diff --git a/TODO b/TODO index 3afde44..8905f95 100644 --- a/TODO +++ b/TODO @@ -1,7 +1,6 @@ TODO: - Documentation - Pass 0.2 when doc is done <3 - - type pass to dbg callback - ProcessMemory object ? (metasm like) @@ -42,17 +41,9 @@ TODO: CHANGELOG: - * NEW REGISTRY -> change examples and documentation - * WinProcess is not a PROCESSENTRY32 anymore (change doc) * re-check every sample Documentation - * Debugger - * LocalDebugger - * windows.com - * New stuff in exception ? - * windows.utils - * verif samples FIXME: diff --git a/doc/source/com.rst b/doc/source/com.rst index 8044eb4..307bcf2 100644 --- a/doc/source/com.rst +++ b/doc/source/com.rst @@ -1,21 +1,43 @@ -COM - Component Object Model -"""""""""""""""""""""""""""" +:mod:`windows.com` - Component Object Model +"""""""""""""""""""""""""""""""""""""""""""" + +.. module:: windows.com A module to call `COM` interfaces from `Python` or `COM` vtable in python. -This code is only used in :mod:`windows.wmi`. +This code is only used in :mod:`windows.winobject.wmi` and :mod:`windows.winobject.network` for the firewall. The ability to create `COM` vtable is used in the `LKD project `_ . -To call a `COM` interface you need to: +Using a COM interface +''''''''''''''''''''' - 1. Describe the `COM` interface `CODE1 `_ - 2. Use an instance (which is a PVOID) to get the interface `CODE2 `_ - 3. Use the object ! `CODE3 `_ +It's possible to directly call `COM` interface from python. All you need is the definition of the `COM` interface. + +There are three ways to get the definition of the code interface: + + * By using it from :mod:`windows.generated_def.interfaces` + * By writing it yourself : `_ + * By generating it. + +To generate a `COM` interface you need its definition from the ".c" file. +Then add thisit to ``PythonForWindows\ctypes_generation\com\MyInterface.txt``. +Finally re-generate the interface using ``generate.py``. + +When you have the `COM` interface defintion you can create an instance of it. +Then you need to retrieve the interface by using an API returning an object or :func:`window.com.create_instance`. +You can then use the instance to call whatever method you need. + +.. note:: + + see sample :ref:`sample_com_firewall` + +Implementing a COM interface +'''''''''''''''''''''''''''' To create `COM` object you need to: - 1. Describe your ComVtable `CODE4 `_ - 2. Implement the python functions described `CODE5 `_ - 3. Create an instance and pass it to whatever native function expects it `CODE6 `_ \ No newline at end of file + 1. Describe your ComVtable `CODE1 `_ + 2. Implement the python functions described `CODE2 `_ + 3. Create an instance and pass it to whatever native function expects it `CODE3 `_ \ No newline at end of file diff --git a/doc/source/index.rst b/doc/source/index.rst index fda44bf..6246398 100644 --- a/doc/source/index.rst +++ b/doc/source/index.rst @@ -19,6 +19,7 @@ Contents: utils.rst wintrust.rst debug.rst + com.rst iat_hook.rst wip.rst internals.rst diff --git a/doc/source/sample.rst b/doc/source/sample.rst index d0a2f4b..ad71782 100644 --- a/doc/source/sample.rst +++ b/doc/source/sample.rst @@ -436,4 +436,29 @@ Ouput:: * {'Caption': u'C:', 'FreeSpace': u'43991547904', 'FileSystem': u'NTFS'} * {'Caption': u'E:', 'FreeSpace': u'82776027136', 'FileSystem': u'NTFS'} * {'Caption': u'F:', 'FreeSpace': u'5711265792', 'FileSystem': u'FAT32'} - * {'Caption': u'G:', 'FreeSpace': None, 'FileSystem': None} \ No newline at end of file + * {'Caption': u'G:', 'FreeSpace': None, 'FileSystem': None} + +.. _sample_com_firewall: + +using COM: ``INetFwPolicy2`` +'''''''''''''''''''''''''''' + +.. literalinclude:: ..