATION',
|
||||
@@ -13772,6 +13773,7 @@ structs = {'ACCESS_ALLOWED_ACE',
|
||||
'_EXCEPTION_RECORD',
|
||||
'_EXCEPTION_RECORD32',
|
||||
'_EXCEPTION_RECORD64',
|
||||
'_EXCEPTION_REGISTRATION_RECORD',
|
||||
'_EXIT_PROCESS_DEBUG_INFO',
|
||||
'_EXIT_THREAD_DEBUG_INFO',
|
||||
'_EXPLICIT_ACCESS_W',
|
||||
@@ -13917,6 +13919,7 @@ structs = {'ACCESS_ALLOWED_ACE',
|
||||
'_NET_DISPLAY_GROUP',
|
||||
'_NET_DISPLAY_MACHINE',
|
||||
'_NET_DISPLAY_USER',
|
||||
'_NT_TIB',
|
||||
'_OBJECTS_AND_NAME_A',
|
||||
'_OBJECTS_AND_NAME_W',
|
||||
'_OBJECTS_AND_SID',
|
||||
@@ -14047,6 +14050,7 @@ structs = {'ACCESS_ALLOWED_ACE',
|
||||
'_SYSTEM_RESOURCE_ATTRIBUTE_ACE',
|
||||
'_SYSTEM_SCOPED_POLICY_ID_ACE',
|
||||
'_SYSTEM_VERIFIER_INFORMATION',
|
||||
'_TEB',
|
||||
'_THREAD_BASIC_INFORMATION',
|
||||
'_TIME_ZONE_INFORMATION',
|
||||
'_TMPUNION_CERT_ID',
|
||||
|
||||
+413
-375
@@ -3876,6 +3876,92 @@ class _SHFILEOPSTRUCTA(Structure):
|
||||
LPSHFILEOPSTRUCTA = POINTER(_SHFILEOPSTRUCTA)
|
||||
SHFILEOPSTRUCTA = _SHFILEOPSTRUCTA
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _LIST_ENTRY(Structure): pass
|
||||
LIST_ENTRY = _LIST_ENTRY
|
||||
PLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
PRLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
_LIST_ENTRY._fields_ = [
|
||||
("Flink", POINTER(_LIST_ENTRY)),
|
||||
("Blink", POINTER(_LIST_ENTRY)),
|
||||
]
|
||||
|
||||
class _LSA_UNICODE_STRING(Structure):
|
||||
_fields_ = [
|
||||
("Length", USHORT),
|
||||
("MaximumLength", USHORT),
|
||||
("Buffer", PVOID),
|
||||
]
|
||||
LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
|
||||
INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
|
||||
class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING):
|
||||
@property
|
||||
def str(self):
|
||||
"""The python string of the LSA_UNICODE_STRING object
|
||||
|
||||
:type: :class:`unicode`
|
||||
"""
|
||||
if not self.Length:
|
||||
return ""
|
||||
if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR
|
||||
raw_data = self._target.read_memory(self.Buffer, self.Length)
|
||||
return raw_data.decode("utf16")
|
||||
size = int(self.Length / 2)
|
||||
return (ctypes.c_wchar * size).from_address(self.Buffer)[:]
|
||||
|
||||
@classmethod
|
||||
def from_string(cls, s):
|
||||
utf16_len = len(s) * 2
|
||||
return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID))
|
||||
|
||||
@classmethod
|
||||
def from_size(cls, size):
|
||||
buffer = ctypes.create_string_buffer(size)
|
||||
return cls(size, size, ctypes.cast(buffer, PVOID))
|
||||
|
||||
def __repr__(self):
|
||||
return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self))))
|
||||
|
||||
def __sprint__(self):
|
||||
try:
|
||||
return self.__repr__()
|
||||
except TypeError as e:
|
||||
# Bad buffer: print raw infos
|
||||
return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer)
|
||||
|
||||
LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
class _CLIENT_ID(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", HANDLE),
|
||||
("UniqueThread", HANDLE),
|
||||
]
|
||||
CLIENT_ID = _CLIENT_ID
|
||||
PCLIENT_ID = POINTER(_CLIENT_ID)
|
||||
|
||||
class _CLIENT_ID64(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", ULONG64),
|
||||
("UniqueThread", ULONG64),
|
||||
]
|
||||
CLIENT_ID64 = _CLIENT_ID64
|
||||
PCLIENT_ID64 = POINTER(_CLIENT_ID64)
|
||||
|
||||
class _CLIENT_ID32(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", ULONG),
|
||||
("UniqueThread", ULONG),
|
||||
]
|
||||
CLIENT_ID32 = _CLIENT_ID32
|
||||
PCLIENT_ID32 = POINTER(_CLIENT_ID32)
|
||||
|
||||
SymNone = EnumValue("SYM_TYPE", "SymNone", 0x0)
