From 3069b93d214406b09e15b6166f7bb5401b891992 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Fri, 1 Jul 2016 18:12:28 +0200 Subject: [PATCH] Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum --- CHANGELOG | 3 +- TODO | 8 - ctypes_generation/definitions/winstruct.txt | 201 +++++++++++++++- windows/generated_def/winstructs.py | 243 +++++++++++++++++++- windows/syswow64.py | 27 ++- windows/winobject/process.py | 12 +- windows/winproxy.py | 85 +++---- 7 files changed, 507 insertions(+), 72 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index b0dad72..9e33f13 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -15,4 +15,5 @@ Since 0.2: * generate.py cleaned with class and stuff / usable for extern project (cc lkd) * Added COMImplementation to com interface * fix x86.assemble + add x64.assemble | fix some enconding problem in x64 - * Add test_code.py sample \ No newline at end of file + * Add test_code.py sample + * Remove OptionExport from winproxy \ No newline at end of file diff --git a/TODO b/TODO index 975ab85..5afd454 100644 --- a/TODO +++ b/TODO @@ -9,24 +9,16 @@ TODO: - Test !! (bp, BP_HX, bp on only on process, bp_hx on only one thread..) - test breakpoint with specific target - - Winproxy: - - rethink OptionalExport ? not useful with lazy resolution (or we need to force resolution..) - - Readme - Debugger ? Veh ? - TransparentApiProxy double name (params and args) for same info.. - - 32 <-> 64 - * What about ``NtWow64QueryVirtualMemory64`` ? - - Parse .IDL file for more COM NAME->IID - Add test for debugger with breakpoint that add another breakpoint on trigger - - NtQueryVirtualMemory_32_to_64 (stop using hardcoded value for request type: add it to enum) - - Some test/doc on windows.system.handles diff --git a/ctypes_generation/definitions/winstruct.txt b/ctypes_generation/definitions/winstruct.txt index a2f5705..553489e 100644 --- a/ctypes_generation/definitions/winstruct.txt +++ b/ctypes_generation/definitions/winstruct.txt @@ -171,7 +171,11 @@ typedef enum _SYSTEM_INFORMATION_CLASS { typedef enum _MEMORY_INFORMATION_CLASS { - MemoryBasicInformation + MemoryBasicInformation, + MemoryWorkingSetList, + MemorySectionName, + MemoryBasicVlmInformation, + MemoryWorkingSetListEx } MEMORY_INFORMATION_CLASS; typedef enum _THREAD_INFORMATION_CLASS { @@ -2514,4 +2518,197 @@ typedef struct _DEBUG_SYMBOL_SOURCE_ENTRY ULONG StartColumn; ULONG EndColumn; ULONG Reserved; -} DEBUG_SYMBOL_SOURCE_ENTRY, *PDEBUG_SYMBOL_SOURCE_ENTRY; \ No newline at end of file +} DEBUG_SYMBOL_SOURCE_ENTRY, *PDEBUG_SYMBOL_SOURCE_ENTRY; + + +typedef struct _CMSG_SIGNER_INFO { + DWORD dwVersion; + CERT_NAME_BLOB Issuer; + CRYPT_INTEGER_BLOB SerialNumber; + CRYPT_ALGORITHM_IDENTIFIER HashAlgorithm; + CRYPT_ALGORITHM_IDENTIFIER HashEncryptionAlgorithm; + + CRYPT_DATA_BLOB EncryptedHash; + CRYPT_ATTRIBUTES AuthAttrs; + CRYPT_ATTRIBUTES UnauthAttrs; +} CMSG_SIGNER_INFO, *PCMSG_SIGNER_INFO; + + +typedef struct _SPC_SERIALIZED_OBJECT +{ + SPC_UUID ClassId; + CRYPT_DATA_BLOB SerializedData; + +} SPC_SERIALIZED_OBJECT, *PSPC_SERIALIZED_OBJECT; + + +typedef union _TMP_SPC_LINK_UNION +{ + LPWSTR pwszUrl; + SPC_SERIALIZED_OBJECT Moniker; + LPWSTR pwszFile; +} TMP_SPC_LINK_UNION; + + + +typedef struct SPC_LINK_ +{ + DWORD dwLinkChoice; + TMP_SPC_LINK_UNION u; +} SPC_LINK, *PSPC_LINK; + + +typedef struct _SPC_SP_OPUS_INFO +{ + LPCWSTR pwszProgramName; + struct SPC_LINK_ *pMoreInfo; + struct SPC_LINK_ *pPublisherInfo; + +} SPC_SP_OPUS_INFO, *PSPC_SP_OPUS_INFO; + + +typedef struct _CERT_TRUST_STATUS { + + DWORD dwErrorStatus; + DWORD dwInfoStatus; + +} CERT_TRUST_STATUS, *PCERT_TRUST_STATUS; + +typedef struct _CERT_TRUST_LIST_INFO { + + DWORD cbSize; + PCTL_ENTRY pCtlEntry; + PCCTL_CONTEXT