mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum
This commit is contained in:
Clement Rouault
@@ -15,4 +15,5 @@ Since 0.2:
|
||||
* generate.py cleaned with class and stuff / usable for extern project (cc lkd)
|
||||
* Added COMImplementation to com interface
|
||||
* fix x86.assemble + add x64.assemble | fix some enconding problem in x64
|
||||
* Add test_code.py sample
|
||||
* Add test_code.py sample
|
||||
* Remove OptionExport from winproxy
|
||||
@@ -9,24 +9,16 @@ TODO:
|
||||
- Test !! (bp, BP_HX, bp on only on process, bp_hx on only one thread..)
|
||||
- test breakpoint with specific target
|
||||
|
||||
- Winproxy:
|
||||
- rethink OptionalExport ? not useful with lazy resolution (or we need to force resolution..)
|
||||
|
||||
- Readme
|
||||
- Debugger ? Veh ?
|
||||
|
||||
- TransparentApiProxy
|
||||
double name (params and args) for same info..
|
||||
|
||||
- 32 <-> 64
|
||||
* What about ``NtWow64QueryVirtualMemory64`` ?
|
||||
|
||||
- Parse .IDL file for more COM NAME->IID
|
||||
|
||||
- Add test for debugger with breakpoint that add another breakpoint on trigger
|
||||
|
||||
- NtQueryVirtualMemory_32_to_64 (stop using hardcoded value for request type: add it to enum)
|
||||
|
||||
- Some test/doc on windows.system.handles
|
||||
|
||||
|
||||
|
||||
@@ -171,7 +171,11 @@ typedef enum _SYSTEM_INFORMATION_CLASS {
|
||||
|
||||
|
||||
typedef enum _MEMORY_INFORMATION_CLASS {
|
||||
MemoryBasicInformation
|
||||
MemoryBasicInformation,
|
||||
MemoryWorkingSetList,
|
||||
MemorySectionName,
|
||||
MemoryBasicVlmInformation,
|
||||
MemoryWorkingSetListEx
|
||||
} MEMORY_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _THREAD_INFORMATION_CLASS {
|
||||
@@ -2514,4 +2518,197 @@ typedef struct _DEBUG_SYMBOL_SOURCE_ENTRY
|
||||
ULONG StartColumn;
|
||||
ULONG EndColumn;
|
||||
ULONG Reserved;
|
||||
} DEBUG_SYMBOL_SOURCE_ENTRY, *PDEBUG_SYMBOL_SOURCE_ENTRY;
|
||||
} DEBUG_SYMBOL_SOURCE_ENTRY, *PDEBUG_SYMBOL_SOURCE_ENTRY;
|
||||
|
||||
|
||||
typedef struct _CMSG_SIGNER_INFO {
|
||||
DWORD dwVersion;
|
||||
CERT_NAME_BLOB Issuer;
|
||||
CRYPT_INTEGER_BLOB SerialNumber;
|
||||
CRYPT_ALGORITHM_IDENTIFIER HashAlgorithm;
|
||||
CRYPT_ALGORITHM_IDENTIFIER HashEncryptionAlgorithm;
|
||||
|
||||
CRYPT_DATA_BLOB EncryptedHash;
|
||||
CRYPT_ATTRIBUTES AuthAttrs;
|
||||
CRYPT_ATTRIBUTES UnauthAttrs;
|
||||
} CMSG_SIGNER_INFO, *PCMSG_SIGNER_INFO;
|
||||
|
||||
|
||||
typedef struct _SPC_SERIALIZED_OBJECT
|
||||
{
|
||||
SPC_UUID ClassId;
|
||||
CRYPT_DATA_BLOB SerializedData;
|
||||
|
||||
} SPC_SERIALIZED_OBJECT, *PSPC_SERIALIZED_OBJECT;
|
||||
|
||||
|
||||
typedef union _TMP_SPC_LINK_UNION
|
||||
{
|
||||
LPWSTR pwszUrl;
|
||||
SPC_SERIALIZED_OBJECT Moniker;
|
||||
LPWSTR pwszFile;
|
||||
} TMP_SPC_LINK_UNION;
|
||||
|
||||
|
||||
|
||||
typedef struct SPC_LINK_
|
||||
{
|
||||
DWORD dwLinkChoice;
|
||||
TMP_SPC_LINK_UNION u;
|
||||
} SPC_LINK, *PSPC_LINK;
|
||||
|
||||
|
||||
typedef struct _SPC_SP_OPUS_INFO
|
||||
{
|
||||
LPCWSTR pwszProgramName;
|
||||
struct SPC_LINK_ *pMoreInfo;
|
||||
struct SPC_LINK_ *pPublisherInfo;
|
||||
|
||||
} SPC_SP_OPUS_INFO, *PSPC_SP_OPUS_INFO;
|
||||
|
||||
|
||||
typedef struct _CERT_TRUST_STATUS {
|
||||
|
||||
DWORD dwErrorStatus;
|
||||
DWORD dwInfoStatus;
|
||||
|
||||
} CERT_TRUST_STATUS, *PCERT_TRUST_STATUS;
|
||||
|
||||
typedef struct _CERT_TRUST_LIST_INFO {
|
||||
|
||||
DWORD cbSize;
|
||||
PCTL_ENTRY pCtlEntry;
|
||||
PCCTL_CONTEXT pCtlContext;
|
||||
|
||||
} CERT_TRUST_LIST_INFO, *PCERT_TRUST_LIST_INFO;
|
||||
|
||||
|
||||
typedef struct _CERT_CONTEXT {
|
||||
DWORD dwCertEncodingType;
|
||||
BYTE *pbCertEncoded;
|
||||
DWORD cbCertEncoded;
|
||||
PCERT_INFO pCertInfo;
|
||||
HCERTSTORE hCertStore;
|
||||
} CERT_CONTEXT, *PCERT_CONTEXT, *PCCERT_CONTEXT;
|
||||
|
||||
typedef struct _CRL_ENTRY {
|
||||
CRYPT_INTEGER_BLOB SerialNumber;
|
||||
FILETIME RevocationDate;
|
||||
DWORD cExtension;
|
||||
PCERT_EXTENSION rgExtension;
|
||||
} CRL_ENTRY, *PCRL_ENTRY;
|
||||
|
||||
|
||||
typedef struct _CRL_INFO {
|
||||
DWORD dwVersion;
|
||||
CRYPT_ALGORITHM_IDENTIFIER SignatureAlgorithm;
|
||||
CERT_NAME_BLOB Issuer;
|
||||
FILETIME ThisUpdate;
|
||||
FILETIME NextUpdate;