|
||||
SymCoff = EnumValue("SYM_TYPE", "SymCoff", 0x1)
|
||||
SymCv = EnumValue("SYM_TYPE", "SymCv", 0x2)
|
||||
@@ -4437,6 +4523,82 @@ class _tagSTACKFRAME_EX(Structure):
|
||||
LPSTACKFRAME_EX = POINTER(_tagSTACKFRAME_EX)
|
||||
STACKFRAME_EX = _tagSTACKFRAME_EX
|
||||
|
||||
ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0)
|
||||
ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1)
|
||||
ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2)
|
||||
ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3)
|
||||
ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4)
|
||||
ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5)
|
||||
ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6)
|
||||
ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7)
|
||||
ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8)
|
||||
class _COMPUTER_NAME_FORMAT(EnumType):
|
||||
values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax]
|
||||
mapper = FlagMapper(*values)
|
||||
COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT
|
||||
|
||||
|
||||
class _SYSTEM_PROCESS_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("NextEntryOffset", ULONG),
|
||||
("NumberOfThreads", ULONG),
|
||||
("Reserved1", BYTE * (24)),
|
||||
("CreateTime", LARGE_INTEGER),
|
||||
("UserTime", LARGE_INTEGER),
|
||||
("KernelTime", LARGE_INTEGER),
|
||||
("ImageName", UNICODE_STRING),
|
||||
("BasePriority", LONG),
|
||||
("UniqueProcessId", HANDLE),
|
||||
("InheritedFromUniqueProcessId", PVOID),
|
||||
("HandleCount", ULONG),
|
||||
("Reserved4", BYTE * (4)),
|
||||
("Reserved5", PVOID * (1)),
|
||||
("PeakVirtualSize", PVOID),
|
||||
("VirtualSize", PVOID),
|
||||
("PageFaultCount", PVOID),
|
||||
("PeakWorkingSetSize", PVOID),
|
||||
("WorkingSetSize", PVOID),
|
||||
("QuotaPeakPagedPoolUsage", PVOID),
|
||||
("QuotaPagedPoolUsage", PVOID),
|
||||
("QuotaPeakNonPagedPoolUsage", PVOID),
|
||||
("QuotaNonPagedPoolUsage", PVOID),
|
||||
("PagefileUsage", PVOID),
|
||||
("PeakPagefileUsage", SIZE_T),
|
||||
("PrivatePageCount", SIZE_T),
|
||||
("Reserved6", LARGE_INTEGER * (6)),
|
||||
]
|
||||
PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION)
|
||||
SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION
|
||||
|
||||
class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("IdleTime", LARGE_INTEGER),
|
||||
("KernelTime", LARGE_INTEGER),
|
||||
("UserTime", LARGE_INTEGER),
|
||||
("Reserved1", LARGE_INTEGER * (2)),
|
||||
("Reserved2", ULONG),
|
||||
]
|
||||
PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)
|
||||
SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
|
||||
|
||||
class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("RegistryQuotaAllowed", ULONG),
|
||||
("RegistryQuotaUsed", ULONG),
|
||||
("Reserved1", PVOID),
|
||||
]
|
||||
PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION)
|
||||
SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION
|
||||
|
||||
class _SYSTEM_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", BYTE * (24)),
|
||||
("Reserved2", PVOID * (4)),
|
||||
("NumberOfProcessors", CHAR),
|
||||
]
|
||||
PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION)
|
||||
SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION
|
||||
|
||||
TASK_ACTION_EXEC = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_EXEC", 0x0)
|
||||
TASK_ACTION_COM_HANDLER = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_COM_HANDLER", 0x5)
|
||||
TASK_ACTION_SEND_EMAIL = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_SEND_EMAIL", 0x6)
|
||||