\..\samples\com_inetfwpolicy2.py + +Output:: + + (cmd λ) python .\samples\com_inetfwpolicy2.py + Initialisation of COM + Creating INetFwPolicy2 variable + (value = None) + + Generating CLSID + + + Creating COM instance + (value = 0x8984848) + + Checking for enabled profiles + * NET_FW_PROFILE2_DOMAIN(0x1L) -> True + * NET_FW_PROFILE2_PRIVATE(0x2L) -> True + * NET_FW_PROFILE2_PUBLIC(0x4L) -> True \ No newline at end of file diff --git a/doc/source/various.rst b/doc/source/various.rst index b856450..4a9ea92 100644 --- a/doc/source/various.rst +++ b/doc/source/various.rst @@ -15,5 +15,4 @@ This sections describes them by group of relation. network.rst service.rst volume.rst - com.rst wmi.rst \ No newline at end of file diff --git a/doc/source/winproxy.rst b/doc/source/winproxy.rst index af3b6e1..87a68d2 100644 --- a/doc/source/winproxy.rst +++ b/doc/source/winproxy.rst @@ -88,24 +88,42 @@ Transparent proxies: * DebugBreak() * DebugBreakProcess(Process) * DebugSetProcessKillOnExit(KillOnExit) +* EnumWindows(lpEnumFunc, lParam) * ExitProcess(uExitCode) * ExitThread(dwExitCode) * FreeConsole() +* GetComputerNameA(lpBuffer, lpnSize) +* GetComputerNameW(lpBuffer, lpnSize) * GetCurrentProcess() * GetCurrentProcessorNumber() * GetCurrentThread() * GetCurrentThreadId() +* GetDriveTypeA(lpRootPathName) +* GetDriveTypeW(lpRootPathName) * GetExitCodeProcess(hProcess, lpExitCode) * GetExitCodeThread(hThread, lpExitCode) * GetLastError() +* GetLogicalDriveStringsA(nBufferLength, lpBuffer) +* GetLogicalDriveStringsW(nBufferLength, lpBuffer) * GetProcAddress(hModule, lpProcName) * GetProcessId(Process) * GetSidSubAuthority(pSid, nSubAuthority) * GetSidSubAuthorityCount(pSid) * GetStdHandle(nStdHandle) +* GetSystemMetrics(nIndex) * GetThreadId(Thread) +* GetVersionExA(lpVersionInformation) +* GetVersionExW(lpVersionInformation) +* GetVolumeNameForVolumeMountPointA(lpszVolumeMountPoint, lpszVolumeName, cchBufferLength) +* GetVolumeNameForVolumeMountPointW(lpszVolumeMountPoint, lpszVolumeName, cchBufferLength) +* GetWindowModuleFileNameA(hwnd, pszFileName, cchFileNameMax) +* GetWindowModuleFileNameW(hwnd, pszFileName, cchFileNameMax) +* GetWindowTextA(hWnd, lpString, nMaxCount) +* GetWindowTextW(hWnd, lpString, nMaxCount) * LoadLibraryA(lpFileName) * LoadLibraryW(lpFileName) +* QueryDosDeviceA(lpDeviceName, lpTargetPath, ucchMax) +* QueryDosDeviceW(lpDeviceName, lpTargetPath, ucchMax) * ResumeThread(hThread) * SetStdHandle(nStdHandle, hHandle) * SetTcpEntry(pTcpRow) @@ -117,6 +135,8 @@ Transparent proxies: * Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection) * Wow64GetThreadContext(hThread, lpContext) * Wow64RevertWow64FsRedirection(OldValue) +* lstrcmpA(lpString1, lpString2) +* lstrcmpW(lpString1, lpString2) Functions: * AddVectoredContinueHandler:: @@ -137,12 +157,52 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* AlpcGetMessageAttribute:: + + AlpcGetMessageAttribute(Buffer, AttributeFlag) + Errcheck: + Nothing special + +* AlpcInitializeMessageAttribute:: + + AlpcInitializeMessageAttribute(AttributeFlags, Buffer, BufferSize, RequiredBufferSize) + +* CoCreateInstance:: + + CoCreateInstance(rclsid, pUnkOuter=None, dwClsContext=tagCLSCTX.CLSCTX_INPROC_SERVER(0x1L), riid=NeededParameter, ppv=NeededParameter) + Errcheck: + Nothing special + +* CoInitializeEx:: + + CoInitializeEx(pvReserved=None, dwCoInit=tagCOINIT.COINIT_MULTITHREADED(0x0L)) + Errcheck: + Nothing special + +* CoInitializeSecurity:: + + CoInitializeSecurity(pSecDesc, cAuthSvc, asAuthSvc, pReserved1, dwAuthnLevel, dwImpLevel, pAuthList, dwCapabilities, pReserved3) + Errcheck: + Nothing special + * CreateFileA:: CreateFileA(lpFileName, dwDesiredAccess=GENERIC_READ(0x80000000L), dwShareMode=0, lpSecurityAttributes=None, dwCreationDisposition=OPEN_EXISTING(0x3L), dwFlagsAndAttributes=FILE_ATTRIBUTE_NORMAL(0x80L), hTemplateFile=None) Errcheck: raise Kernel32Error if result is NOT 0 +* CreateFileMappingA:: + + CreateFileMappingA(hFile, lpFileMappingAttributes=None, flProtect=PAGE_READWRITE(0x4L), dwMaximumSizeHigh=0, dwMaximumSizeLow=NeededParameter, lpName=NeededParameter) + Errcheck: + raise Kernel32Error if result is 0 + +* CreateFileMappingW:: + + CreateFileMappingW(hFile, lpFileMappingAttributes=None, flProtect=PAGE_READWRITE(0x4L), dwMaximumSizeHigh=0, dwMaximumSizeLow=0, lpName=NeededParameter) + Errcheck: + raise Kernel32Error if result is 0 + * CreateFileW:: CreateFileW(lpFileName, dwDesiredAccess=GENERIC_READ(0x80000000L), dwShareMode=0, lpSecurityAttributes=None, dwCreationDisposition=OPEN_EXISTING(0x3L), dwFlagsAndAttributes=FILE_ATTRIBUTE_NORMAL(0x80L), hTemplateFile=None) @@ -179,27 +239,213 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* CryptCATAdminAcquireContext:: + + CryptCATAdminAcquireContext(phCatAdmin, pgSubsystem, dwFlags) + Errcheck: + raise Kernel32Error if result is 0 + +* CryptCATAdminCalcHashFromFileHandle:: + + CryptCATAdminCalcHashFromFileHandle(hFile, pcbHash, pbHash, dwFlags) + Errcheck: + raise Kernel32Error if result is 0 + +* CryptCATAdminEnumCatalogFromHash:: + + CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo) + Errcheck: + Nothing special + +* CryptCATAdminReleaseCatalogContext:: + + CryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfo, dwFlags) + Errcheck: + Nothing special + +* CryptCATAdminReleaseContext:: + + CryptCATAdminReleaseContext(hCatAdmin, dwFlags) + Errcheck: + Nothing special + +* CryptCATCatalogInfoFromContext:: + + CryptCATCatalogInfoFromContext(hCatInfo, psCatInfo, dwFlags) + Errcheck: + raise Kernel32Error if result is 0 + * DeviceIoControl:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lpOutBuffer=NeededParameter, nOutBufferSize=None, lpBytesReturned=None, lpOverlapped=None) Errcheck: raise Kernel32Error if result is 0 -* GetExtendedTcpTable:: +* DuplicateHandle:: - GetExtendedTcpTable(pTcpTable, pdwSize=None, bOrder=True, ulAf=NeededParameter, TableClass=5, Reserved=0) - Errcheck: - raise IphlpapiError if result is NOT 0 - -* GetMappedFileNameA:: - - GetMappedFileNameA(hProcess, lpv, lpFilename, nSize=None) + DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, lpTargetHandle, dwDesiredAccess=0, bInheritHandle=False, dwOptions=0) Errcheck: raise Kernel32Error if result is 0 -* GetMappedFileNameW:: +* EnumServicesStatusExA:: - GetMappedFileNameW(hProcess, lpv, lpFilename, nSize=None) + EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName) + Errcheck: + raise Kernel32Error if result is 0 + +* EnumServicesStatusExW:: + + EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName) + Errcheck: + raise Kernel32Error if result is 0 + +* GetExtendedTcpTable:: + + GetExtendedTcpTable(pTcpTable, pdwSize=None, bOrder=True, ulAf=NeededParameter, TableClass=_TCP_TABLE_CLASS.TCP_TABLE_OWNER_PID_ALL(0x5L), Reserved=0) + Errcheck: + raise IphlpapiError if result is NOT 0 + +* GetFileVersionInfoA:: + + GetFileVersionInfoA(lptstrFilename, dwHandle=0, dwLen=None, lpData=NeededParameter) + Errcheck: + raise Kernel32Error if result is 0 + +* GetFileVersionInfoSizeA:: + + GetFileVersionInfoSizeA(lptstrFilename, lpdwHandle=None) + Errcheck: + raise Kernel32Error if result is 0 + +* GetFileVersionInfoSizeW:: + + GetFileVersionInfoSizeW(lptstrFilename, lpdwHandle=None) + Errcheck: + raise Kernel32Error if result is 0 + +* GetFileVersionInfoW:: + + GetFileVersionInfoW(lptstrFilename, dwHandle=0, dwLen=None, lpData=NeededParameter) + Errcheck: + raise Kernel32Error if result is 0 + +* GetIfTable:: + + GetIfTable(pIfTable, pdwSize, bOrder=False) + Errcheck: + raise IphlpapiError if result is NOT 0 + +* GetInterfaceInfo:: + + GetInterfaceInfo(pIfTable, dwOutBufLen=None) + Errcheck: + raise IphlpapiError if result is NOT 0 + +* GetIpAddrTable:: + + GetIpAddrTable(pIpAddrTable, pdwSize, bOrder=False) + Errcheck: + raise IphlpapiError if result is NOT 0 + +* GetMappedFileNameAWrapper:: + + GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetMappedFileNameAWrapper:: + + GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetMappedFileNameWWrapper:: + + GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetMappedFileNameWWrapper:: + + GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetModuleBaseNameAWrapper:: + + GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetModuleBaseNameAWrapper:: + + GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetModuleBaseNameWWrapper:: + + GetModuleBaseNameWWrapper(hProcess, hModule, lpBaseName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetModuleBaseNameWWrapper:: + + GetModuleBaseNameWWrapper(hProcess, hModule, lpBaseName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetProcessImageFileNameAWrapper:: + + GetProcessImageFileNameAWrapper(hProcess, lpImageFileName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetProcessImageFileNameAWrapper:: + + GetProcessImageFileNameAWrapper(hProcess, lpImageFileName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetProcessImageFileNameWWrapper:: + + GetProcessImageFileNameWWrapper(hProcess, lpImageFileName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetProcessImageFileNameWWrapper:: + + GetProcessImageFileNameWWrapper(hProcess, lpImageFileName, nSize=None) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* GetProcessTimes:: + + GetProcessTimes(hProcess, lpCreationTime, lpExitTime, lpKernelTime, lpUserTime) Errcheck: raise Kernel32Error if result is 0 @@ -215,10 +461,34 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* GetVolumeInformationA:: + + GetVolumeInformationA(lpRootPathName, lpVolumeNameBuffer, nVolumeNameSize, lpVolumeSerialNumber, lpMaximumComponentLength, lpFileSystemFlags, lpFileSystemNameBuffer, nFileSystemNameSize) + Errcheck: + raise Kernel32Error if result is 0 + +* GetVolumeInformationW:: + + GetVolumeInformationW(lpRootPathName, lpVolumeNameBuffer=None, nVolumeNameSize=0, lpVolumeSerialNumber=None, lpMaximumComponentLength=None, lpFileSystemFlags=None, lpFileSystemNameBuffer=None, nFileSystemNameSize=0) + Errcheck: + raise Kernel32Error if result is 0 + * LdrLoadDll:: LdrLoadDll(PathToFile, Flags, ModuleFileName, ModuleHandle) +* LookupAccountSidA:: + + LookupAccountSidA(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainName, cchReferencedDomainName, peUse) + Errcheck: + raise Kernel32Error if result is 0 + +* LookupAccountSidW:: + + LookupAccountSidW(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainName, cchReferencedDomainName, peUse) + Errcheck: + raise Kernel32Error if result is 0 + * LookupPrivilegeValueA:: LookupPrivilegeValueA(lpSystemName=None, lpName=NeededParameter, lpLuid=NeededParameter) @@ -231,6 +501,28 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* MapViewOfFile:: + + MapViewOfFile(hFileMappingObject, dwDesiredAccess=FILE_MAP_ALL_ACCESS(0xf001fL), dwFileOffsetHigh=0, dwFileOffsetLow=0, dwNumberOfBytesToMap=NeededParameter) + Errcheck: + raise Kernel32Error if result is 0 + +* NtAlpcAcceptConnectPort:: + + NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection) + +* NtAlpcConnectPort:: + + NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout) + +* NtAlpcCreatePort:: + + NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes) + +* NtAlpcSendWaitReceivePort:: + + NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout) + * NtCreateThreadEx:: NtCreateThreadEx(ThreadHandle=None, DesiredAccess=2097151, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0) @@ -239,6 +531,26 @@ Functions: NtGetContextThread(hThread, lpContext) +* NtOpenDirectoryObject:: + + NtOpenDirectoryObject(DirectoryHandle, DesiredAccess, ObjectAttributes) + +* NtOpenEvent:: + + NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes) + +* NtOpenSymbolicLinkObject:: + + NtOpenSymbolicLinkObject(LinkHandle, DesiredAccess, ObjectAttributes) + +* NtProtectVirtualMemory:: + + NtProtectVirtualMemory(ProcessHandle, BaseAddress, NumberOfBytesToProtect, NewAccessProtection, OldAccessProtection=None) + +* NtQueryDirectoryObject:: + + NtQueryDirectoryObject(DirectoryHandle, Buffer, Length, ReturnSingleEntry, RestartScan, Context, ReturnLength) + * NtQueryInformationProcess:: NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength=0, ReturnLength=None) @@ -247,6 +559,14 @@ Functions: NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength=0, ReturnLength=None) +* NtQueryObject:: + + NtQueryObject(Handle, ObjectInformationClass, ObjectInformation=None, ObjectInformationLength=0, ReturnLength=NeededParameter) + +* NtQuerySymbolicLinkObject:: + + NtQuerySymbolicLinkObject(LinkHandle, LinkTarget, ReturnedLength) + * NtQuerySystemInformation:: NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter) @@ -263,6 +583,22 @@ Functions: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None) +* NtWow64WriteVirtualMemory64:: + + NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten=None) + +* OpenEventA:: + + OpenEventA(dwDesiredAccess, bInheritHandle, lpName) + Errcheck: + raise Kernel32Error if result is 0 + +* OpenEventW:: + + OpenEventW(dwDesiredAccess, bInheritHandle, lpName) + Errcheck: + raise Kernel32Error if result is 0 + * OpenProcess:: OpenProcess(dwDesiredAccess=PROCESS_ALL_ACCESS(0x1f0fffL), bInheritHandle=0, dwProcessId=NeededParameter) @@ -276,6 +612,18 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* OpenSCManagerA:: + + OpenSCManagerA(lpMachineName=None, lpDatabaseName=None, dwDesiredAccess=SC_MANAGER_ALL_ACCESS(0xf003fL)) + Errcheck: + raise Kernel32Error if result is 0 + +* OpenSCManagerW:: + + OpenSCManagerW(lpMachineName=None, lpDatabaseName=None, dwDesiredAccess=SC_MANAGER_ALL_ACCESS(0xf003fL)) + Errcheck: + raise Kernel32Error if result is 0 + * OpenThread:: OpenThread(dwDesiredAccess=THREAD_ALL_ACCESS(0x1f03ffL), bInheritHandle=0, dwThreadId=NeededParameter) @@ -285,17 +633,47 @@ Functions: * Process32First:: Process32First(hSnapshot, lpte) - Set byref(lpte) if needed Errcheck: - Nothing special + raise Kernel32Error if result is 0 * Process32Next:: Process32Next(hSnapshot, lpte) - Set byref(lpte) if needed Errcheck: Nothing special +* QueryWorkingSetWrapper:: + + QueryWorkingSetWrapper(hProcess, pv, cb) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* QueryWorkingSetExWrapper:: + + QueryWorkingSetExWrapper(hProcess, pv, cb) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* QueryWorkingSetExWrapper:: + + QueryWorkingSetExWrapper(hProcess, pv, cb) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + +* QueryWorkingSetWrapper:: + + QueryWorkingSetWrapper(hProcess, pv, cb) + Errcheck: + raise Kernel32Error if result is 0 + Errcheck: + raise Kernel32Error if result is 0 + * ReadProcessMemory:: ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None) @@ -356,7 +734,7 @@ Functions: Thread32First(hSnapshot, lpte) Set byref(lpte) if needed Errcheck: - Nothing special + raise Kernel32Error if result is 0 * Thread32Next:: @@ -365,6 +743,18 @@ Functions: Errcheck: Nothing special +* VerQueryValueA:: + + VerQueryValueA(pBlock, lpSubBlock, lplpBuffer, puLen) + Errcheck: + raise Kernel32Error if result is 0 + +* VerQueryValueW:: + + VerQueryValueW(pBlock, lpSubBlock, lplpBuffer, puLen) + Errcheck: + raise Kernel32Error if result is 0 + * VirtualAlloc:: VirtualAlloc(lpAddress=0, dwSize=NeededParameter, flAllocationType=MEM_COMMIT(0x1000L), flProtect=PAGE_EXECUTE_READWRITE(0x40L)) @@ -395,6 +785,12 @@ Functions: Errcheck: raise Kernel32Error if result is 0 +* VirtualProtectEx:: + + VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect, lpflOldProtect=None) + Errcheck: + raise Kernel32Error if result is 0 + * WaitForDebugEvent:: WaitForDebugEvent(lpDebugEvent, dwMilliseconds=INFINITE(0xffffffffL)) diff --git a/samples/debugger.py b/samples/debugger.py index 9ea288a..05572bf 100644 --- a/samples/debugger.py +++ b/samples/debugger.py @@ -1,3 +1,8 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + import windows import windows.test import windows.debug diff --git a/samples/local_debugger.py b/samples/local_debugger.py index d2911a2..aa7f415 100644 --- a/samples/local_debugger.py +++ b/samples/local_debugger.py @@ -1,3 +1,8 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + import ctypes import windows import windows.debug diff --git a/samples/local_debugger_remote_process.py b/samples/local_debugger_remote_process.py index 1b735b1..42c5432 100644 --- a/samples/local_debugger_remote_process.py +++ b/samples/local_debugger_remote_process.py @@ -1,3 +1,8 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + import ctypes import windows import windows.test diff --git a/samples/native_utils.py b/samples/native_utils.py index d7e2826..a736428 100644 --- a/samples/native_utils.py +++ b/samples/native_utils.py @@ -1,3 +1,8 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + import windows import windows.test diff --git a/samples/network.py b/samples/network.py index 5eeab44..75290d0 100644 --- a/samples/network.py +++ b/samples/network.py @@ -1,7 +1,6 @@ import sys import os.path import socket - sys.path.append(os.path.abspath(__file__ + "\..