|
||||
DWORD cCRLEntry;
|
||||
PCRL_ENTRY rgCRLEntry;
|
||||
DWORD cExtension;
|
||||
PCERT_EXTENSION rgExtension;
|
||||
} CRL_INFO, *PCRL_INFO;
|
||||
|
||||
typedef struct _CRL_CONTEXT {
|
||||
DWORD dwCertEncodingType;
|
||||
BYTE *pbCrlEncoded;
|
||||
DWORD cbCrlEncoded;
|
||||
PCRL_INFO pCrlInfo;
|
||||
HCERTSTORE hCertStore;
|
||||
} CRL_CONTEXT, *PCRL_CONTEXT, *PCCRL_CONTEXT;
|
||||
|
||||
typedef struct _CERT_REVOCATION_CRL_INFO {
|
||||
DWORD cbSize;
|
||||
PCCRL_CONTEXT pBaseCrlContext;
|
||||
PCCRL_CONTEXT pDeltaCrlContext;
|
||||
|
||||
PCRL_ENTRY pCrlEntry;
|
||||
BOOL fDeltaCrlEntry;
|
||||
} CERT_REVOCATION_CRL_INFO, *PCERT_REVOCATION_CRL_INFO;
|
||||
|
||||
typedef struct _CERT_REVOCATION_INFO {
|
||||
|
||||
DWORD cbSize;
|
||||
DWORD dwRevocationResult;
|
||||
LPCSTR pszRevocationOid;
|
||||
LPVOID pvOidSpecificInfo;
|
||||
BOOL fHasFreshnessTime;
|
||||
DWORD dwFreshnessTime;
|
||||
PCERT_REVOCATION_CRL_INFO pCrlInfo;
|
||||
|
||||
} CERT_REVOCATION_INFO, *PCERT_REVOCATION_INFO;
|
||||
|
||||
typedef struct _CERT_CHAIN_ELEMENT {
|
||||
|
||||
DWORD cbSize;
|
||||
PCCERT_CONTEXT pCertContext;
|
||||
CERT_TRUST_STATUS TrustStatus;
|
||||
PCERT_REVOCATION_INFO pRevocationInfo;
|
||||
|
||||
PCERT_ENHKEY_USAGE pIssuanceUsage;
|
||||
PCERT_ENHKEY_USAGE pApplicationUsage;
|
||||
|
||||
LPCWSTR pwszExtendedErrorInfo;
|
||||
} CERT_CHAIN_ELEMENT, *PCERT_CHAIN_ELEMENT, *PCCERT_CHAIN_ELEMENT;
|
||||
|
||||
typedef struct _CERT_SIMPLE_CHAIN {
|
||||
|
||||
DWORD cbSize;
|
||||
CERT_TRUST_STATUS TrustStatus;
|
||||
DWORD cElement;
|
||||
PCERT_CHAIN_ELEMENT* rgpElement;
|
||||
PCERT_TRUST_LIST_INFO pTrustListInfo;
|
||||
|
||||
BOOL fHasRevocationFreshnessTime;
|
||||
DWORD dwRevocationFreshnessTime;
|
||||
|
||||
} CERT_SIMPLE_CHAIN, *PCERT_SIMPLE_CHAIN, *PCCERT_SIMPLE_CHAIN;
|
||||
|
||||
typedef struct _CERT_CHAIN_CONTEXT {
|
||||
DWORD cbSize;
|
||||
CERT_TRUST_STATUS TrustStatus;
|
||||
DWORD cChain;
|
||||
PCERT_SIMPLE_CHAIN* rgpChain;
|
||||
DWORD cLowerQualityChainContext;
|
||||
PCCERT_CHAIN_CONTEXT* rgpLowerQualityChainContext;
|
||||
BOOL fHasRevocationFreshnessTime;
|
||||
DWORD dwRevocationFreshnessTime;
|
||||
DWORD dwCreateFlags;
|
||||
GUID ChainId;
|
||||
}CERT_CHAIN_CONTEXT, *PCERT_CHAIN_CONTEXT, *PCCERT_CHAIN_CONTEXT;
|
||||
|
||||
|
||||
typedef struct _CERT_USAGE_MATCH {
|
||||
|
||||
DWORD dwType;
|
||||
CERT_ENHKEY_USAGE Usage;
|
||||
|
||||
} CERT_USAGE_MATCH, *PCERT_USAGE_MATCH;
|
||||
|
||||
typedef struct _CERT_CHAIN_PARA {
|
||||
|
||||
DWORD cbSize;
|
||||
CERT_USAGE_MATCH RequestedUsage;
|
||||
CERT_USAGE_MATCH RequestedIssuancePolicy;
|
||||
DWORD dwUrlRetrievalTimeout;
|
||||
BOOL fCheckRevocationFreshnessTime;
|
||||
DWORD dwRevocationFreshnessTime;
|
||||
LPFILETIME pftCacheResync;
|
||||
|
||||
} CERT_CHAIN_PARA, *PCERT_CHAIN_PARA;
|
||||
|
||||
|
||||
typedef struct _CERT_CHAIN_ENGINE_CONFIG {
|
||||
DWORD cbSize;
|
||||
HCERTSTORE hRestrictedRoot;
|
||||
HCERTSTORE hRestrictedTrust;
|
||||
HCERTSTORE hRestrictedOther;
|
||||
DWORD cAdditionalStore;
|
||||
HCERTSTORE* rghAdditionalStore;
|
||||
DWORD dwFlags;
|
||||
DWORD dwUrlRetrievalTimeout;
|
||||
DWORD MaximumCachedCertificates;
|
||||
DWORD CycleDetectionModulus;
|
||||
} CERT_CHAIN_ENGINE_CONFIG, *PCERT_CHAIN_ENGINE_CONFIG;
|
||||
|
||||
@@ -58,6 +58,7 @@ HKEY = HANDLE
|
||||
HCATADMIN = HANDLE
|
||||
HCATINFO = HANDLE
|
||||
SC_HANDLE = HANDLE
|
||||
HCERTCHAINENGINE = HANDLE
|
||||
LPHANDLE = POINTER(HANDLE)
|
||||
PHKEY = POINTER(HKEY)
|
||||
ACCESS_MASK = DWORD
|
||||
@@ -67,6 +68,7 @@ DISPID = LONG
|
||||
MEMBERID = DISPID
|
||||
PSECURITY_DESCRIPTOR = PVOID
|
||||
LPUNKNOWN = POINTER(PVOID)
|
||||
SPC_UUID = BYTE * 16
|
||||
GUID = PVOID
|
||||
PWINDBG_EXTENSION_APIS32 = PVOID
|
||||
PWINDBG_EXTENSION_APIS64 = PVOID
|
||||
@@ -194,8 +196,12 @@ SYSTEM_INFORMATION_CLASS = _SYSTEM_INFORMATION_CLASS
|
||||
|
||||
|
||||
MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
|
||||
MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
|
||||
MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)
|
||||
MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3)
|
||||
MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4)