@@ -4545,6 +4707,257 @@ class TASK_RUN_FLAGS(EnumType):
|
||||
mapper = FlagMapper(*values)
|
||||
|
||||
|
||||
class _CURDIR(Structure):
|
||||
_fields_ = [
|
||||
("DosPath", UNICODE_STRING),
|
||||
("Handle", PVOID),
|
||||
]
|
||||
CURDIR = _CURDIR
|
||||
PCURDIR = POINTER(_CURDIR)
|
||||
|
||||
class _RTL_DRIVE_LETTER_CURDIR(Structure):
|
||||
_fields_ = [
|
||||
("Flags", WORD),
|
||||
("Length", WORD),
|
||||
("TimeStamp", ULONG),
|
||||
("DosPath", UNICODE_STRING),
|
||||
]
|
||||
PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR)
|
||||
RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR
|
||||
|
||||
class _RTL_USER_PROCESS_PARAMETERS(Structure):
|
||||
_fields_ = [
|
||||
("MaximumLength", ULONG),
|
||||
("Length", ULONG),
|
||||
("Flags", ULONG),
|
||||
("DebugFlags", ULONG),
|
||||
("ConsoleHandle", PVOID),
|
||||
("ConsoleFlags", ULONG),
|
||||
("StandardInput", PVOID),
|
||||
("StandardOutput", PVOID),
|
||||
("StandardError", PVOID),
|
||||
("CurrentDirectory", CURDIR),
|
||||
("DllPath", UNICODE_STRING),
|
||||
("ImagePathName", UNICODE_STRING),
|
||||
("CommandLine", UNICODE_STRING),
|
||||
("Environment", PVOID),
|
||||
("StartingX", ULONG),
|
||||
("StartingY", ULONG),
|
||||
("CountX", ULONG),
|
||||
("CountY", ULONG),
|
||||
("CountCharsX", ULONG),
|
||||
("CountCharsY", ULONG),
|
||||
("FillAttribute", ULONG),
|
||||
("WindowFlags", ULONG),
|
||||
("ShowWindowFlags", ULONG),
|
||||
("WindowTitle", UNICODE_STRING),
|
||||
("DesktopInfo", UNICODE_STRING),
|
||||
("ShellInfo", UNICODE_STRING),
|
||||
("RuntimeData", UNICODE_STRING),
|
||||
("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)),
|
||||
]
|
||||
PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS)
|
||||
RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS
|
||||
|
||||
class _LDR_DATA_TABLE_ENTRY(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", PVOID * (2)),
|
||||
("InMemoryOrderLinks", LIST_ENTRY),
|
||||
("Reserved2", PVOID * (2)),
|
||||
("DllBase", PVOID),
|
||||
("EntryPoint", PVOID),
|
||||
("SizeOfImage", PVOID),
|
||||
("FullDllName", UNICODE_STRING),
|
||||
("BaseDllName", UNICODE_STRING),
|
||||
("Reserved5", PVOID * (3)),
|
||||
("CheckSum", ULONG),
|
||||
("TimeDateStamp", ULONG),
|
||||
]
|
||||
LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY
|
||||
PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY)
|
||||
|
||||
class _PEB_LDR_DATA(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", BYTE * (8)),
|
||||
("Reserved2", PVOID * (3)),
|
||||
("InMemoryOrderModuleList", LIST_ENTRY),
|
||||
]
|
||||
PEB_LDR_DATA = _PEB_LDR_DATA
|
||||
PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA)
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_02(Union):
|
||||
_fields_ = [
|
||||
("FastPebLockRoutine", PVOID),
|
||||
("SparePtr1", PVOID),
|
||||
("AtlThunkSListPtr", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_03(Union):
|
||||
_fields_ = [
|
||||
("FastPebUnlockRoutine", PVOID),
|
||||
("SparePtr2", PVOID),
|
||||
("IFEOKey", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_06(Union):
|
||||
_fields_ = [
|
||||
("FreeList", PVOID),
|
||||
("SparePebPtr0", PVOID),
|
||||
("ApiSetMap", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_07(Union):
|
||||
_fields_ = [
|
||||
("ReadOnlySharedMemoryHeap", PVOID),
|
||||
("HotpatchInformation", PVOID),
|
||||
("SparePvoid0", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_UNION_1(Union):
|
||||
_fields_ = [
|
||||
("KernelCallbackTable", PVOID),
|
||||
("UserSharedInfoPtr", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_UNION_2(Union):
