mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
more doc
This commit is contained in:
Clement Rouault
@@ -1,7 +1,6 @@
|
||||
TODO:
|
||||
- Documentation
|
||||
- Pass 0.2 when doc is done <3
|
||||
- type pass to dbg callback
|
||||
|
||||
- ProcessMemory object ? (metasm like)
|
||||
|
||||
@@ -42,17 +41,9 @@ TODO:
|
||||
|
||||
|
||||
CHANGELOG:
|
||||
* NEW REGISTRY -> change examples and documentation
|
||||
* WinProcess is not a PROCESSENTRY32 anymore (change doc)
|
||||
* re-check every sample
|
||||
|
||||
Documentation
|
||||
* Debugger
|
||||
* LocalDebugger
|
||||
* windows.com
|
||||
* New stuff in exception ?
|
||||
* windows.utils
|
||||
|
||||
* verif samples
|
||||
|
||||
FIXME:
|
||||
|
||||
+32
-10
@@ -1,21 +1,43 @@
|
||||
COM - Component Object Model
|
||||
""""""""""""""""""""""""""""
|
||||
:mod:`windows.com` - Component Object Model
|
||||
""""""""""""""""""""""""""""""""""""""""""""
|
||||
|
||||
.. module:: windows.com
|
||||
|
||||
A module to call `COM` interfaces from `Python` or
|
||||
`COM` vtable in python.
|
||||
|
||||
This code is only used in :mod:`windows.wmi`.
|
||||
This code is only used in :mod:`windows.winobject.wmi` and :mod:`windows.winobject.network` for the firewall.
|
||||
The ability to create `COM` vtable is used in the `LKD project <https://github.com/sogeti-esec-lab/LKD/>`_ .
|
||||
|
||||
|
||||
To call a `COM` interface you need to:
|
||||
Using a COM interface
|
||||
'''''''''''''''''''''
|
||||
|
||||
1. Describe the `COM` interface `CODE1 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L56>`_
|
||||
2. Use an instance (which is a PVOID) to get the interface `CODE2 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L313>`_
|
||||
3. Use the object ! `CODE3 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L366>`_
|
||||
It's possible to directly call `COM` interface from python. All you need is the definition of the `COM` interface.
|
||||
|
||||
There are three ways to get the definition of the code interface:
|
||||
|
||||
* By using it from :mod:`windows.generated_def.interfaces`
|
||||
* By writing it yourself : <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L56>`_
|
||||
* By generating it.
|
||||
|
||||
To generate a `COM` interface you need its definition from the ".c" file.
|
||||
Then add thisit to ``PythonForWindows\ctypes_generation\com\MyInterface.txt``.
|
||||
Finally re-generate the interface using ``generate.py``.
|
||||
|
||||
When you have the `COM` interface defintion you can create an instance of it.
|
||||
Then you need to retrieve the interface by using an API returning an object or :func:`window.com.create_instance`.
|
||||
You can then use the instance to call whatever method you need.