|
||||
class _MEMORY_INFORMATION_CLASS(EnumType):
|
||||
values = [MemoryBasicInformation]
|
||||
values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx]
|
||||
mapper = {x:x for x in values}
|
||||
MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
|
||||
|
||||
@@ -806,13 +812,13 @@ TYPEKIND = tagTYPEKIND
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _LIST_ENTRY(Structure): pass
|
||||
PLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
LIST_ENTRY = _LIST_ENTRY
|
||||
PRLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
_LIST_ENTRY._fields_ = [
|
||||
("Flink", POINTER(_LIST_ENTRY)),
|
||||
("Blink", POINTER(_LIST_ENTRY)),
|
||||
]
|
||||
PLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
LIST_ENTRY = _LIST_ENTRY
|
||||
PRLIST_ENTRY = POINTER(_LIST_ENTRY)
|
||||
|
||||
class _PEB_LDR_DATA(Structure):
|
||||
_fields_ = [
|
||||
@@ -1864,6 +1870,8 @@ IP_INTERFACE_INFO = _IP_INTERFACE_INFO
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _EXCEPTION_RECORD(Structure): pass
|
||||
PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD)
|
||||
EXCEPTION_RECORD = _EXCEPTION_RECORD
|
||||
_EXCEPTION_RECORD._fields_ = [
|
||||
("ExceptionCode", DWORD),
|
||||
("ExceptionFlags", DWORD),
|
||||
@@ -1872,8 +1880,6 @@ _EXCEPTION_RECORD._fields_ = [
|
||||
("NumberParameters", DWORD),
|
||||
("ExceptionInformation", ULONG_PTR * EXCEPTION_MAXIMUM_PARAMETERS),
|
||||
]
|
||||
PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD)
|
||||
EXCEPTION_RECORD = _EXCEPTION_RECORD
|
||||
|
||||
class _EXCEPTION_RECORD32(Structure):
|
||||
_fields_ = [
|
||||
@@ -2209,24 +2215,28 @@ class _TMP_signscale(Structure):
|
||||
("sign", BYTE),
|
||||
]
|
||||
|
||||
|
||||
class _TMP_lowmid(Structure):
|
||||
_fields_ = [
|
||||
("Lo32", ULONG),
|
||||
("Mid32", ULONG),
|
||||
]
|
||||
|
||||
|
||||
class TMP_signscale_union(Union):
|
||||
_fields_ = [
|
||||
("s", _TMP_signscale),
|
||||
("signscale", USHORT),
|
||||
]
|
||||
|
||||
|
||||
class TMP_lowmid_union(Union):
|
||||
_fields_ = [
|
||||
("s", _TMP_lowmid),
|
||||
("Lo64", ULONGLONG),
|
||||
]
|
||||
|
||||
|
||||
class tagDEC(Structure):
|
||||
_fields_ = [
|
||||
("wReserved", USHORT),
|
||||
@@ -2282,6 +2292,7 @@ class TMP_variant_sub_union(Union):
|
||||
("_VARIANT_NAME_4", _tagBRECORD),
|
||||
]
|
||||
|
||||
|
||||
class __tagVARIANT(Structure):
|
||||
_fields_ = [
|
||||
("vt", VARTYPE),
|
||||
@@ -3125,3 +3136,223 @@ class _DEBUG_SYMBOL_SOURCE_ENTRY(Structure):
|
||||
]
|
||||
DEBUG_SYMBOL_SOURCE_ENTRY = _DEBUG_SYMBOL_SOURCE_ENTRY
|
||||
PDEBUG_SYMBOL_SOURCE_ENTRY = POINTER(_DEBUG_SYMBOL_SOURCE_ENTRY)
|
||||
|
||||
class _CMSG_SIGNER_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwVersion", DWORD),
|
||||
("Issuer", CERT_NAME_BLOB),
|
||||
("SerialNumber", CRYPT_INTEGER_BLOB),
|
||||
("HashAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("HashEncryptionAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("EncryptedHash", CRYPT_DATA_BLOB),
|
||||
("AuthAttrs", CRYPT_ATTRIBUTES),
|
||||
("UnauthAttrs", CRYPT_ATTRIBUTES),
|
||||
]
|
||||
CMSG_SIGNER_INFO = _CMSG_SIGNER_INFO
|
||||
PCMSG_SIGNER_INFO = POINTER(_CMSG_SIGNER_INFO)
|
||||
|
||||
class _SPC_SERIALIZED_OBJECT(Structure):
|
||||
_fields_ = [
|
||||
("ClassId", SPC_UUID),
|
||||
("SerializedData", CRYPT_DATA_BLOB),
|
||||
]
|
||||
SPC_SERIALIZED_OBJECT = _SPC_SERIALIZED_OBJECT
|
||||
PSPC_SERIALIZED_OBJECT = POINTER(_SPC_SERIALIZED_OBJECT)
|
||||
|
||||
class _TMP_SPC_LINK_UNION(Union):
|
||||
_fields_ = [
|
||||
("pwszUrl", LPWSTR),
|
||||
("Moniker", SPC_SERIALIZED_OBJECT),
|
||||
("pwszFile", LPWSTR),
|
||||
]
|
||||
TMP_SPC_LINK_UNION = _TMP_SPC_LINK_UNION
|
||||
|
||||
class SPC_LINK_(Structure):
|
||||
_fields_ = [
|
||||
("dwLinkChoice", DWORD),
|
||||
("u", TMP_SPC_LINK_UNION),
|
||||
]
|
||||
PSPC_LINK = POINTER(SPC_LINK_)
|
||||
SPC_LINK = SPC_LINK_
|
||||
|
||||
class _SPC_SP_OPUS_INFO(Structure):
|
||||
_fields_ = [
|
||||
("pwszProgramName", LPCWSTR),
|
||||
("pMoreInfo", POINTER(SPC_LINK_)),
|
||||
("pPublisherInfo", POINTER(SPC_LINK_)),
|
||||
]
|
||||
PSPC_SP_OPUS_INFO = POINTER(_SPC_SP_OPUS_INFO)
|
||||
SPC_SP_OPUS_INFO = _SPC_SP_OPUS_INFO
|
||||
|
||||