|
||||
_fields_ = [
|
||||
("ImageProcessAffinityMask", PVOID),
|
||||
("ActiveProcessAffinityMask", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON__PEB_SUB_UNION_1(Union):
|
||||
_fields_ = [
|
||||
("KernelCallbackTable", PVOID),
|
||||
("UserSharedInfoPtr", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON__PEB_SUB_UNION_2(Union):
|
||||
_fields_ = [
|
||||
("ImageProcessAffinityMask", PVOID),
|
||||
("ActiveProcessAffinityMask", PVOID),
|
||||
]
|
||||
|
||||
class _PEB(Structure):
|
||||
_anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02")
|
||||
_fields_ = [
|
||||
("Reserved1", BYTE * (2)),
|
||||
("BeingDebugged", BYTE),
|
||||
("Reserved2", BYTE * (1)),
|
||||
("Mutant", PVOID),
|
||||
("ImageBaseAddress", PVOID),
|
||||
("Ldr", PPEB_LDR_DATA),
|
||||
("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS),
|
||||
("SubSystemData", PVOID),
|
||||
("ProcessHeap", PVOID),
|
||||
("FastPebLock", PVOID),
|
||||
("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02),
|
||||
("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03),
|
||||
("_SYSTEM_DEPENDENT_04", PVOID),
|
||||
("anon_01", _ANON__PEB_SUB_UNION_1),
|
||||
("SystemReserved", DWORD),
|
||||
("_SYSTEM_DEPENDENT_05", DWORD),
|
||||
("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06),
|
||||
("TlsExpansionCounter", PVOID),
|
||||
("TlsBitmap", PVOID),
|
||||
("TlsBitmapBits", DWORD * (2)),
|
||||
("ReadOnlySharedMemoryBase", PVOID),
|
||||
("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07),
|
||||
("ReadOnlyStaticServerData", PVOID),
|
||||
("AnsiCodePageData", PVOID),
|
||||
("OemCodePageData", PVOID),
|
||||
("UnicodeCaseTableData", PVOID),
|
||||
("NumberOfProcessors", DWORD),
|
||||
("NtGlobalFlag", DWORD),
|
||||
("CriticalSectionTimeout", LARGE_INTEGER),
|
||||
("HeapSegmentReserve", PVOID),
|
||||
("HeapSegmentCommit", PVOID),
|
||||
("HeapDeCommitTotalFreeThreshold", PVOID),
|
||||
("HeapDeCommitFreeBlockThreshold", PVOID),
|
||||
("NumberOfHeaps", DWORD),
|
||||
("MaximumNumberOfHeaps", DWORD),
|
||||
("ProcessHeaps", PVOID),
|
||||
("GdiSharedHandleTable", PVOID),
|
||||
("ProcessStarterHelper", PVOID),
|
||||
("GdiDCAttributeList", PVOID),
|
||||
("LoaderLock", PVOID),
|
||||
("OSMajorVersion", DWORD),
|
||||
("OSMinorVersion", DWORD),
|
||||
("OSBuildNumber", WORD),
|
||||
("OSCSDVersion", WORD),
|
||||
("OSPlatformId", DWORD),
|
||||
("ImageSubsystem", DWORD),
|
||||
("ImageSubsystemMajorVersion", DWORD),
|
||||
("ImageSubsystemMinorVersion", PVOID),
|
||||
("anon_02", _ANON__PEB_SUB_UNION_2),
|
||||
("GdiHandleBuffer", PVOID * (26)),
|
||||
("GdiHandleBuffer2", BYTE * (32)),
|
||||
("PostProcessInitRoutine", PVOID),
|
||||
("TlsExpansionBitmap", PVOID),
|
||||
("TlsExpansionBitmapBits", DWORD * (32)),
|
||||
("SessionId", PVOID),
|
||||
("AppCompatFlags", ULARGE_INTEGER),
|
||||
("AppCompatFlagsUser", ULARGE_INTEGER),
|
||||
("pShimData", PVOID),
|
||||
("AppCompatInfo", PVOID),
|
||||
("CSDVersion", UNICODE_STRING),
|
||||
("ActivationContextData", PVOID),
|
||||
("ProcessAssemblyStorageMap", PVOID),
|
||||
("SystemDefaultActivationContextData", PVOID),
|
||||
("SystemAssemblyStorageMap", PVOID),
|
||||
("MinimumStackCommit", PVOID),
|
||||
]
|
||||
PEB = _PEB
|
||||
PPEB = POINTER(_PEB)
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _EXCEPTION_REGISTRATION_RECORD(Structure): pass
|
||||
|
||||
_EXCEPTION_REGISTRATION_RECORD._fields_ = [
|
||||
("Next", POINTER(_EXCEPTION_REGISTRATION_RECORD)),
|
||||
("Handler", PVOID),
|
||||
]
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _NT_TIB(Structure): pass