pCtlContext; + +} CERT_TRUST_LIST_INFO, *PCERT_TRUST_LIST_INFO; + + +typedef struct _CERT_CONTEXT { + DWORD dwCertEncodingType; + BYTE *pbCertEncoded; + DWORD cbCertEncoded; + PCERT_INFO pCertInfo; + HCERTSTORE hCertStore; +} CERT_CONTEXT, *PCERT_CONTEXT, *PCCERT_CONTEXT; + +typedef struct _CRL_ENTRY { + CRYPT_INTEGER_BLOB SerialNumber; + FILETIME RevocationDate; + DWORD cExtension; + PCERT_EXTENSION rgExtension; +} CRL_ENTRY, *PCRL_ENTRY; + + +typedef struct _CRL_INFO { + DWORD dwVersion; + CRYPT_ALGORITHM_IDENTIFIER SignatureAlgorithm; + CERT_NAME_BLOB Issuer; + FILETIME ThisUpdate; + FILETIME NextUpdate; + DWORD cCRLEntry; + PCRL_ENTRY rgCRLEntry; + DWORD cExtension; + PCERT_EXTENSION rgExtension; +} CRL_INFO, *PCRL_INFO; + +typedef struct _CRL_CONTEXT { + DWORD dwCertEncodingType; + BYTE *pbCrlEncoded; + DWORD cbCrlEncoded; + PCRL_INFO pCrlInfo; + HCERTSTORE hCertStore; +} CRL_CONTEXT, *PCRL_CONTEXT, *PCCRL_CONTEXT; + +typedef struct _CERT_REVOCATION_CRL_INFO { + DWORD cbSize; + PCCRL_CONTEXT pBaseCrlContext; + PCCRL_CONTEXT pDeltaCrlContext; + + PCRL_ENTRY pCrlEntry; + BOOL fDeltaCrlEntry; +} CERT_REVOCATION_CRL_INFO, *PCERT_REVOCATION_CRL_INFO; + +typedef struct _CERT_REVOCATION_INFO { + + DWORD cbSize; + DWORD dwRevocationResult; + LPCSTR pszRevocationOid; + LPVOID pvOidSpecificInfo; + BOOL fHasFreshnessTime; + DWORD dwFreshnessTime; + PCERT_REVOCATION_CRL_INFO pCrlInfo; + +} CERT_REVOCATION_INFO, *PCERT_REVOCATION_INFO; + +typedef struct _CERT_CHAIN_ELEMENT { + + DWORD cbSize; + PCCERT_CONTEXT pCertContext; + CERT_TRUST_STATUS TrustStatus; + PCERT_REVOCATION_INFO pRevocationInfo; + + PCERT_ENHKEY_USAGE pIssuanceUsage; + PCERT_ENHKEY_USAGE pApplicationUsage; + + LPCWSTR pwszExtendedErrorInfo; +} CERT_CHAIN_ELEMENT, *PCERT_CHAIN_ELEMENT, *PCCERT_CHAIN_ELEMENT; + +typedef struct _CERT_SIMPLE_CHAIN { + + DWORD cbSize; + CERT_TRUST_STATUS TrustStatus; + DWORD cElement; + PCERT_CHAIN_ELEMENT* rgpElement; + PCERT_TRUST_LIST_INFO pTrustListInfo; + + BOOL fHasRevocationFreshnessTime; + DWORD dwRevocationFreshnessTime; + +} CERT_SIMPLE_CHAIN, *PCERT_SIMPLE_CHAIN, *PCCERT_SIMPLE_CHAIN; + +typedef struct _CERT_CHAIN_CONTEXT { + DWORD cbSize; + CERT_TRUST_STATUS TrustStatus; + DWORD cChain; + PCERT_SIMPLE_CHAIN* rgpChain; + DWORD cLowerQualityChainContext; + PCCERT_CHAIN_CONTEXT* rgpLowerQualityChainContext; + BOOL fHasRevocationFreshnessTime; + DWORD dwRevocationFreshnessTime; + DWORD dwCreateFlags; + GUID ChainId; +}CERT_CHAIN_CONTEXT, *PCERT_CHAIN_CONTEXT, *PCCERT_CHAIN_CONTEXT; + + +typedef struct _CERT_USAGE_MATCH { + + DWORD dwType; + CERT_ENHKEY_USAGE Usage; + +} CERT_USAGE_MATCH, *PCERT_USAGE_MATCH; + +typedef struct _CERT_CHAIN_PARA { + + DWORD cbSize; + CERT_USAGE_MATCH RequestedUsage; + CERT_USAGE_MATCH RequestedIssuancePolicy; + DWORD dwUrlRetrievalTimeout; + BOOL fCheckRevocationFreshnessTime; + DWORD dwRevocationFreshnessTime; + LPFILETIME pftCacheResync; + +} CERT_CHAIN_PARA, *PCERT_CHAIN_PARA; + + +typedef struct _CERT_CHAIN_ENGINE_CONFIG { + DWORD cbSize; + HCERTSTORE hRestrictedRoot; + HCERTSTORE hRestrictedTrust; + HCERTSTORE hRestrictedOther; + DWORD cAdditionalStore; + HCERTSTORE* rghAdditionalStore; + DWORD dwFlags; + DWORD dwUrlRetrievalTimeout; + DWORD MaximumCachedCertificates; + DWORD CycleDetectionModulus; +} CERT_CHAIN_ENGINE_CONFIG, *PCERT_CHAIN_ENGINE_CONFIG; diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index fcc1481..cd68289 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -58,6 +58,7 @@ HKEY = HANDLE HCATADMIN = HANDLE HCATINFO = HANDLE SC_HANDLE = HANDLE +HCERTCHAINENGINE = HANDLE LPHANDLE = POINTER(HANDLE) PHKEY = POINTER(HKEY) ACCESS_MASK = DWORD @@ -67,6 +68,7 @@ DISPID = LONG MEMBERID = DISPID PSECURITY_DESCRIPTOR = PVOID LPUNKNOWN = POINTER(PVOID) +SPC_UUID = BYTE * 16 GUID = PVOID PWINDBG_EXTENSION_APIS32 = PVOID PWINDBG_EXTENSION_APIS64 = PVOID @@ -194,8 +196,12 @@ SYSTEM_INFORMATION_CLASS = _SYSTEM_INFORMATION_CLASS MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0) +MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1) +MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2) +MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3) +MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4) class _MEMORY_INFORMATION_CLASS(EnumType): - values = [MemoryBasicInformation] + values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx] mapper = {x:x for x in values} MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS @@ -806,13 +812,13 @@ TYPEKIND = tagTYPEKIND # Self referencing struct tricks class _LIST_ENTRY(Structure): pass +PLIST_ENTRY = POINTER(_LIST_ENTRY) +LIST_ENTRY = _LIST_ENTRY +PRLIST_ENTRY = POINTER(_LIST_ENTRY) _LIST_ENTRY._fields_ = [ ("Flink", POINTER(_LIST_ENTRY)), ("Blink", POINTER(_LIST_ENTRY)), ] -PLIST_ENTRY = POINTER(_LIST_ENTRY) -LIST_ENTRY = _LIST_ENTRY -PRLIST_ENTRY = POINTER(_LIST_ENTRY) class _PEB_LDR_DATA(Structure): _fields_ = [ @@ -1864,6 +1870,8 @@ IP_INTERFACE_INFO = _IP_INTERFACE_INFO # Self referencing struct tricks class _EXCEPTION_RECORD(Structure): pass +PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD) +EXCEPTION_RECORD = _EXCEPTION_RECORD _EXCEPTION_RECORD._fields_ = [ ("ExceptionCode", DWORD), ("ExceptionFlags", DWORD), @@ -1872,8 +1880,6 @@ _EXCEPTION_RECORD._fields_ = [ ("NumberParameters", DWORD), ("ExceptionInformation", ULONG_PTR * EXCEPTION_MAXIMUM_PARAMETERS), ] -PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD) -EXCEPTION_RECORD = _EXCEPTION_RECORD class _EXCEPTION_RECORD32(Structure): _fields_ = [ @@ -2209,24 +2215,28 @@ class _TMP_signscale(Structure): ("sign", BYTE), ] + class _TMP_lowmid(Structure): _fields_ = [ ("Lo32", ULONG), ("Mid32", ULONG), ] + class TMP_signscale_union(Union): _fields_ = [ ("s", _TMP_signscale), ("signscale", USHORT), ] + class TMP_lowmid_union(Union): _fields_ = [ ("s", _TMP_lowmid), ("Lo64", ULONGLONG), ] + class tagDEC(Structure): _fields_ = [ ("wReserved", USHORT), @@ -2282,6 +2292,7 @@ class TMP_variant_sub_union(Union): ("_VARIANT_NAME_4", _tagBRECORD), ] + class __tagVARIANT(Structure): _fields_ = [ ("vt", VARTYPE), @@ -3125,3 +3136,223 @@ class _DEBUG_SYMBOL_SOURCE_ENTRY(Structure): ] DEBUG_SYMBOL_SOURCE_ENTRY = _DEBUG_SYMBOL_SOURCE_ENTRY PDEBUG_SYMBOL_SOURCE_ENTRY = POINTER(_DEBUG_SYMBOL_SOURCE_ENTRY) + +class _CMSG_SIGNER_INFO(Structure): + _fields_ = [ + ("dwVersion", DWORD), + ("Issuer", CERT_NAME_BLOB), + ("SerialNumber", CRYPT_INTEGER_BLOB), + ("HashAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("HashEncryptionAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("EncryptedHash", CRYPT_DATA_BLOB), + ("AuthAttrs", CRYPT_ATTRIBUTES), + ("UnauthAttrs", CRYPT_ATTRIBUTES), + ] +CMSG_SIGNER_INFO = _CMSG_SIGNER_INFO +PCMSG_SIGNER_INFO = POINTER(_CMSG_SIGNER_INFO) + +class _SPC_SERIALIZED_OBJECT(Structure): + _fields_ = [ + ("ClassId", SPC_UUID), + ("SerializedData", CRYPT_DATA_BLOB), + ] +SPC_SERIALIZED_OBJECT = _SPC_SERIALIZED_OBJECT +PSPC_SERIALIZED_OBJECT = POINTER(_SPC_SERIALIZED_OBJECT) + +class _TMP_SPC_LINK_UNION(Union): + _fields_ = [ + ("pwszUrl", LPWSTR), + ("Moniker", SPC_SERIALIZED_OBJECT), + ("pwszFile", LPWSTR), + ] +TMP_SPC_LINK_UNION = _TMP_SPC_LINK_UNION + +class SPC_LINK_(Structure): + _fields_ = [ + ("dwLinkChoice", DWORD), + ("u", TMP_SPC_LINK_UNION), + ] +PSPC_LINK = POINTER(SPC_LINK_) +SPC_LINK = SPC_LINK_ + +class _SPC_SP_OPUS_INFO(Structure): + _fields_ = [ + ("pwszProgramName", LPCWSTR), + ("pMoreInfo", POINTER(SPC_LINK_)), + ("pPublisherInfo", POINTER(SPC_LINK_)), + ] +PSPC_SP_OPUS_INFO = POINTER(_SPC_SP_OPUS_INFO) +SPC_SP_OPUS_INFO = _SPC_SP_OPUS_INFO + +class _CERT_TRUST_STATUS(Structure): + _fields_ = [ + ("dwErrorStatus", DWORD), + ("dwInfoStatus", DWORD), + ] +PCERT_TRUST_STATUS = POINTER(_CERT_TRUST_STATUS) +CERT_TRUST_STATUS = _CERT_TRUST_STATUS + +class _CERT_TRUST_LIST_INFO(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("pCtlEntry", PCTL_ENTRY), + ("pCtlContext", PCCTL_CONTEXT), + ] +PCERT_TRUST_LIST_INFO = POINTER(_CERT_TRUST_LIST_INFO) +CERT_TRUST_LIST_INFO = _CERT_TRUST_LIST_INFO + +class _CERT_CONTEXT(Structure): + _fields_ = [ + ("dwCertEncodingType", DWORD), + ("pbCertEncoded", POINTER(BYTE)), + ("cbCertEncoded", DWORD), + ("pCertInfo", PCERT_INFO), + ("hCertStore", HCERTSTORE), + ] +PCCERT_CONTEXT = POINTER(_CERT_CONTEXT) +CERT_CONTEXT = _CERT_CONTEXT +PCERT_CONTEXT = POINTER(_CERT_CONTEXT) + +class _CRL_ENTRY(Structure): + _fields_ = [ + ("SerialNumber", CRYPT_INTEGER_BLOB), + ("RevocationDate", FILETIME), + ("cExtension", DWORD), + ("rgExtension", PCERT_EXTENSION), + ] +CRL_ENTRY = _CRL_ENTRY +PCRL_ENTRY = POINTER(_CRL_ENTRY) + +class _CRL_INFO(Structure): + _fields_ = [ + ("dwVersion", DWORD), + ("SignatureAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("Issuer", CERT_NAME_BLOB), + ("ThisUpdate", FILETIME), + ("NextUpdate", FILETIME), + ("cCRLEntry", DWORD), + ("rgCRLEntry", PCRL_ENTRY), + ("cExtension", DWORD), + ("rgExtension", PCERT_EXTENSION), + ] +CRL_INFO = _CRL_INFO +PCRL_INFO = POINTER(_CRL_INFO) + +class _CRL_CONTEXT(Structure): + _fields_ = [ + ("dwCertEncodingType", DWORD), + ("pbCrlEncoded", POINTER(BYTE)), + ("cbCrlEncoded", DWORD), + ("pCrlInfo", PCRL_INFO), + ("hCertStore", HCERTSTORE), + ] +PCCRL_CONTEXT = POINTER(_CRL_CONTEXT) +CRL_CONTEXT = _CRL_CONTEXT +PCRL_CONTEXT = POINTER(_CRL_CONTEXT) + +class _CERT_REVOCATION_CRL_INFO(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("pBaseCrlContext", PCCRL_CONTEXT), + ("pDeltaCrlContext", PCCRL_CONTEXT), + ("pCrlEntry", PCRL_ENTRY), + ("fDeltaCrlEntry", BOOL), + ] +CERT_REVOCATION_CRL_INFO = _CERT_REVOCATION_CRL_INFO +PCERT_REVOCATION_CRL_INFO = POINTER(_CERT_REVOCATION_CRL_INFO) + +class _CERT_REVOCATION_INFO(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("dwRevocationResult", DWORD), + ("pszRevocationOid", LPCSTR), + ("pvOidSpecificInfo", LPVOID), + ("fHasFreshnessTime", BOOL), + ("dwFreshnessTime", DWORD), + ("pCrlInfo", PCERT_REVOCATION_CRL_INFO), + ] +CERT_REVOCATION_INFO = _CERT_REVOCATION_INFO +PCERT_REVOCATION_INFO = POINTER(_CERT_REVOCATION_INFO) + +class _CERT_CHAIN_ELEMENT(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("pCertContext", PCCERT_CONTEXT), + ("TrustStatus", CERT_TRUST_STATUS), + ("pRevocationInfo", PCERT_REVOCATION_INFO), + ("pIssuanceUsage", PCERT_ENHKEY_USAGE), + ("pApplicationUsage", PCERT_ENHKEY_USAGE), + ("pwszExtendedErrorInfo", LPCWSTR), + ] +PCERT_CHAIN_ELEMENT = POINTER(_CERT_CHAIN_ELEMENT) +CERT_CHAIN_ELEMENT = _CERT_CHAIN_ELEMENT +PCCERT_CHAIN_ELEMENT = POINTER(_CERT_CHAIN_ELEMENT) + +class _CERT_SIMPLE_CHAIN(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("TrustStatus", CERT_TRUST_STATUS), + ("cElement", DWORD), + ("rgpElement", POINTER(PCERT_CHAIN_ELEMENT)), + ("pTrustListInfo", PCERT_TRUST_LIST_INFO), + ("fHasRevocationFreshnessTime", BOOL), + ("dwRevocationFreshnessTime", DWORD), + ] +CERT_SIMPLE_CHAIN = _CERT_SIMPLE_CHAIN +PCERT_SIMPLE_CHAIN = POINTER(_CERT_SIMPLE_CHAIN) +PCCERT_SIMPLE_CHAIN = POINTER(_CERT_SIMPLE_CHAIN) + +# Self referencing struct tricks +class _CERT_CHAIN_CONTEXT(Structure): pass +CERT_CHAIN_CONTEXT = _CERT_CHAIN_CONTEXT +PCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT) +PCCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT) +_CERT_CHAIN_CONTEXT._fields_ = [ + ("cbSize", DWORD), + ("TrustStatus", CERT_TRUST_STATUS), + ("cChain", DWORD), + ("rgpChain", POINTER(PCERT_SIMPLE_CHAIN)), + ("cLowerQualityChainContext", DWORD), + ("rgpLowerQualityChainContext", POINTER(PCCERT_CHAIN_CONTEXT)), + ("fHasRevocationFreshnessTime", BOOL), + ("dwRevocationFreshnessTime", DWORD), + ("dwCreateFlags", DWORD), + ("ChainId", GUID), +] + +class _CERT_USAGE_MATCH(Structure): + _fields_ = [ + ("dwType", DWORD), + ("Usage", CERT_ENHKEY_USAGE), + ] +CERT_USAGE_MATCH = _CERT_USAGE_MATCH +PCERT_USAGE_MATCH = POINTER(_CERT_USAGE_MATCH) + +class _CERT_CHAIN_PARA(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("RequestedUsage", CERT_USAGE_MATCH), + ("RequestedIssuancePolicy", CERT_USAGE_MATCH), + ("dwUrlRetrievalTimeout", DWORD), + ("fCheckRevocationFreshnessTime", BOOL), + ("dwRevocationFreshnessTime", DWORD), + ("pftCacheResync", LPFILETIME), + ] +CERT_CHAIN_PARA = _CERT_CHAIN_PARA +PCERT_CHAIN_PARA = POINTER(_CERT_CHAIN_PARA) + +class _CERT_CHAIN_ENGINE_CONFIG(Structure): + _fields_ = [ + ("cbSize", DWORD), + ("hRestrictedRoot", HCERTSTORE), + ("hRestrictedTrust", HCERTSTORE), + ("hRestrictedOther", HCERTSTORE), + ("cAdditionalStore", DWORD), + ("rghAdditionalStore", POINTER(HCERTSTORE)), + ("dwFlags", DWORD), + ("dwUrlRetrievalTimeout", DWORD), + ("MaximumCachedCertificates", DWORD), + ("CycleDetectionModulus", DWORD), + ] +CERT_CHAIN_ENGINE_CONFIG = _CERT_CHAIN_ENGINE_CONFIG +PCERT_CHAIN_ENGINE_CONFIG = POINTER(_CERT_CHAIN_ENGINE_CONFIG) diff --git a/windows/syswow64.py b/windows/syswow64.py index fd69f70..d9b668b 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -9,7 +9,7 @@ import windows.native_exec.simple_x64 as x64 from generated_def.winstructs import * from windows.winobject import process from windows import winproxy -from winproxy import NeededParameter, OptionalExport, NtdllProxy, error_ntstatus +from winproxy import NeededParameter, NtdllProxy, error_ntstatus # Special code for syswow64 process CS_32bits = 0x23 @@ -28,7 +28,7 @@ def genere_return_32bits_stub(ret_addr): return ret_32b.get_code() # The format of a jump to 64bits mode -dummy_jump = "\xea" + struct.pack("".format(self.winproxy_function.__name__, param_name)) if self.raw_call is None: - self.raw_call = generate_syswow64_call(self.winproxy_function) + force_resolution() return self.raw_call(*args) setattr(python_proxy, "ctypes_function", perform_call) + setattr(python_proxy, "force_resolution", force_resolution) return python_proxy @@ -277,7 +290,7 @@ def NtQueryInformationThread_32_to_64(ThreadHandle, ThreadInformationClass, Thre @Syswow64ApiProxy(winproxy.NtQueryVirtualMemory) -def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None): +def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None): if ReturnLength is None: ReturnLength = byref(ULONG()) if MemoryInformation is not None and MemoryInformationLength == 0: diff --git a/windows/winobject/process.py b/windows/winobject/process.py index cad5c79..b2a3de5 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -370,7 +370,7 @@ class Process(AutoHandle): if windows.current_process.bitness == 32 and self.bitness == 64: res = MEMORY_BASIC_INFORMATION64() try: - v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformation=res) + v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res) except NtStatusException as e: if e.code & 0xffffffff == 0XC000000D: raise winproxy.Kernel32Error("NtQueryVirtualMemory_32_to_64") @@ -422,7 +422,7 @@ class Process(AutoHandle): res = GENERATED_PSAPI_WORKING_SET_INFORMATION() try: if windows.current_process.bitness == 32 and self.bitness == 64: - windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, 1, res) + windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetList, res) else: windows.winproxy.QueryWorkingSet(self.handle, ctypes.byref(res), ctypes.sizeof(res)) except WindowsError as e: @@ -448,7 +448,7 @@ class Process(AutoHandle): for i, data in enumerate(info_array): info_array[i].VirtualAddress = addresses[i] if windows.current_process.bitness == 32 and self.bitness == 64: - windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, 4, info_array) + windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetListEx, info_array) else: winproxy.QueryWorkingSetEx(self.handle, ctypes.byref(info_array), ctypes.sizeof(info_array)) return info_array @@ -465,7 +465,7 @@ class Process(AutoHandle): if windows.current_process.bitness == 32 and self.bitness == 64: target_size = ctypes.c_buffer(buffer_size) try: - windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, addr, 2, buffer, buffer_size, target_size) + windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, addr, MemorySectionName, buffer, buffer_size, target_size) except NtStatusException as e: if e.code not in [STATUS_FILE_INVALID, STATUS_INVALID_ADDRESS, STATUS_TRANSACTION_NOT_ACTIVE]: raise @@ -812,7 +812,7 @@ class WinProcess(Process): def write_memory(self, addr, data): """Write `data` at `addr`""" if windows.current_process.bitness == 32 and self.bitness == 64: - if winproxy.NtWow64WriteVirtualMemory64 is None: + if not winproxy.is_implemented(winproxy.NtWow64WriteVirtualMemory64): raise ValueError("NtWow64WriteVirtualMemory64 non available in ntdll: cannot write into 64bits processus") return winproxy.NtWow64WriteVirtualMemory64(self.handle, addr, data, len(data)) return winproxy.WriteProcessMemory(self.handle, addr, lpBuffer=data) @@ -820,7 +820,7 @@ class WinProcess(Process): def low_read_memory(self, addr, buffer_addr, size): if windows.current_process.bitness == 32 and self.bitness == 64: # OptionalExport can be None (see winproxy.py) - if winproxy.NtWow64ReadVirtualMemory64 is None: + if not winproxy.is_implemented(winproxy.NtWow64ReadVirtualMemory64): raise ValueError("NtWow64ReadVirtualMemory64 non available in ntdll: cannot read into 64bits processus") return winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) #if self.is_wow_64 and addr > 0xffffffff: diff --git a/windows/winproxy.py b/windows/winproxy.py index 3f60689..c0583c4 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -186,27 +186,27 @@ class VersionProxy(ApiProxy): APIDLL = "version" default_error_check = staticmethod(kernel32_error_check) -class OptionalExport(object): - """used 'around' a Proxy decorator - Should be used for export that are not available everywhere (ntdll internals | 32/64 bits stuff) - If the export is not found the function will be None - - Example: - @OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64')) - def NtWow64ReadVirtualMemory64(...) - ... - """ - def __init__(self, subdecorator): - self.subdecorator = subdecorator - - def __call__(self, f): - try: - x = self.subdecorator(f) - x.force_resolution() - return x - except ExportNotFound as e: - dbgprint("Export <{e.func_name}> not found in <{e.api_name}>".format(e=e), "EXPORTNOTFOUND") - return None +#class OptionalExport(object): +# """used 'around' a Proxy decorator +# Should be used for export that are not available everywhere (ntdll internals | 32/64 bits stuff) +# If the export is not found the function will be None +# +# Example: +# @OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64')) +# def NtWow64ReadVirtualMemory64(...) +# ... +# """ +# def __init__(self, subdecorator): +# self.subdecorator = subdecorator +# +# def __call__(self, f): +# try: +# x = self.subdecorator(f) +# x.force_resolution() +# return x +# except ExportNotFound as e: +# dbgprint("Export <{e.func_name}> not