class _CERT_TRUST_STATUS(Structure):
|
||||
_fields_ = [
|
||||
("dwErrorStatus", DWORD),
|
||||
("dwInfoStatus", DWORD),
|
||||
]
|
||||
PCERT_TRUST_STATUS = POINTER(_CERT_TRUST_STATUS)
|
||||
CERT_TRUST_STATUS = _CERT_TRUST_STATUS
|
||||
|
||||
class _CERT_TRUST_LIST_INFO(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("pCtlEntry", PCTL_ENTRY),
|
||||
("pCtlContext", PCCTL_CONTEXT),
|
||||
]
|
||||
PCERT_TRUST_LIST_INFO = POINTER(_CERT_TRUST_LIST_INFO)
|
||||
CERT_TRUST_LIST_INFO = _CERT_TRUST_LIST_INFO
|
||||
|
||||
class _CERT_CONTEXT(Structure):
|
||||
_fields_ = [
|
||||
("dwCertEncodingType", DWORD),
|
||||
("pbCertEncoded", POINTER(BYTE)),
|
||||
("cbCertEncoded", DWORD),
|
||||
("pCertInfo", PCERT_INFO),
|
||||
("hCertStore", HCERTSTORE),
|
||||
]
|
||||
PCCERT_CONTEXT = POINTER(_CERT_CONTEXT)
|
||||
CERT_CONTEXT = _CERT_CONTEXT
|
||||
PCERT_CONTEXT = POINTER(_CERT_CONTEXT)
|
||||
|
||||
class _CRL_ENTRY(Structure):
|
||||
_fields_ = [
|
||||
("SerialNumber", CRYPT_INTEGER_BLOB),
|
||||
("RevocationDate", FILETIME),
|
||||
("cExtension", DWORD),
|
||||
("rgExtension", PCERT_EXTENSION),
|
||||
]
|
||||
CRL_ENTRY = _CRL_ENTRY
|
||||
PCRL_ENTRY = POINTER(_CRL_ENTRY)
|
||||
|
||||
class _CRL_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwVersion", DWORD),
|
||||
("SignatureAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("Issuer", CERT_NAME_BLOB),
|
||||
("ThisUpdate", FILETIME),
|
||||
("NextUpdate", FILETIME),
|
||||
("cCRLEntry", DWORD),
|
||||
("rgCRLEntry", PCRL_ENTRY),
|
||||
("cExtension", DWORD),
|
||||
("rgExtension", PCERT_EXTENSION),
|
||||
]
|
||||
CRL_INFO = _CRL_INFO
|
||||
PCRL_INFO = POINTER(_CRL_INFO)
|
||||
|
||||
class _CRL_CONTEXT(Structure):
|
||||
_fields_ = [
|
||||
("dwCertEncodingType", DWORD),
|
||||
("pbCrlEncoded", POINTER(BYTE)),
|
||||
("cbCrlEncoded", DWORD),
|
||||
("pCrlInfo", PCRL_INFO),
|
||||
("hCertStore", HCERTSTORE),
|
||||
]
|
||||
PCCRL_CONTEXT = POINTER(_CRL_CONTEXT)
|
||||
CRL_CONTEXT = _CRL_CONTEXT
|
||||
PCRL_CONTEXT = POINTER(_CRL_CONTEXT)
|
||||
|
||||
class _CERT_REVOCATION_CRL_INFO(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("pBaseCrlContext", PCCRL_CONTEXT),
|
||||
("pDeltaCrlContext", PCCRL_CONTEXT),
|
||||
("pCrlEntry", PCRL_ENTRY),
|
||||
("fDeltaCrlEntry", BOOL),
|
||||
]
|
||||
CERT_REVOCATION_CRL_INFO = _CERT_REVOCATION_CRL_INFO
|
||||
PCERT_REVOCATION_CRL_INFO = POINTER(_CERT_REVOCATION_CRL_INFO)
|
||||
|
||||
class _CERT_REVOCATION_INFO(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("dwRevocationResult", DWORD),
|
||||
("pszRevocationOid", LPCSTR),
|
||||
("pvOidSpecificInfo", LPVOID),
|
||||
("fHasFreshnessTime", BOOL),
|
||||
("dwFreshnessTime", DWORD),
|
||||
("pCrlInfo", PCERT_REVOCATION_CRL_INFO),
|
||||
]
|
||||
CERT_REVOCATION_INFO = _CERT_REVOCATION_INFO
|
||||
PCERT_REVOCATION_INFO = POINTER(_CERT_REVOCATION_INFO)
|
||||
|
||||
class _CERT_CHAIN_ELEMENT(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("pCertContext", PCCERT_CONTEXT),
|
||||
("TrustStatus", CERT_TRUST_STATUS),
|
||||
("pRevocationInfo", PCERT_REVOCATION_INFO),
|
||||
("pIssuanceUsage", PCERT_ENHKEY_USAGE),
|
||||
("pApplicationUsage", PCERT_ENHKEY_USAGE),
|
||||
("pwszExtendedErrorInfo", LPCWSTR),
|
||||
]
|
||||
PCERT_CHAIN_ELEMENT = POINTER(_CERT_CHAIN_ELEMENT)
|
||||
CERT_CHAIN_ELEMENT = _CERT_CHAIN_ELEMENT
|
||||
PCCERT_CHAIN_ELEMENT = POINTER(_CERT_CHAIN_ELEMENT)
|
||||
|
||||
class _CERT_SIMPLE_CHAIN(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("TrustStatus", CERT_TRUST_STATUS),
|
||||
("cElement", DWORD),
|
||||
("rgpElement", POINTER(PCERT_CHAIN_ELEMENT)),
|
||||
("pTrustListInfo", PCERT_TRUST_LIST_INFO),
|
||||
("fHasRevocationFreshnessTime", BOOL),
|
||||
("dwRevocationFreshnessTime", DWORD),
|
||||
]
|
||||
CERT_SIMPLE_CHAIN = _CERT_SIMPLE_CHAIN
|
||||
PCERT_SIMPLE_CHAIN = POINTER(_CERT_SIMPLE_CHAIN)
|
||||
PCCERT_SIMPLE_CHAIN = POINTER(_CERT_SIMPLE_CHAIN)
|
||||
|
||||
# Self referencing struct tricks
|
||||
class _CERT_CHAIN_CONTEXT(Structure): pass
|
||||
CERT_CHAIN_CONTEXT = _CERT_CHAIN_CONTEXT
|
||||
PCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT)
|
||||
PCCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT)
|
||||