|
||||
|
||||
_NT_TIB._fields_ = [
|
||||
("ExceptionList", POINTER(_EXCEPTION_REGISTRATION_RECORD)),
|
||||
("StackBase", PVOID),
|
||||
("StackLimit", PVOID),
|
||||
("SubSystemTib", PVOID),
|
||||
("FiberData", PVOID),
|
||||
("Version", ULONG),
|
||||
("ArbitraryUserPointer", PVOID),
|
||||
("Self", POINTER(_NT_TIB)),
|
||||
]
|
||||
|
||||
class _TEB(Structure):
|
||||
_fields_ = [
|
||||
("NtTib", _NT_TIB),
|
||||
("EnvironmentPointer", PVOID),
|
||||
("ClientId", _CLIENT_ID),
|
||||
("ActiveRpcHandle", PVOID),
|
||||
("ThreadLocalStoragePointer", PVOID),
|
||||
("ProcessEnvironmentBlock", POINTER(_PEB)),
|
||||
("LastErrorValue", ULONG),
|
||||
("CountOfOwnedCriticalSections", ULONG),
|
||||
("CsrClientThread", PVOID),
|
||||
("Win32ThreadInfo", PVOID),
|
||||
("User32Reserved", ULONG * (26)),
|
||||
("UserReserved", ULONG * (5)),
|
||||
("WOW32Reserved", PVOID),
|
||||
("CurrentLocale", ULONG),
|
||||
("FpSoftwareStatusRegister", ULONG),
|
||||
]
|
||||
TEB = _TEB
|
||||
|
||||
class _TRACE_PROVIDER_INFO(Structure):
|
||||
_fields_ = [
|
||||
("ProviderGuid", GUID),
|
||||
@@ -5426,264 +5839,6 @@ NT_PRODUCT_TYPE = _NT_PRODUCT_TYPE
|
||||
PNT_PRODUCT_TYPE = POINTER(_NT_PRODUCT_TYPE)
|
||||
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _LIST_ENTRY(Structure): pass
|
||||
LIST_ENTRY = _LIST_ENTRY
|
||||
PLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
PRLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
_LIST_ENTRY._fields_ = [
|
||||
("Flink", POINTER(_LIST_ENTRY)),
|
||||
("Blink", POINTER(_LIST_ENTRY)),
|
||||
]
|
||||
|
||||
class _PEB_LDR_DATA(Structure):
|
||||
_fields_ = [
|
||||
("Length", ULONG),
|
||||
("Initialized", BYTE),
|
||||
("SsHandle", PVOID),
|
||||
("InLoadOrderModuleList", _LIST_ENTRY),
|
||||
("InMemoryOrderModuleList", _LIST_ENTRY),
|
||||
("InInitializationOrderModuleList", _LIST_ENTRY),
|
||||
("EntryInProgress", PVOID),
|
||||
]
|
||||
PEB_LDR_DATA = _PEB_LDR_DATA
|
||||
PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA)
|
||||
|
||||
class _LSA_UNICODE_STRING(Structure):
|
||||
_fields_ = [
|
||||
("Length", USHORT),
|
||||
("MaximumLength", USHORT),
|
||||
("Buffer", PVOID),
|
||||
]
|
||||
LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
|
||||
INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
|
||||
class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING):
|
||||
@property
|
||||
def str(self):
|
||||
"""The python string of the LSA_UNICODE_STRING object
|
||||
|
||||
:type: :class:`unicode`
|
||||
"""
|
||||
if not self.Length:
|
||||
return ""
|
||||
if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR
|
||||
raw_data = self._target.read_memory(self.Buffer, self.Length)
|
||||
return raw_data.decode("utf16")
|
||||
size = int(self.Length / 2)
|
||||
return (ctypes.c_wchar * size).from_address(self.Buffer)[:]
|
||||
|
||||
@classmethod
|
||||
def from_string(cls, s):
|
||||
utf16_len = len(s) * 2
|
||||
return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID))
|
||||
|
||||
@classmethod
|
||||
def from_size(cls, size):
|
||||
buffer = ctypes.create_string_buffer(size)
|
||||
return cls(size, size, ctypes.cast(buffer, PVOID))
|
||||
|
||||
def __repr__(self):
|
||||
return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self))))
|
||||
|
||||
def __sprint__(self):
|
||||
try:
|
||||
return self.__repr__()
|
||||
except TypeError as e:
|
||||
# Bad buffer: print raw infos
|
||||
return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer)
|
||||
|
||||
LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
class _CURDIR(Structure):
|
||||