|
||||
|
||||
.. note::
|
||||
|
||||
see sample :ref:`sample_com_firewall`
|
||||
|
||||
Implementing a COM interface
|
||||
''''''''''''''''''''''''''''
|
||||
|
||||
To create `COM` object you need to:
|
||||
|
||||
1. Describe your ComVtable `CODE4 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/simple_com.py#L89>`_
|
||||
2. Implement the python functions described `CODE5 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L233>`_
|
||||
3. Create an instance and pass it to whatever native function expects it `CODE6 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L438>`_
|
||||
1. Describe your ComVtable `CODE1 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/simple_com.py#L89>`_
|
||||
2. Implement the python functions described `CODE2 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L233>`_
|
||||
3. Create an instance and pass it to whatever native function expects it `CODE3 <https://github.com/sogeti-esec-lab/LKD/blob/ba40727d7d257b00f89fc6ca7296c9833b7b75b2/dbginterface/remote.py#L438>`_
|
||||
@@ -19,6 +19,7 @@ Contents:
|
||||
utils.rst
|
||||
wintrust.rst
|
||||
debug.rst
|
||||
com.rst
|
||||
iat_hook.rst
|
||||
wip.rst
|
||||
internals.rst
|
||||
|
||||
+26
-1
@@ -436,4 +436,29 @@ Ouput::
|
||||
* {'Caption': u'C:', 'FreeSpace': u'43991547904', 'FileSystem': u'NTFS'}
|
||||
* {'Caption': u'E:', 'FreeSpace': u'82776027136', 'FileSystem': u'NTFS'}
|
||||
* {'Caption': u'F:', 'FreeSpace': u'5711265792', 'FileSystem': u'FAT32'}
|
||||
* {'Caption': u'G:', 'FreeSpace': None, 'FileSystem': None}
|
||||
* {'Caption': u'G:', 'FreeSpace': None, 'FileSystem': None}
|
||||
|
||||
.. _sample_com_firewall:
|
||||
|
||||
using COM: ``INetFwPolicy2``
|
||||
''''''''''''''''''''''''''''
|
||||
|
||||
.. literalinclude:: ..\..\samples\com_inetfwpolicy2.py
|
||||
|
||||
Output::
|
||||
|
||||
(cmd λ) python .\samples\com_inetfwpolicy2.py
|
||||
Initialisation of COM
|
||||
Creating INetFwPolicy2 variable
|
||||
<INetFwPolicy2 object at 0x02DC8210> (value = None)
|
||||
|
||||
Generating CLSID
|
||||
<IID "E2B3C97F-6AE1-41AC-817A-F6F92166D7DD">
|
||||
|
||||
Creating COM instance
|
||||
<INetFwPolicy2 object at 0x02DC8210> (value = 0x8984848)
|
||||
|
||||
Checking for enabled profiles
|
||||
* NET_FW_PROFILE2_DOMAIN(0x1L) -> True
|
||||
* NET_FW_PROFILE2_PRIVATE(0x2L) -> True
|
||||
* NET_FW_PROFILE2_PUBLIC(0x4L) -> True
|
||||
@@ -15,5 +15,4 @@ This sections describes them by group of relation.
|
||||
network.rst
|
||||
service.rst
|
||||
volume.rst
|
||||
com.rst
|
||||
wmi.rst
|
||||
+410
-14
@@ -88,24 +88,42 @@ Transparent proxies:
|
||||
* DebugBreak()
|
||||
* DebugBreakProcess(Process)
|
||||
* DebugSetProcessKillOnExit(KillOnExit)
|
||||
* EnumWindows(lpEnumFunc, lParam)
|
||||
* ExitProcess(uExitCode)
|
||||
* ExitThread(dwExitCode)
|
||||
* FreeConsole()
|
||||
* GetComputerNameA(lpBuffer, lpnSize)
|
||||
* GetComputerNameW(lpBuffer, lpnSize)
|
||||
* GetCurrentProcess()
|
||||
* GetCurrentProcessorNumber()
|
||||
* GetCurrentThread()
|
||||
* GetCurrentThreadId()
|
||||
* GetDriveTypeA(lpRootPathName)
|
||||
* GetDriveTypeW(lpRootPathName)
|
||||
* GetExitCodeProcess(hProcess, lpExitCode)
|
||||
* GetExitCodeThread(hThread, lpExitCode)
|
||||
* GetLastError()
|
||||
* GetLogicalDriveStringsA(nBufferLength, lpBuffer)
|
||||
* GetLogicalDriveStringsW(nBufferLength, lpBuffer)
|
||||
* GetProcAddress(hModule, lpProcName)
|
||||
* GetProcessId(Process)
|
||||
* GetSidSubAuthority(pSid, nSubAuthority)
|
||||
* GetSidSubAuthorityCount(pSid)
|
||||
* GetStdHandle(nStdHandle)
|
||||
* GetSystemMetrics(nIndex)
|
||||
* GetThreadId(Thread)
|
||||
* GetVersionExA(lpVersionInformation)
|
||||
* GetVersionExW(lpVersionInformation)
|
||||
* GetVolumeNameForVolumeMountPointA(lpszVolumeMountPoint, lpszVolumeName, cchBufferLength)
|
||||
* GetVolumeNameForVolumeMountPointW(lpszVolumeMountPoint, lpszVolumeName, cchBufferLength)
|
||||
* GetWindowModuleFileNameA(hwnd, pszFileName, cchFileNameMax)
|
||||
* GetWindowModuleFileNameW(hwnd, pszFileName, cchFileNameMax)