_CERT_CHAIN_CONTEXT._fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("TrustStatus", CERT_TRUST_STATUS),
|
||||
("cChain", DWORD),
|
||||
("rgpChain", POINTER(PCERT_SIMPLE_CHAIN)),
|
||||
("cLowerQualityChainContext", DWORD),
|
||||
("rgpLowerQualityChainContext", POINTER(PCCERT_CHAIN_CONTEXT)),
|
||||
("fHasRevocationFreshnessTime", BOOL),
|
||||
("dwRevocationFreshnessTime", DWORD),
|
||||
("dwCreateFlags", DWORD),
|
||||
("ChainId", GUID),
|
||||
]
|
||||
|
||||
class _CERT_USAGE_MATCH(Structure):
|
||||
_fields_ = [
|
||||
("dwType", DWORD),
|
||||
("Usage", CERT_ENHKEY_USAGE),
|
||||
]
|
||||
CERT_USAGE_MATCH = _CERT_USAGE_MATCH
|
||||
PCERT_USAGE_MATCH = POINTER(_CERT_USAGE_MATCH)
|
||||
|
||||
class _CERT_CHAIN_PARA(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("RequestedUsage", CERT_USAGE_MATCH),
|
||||
("RequestedIssuancePolicy", CERT_USAGE_MATCH),
|
||||
("dwUrlRetrievalTimeout", DWORD),
|
||||
("fCheckRevocationFreshnessTime", BOOL),
|
||||
("dwRevocationFreshnessTime", DWORD),
|
||||
("pftCacheResync", LPFILETIME),
|
||||
]
|
||||
CERT_CHAIN_PARA = _CERT_CHAIN_PARA
|
||||
PCERT_CHAIN_PARA = POINTER(_CERT_CHAIN_PARA)
|
||||
|
||||
class _CERT_CHAIN_ENGINE_CONFIG(Structure):
|
||||
_fields_ = [
|
||||
("cbSize", DWORD),
|
||||
("hRestrictedRoot", HCERTSTORE),
|
||||
("hRestrictedTrust", HCERTSTORE),
|
||||
("hRestrictedOther", HCERTSTORE),
|
||||
("cAdditionalStore", DWORD),
|
||||
("rghAdditionalStore", POINTER(HCERTSTORE)),
|
||||
("dwFlags", DWORD),
|
||||
("dwUrlRetrievalTimeout", DWORD),
|
||||
("MaximumCachedCertificates", DWORD),
|
||||
("CycleDetectionModulus", DWORD),
|
||||
]
|
||||
CERT_CHAIN_ENGINE_CONFIG = _CERT_CHAIN_ENGINE_CONFIG
|
||||
PCERT_CHAIN_ENGINE_CONFIG = POINTER(_CERT_CHAIN_ENGINE_CONFIG)
|
||||
|
||||
+20
-7
@@ -9,7 +9,7 @@ import windows.native_exec.simple_x64 as x64
|
||||
from generated_def.winstructs import *
|
||||
from windows.winobject import process
|
||||
from windows import winproxy
|
||||
from winproxy import NeededParameter, OptionalExport, NtdllProxy, error_ntstatus
|
||||
from winproxy import NeededParameter, NtdllProxy, error_ntstatus
|
||||
|
||||
# Special code for syswow64 process
|
||||
CS_32bits = 0x23
|
||||
@@ -28,7 +28,7 @@ def genere_return_32bits_stub(ret_addr):
|
||||
return ret_32b.get_code()
|
||||
|
||||
# The format of a jump to 64bits mode
|
||||
dummy_jump = "\xea" + struct.pack("<I", 0) + chr(CS_64bits) + "\x00\x00"
|
||||
dummy_jump = "\xea" + struct.pack("<I", 0) + struct.pack("<H", CS_64bits)
|
||||
|
||||
|
||||
def execute_64bits_code_from_syswow(shellcode):
|
||||
@@ -44,7 +44,7 @@ def execute_64bits_code_from_syswow(shellcode):
|
||||
ret_addr = addr
|
||||
shell_code_addr = ret_addr + len(ret) + len(dummy_jump)
|
||||
# ljmp
|
||||
jump = "\xea" + struct.pack("<I", shell_code_addr) + chr(CS_64bits) + "\x00\x00"
|
||||
jump = "\xea" + struct.pack("<I", shell_code_addr) + struct.pack("<H", CS_64bits)
|
||||
jump_addr = ret_addr + len(ret)
|
||||
# Return to 32bits stub
|
||||
shellcode += genere_return_32bits_stub(ret_addr)
|
||||
@@ -225,10 +225,22 @@ class Syswow64ApiProxy(object):
|
||||
if winproxy_function is not None:
|
||||
self.params_name = [param[1] for param in winproxy_function.params]
|
||||
|
||||
|
||||
|
||||
|
||||
def __call__(self, python_proxy):
|
||||
# handle winproxy_function is None (OptionalExport)
|
||||
if self.winproxy_function is None:
|
||||
if not windows.winproxy.is_implemented(self.winproxy_function):
|
||||
return None
|
||||
|
||||
def force_resolution():
|
||||
if self.raw_call:
|
||||
return True
|
||||
try:
|
||||
self.raw_call = generate_syswow64_call(self.winproxy_function)
|
||||
except KeyError:
|
||||
raise windows.winproxy.ExportNotFound(self.winproxy_function.__name__, "SysWow[ntdll64]")
|
||||
|
||||
|
||||
def perform_call(*args):
|
||||
if len(self.params_name) != len(args):
|
||||
print("ERROR:")
|
||||
@@ -240,9 +252,10 @@ class Syswow64ApiProxy(object):
|
||||
raise TypeError("{0}: Missing Mandatory parameter <{1}>".format(self.winproxy_function.__name__, param_name))
|
||||
|
||||
if self.raw_call is None:
|
||||
self.raw_call = generate_syswow64_call(self.winproxy_function)
|
||||