_fields_ = [
|
||||
("DosPath", UNICODE_STRING),
|
||||
("Handle", PVOID),
|
||||
]
|
||||
CURDIR = _CURDIR
|
||||
PCURDIR = POINTER(_CURDIR)
|
||||
|
||||
class _RTL_DRIVE_LETTER_CURDIR(Structure):
|
||||
_fields_ = [
|
||||
("Flags", WORD),
|
||||
("Length", WORD),
|
||||
("TimeStamp", ULONG),
|
||||
("DosPath", UNICODE_STRING),
|
||||
]
|
||||
PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR)
|
||||
RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR
|
||||
|
||||
class _RTL_USER_PROCESS_PARAMETERS(Structure):
|
||||
_fields_ = [
|
||||
("MaximumLength", ULONG),
|
||||
("Length", ULONG),
|
||||
("Flags", ULONG),
|
||||
("DebugFlags", ULONG),
|
||||
("ConsoleHandle", PVOID),
|
||||
("ConsoleFlags", ULONG),
|
||||
("StandardInput", PVOID),
|
||||
("StandardOutput", PVOID),
|
||||
("StandardError", PVOID),
|
||||
("CurrentDirectory", CURDIR),
|
||||
("DllPath", UNICODE_STRING),
|
||||
("ImagePathName", UNICODE_STRING),
|
||||
("CommandLine", UNICODE_STRING),
|
||||
("Environment", PVOID),
|
||||
("StartingX", ULONG),
|
||||
("StartingY", ULONG),
|
||||
("CountX", ULONG),
|
||||
("CountY", ULONG),
|
||||
("CountCharsX", ULONG),
|
||||
("CountCharsY", ULONG),
|
||||
("FillAttribute", ULONG),
|
||||
("WindowFlags", ULONG),
|
||||
("ShowWindowFlags", ULONG),
|
||||
("WindowTitle", UNICODE_STRING),
|
||||
("DesktopInfo", UNICODE_STRING),
|
||||
("ShellInfo", UNICODE_STRING),
|
||||
("RuntimeData", UNICODE_STRING),
|
||||
("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)),
|
||||
]
|
||||
PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS)
|
||||
RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_02(Union):
|
||||
_fields_ = [
|
||||
("FastPebLockRoutine", PVOID),
|
||||
("SparePtr1", PVOID),
|
||||
("AtlThunkSListPtr", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_03(Union):
|
||||
_fields_ = [
|
||||
("FastPebUnlockRoutine", PVOID),
|
||||
("SparePtr2", PVOID),
|
||||
("IFEOKey", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_06(Union):
|
||||
_fields_ = [
|
||||
("FreeList", PVOID),
|
||||
("SparePebPtr0", PVOID),
|
||||
("ApiSetMap", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_SYSTEM_DEPENDENT_07(Union):
|
||||
_fields_ = [
|
||||
("ReadOnlySharedMemoryHeap", PVOID),
|
||||
("HotpatchInformation", PVOID),
|
||||
("SparePvoid0", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_UNION_1(Union):
|
||||
_fields_ = [
|
||||
("KernelCallbackTable", PVOID),
|
||||
("UserSharedInfoPtr", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON_PEB_UNION_2(Union):
|
||||
_fields_ = [
|
||||
("ImageProcessAffinityMask", PVOID),
|
||||
("ActiveProcessAffinityMask", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON__PEB_SUB_UNION_1(Union):
|
||||
_fields_ = [
|
||||
("KernelCallbackTable", PVOID),
|
||||
("UserSharedInfoPtr", PVOID),
|
||||
]
|
||||
|
||||
|
||||
class _ANON__PEB_SUB_UNION_2(Union):
|
||||
_fields_ = [
|
||||
("ImageProcessAffinityMask", PVOID),
|
||||
("ActiveProcessAffinityMask", PVOID),
|
||||
]
|
||||
|
||||
class _PEB(Structure):
|
||||
_anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02")
|
||||
_fields_ = [
|
||||
("Reserved1", BYTE * (2)),
|
||||
("BeingDebugged", BYTE),
|
||||
("Reserved2", BYTE * (1)),
|
||||
("Mutant", PVOID),
|
||||
("ImageBaseAddress", PVOID),
|
||||
("Ldr", PPEB_LDR_DATA),
|
||||
("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS),
|
||||
("SubSystemData", PVOID),
|
||||
("ProcessHeap", PVOID),
|
||||
("FastPebLock", PVOID),
|
||||
("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02),
|
||||
("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03),