|
||||
* GetWindowTextA(hWnd, lpString, nMaxCount)
|
||||
* GetWindowTextW(hWnd, lpString, nMaxCount)
|
||||
* LoadLibraryA(lpFileName)
|
||||
* LoadLibraryW(lpFileName)
|
||||
* QueryDosDeviceA(lpDeviceName, lpTargetPath, ucchMax)
|
||||
* QueryDosDeviceW(lpDeviceName, lpTargetPath, ucchMax)
|
||||
* ResumeThread(hThread)
|
||||
* SetStdHandle(nStdHandle, hHandle)
|
||||
* SetTcpEntry(pTcpRow)
|
||||
@@ -117,6 +135,8 @@ Transparent proxies:
|
||||
* Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
|
||||
* Wow64GetThreadContext(hThread, lpContext)
|
||||
* Wow64RevertWow64FsRedirection(OldValue)
|
||||
* lstrcmpA(lpString1, lpString2)
|
||||
* lstrcmpW(lpString1, lpString2)
|
||||
Functions:
|
||||
|
||||
* AddVectoredContinueHandler::
|
||||
@@ -137,12 +157,52 @@ Functions:
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* AlpcGetMessageAttribute::
|
||||
|
||||
AlpcGetMessageAttribute(Buffer, AttributeFlag)
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* AlpcInitializeMessageAttribute::
|
||||
|
||||
AlpcInitializeMessageAttribute(AttributeFlags, Buffer, BufferSize, RequiredBufferSize)
|
||||
|
||||
* CoCreateInstance::
|
||||
|
||||
CoCreateInstance(rclsid, pUnkOuter=None, dwClsContext=tagCLSCTX.CLSCTX_INPROC_SERVER(0x1L), riid=NeededParameter, ppv=NeededParameter)
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* CoInitializeEx::
|
||||
|
||||
CoInitializeEx(pvReserved=None, dwCoInit=tagCOINIT.COINIT_MULTITHREADED(0x0L))
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* CoInitializeSecurity::
|
||||
|
||||
CoInitializeSecurity(pSecDesc, cAuthSvc, asAuthSvc, pReserved1, dwAuthnLevel, dwImpLevel, pAuthList, dwCapabilities, pReserved3)
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* CreateFileA::
|
||||
|
||||
CreateFileA(lpFileName, dwDesiredAccess=GENERIC_READ(0x80000000L), dwShareMode=0, lpSecurityAttributes=None, dwCreationDisposition=OPEN_EXISTING(0x3L), dwFlagsAndAttributes=FILE_ATTRIBUTE_NORMAL(0x80L), hTemplateFile=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is NOT 0
|
||||
|
||||
* CreateFileMappingA::
|
||||
|
||||
CreateFileMappingA(hFile, lpFileMappingAttributes=None, flProtect=PAGE_READWRITE(0x4L), dwMaximumSizeHigh=0, dwMaximumSizeLow=NeededParameter, lpName=NeededParameter)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* CreateFileMappingW::
|
||||
|
||||
CreateFileMappingW(hFile, lpFileMappingAttributes=None, flProtect=PAGE_READWRITE(0x4L), dwMaximumSizeHigh=0, dwMaximumSizeLow=0, lpName=NeededParameter)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* CreateFileW::
|
||||
|
||||
CreateFileW(lpFileName, dwDesiredAccess=GENERIC_READ(0x80000000L), dwShareMode=0, lpSecurityAttributes=None, dwCreationDisposition=OPEN_EXISTING(0x3L), dwFlagsAndAttributes=FILE_ATTRIBUTE_NORMAL(0x80L), hTemplateFile=None)
|
||||
@@ -179,27 +239,213 @@ Functions:
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* CryptCATAdminAcquireContext::
|
||||
|
||||
CryptCATAdminAcquireContext(phCatAdmin, pgSubsystem, dwFlags)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* CryptCATAdminCalcHashFromFileHandle::
|
||||
|
||||
CryptCATAdminCalcHashFromFileHandle(hFile, pcbHash, pbHash, dwFlags)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* CryptCATAdminEnumCatalogFromHash::
|
||||
|
||||
CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo)
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* CryptCATAdminReleaseCatalogContext::
|
||||
|
||||
CryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfo, dwFlags)
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* CryptCATAdminReleaseContext::
|
||||
|
||||
CryptCATAdminReleaseContext(hCatAdmin, dwFlags)
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* CryptCATCatalogInfoFromContext::
|
||||
|
||||
CryptCATCatalogInfoFromContext(hCatInfo, psCatInfo, dwFlags)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* DeviceIoControl::
|
||||
|
||||
DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lpOutBuffer=NeededParameter, nOutBufferSize=None, lpBytesReturned=None, lpOverlapped=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetExtendedTcpTable::
|
||||
* DuplicateHandle::
|
||||
|
||||
GetExtendedTcpTable(pTcpTable, pdwSize=None, bOrder=True, ulAf=NeededParameter, TableClass=5, Reserved=0)
|
||||
Errcheck:
|
||||
raise IphlpapiError if result is NOT 0
|
||||
|
||||
* GetMappedFileNameA::
|
||||
|
||||
GetMappedFileNameA(hProcess, lpv, lpFilename, nSize=None)
|
||||
DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, lpTargetHandle, dwDesiredAccess=0, bInheritHandle=False, dwOptions=0)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetMappedFileNameW::
|
||||
* EnumServicesStatusExA::
|
||||
|
||||
GetMappedFileNameW(hProcess, lpv, lpFilename, nSize=None)
|
||||
EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* EnumServicesStatusExW::
|
||||
|
||||
EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetExtendedTcpTable::
|
||||
|
||||
GetExtendedTcpTable(pTcpTable, pdwSize=None, bOrder=True, ulAf=NeededParameter, TableClass=_TCP_TABLE_CLASS.TCP_TABLE_OWNER_PID_ALL(0x5L), Reserved=0)
|
||||
Errcheck:
|
||||
raise IphlpapiError if result is NOT 0
|
||||
|
||||
* GetFileVersionInfoA::
|
||||
|
||||
GetFileVersionInfoA(lptstrFilename, dwHandle=0, dwLen=None, lpData=NeededParameter)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetFileVersionInfoSizeA::
|
||||
|
||||
GetFileVersionInfoSizeA(lptstrFilename, lpdwHandle=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetFileVersionInfoSizeW::
|
||||
|
||||
GetFileVersionInfoSizeW(lptstrFilename, lpdwHandle=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetFileVersionInfoW::
|
||||
|
||||
GetFileVersionInfoW(lptstrFilename, dwHandle=0, dwLen=None, lpData=NeededParameter)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetIfTable::
|
||||
|
||||
GetIfTable(pIfTable, pdwSize, bOrder=False)
|
||||
Errcheck:
|
||||
raise IphlpapiError if result is NOT 0
|
||||
|
||||
* GetInterfaceInfo::
|
||||
|
||||
GetInterfaceInfo(pIfTable, dwOutBufLen=None)
|
||||
Errcheck:
|
||||
raise IphlpapiError if result is NOT 0
|
||||
|
||||
* GetIpAddrTable::
|
||||
|
||||
GetIpAddrTable(pIpAddrTable, pdwSize, bOrder=False)
|
||||
Errcheck:
|
||||
raise IphlpapiError if result is NOT 0
|
||||
|
||||
* GetMappedFileNameAWrapper::
|
||||
|
||||
GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetMappedFileNameAWrapper::
|
||||
|
||||
GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetMappedFileNameWWrapper::
|
||||
|
||||
GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetMappedFileNameWWrapper::
|
||||
|
||||
GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetModuleBaseNameAWrapper::
|
||||
|
||||
GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetModuleBaseNameAWrapper::
|
||||
|
||||
GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetModuleBaseNameWWrapper::
|
||||
|
||||
GetModuleBaseNameWWrapper(hProcess, hModule, lpBaseName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetModuleBaseNameWWrapper::
|
||||
|
||||
GetModuleBaseNameWWrapper(hProcess, hModule, lpBaseName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetProcessImageFileNameAWrapper::
|
||||
|
||||
GetProcessImageFileNameAWrapper(hProcess, lpImageFileName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetProcessImageFileNameAWrapper::
|
||||
|
||||
GetProcessImageFileNameAWrapper(hProcess, lpImageFileName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetProcessImageFileNameWWrapper::
|
||||
|
||||
GetProcessImageFileNameWWrapper(hProcess, lpImageFileName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetProcessImageFileNameWWrapper::
|
||||
|
||||
GetProcessImageFileNameWWrapper(hProcess, lpImageFileName, nSize=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetProcessTimes::
|
||||
|
||||
GetProcessTimes(hProcess, lpCreationTime, lpExitTime, lpKernelTime, lpUserTime)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
@@ -215,10 +461,34 @@ Functions:
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetVolumeInformationA::