force_resolution()
|
||||
return self.raw_call(*args)
|
||||
setattr(python_proxy, "ctypes_function", perform_call)
|
||||
setattr(python_proxy, "force_resolution", force_resolution)
|
||||
return python_proxy
|
||||
|
||||
|
||||
@@ -277,7 +290,7 @@ def NtQueryInformationThread_32_to_64(ThreadHandle, ThreadInformationClass, Thre
|
||||
|
||||
|
||||
@Syswow64ApiProxy(winproxy.NtQueryVirtualMemory)
|
||||
def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None):
|
||||
def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None):
|
||||
if ReturnLength is None:
|
||||
ReturnLength = byref(ULONG())
|
||||
if MemoryInformation is not None and MemoryInformationLength == 0:
|
||||
|
||||
@@ -370,7 +370,7 @@ class Process(AutoHandle):
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
res = MEMORY_BASIC_INFORMATION64()
|
||||
try:
|
||||
v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformation=res)
|
||||
v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res)
|
||||
except NtStatusException as e:
|
||||
if e.code & 0xffffffff == 0XC000000D:
|
||||
raise winproxy.Kernel32Error("NtQueryVirtualMemory_32_to_64")
|
||||
@@ -422,7 +422,7 @@ class Process(AutoHandle):
|
||||
res = GENERATED_PSAPI_WORKING_SET_INFORMATION()
|
||||
try:
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, 1, res)
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetList, res)
|
||||
else:
|
||||
windows.winproxy.QueryWorkingSet(self.handle, ctypes.byref(res), ctypes.sizeof(res))
|
||||
except WindowsError as e:
|
||||
@@ -448,7 +448,7 @@ class Process(AutoHandle):
|
||||
for i, data in enumerate(info_array):
|
||||
info_array[i].VirtualAddress = addresses[i]
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, 4, info_array)
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetListEx, info_array)
|
||||
else:
|
||||
winproxy.QueryWorkingSetEx(self.handle, ctypes.byref(info_array), ctypes.sizeof(info_array))
|
||||
return info_array
|
||||
@@ -465,7 +465,7 @@ class Process(AutoHandle):
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
target_size = ctypes.c_buffer(buffer_size)
|
||||
try:
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, addr, 2, buffer, buffer_size, target_size)
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, addr, MemorySectionName, buffer, buffer_size, target_size)
|
||||
except NtStatusException as e:
|
||||
if e.code not in [STATUS_FILE_INVALID, STATUS_INVALID_ADDRESS, STATUS_TRANSACTION_NOT_ACTIVE]:
|
||||
raise
|
||||
@@ -812,7 +812,7 @@ class WinProcess(Process):
|
||||
def write_memory(self, addr, data):
|
||||
"""Write `data` at `addr`"""
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
if winproxy.NtWow64WriteVirtualMemory64 is None:
|
||||
if not winproxy.is_implemented(winproxy.NtWow64WriteVirtualMemory64):
|
||||
raise ValueError("NtWow64WriteVirtualMemory64 non available in ntdll: cannot write into 64bits processus")
|
||||
return winproxy.NtWow64WriteVirtualMemory64(self.handle, addr, data, len(data))
|
||||
return winproxy.WriteProcessMemory(self.handle, addr, lpBuffer=data)
|
||||
@@ -820,7 +820,7 @@ class WinProcess(Process):
|
||||
def low_read_memory(self, addr, buffer_addr, size):
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
# OptionalExport can be None (see winproxy.py)
|
||||
if winproxy.NtWow64ReadVirtualMemory64 is None:
|
||||
if not winproxy.is_implemented(winproxy.NtWow64ReadVirtualMemory64):
|
||||
raise ValueError("NtWow64ReadVirtualMemory64 non available in ntdll: cannot read into 64bits processus")
|
||||
return winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size)
|
||||
#if self.is_wow_64 and addr > 0xffffffff:
|
||||
|
||||
+43
-42
@@ -186,27 +186,27 @@ class VersionProxy(ApiProxy):
|
||||
APIDLL = "version"
|
||||
default_error_check = staticmethod(kernel32_error_check)
|
||||
|
||||
class OptionalExport(object):
|
||||
"""used 'around' a Proxy decorator
|
||||
Should be used for export that are not available everywhere (ntdll internals | 32/64 bits stuff)
|
||||
If the export is not found the function will be None
|
||||
|
||||
Example:
|
||||
@OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64'))
|
||||
def NtWow64ReadVirtualMemory64(...)