\..")) import windows diff --git a/samples/remote_veh_segv.py b/samples/remote_veh_segv.py index 07316a9..600399e 100644 --- a/samples/remote_veh_segv.py +++ b/samples/remote_veh_segv.py @@ -1,3 +1,8 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + import windows import windows.test @@ -7,7 +12,7 @@ python_code = """ import windows import ctypes import windows -from windows.exception import VectoredException +from windows.winobject.exception import VectoredException import windows.generated_def.windef as windef from windows.generated_def.winstructs import * diff --git a/samples/veh_segv.py b/samples/veh_segv.py index 0211a7a..cc01d41 100644 --- a/samples/veh_segv.py +++ b/samples/veh_segv.py @@ -1,3 +1,8 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + import ctypes import windows from windows.winobject.exception import VectoredException diff --git a/windows/debug.py b/windows/debug.py index b5bd1a7..3380c58 100644 --- a/windows/debug.py +++ b/windows/debug.py @@ -439,35 +439,35 @@ class Debugger(object): return DBG_CONTINUE def on_create_process(self, create_process): - """Called on create_process event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679286(v=vs.85).aspx)""" + """Called on create_process event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679286(v=vs.85).aspx)""" pass def on_exit_process(self, exit_process): - """Called on exit_process event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679334(v=vs.85).aspx)""" + """Called on exit_process event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679334(v=vs.85).aspx)""" pass def on_create_thread(self, create_thread): - """Called on create_thread event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679287(v=vs.85).aspx)""" + """Called on create_thread event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679287(v=vs.85).aspx)""" pass def on_exit_thread(self, exit_thread): - """Called on exit_thread event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679335(v=vs.85).aspx)""" + """Called on exit_thread event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679335(v=vs.85).aspx)""" pass def on_load_dll(self, load_dll): - """Called on load_dll event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680351(v=vs.85).aspx)""" + """Called on load_dll event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680351(v=vs.85).aspx)""" pass def on_unload_dll(self, unload_dll): - """Called on unload_dll event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms681403(v=vs.85).aspx)""" + """Called on unload_dll event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms681403(v=vs.85).aspx)""" pass def on_output_debug_string(self, debug_string): - """Called on debug_string event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680545(v=vs.85).aspx)""" + """Called on debug_string event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680545(v=vs.85).aspx)""" pass def on_rip(self, rip_info): - """Called on rip_info event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680587(v=vs.85).aspx)""" + """Called on rip_info event (for param type see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680587(v=vs.85).aspx)""" pass def debug(path, args=None, dwCreationFlags=0, show_windows=False): diff --git a/windows/utils/winutils.py b/windows/utils/winutils.py index ca8f488..80feef1 100644 --- a/windows/utils/winutils.py +++ b/windows/utils/winutils.py @@ -150,9 +150,11 @@ def check_debug(): def datetime_from_filetime(filetime): + """return a :class:`datetime.datetime` from a ``windows`` FILETIME int""" return datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=filetime / 10) def filetime_from_datetime(dtime): + """Return the FILETIME value from a :class:`datetime.datetime` in a python :class:`int`""" return int((dtime - datetime.datetime(1601,1,1)).total_seconds() * 1000) * 10000