|
||||
|
||||
GetVolumeInformationA(lpRootPathName, lpVolumeNameBuffer, nVolumeNameSize, lpVolumeSerialNumber, lpMaximumComponentLength, lpFileSystemFlags, lpFileSystemNameBuffer, nFileSystemNameSize)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* GetVolumeInformationW::
|
||||
|
||||
GetVolumeInformationW(lpRootPathName, lpVolumeNameBuffer=None, nVolumeNameSize=0, lpVolumeSerialNumber=None, lpMaximumComponentLength=None, lpFileSystemFlags=None, lpFileSystemNameBuffer=None, nFileSystemNameSize=0)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* LdrLoadDll::
|
||||
|
||||
LdrLoadDll(PathToFile, Flags, ModuleFileName, ModuleHandle)
|
||||
|
||||
* LookupAccountSidA::
|
||||
|
||||
LookupAccountSidA(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainName, cchReferencedDomainName, peUse)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* LookupAccountSidW::
|
||||
|
||||
LookupAccountSidW(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainName, cchReferencedDomainName, peUse)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* LookupPrivilegeValueA::
|
||||
|
||||
LookupPrivilegeValueA(lpSystemName=None, lpName=NeededParameter, lpLuid=NeededParameter)
|
||||
@@ -231,6 +501,28 @@ Functions:
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* MapViewOfFile::
|
||||
|
||||
MapViewOfFile(hFileMappingObject, dwDesiredAccess=FILE_MAP_ALL_ACCESS(0xf001fL), dwFileOffsetHigh=0, dwFileOffsetLow=0, dwNumberOfBytesToMap=NeededParameter)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* NtAlpcAcceptConnectPort::
|
||||
|
||||
NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection)
|
||||
|
||||
* NtAlpcConnectPort::
|
||||
|
||||
NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout)
|
||||
|
||||
* NtAlpcCreatePort::
|
||||
|
||||
NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes)
|
||||
|
||||
* NtAlpcSendWaitReceivePort::
|
||||
|
||||
NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout)
|
||||
|
||||
* NtCreateThreadEx::
|
||||
|
||||
NtCreateThreadEx(ThreadHandle=None, DesiredAccess=2097151, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0)
|
||||
@@ -239,6 +531,26 @@ Functions:
|
||||
|
||||
NtGetContextThread(hThread, lpContext)
|
||||
|
||||
* NtOpenDirectoryObject::
|
||||
|
||||
NtOpenDirectoryObject(DirectoryHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
* NtOpenEvent::
|
||||
|
||||
NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
* NtOpenSymbolicLinkObject::
|
||||
|
||||
NtOpenSymbolicLinkObject(LinkHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
* NtProtectVirtualMemory::
|
||||
|
||||
NtProtectVirtualMemory(ProcessHandle, BaseAddress, NumberOfBytesToProtect, NewAccessProtection, OldAccessProtection=None)
|
||||
|
||||
* NtQueryDirectoryObject::
|
||||
|
||||
NtQueryDirectoryObject(DirectoryHandle, Buffer, Length, ReturnSingleEntry, RestartScan, Context, ReturnLength)
|
||||
|
||||
* NtQueryInformationProcess::
|
||||
|
||||
NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength=0, ReturnLength=None)
|
||||
@@ -247,6 +559,14 @@ Functions:
|
||||
|
||||
NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength=0, ReturnLength=None)
|
||||
|
||||
* NtQueryObject::
|
||||
|
||||
NtQueryObject(Handle, ObjectInformationClass, ObjectInformation=None, ObjectInformationLength=0, ReturnLength=NeededParameter)
|
||||
|
||||
* NtQuerySymbolicLinkObject::
|
||||
|
||||
NtQuerySymbolicLinkObject(LinkHandle, LinkTarget, ReturnedLength)
|
||||
|
||||
* NtQuerySystemInformation::
|
||||
|
||||
NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter)
|
||||
@@ -263,6 +583,22 @@ Functions:
|
||||
|
||||
NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None)
|
||||
|
||||
* NtWow64WriteVirtualMemory64::
|
||||
|
||||
NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten=None)
|
||||
|
||||
* OpenEventA::
|
||||
|
||||
OpenEventA(dwDesiredAccess, bInheritHandle, lpName)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* OpenEventW::
|
