diff --git a/README.md b/README.md index b965ff9..8a7aaab 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ # PythonForWindows -PythonForWindows is a base of code aimed to make interaction with `Windows` (on X86/X64) easier (with both 32 and 64 bits Python). +PythonForWindows is a base of code aimed to make interaction with `Windows` (on X86/X64) easier (for both 32 and 64 bits Python). Its goal is to offer abstractions around some of the OS features in a (I hope) pythonic way. -It also tries to make the barrier between python and native execution thiner in both ways. -There is no external dependencies but it relies heavily on the `ctypes` modules. +It also tries to make the barrier between python and native execution thinner in both ways. +There is no external dependencies but it relies heavily on the `ctypes` module. Some of this code is clean (IMHO) and some parts are just a wreck that works for now. @@ -11,6 +11,8 @@ Let's say that the codebase evolves with my needs and my curiosity. You can find some examples of code in the `samples/` directory. +Parts of PythonForWindows are used in the [LKD project][LKD_GITHUB]. + ## Overview ### Processes / Threads @@ -55,3 +57,5 @@ Some code are just exploration and need improvement like: - Exception - COM + +[LKD_GITHUB]: https://github.com/sogeti-esec-lab/LKD/ \ No newline at end of file diff --git a/doc/source/com.rst b/doc/source/com.rst index d26e9f8..8044eb4 100644 --- a/doc/source/com.rst +++ b/doc/source/com.rst @@ -1,12 +1,21 @@ COM - Component Object Model """""""""""""""""""""""""""" -A module to call ``COM`` interfaces from `Python` or -``COM`` vtable in python. +A module to call `COM` interfaces from `Python` or +`COM` vtable in python. This code is only used in :mod:`windows.wmi`. -The ability to create ``COM`` vtable is used in LKD +The ability to create `COM` vtable is used in the `LKD project `_ . -.. note:: - TODO: link to LKD code \ No newline at end of file +To call a `COM` interface you need to: + + 1. Describe the `COM` interface `CODE1 `_ + 2. Use an instance (which is a PVOID) to get the interface `CODE2 `_ + 3. Use the object ! `CODE3 `_ + +To create `COM` object you need to: + + 1. Describe your ComVtable `CODE4 `_ + 2. Implement the python functions described `CODE5 `_ + 3. Create an instance and pass it to whatever native function expects it `CODE6 `_ \ No newline at end of file diff --git a/doc/source/internals.rst b/doc/source/internals.rst index 24b13c9..7787bb0 100644 --- a/doc/source/internals.rst +++ b/doc/source/internals.rst @@ -68,7 +68,8 @@ To be able to perform those operation we must be able to execute code in the ``6 .. note:: - TODO link to ``Heaven Gate`` + See `Knockin’ on Heaven’s Gate – Dynamic Processor Mode Switching `_ + For that we need to jump to the 64bits segment of our process, execute some code then return. To do so, we need to use some ``far jump`` / ``far ret`` with the segments selector ``0x23`` (CS_32bits) and ``0x33`` (CS_64bits). @@ -120,3 +121,4 @@ Existing function are: .. function:: NtGetContextThread_32_to_64 +.. _heaven_gate: http://rce.co/knockin-on-heavens-gate-dynamic-processor-mode-switching/ \ No newline at end of file