found in <{e.api_name}>".format(e=e), "EXPORTNOTFOUND") +# return None class TransparentApiProxy(object): def __init__(self, DLLNAME, func_name, error_check): @@ -285,10 +285,10 @@ GetComputerNameW = TransparentKernel32Proxy("GetComputerNameW") -Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection") -Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection") -Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection") -Wow64GetThreadContext = OptionalExport(TransparentKernel32Proxy)("Wow64GetThreadContext") +Wow64DisableWow64FsRedirection = TransparentKernel32Proxy("Wow64DisableWow64FsRedirection") +Wow64RevertWow64FsRedirection = TransparentKernel32Proxy("Wow64RevertWow64FsRedirection") +Wow64EnableWow64FsRedirection = TransparentKernel32Proxy("Wow64EnableWow64FsRedirection") +Wow64GetThreadContext = TransparentKernel32Proxy("Wow64GetThreadContext") def CreateFile_error_check(func_name, result, func, args): @@ -553,24 +553,25 @@ def GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None): if nSize is None: nSize = ctypes.sizeof(lpFilename) return GetMappedFileNameWWrapper.ctypes_function(hProcess, lpv, lpFilename, nSize) -GetMappedFileNameW = OptionalExport(Kernel32Proxy("GetMappedFileNameW"))(GetMappedFileNameWWrapper) +GetMappedFileNameW = Kernel32Proxy("GetMappedFileNameW")(GetMappedFileNameWWrapper) def GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None): if nSize is None: nSize = ctypes.sizeof(lpFilename) return GetMappedFileNameAWrapper.ctypes_function(hProcess, lpv, lpFilename, nSize) -GetMappedFileNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetMappedFileNameAWrapper) +GetMappedFileNameA = Kernel32Proxy("GetMappedFileNameA")(GetMappedFileNameAWrapper) def QueryWorkingSetWrapper(hProcess, pv, cb): return QueryWorkingSet.ctypes_function(hProcess, pv, cb) -QueryWorkingSet = OptionalExport(Kernel32Proxy("QueryWorkingSet"))(QueryWorkingSetWrapper) +QueryWorkingSet = Kernel32Proxy("QueryWorkingSet")(QueryWorkingSetWrapper) def QueryWorkingSetExWrapper(hProcess, pv, cb): return QueryWorkingSetEx.ctypes_function(hProcess, pv, cb) -QueryWorkingSetEx = OptionalExport(Kernel32Proxy("QueryWorkingSetEx"))(QueryWorkingSetExWrapper) +QueryWorkingSetEx = Kernel32Proxy("QueryWorkingSetEx")(QueryWorkingSetExWrapper) -if GetMappedFileNameA is None: + +if not is_implemented(GetMappedFileNameA): GetMappedFileNameW = PsapiProxy("GetMappedFileNameW")(GetMappedFileNameWWrapper) GetMappedFileNameA = PsapiProxy("GetMappedFileNameA")(GetMappedFileNameAWrapper) QueryWorkingSet = PsapiProxy("QueryWorkingSet")(QueryWorkingSetWrapper) @@ -580,16 +581,16 @@ def GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None): if nSize is None: nSize = len(lpBaseName) return GetModuleBaseNameAWrapper.ctypes_function(hProcess, hModule, lpBaseName, nSize) -GetModuleBaseNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetModuleBaseNameAWrapper) +GetModuleBaseNameA = Kernel32Proxy("GetMappedFileNameA")(GetModuleBaseNameAWrapper) def GetModuleBaseNameWWrapper(hProcess, hModule, lpBaseName, nSize=None): if nSize is None: nSize = len(lpBaseName) return GetModuleBaseNameWWrapper.ctypes_function(hProcess, hModule, lpBaseName, nSize) -GetModuleBaseNameA = OptionalExport(Kernel32Proxy("GetModuleBaseNameW"))(GetModuleBaseNameWWrapper) +GetModuleBaseNameA = Kernel32Proxy("GetModuleBaseNameW")(GetModuleBaseNameWWrapper) -if GetModuleBaseNameA is None: +if not is_implemented(GetModuleBaseNameA): GetModuleBaseNameA = PsapiProxy("GetModuleBaseNameA")(GetModuleBaseNameAWrapper) GetModuleBaseNameW = PsapiProxy("GetModuleBaseNameW")(GetModuleBaseNameWWrapper) @@ -598,15 +599,15 @@ def GetProcessImageFileNameAWrapper(hProcess, lpImageFileName, nSize=None): if nSize is None: nSize = len(lpImageFileName) return GetProcessImageFileNameAWrapper.ctypes_function(hProcess, lpImageFileName, nSize) -GetProcessImageFileNameA = OptionalExport(Kernel32Proxy("GetProcessImageFileNameA"))(GetProcessImageFileNameAWrapper) +GetProcessImageFileNameA = Kernel32Proxy("GetProcessImageFileNameA")(GetProcessImageFileNameAWrapper) def GetProcessImageFileNameWWrapper(hProcess, lpImageFileName, nSize=None): if nSize is None: nSize = len(lpImageFileName) return GetProcessImageFileNameWWrapper.ctypes_function(hProcess, lpImageFileName, nSize) -GetProcessImageFileNameW = OptionalExport(Kernel32Proxy("GetProcessImageFileNameW"))(GetProcessImageFileNameWWrapper) +GetProcessImageFileNameW = Kernel32Proxy("GetProcessImageFileNameW")(GetProcessImageFileNameWWrapper) -if GetProcessImageFileNameA is None: +if not is_implemented(GetProcessImageFileNameA): GetProcessImageFileNameA = PsapiProxy("GetProcessImageFileNameA")(GetProcessImageFileNameAWrapper) GetProcessImageFileNameW = PsapiProxy("GetProcessImageFileNameW")(GetProcessImageFileNameWWrapper) @@ -659,11 +660,11 @@ def SetConsoleCtrlHandler(HandlerRoutine, Add): # ### NTDLL #### # -@OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus)) +@NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus) def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None): return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead) -@OptionalExport(NtdllProxy('NtWow64WriteVirtualMemory64', error_ntstatus)) +@NtdllProxy('NtWow64WriteVirtualMemory64', error_ntstatus) def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten=None): return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten) @@ -691,7 +692,7 @@ def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, Sys return NtQuerySystemInformation.ctypes_function(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength) -@OptionalExport(NtdllProxy('NtQueryInformationProcess', error_ntstatus)) +@NtdllProxy('NtQueryInformationProcess', error_ntstatus) def NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength=0, ReturnLength=None): if ProcessInformation is not None and ProcessInformationLength == 0: ProcessInformationLength = ctypes.sizeof(ProcessInformation) @@ -717,7 +718,7 @@ def NtProtectVirtualMemory(ProcessHandle, BaseAddress, NumberOfBytesToProtect, N OldAccessProtection = DWORD() return NtProtectVirtualMemory.ctypes_function(ProcessHandle, BaseAddress, NumberOfBytesToProtect, NewAccessProtection, OldAccessProtection) -@OptionalExport(NtdllProxy('NtQueryVirtualMemory', error_ntstatus)) +@NtdllProxy('NtQueryVirtualMemory', error_ntstatus) def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None): if ReturnLength is None: ReturnLength = byref(ULONG()) @@ -732,7 +733,7 @@ def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, Mem def NtQueryObject(Handle, ObjectInformationClass, ObjectInformation=None, ObjectInformationLength=0, ReturnLength=NeededParameter): return NtQueryObject.ctypes_function(Handle, ObjectInformationClass, ObjectInformation, ObjectInformationLength, ReturnLength) -@OptionalExport(NtdllProxy('NtCreateThreadEx', error_ntstatus)) +@NtdllProxy('NtCreateThreadEx', error_ntstatus) def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0): if ThreadHandle is None: ThreadHandle = byref(HANDLE()) @@ -907,7 +908,7 @@ def set_tcp_entry_error_check(func_name, result, func, args): SetTcpEntry = TransparentIphlpapiProxy('SetTcpEntry', error_check=set_tcp_entry_error_check) -@OptionalExport(IphlpapiProxy('GetExtendedTcpTable')) +@IphlpapiProxy('GetExtendedTcpTable') def GetExtendedTcpTable(pTcpTable, pdwSize=None, bOrder=True, ulAf=NeededParameter, TableClass=TCP_TABLE_OWNER_PID_ALL, Reserved=0): if pdwSize is None: pdwSize = ULONG(ctypes.sizeof(pTcpTable))