||||
|
||||
OpenEventW(dwDesiredAccess, bInheritHandle, lpName)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* OpenProcess::
|
||||
|
||||
OpenProcess(dwDesiredAccess=PROCESS_ALL_ACCESS(0x1f0fffL), bInheritHandle=0, dwProcessId=NeededParameter)
|
||||
@@ -276,6 +612,18 @@ Functions:
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* OpenSCManagerA::
|
||||
|
||||
OpenSCManagerA(lpMachineName=None, lpDatabaseName=None, dwDesiredAccess=SC_MANAGER_ALL_ACCESS(0xf003fL))
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* OpenSCManagerW::
|
||||
|
||||
OpenSCManagerW(lpMachineName=None, lpDatabaseName=None, dwDesiredAccess=SC_MANAGER_ALL_ACCESS(0xf003fL))
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* OpenThread::
|
||||
|
||||
OpenThread(dwDesiredAccess=THREAD_ALL_ACCESS(0x1f03ffL), bInheritHandle=0, dwThreadId=NeededParameter)
|
||||
@@ -285,17 +633,47 @@ Functions:
|
||||
* Process32First::
|
||||
|
||||
Process32First(hSnapshot, lpte)
|
||||
Set byref(lpte) if needed
|
||||
Errcheck:
|
||||
Nothing special
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* Process32Next::
|
||||
|
||||
Process32Next(hSnapshot, lpte)
|
||||
Set byref(lpte) if needed
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* QueryWorkingSetWrapper::
|
||||
|
||||
QueryWorkingSetWrapper(hProcess, pv, cb)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* QueryWorkingSetExWrapper::
|
||||
|
||||
QueryWorkingSetExWrapper(hProcess, pv, cb)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* QueryWorkingSetExWrapper::
|
||||
|
||||
QueryWorkingSetExWrapper(hProcess, pv, cb)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* QueryWorkingSetWrapper::
|
||||
|
||||
QueryWorkingSetWrapper(hProcess, pv, cb)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* ReadProcessMemory::
|
||||
|
||||
ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None)
|
||||
@@ -356,7 +734,7 @@ Functions:
|
||||
Thread32First(hSnapshot, lpte)
|
||||
Set byref(lpte) if needed
|
||||
Errcheck:
|
||||
Nothing special
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* Thread32Next::
|
||||
|
||||
@@ -365,6 +743,18 @@ Functions:
|
||||
Errcheck:
|
||||
Nothing special
|
||||
|
||||
* VerQueryValueA::
|
||||
|
||||
VerQueryValueA(pBlock, lpSubBlock, lplpBuffer, puLen)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* VerQueryValueW::
|
||||
|
||||
VerQueryValueW(pBlock, lpSubBlock, lplpBuffer, puLen)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* VirtualAlloc::
|
||||
|
||||
VirtualAlloc(lpAddress=0, dwSize=NeededParameter, flAllocationType=MEM_COMMIT(0x1000L), flProtect=PAGE_EXECUTE_READWRITE(0x40L))
|
||||
@@ -395,6 +785,12 @@ Functions:
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* VirtualProtectEx::
|
||||
|
||||
VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, lpflOldProtect=None)
|
||||
Errcheck:
|
||||
raise Kernel32Error if result is 0
|
||||
|
||||
* WaitForDebugEvent::
|
||||
|
||||
WaitForDebugEvent(lpDebugEvent, dwMilliseconds=INFINITE(0xffffffffL))
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
import sys
|
||||
import os.path
|
||||
import pprint
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import windows
|
||||
import windows.test
|
||||
import windows.debug
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
import sys
|
||||
import os.path
|
||||
import pprint
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import ctypes
|
||||
import windows
|
||||
import windows.debug
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
import sys
|
||||
import os.path
|
||||
import pprint
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import ctypes
|
||||
import windows
|
||||
import windows.test
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
import sys
|
||||
import os.path
|
||||
import pprint
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import windows
|
||||
import windows.test
|
||||
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
import sys
|
||||
import os.path
|
||||
import socket
|
||||