|
||||
...
|
||||
"""
|
||||
def __init__(self, subdecorator):
|
||||
self.subdecorator = subdecorator
|
||||
|
||||
def __call__(self, f):
|
||||
try:
|
||||
x = self.subdecorator(f)
|
||||
x.force_resolution()
|
||||
return x
|
||||
except ExportNotFound as e:
|
||||
dbgprint("Export <{e.func_name}> not found in <{e.api_name}>".format(e=e), "EXPORTNOTFOUND")
|
||||
return None
|
||||
#class OptionalExport(object):
|
||||
# """used 'around' a Proxy decorator
|
||||
# Should be used for export that are not available everywhere (ntdll internals | 32/64 bits stuff)
|
||||
# If the export is not found the function will be None
|
||||
#
|
||||
# Example:
|
||||
# @OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64'))
|
||||
# def NtWow64ReadVirtualMemory64(...)
|
||||
# ...
|
||||
# """
|
||||
# def __init__(self, subdecorator):
|
||||
# self.subdecorator = subdecorator
|
||||
#
|
||||
# def __call__(self, f):
|
||||
# try:
|
||||
# x = self.subdecorator(f)
|
||||
# x.force_resolution()
|
||||
# return x
|
||||
# except ExportNotFound as e:
|
||||
# dbgprint("Export <{e.func_name}> not found in <{e.api_name}>".format(e=e), "EXPORTNOTFOUND")
|
||||
# return None
|
||||
|
||||
class TransparentApiProxy(object):
|
||||
def __init__(self, DLLNAME, func_name, error_check):
|
||||
@@ -285,10 +285,10 @@ GetComputerNameW = TransparentKernel32Proxy("GetComputerNameW")
|
||||
|
||||
|
||||
|
||||
Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection")
|
||||
Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection")
|
||||
Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection")
|
||||
Wow64GetThreadContext = OptionalExport(TransparentKernel32Proxy)("Wow64GetThreadContext")
|
||||
Wow64DisableWow64FsRedirection = TransparentKernel32Proxy("Wow64DisableWow64FsRedirection")
|
||||
Wow64RevertWow64FsRedirection = TransparentKernel32Proxy("Wow64RevertWow64FsRedirection")
|
||||
Wow64EnableWow64FsRedirection = TransparentKernel32Proxy("Wow64EnableWow64FsRedirection")
|
||||
Wow64GetThreadContext = TransparentKernel32Proxy("Wow64GetThreadContext")
|
||||
|
||||
|
||||
def CreateFile_error_check(func_name, result, func, args):
|
||||
@@ -553,24 +553,25 @@ def GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = ctypes.sizeof(lpFilename)
|
||||
return GetMappedFileNameWWrapper.ctypes_function(hProcess, lpv, lpFilename, nSize)
|
||||
GetMappedFileNameW = OptionalExport(Kernel32Proxy("GetMappedFileNameW"))(GetMappedFileNameWWrapper)
|
||||
GetMappedFileNameW = Kernel32Proxy("GetMappedFileNameW")(GetMappedFileNameWWrapper)
|
||||
|
||||
|
||||
def GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = ctypes.sizeof(lpFilename)
|
||||
return GetMappedFileNameAWrapper.ctypes_function(hProcess, lpv, lpFilename, nSize)
|
||||
GetMappedFileNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetMappedFileNameAWrapper)
|
||||
GetMappedFileNameA = Kernel32Proxy("GetMappedFileNameA")(GetMappedFileNameAWrapper)
|
||||
|
||||
def QueryWorkingSetWrapper(hProcess, pv, cb):
|
||||
return QueryWorkingSet.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSet = OptionalExport(Kernel32Proxy("QueryWorkingSet"))(QueryWorkingSetWrapper)
|
||||
QueryWorkingSet = Kernel32Proxy("QueryWorkingSet")(QueryWorkingSetWrapper)
|
||||
|
||||
def QueryWorkingSetExWrapper(hProcess, pv, cb):
|
||||
return QueryWorkingSetEx.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSetEx = OptionalExport(Kernel32Proxy("QueryWorkingSetEx"))(QueryWorkingSetExWrapper)
|
||||
QueryWorkingSetEx = Kernel32Proxy("QueryWorkingSetEx")(QueryWorkingSetExWrapper)
|
||||
|
||||
if GetMappedFileNameA is None:
|
||||
|
||||
if not is_implemented(GetMappedFileNameA):
|
||||
GetMappedFileNameW = PsapiProxy("GetMappedFileNameW")(GetMappedFileNameWWrapper)
|
||||
GetMappedFileNameA = PsapiProxy("GetMappedFileNameA")(GetMappedFileNameAWrapper)
|
||||
QueryWorkingSet = PsapiProxy("QueryWorkingSet")(QueryWorkingSetWrapper)
|
||||
@@ -580,16 +581,16 @@ def GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = len(lpBaseName)
|
||||
return GetModuleBaseNameAWrapper.ctypes_function(hProcess, hModule, lpBaseName, nSize)
|
||||
GetModuleBaseNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetModuleBaseNameAWrapper)
|
||||
GetModuleBaseNameA = Kernel32Proxy("GetMappedFileNameA")(GetModuleBaseNameAWrapper)
|
||||
|
||||
|
||||
def GetModuleBaseNameWWrapper(hProcess, hModule, lpBaseName, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = len(lpBaseName)
|
||||
return GetModuleBaseNameWWrapper.ctypes_function(hProcess, hModule, lpBaseName, nSize)
|
||||
GetModuleBaseNameA = OptionalExport(Kernel32Proxy("GetModuleBaseNameW"))(GetModuleBaseNameWWrapper)
|
||||