|
||||
("_SYSTEM_DEPENDENT_04", PVOID),
|
||||
("anon_01", _ANON__PEB_SUB_UNION_1),
|
||||
("SystemReserved", DWORD),
|
||||
("_SYSTEM_DEPENDENT_05", DWORD),
|
||||
("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06),
|
||||
("TlsExpansionCounter", PVOID),
|
||||
("TlsBitmap", PVOID),
|
||||
("TlsBitmapBits", DWORD * (2)),
|
||||
("ReadOnlySharedMemoryBase", PVOID),
|
||||
("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07),
|
||||
("ReadOnlyStaticServerData", PVOID),
|
||||
("AnsiCodePageData", PVOID),
|
||||
("OemCodePageData", PVOID),
|
||||
("UnicodeCaseTableData", PVOID),
|
||||
("NumberOfProcessors", DWORD),
|
||||
("NtGlobalFlag", DWORD),
|
||||
("CriticalSectionTimeout", LARGE_INTEGER),
|
||||
("HeapSegmentReserve", PVOID),
|
||||
("HeapSegmentCommit", PVOID),
|
||||
("HeapDeCommitTotalFreeThreshold", PVOID),
|
||||
("HeapDeCommitFreeBlockThreshold", PVOID),
|
||||
("NumberOfHeaps", DWORD),
|
||||
("MaximumNumberOfHeaps", DWORD),
|
||||
("ProcessHeaps", PVOID),
|
||||
("GdiSharedHandleTable", PVOID),
|
||||
("ProcessStarterHelper", PVOID),
|
||||
("GdiDCAttributeList", PVOID),
|
||||
("LoaderLock", PVOID),
|
||||
("OSMajorVersion", DWORD),
|
||||
("OSMinorVersion", DWORD),
|
||||
("OSBuildNumber", WORD),
|
||||
("OSCSDVersion", WORD),
|
||||
("OSPlatformId", DWORD),
|
||||
("ImageSubsystem", DWORD),
|
||||
("ImageSubsystemMajorVersion", DWORD),
|
||||
("ImageSubsystemMinorVersion", PVOID),
|
||||
("anon_02", _ANON__PEB_SUB_UNION_2),
|
||||
("GdiHandleBuffer", PVOID * (26)),
|
||||
("GdiHandleBuffer2", BYTE * (32)),
|
||||
("PostProcessInitRoutine", PVOID),
|
||||
("TlsExpansionBitmap", PVOID),
|
||||
("TlsExpansionBitmapBits", DWORD * (32)),
|
||||
("SessionId", PVOID),
|
||||
("AppCompatFlags", ULARGE_INTEGER),
|
||||
("AppCompatFlagsUser", ULARGE_INTEGER),
|
||||
("pShimData", PVOID),
|
||||
("AppCompatInfo", PVOID),
|
||||
("CSDVersion", UNICODE_STRING),
|
||||
("ActivationContextData", PVOID),
|
||||
("ProcessAssemblyStorageMap", PVOID),
|
||||
("SystemDefaultActivationContextData", PVOID),
|
||||
("SystemAssemblyStorageMap", PVOID),
|
||||
("MinimumStackCommit", PVOID),
|
||||
]
|
||||
PEB = _PEB
|
||||
PPEB = POINTER(_PEB)
|
||||
|
||||
class _SECURITY_ATTRIBUTES(Structure):
|
||||
_fields_ = [
|
||||
("nLength", DWORD),
|
||||
@@ -5733,47 +5888,6 @@ class _SYSTEM_PROCESS_ID_INFORMATION(Structure):
|
||||
PSYSTEM_PROCESS_ID_INFORMATION = POINTER(_SYSTEM_PROCESS_ID_INFORMATION)
|
||||
SYSTEM_PROCESS_ID_INFORMATION = _SYSTEM_PROCESS_ID_INFORMATION
|
||||
|
||||
class _CLIENT_ID(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", HANDLE),
|
||||
("UniqueThread", HANDLE),
|
||||
]
|
||||
CLIENT_ID = _CLIENT_ID
|
||||
PCLIENT_ID = POINTER(_CLIENT_ID)
|
||||
|
||||
class _CLIENT_ID64(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", ULONG64),
|
||||
("UniqueThread", ULONG64),
|
||||
]
|
||||
CLIENT_ID64 = _CLIENT_ID64
|
||||
PCLIENT_ID64 = POINTER(_CLIENT_ID64)
|
||||
|
||||
class _CLIENT_ID32(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", ULONG),
|
||||
("UniqueThread", ULONG),
|
||||
]
|
||||
CLIENT_ID32 = _CLIENT_ID32
|
||||
PCLIENT_ID32 = POINTER(_CLIENT_ID32)
|
||||
|
||||
class _LDR_DATA_TABLE_ENTRY(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", PVOID * (2)),
|
||||
("InMemoryOrderLinks", LIST_ENTRY),
|
||||
("Reserved2", PVOID * (2)),
|
||||
("DllBase", PVOID),
|
||||
("EntryPoint", PVOID),
|
||||
("SizeOfImage", PVOID),
|
||||
("FullDllName", UNICODE_STRING),
|
||||
("BaseDllName", UNICODE_STRING),
|
||||
("Reserved5", PVOID * (3)),
|
||||