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import windows
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
import sys
|
||||
import os.path
|
||||
import pprint
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import windows
|
||||
import windows.test
|
||||
|
||||
@@ -7,7 +12,7 @@ python_code = """
|
||||
import windows
|
||||
import ctypes
|
||||
import windows
|
||||
from windows.exception import VectoredException
|
||||
from windows.winobject.exception import VectoredException
|
||||
import windows.generated_def.windef as windef
|
||||
from windows.generated_def.winstructs import *
|
||||
|
||||
|
||||
@@ -1,3 +1,8 @@
|
||||
import sys
|
||||
import os.path
|
||||
import pprint
|
||||
sys.path.append(os.path.abspath(__file__ + "\..\.."))
|
||||
|
||||
import ctypes
|
||||
import windows
|
||||
from windows.winobject.exception import VectoredException
|
||||
|
||||
+8
-8
@@ -439,35 +439,35 @@ class Debugger(object):
|
||||
return DBG_CONTINUE
|
||||
|
||||
def on_create_process(self, create_process):
|
||||
"""Called on create_process event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679286(v=vs.85).aspx)"""
|
||||
"""Called on create_process event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679286(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_exit_process(self, exit_process):
|
||||
"""Called on exit_process event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679334(v=vs.85).aspx)"""
|
||||
"""Called on exit_process event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679334(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_create_thread(self, create_thread):
|
||||
"""Called on create_thread event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679287(v=vs.85).aspx)"""
|
||||
"""Called on create_thread event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679287(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_exit_thread(self, exit_thread):
|
||||
"""Called on exit_thread event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679335(v=vs.85).aspx)"""
|
||||
"""Called on exit_thread event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679335(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_load_dll(self, load_dll):
|
||||
"""Called on load_dll event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680351(v=vs.85).aspx)"""
|
||||
"""Called on load_dll event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680351(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_unload_dll(self, unload_dll):
|
||||
"""Called on unload_dll event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms681403(v=vs.85).aspx)"""
|
||||
"""Called on unload_dll event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms681403(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_output_debug_string(self, debug_string):
|
||||
"""Called on debug_string event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680545(v=vs.85).aspx)"""
|
||||
"""Called on debug_string event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680545(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def on_rip(self, rip_info):
|
||||
"""Called on rip_info event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680587(v=vs.85).aspx)"""
|
||||
"""Called on rip_info event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680587(v=vs.85).aspx)"""
|
||||
pass
|
||||
|
||||
def debug(path, args=None, dwCreationFlags=0, show_windows=False):
|
||||
|
||||
@@ -150,9 +150,11 @@ def check_debug():
|
||||
|
||||
|
||||
def datetime_from_filetime(filetime):
|
||||
"""return a :class:`datetime.datetime` from a ``windows`` FILETIME int"""
|
||||
return datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=filetime / 10)
|
||||
|
||||
def filetime_from_datetime(dtime):
|
||||
"""Return the FILETIME value from a :class:`datetime.datetime` in a python :class:`int`"""
|
||||
return int((dtime - datetime.datetime(1601,1,1)).total_seconds() * 1000) * 10000
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user