GetModuleBaseNameA = Kernel32Proxy("GetModuleBaseNameW")(GetModuleBaseNameWWrapper)
|
||||
|
||||
if GetModuleBaseNameA is None:
|
||||
if not is_implemented(GetModuleBaseNameA):
|
||||
GetModuleBaseNameA = PsapiProxy("GetModuleBaseNameA")(GetModuleBaseNameAWrapper)
|
||||
GetModuleBaseNameW = PsapiProxy("GetModuleBaseNameW")(GetModuleBaseNameWWrapper)
|
||||
|
||||
@@ -598,15 +599,15 @@ def GetProcessImageFileNameAWrapper(hProcess, lpImageFileName, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = len(lpImageFileName)
|
||||
return GetProcessImageFileNameAWrapper.ctypes_function(hProcess, lpImageFileName, nSize)
|
||||
GetProcessImageFileNameA = OptionalExport(Kernel32Proxy("GetProcessImageFileNameA"))(GetProcessImageFileNameAWrapper)
|
||||
GetProcessImageFileNameA = Kernel32Proxy("GetProcessImageFileNameA")(GetProcessImageFileNameAWrapper)
|
||||
|
||||
def GetProcessImageFileNameWWrapper(hProcess, lpImageFileName, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = len(lpImageFileName)
|
||||
return GetProcessImageFileNameWWrapper.ctypes_function(hProcess, lpImageFileName, nSize)
|
||||
GetProcessImageFileNameW = OptionalExport(Kernel32Proxy("GetProcessImageFileNameW"))(GetProcessImageFileNameWWrapper)
|
||||
GetProcessImageFileNameW = Kernel32Proxy("GetProcessImageFileNameW")(GetProcessImageFileNameWWrapper)
|
||||
|
||||
if GetProcessImageFileNameA is None:
|
||||
if not is_implemented(GetProcessImageFileNameA):
|
||||
GetProcessImageFileNameA = PsapiProxy("GetProcessImageFileNameA")(GetProcessImageFileNameAWrapper)
|
||||
GetProcessImageFileNameW = PsapiProxy("GetProcessImageFileNameW")(GetProcessImageFileNameWWrapper)
|
||||
|
||||
@@ -659,11 +660,11 @@ def SetConsoleCtrlHandler(HandlerRoutine, Add):
|
||||
|
||||
# ### NTDLL #### #
|
||||
|
||||
@OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus))
|
||||
@NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus)
|
||||
def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None):
|
||||
return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
|
||||
|
||||
@OptionalExport(NtdllProxy('NtWow64WriteVirtualMemory64', error_ntstatus))
|
||||
@NtdllProxy('NtWow64WriteVirtualMemory64', error_ntstatus)
|
||||
def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten=None):
|
||||
return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
|
||||
|
||||
@@ -691,7 +692,7 @@ def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, Sys
|
||||
return NtQuerySystemInformation.ctypes_function(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength)
|
||||
|
||||
|
||||
@OptionalExport(NtdllProxy('NtQueryInformationProcess', error_ntstatus))
|
||||
@NtdllProxy('NtQueryInformationProcess', error_ntstatus)
|
||||
def NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength=0, ReturnLength=None):
|
||||
if ProcessInformation is not None and ProcessInformationLength == 0:
|
||||
ProcessInformationLength = ctypes.sizeof(ProcessInformation)
|
||||
@@ -717,7 +718,7 @@ def NtProtectVirtualMemory(ProcessHandle, BaseAddress, NumberOfBytesToProtect, N
|
||||
OldAccessProtection = DWORD()
|
||||
return NtProtectVirtualMemory.ctypes_function(ProcessHandle, BaseAddress, NumberOfBytesToProtect, NewAccessProtection, OldAccessProtection)
|
||||
|
||||
@OptionalExport(NtdllProxy('NtQueryVirtualMemory', error_ntstatus))
|
||||
@NtdllProxy('NtQueryVirtualMemory', error_ntstatus)
|
||||
def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None):
|
||||
if ReturnLength is None:
|
||||
ReturnLength = byref(ULONG())
|
||||
@@ -732,7 +733,7 @@ def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, Mem
|
||||
def NtQueryObject(Handle, ObjectInformationClass, ObjectInformation=None, ObjectInformationLength=0, ReturnLength=NeededParameter):
|
||||
return NtQueryObject.ctypes_function(Handle, ObjectInformationClass, ObjectInformation, ObjectInformationLength, ReturnLength)
|
||||
|
||||
@OptionalExport(NtdllProxy('NtCreateThreadEx', error_ntstatus))
|
||||
@NtdllProxy('NtCreateThreadEx', error_ntstatus)
|
||||
def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0):
|
||||
if ThreadHandle is None:
|
||||
ThreadHandle = byref(HANDLE())
|
||||
@@ -907,7 +908,7 @@ def set_tcp_entry_error_check(func_name, result, func, args):
|
||||
SetTcpEntry = TransparentIphlpapiProxy('SetTcpEntry', error_check=set_tcp_entry_error_check)
|
||||
|
||||
|
||||
@OptionalExport(IphlpapiProxy('GetExtendedTcpTable'))
|
||||
@IphlpapiProxy('GetExtendedTcpTable')
|
||||
def GetExtendedTcpTable(pTcpTable, pdwSize=None, bOrder=True, ulAf=NeededParameter, TableClass=TCP_TABLE_OWNER_PID_ALL, Reserved=0):
|
||||
if pdwSize is None:
|
||||
pdwSize = ULONG(ctypes.sizeof(pTcpTable))
|
||||
|
||||
Reference in New Issue
Block a user