("CheckSum", ULONG),
|
||||
("TimeDateStamp", ULONG),
|
||||
]
|
||||
LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY
|
||||
PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY)
|
||||
|
||||
class _MEMORY_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("BaseAddress", PVOID),
|
||||
@@ -11064,82 +11178,6 @@ EXPLICIT_ACCESS_W = _EXPLICIT_ACCESS_W
|
||||
PEXPLICIT_ACCESSW = POINTER(_EXPLICIT_ACCESS_W)
|
||||
PEXPLICIT_ACCESS_W = POINTER(_EXPLICIT_ACCESS_W)
|
||||
|
||||
ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0)
|
||||
ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1)
|
||||
ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2)
|
||||
ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3)
|
||||
ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4)
|
||||
ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5)
|
||||
ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6)
|
||||
ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7)
|
||||
ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8)
|
||||
class _COMPUTER_NAME_FORMAT(EnumType):
|
||||
values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax]
|
||||
mapper = FlagMapper(*values)
|
||||
COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT
|
||||
|
||||
|
||||
class _SYSTEM_PROCESS_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("NextEntryOffset", ULONG),
|
||||
("NumberOfThreads", ULONG),
|
||||
("Reserved1", BYTE * (24)),
|
||||
("CreateTime", LARGE_INTEGER),
|
||||
("UserTime", LARGE_INTEGER),
|
||||
("KernelTime", LARGE_INTEGER),
|
||||
("ImageName", UNICODE_STRING),
|
||||
("BasePriority", LONG),
|
||||
("UniqueProcessId", HANDLE),
|
||||
("InheritedFromUniqueProcessId", PVOID),
|
||||
("HandleCount", ULONG),
|
||||
("Reserved4", BYTE * (4)),
|
||||
("Reserved5", PVOID * (1)),
|
||||
("PeakVirtualSize", PVOID),
|
||||
("VirtualSize", PVOID),
|
||||
("PageFaultCount", PVOID),
|
||||
("PeakWorkingSetSize", PVOID),
|
||||
("WorkingSetSize", PVOID),
|
||||
("QuotaPeakPagedPoolUsage", PVOID),
|
||||
("QuotaPagedPoolUsage", PVOID),
|
||||
("QuotaPeakNonPagedPoolUsage", PVOID),
|
||||
("QuotaNonPagedPoolUsage", PVOID),
|
||||
("PagefileUsage", PVOID),
|
||||
("PeakPagefileUsage", SIZE_T),
|
||||
("PrivatePageCount", SIZE_T),
|
||||
("Reserved6", LARGE_INTEGER * (6)),
|
||||
]
|
||||
PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION)
|
||||
SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION
|
||||
|
||||
class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("IdleTime", LARGE_INTEGER),
|
||||
("KernelTime", LARGE_INTEGER),
|
||||
("UserTime", LARGE_INTEGER),
|
||||
("Reserved1", LARGE_INTEGER * (2)),
|
||||
("Reserved2", ULONG),
|
||||
]
|
||||
PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)
|
||||
SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
|
||||
|
||||
class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("RegistryQuotaAllowed", ULONG),
|
||||
("RegistryQuotaUsed", ULONG),
|
||||
("Reserved1", PVOID),
|
||||
]
|
||||
PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION)
|
||||
SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION
|
||||
|
||||
class _SYSTEM_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", BYTE * (24)),
|
||||
("Reserved2", PVOID * (4)),
|
||||
("NumberOfProcessors", CHAR),
|
||||
]
|
||||
PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION)
|
||||
SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION
|
||||
|
||||
class _TIME_ZONE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Bias", LONG),
|
||||
|
||||
Reference in New Issue
Block a user