Fix ntdll-registry winproxy error check + add LocalDebugger.current_thread to match Debugger API

This commit is contained in:
hakril
2018-06-05 21:53:35 +02:00
parent b223ed233e
commit 3dcd27a1ca
4 changed files with 230 additions and 209 deletions
+29 -9
View File
@@ -9,6 +9,23 @@ from windows.generated_def import windef
from windows.generated_def.winstructs import *
from .breakpoints import *
class FakeDebuggerCurrentThread(object):
"""A pseudo thread representing the current thread at exception time"""
def __init__(self, dbg):
self.dbg = dbg
@property
def tid(self):
return windows.current_thread.tid
@property
def context(self):
"""!!! This context in-place modification will be effective without set_context"""
return self.dbg.get_exception_context()
def set_context(self, context):
# The context returned by 'self.context' already modify the return context in place..
pass
class LocalDebugger(object):
"""A debugger interface around :func:`AddVectoredExceptionHandler`.
@@ -16,7 +33,8 @@ class LocalDebugger(object):
Handle:
* Standard BP (int3)
* Hardware-Exec BP (DrX)"""
* Hardware-Exec BP (DrX)
"""
def __init__(self):
self.breakpoints = {}
@@ -33,6 +51,7 @@ class LocalDebugger(object):
self.current_exception = None
self.exceptions_stack = [None]
self.current_process = windows.current_process
self.current_thread = FakeDebuggerCurrentThread(self)
@contextmanager
def NewCurrentException(self, exc):
@@ -98,7 +117,6 @@ class LocalDebugger(object):
exp_code = self.get_exception_code()
context = self.get_exception_context()
exp_addr = context.pc
if exp_code == EXCEPTION_BREAKPOINT and exp_addr in self.breakpoints:
res = self.breakpoints[exp_addr].trigger(self, exc)
single_step = self.get_exception_context().EEFlags.TF # single step activated by breakpoint
@@ -108,9 +126,9 @@ class LocalDebugger(object):
if exp_code == EXCEPTION_SINGLE_STEP and windows.current_thread.tid in self._reput_breakpoint:
bp, single_step = self._reput_breakpoint[windows.current_thread.tid]
self._memory_save[bp.addr] = windows.current_process.read_memory(bp.addr, 1)
with windows.utils.VirtualProtected(bp.addr, 1, PAGE_EXECUTE_READWRITE):
windows.current_process.write_memory(bp.addr, "\xcc")
self._memory_save[bp._addr] = windows.current_process.read_memory(bp._addr, 1)
with windows.utils.VirtualProtected(bp._addr, 1, PAGE_EXECUTE_READWRITE):
windows.current_process.write_memory(bp._addr, "\xcc")
del self._reput_breakpoint[windows.current_thread.tid]
if single_step:
return self.on_exception(exc)
@@ -127,8 +145,9 @@ class LocalDebugger(object):
return windef.EXCEPTION_CONTINUE_SEARCH
return windef.EXCEPTION_CONTINUE_EXECUTION
def del_bp(self, bp):
def del_bp(self, bp, targets=None):
"""Delete a breakpoint"""
# TODO: check targets..
if bp.type == STANDARD_BP:
with windows.utils.VirtualProtected(bp.addr, 1, PAGE_EXECUTE_READWRITE):
windows.current_process.write_memory(bp.addr, self._memory_save[bp.addr])
@@ -147,7 +166,7 @@ class LocalDebugger(object):
return
raise NotImplementedError("Unknow BP type {0}".format(bp.type))
def add_bp(self, bp, targets=None):
def add_bp(self, bp, target=None):
"""Add a breakpoint, bp is a "class:`Breakpoint`
If the ``bp`` type is ``STANDARD_BP``, target must be None.
@@ -155,12 +174,13 @@ class LocalDebugger(object):
If the ``bp`` type is ``HARDWARE_EXEC_BP``, target can be None (all threads), or some threads of the process
"""
if bp.type == HARDWARE_EXEC_BP:
return self.add_bp_hxbp(bp, targets)
return self.add_bp_hxbp(bp, target)
if bp.type != STANDARD_BP:
raise NotImplementedError("Unknow BP type {0}".format(bp.type))
if targets is not None:
if target not in [None, windows.current_process]:
raise ValueError("LocalDebugger: STANDARD_BP doest not support targets {0}".format(targets))
addr = self._local_resolve(bp.addr)
bp._addr = addr
self.breakpoints[addr] = bp
self._memory_save[addr] = windows.current_process.read_memory(addr, 1)
with windows.utils.VirtualProtected(addr, 1, PAGE_EXECUTE_READWRITE):
+60 -60
View File
@@ -100,6 +100,66 @@ NtAlpcDeleteSecurityContextParams = ((1, 'PortHandle'), (1, 'Flags'), (1, 'Conte
NtAlpcRevokeSecurityContextPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG, ALPC_HANDLE)
NtAlpcRevokeSecurityContextParams = ((1, 'PortHandle'), (1, 'Flags'), (1, 'ContextHandle'))
#def CreateFileTransactedA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter):
# return CreateFileTransactedA.ctypes_function(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter)
CreateFileTransactedAPrototype = WINFUNCTYPE(HANDLE, LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE, HANDLE, PUSHORT, PVOID)
CreateFileTransactedAParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode'), (1, 'lpSecurityAttributes'), (1, 'dwCreationDisposition'), (1, 'dwFlagsAndAttributes'), (1, 'hTemplateFile'), (1, 'hTransaction'), (1, 'pusMiniVersion'), (1, 'pExtendedParameter'))
#def CreateFileTransactedW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter):
# return CreateFileTransactedW.ctypes_function(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter)
CreateFileTransactedWPrototype = WINFUNCTYPE(HANDLE, LPWSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE, HANDLE, PUSHORT, PVOID)
CreateFileTransactedWParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode'), (1, 'lpSecurityAttributes'), (1, 'dwCreationDisposition'), (1, 'dwFlagsAndAttributes'), (1, 'hTemplateFile'), (1, 'hTransaction'), (1, 'pusMiniVersion'), (1, 'pExtendedParameter'))
#def CommitTransaction(TransactionHandle):
# return CommitTransaction.ctypes_function(TransactionHandle)
CommitTransactionPrototype = WINFUNCTYPE(BOOL, HANDLE)
CommitTransactionParams = ((1, 'TransactionHandle'),)
#def CreateTransaction(lpTransactionAttributes, UOW, CreateOptions, IsolationLevel, IsolationFlags, Timeout, Description):
# return CreateTransaction.ctypes_function(lpTransactionAttributes, UOW, CreateOptions, IsolationLevel, IsolationFlags, Timeout, Description)
CreateTransactionPrototype = WINFUNCTYPE(HANDLE, LPSECURITY_ATTRIBUTES, LPGUID, DWORD, DWORD, DWORD, DWORD, LPWSTR)
CreateTransactionParams = ((1, 'lpTransactionAttributes'), (1, 'UOW'), (1, 'CreateOptions'), (1, 'IsolationLevel'), (1, 'IsolationFlags'), (1, 'Timeout'), (1, 'Description'))
#def RollbackTransaction(TransactionHandle):
# return RollbackTransaction.ctypes_function(TransactionHandle)
RollbackTransactionPrototype = WINFUNCTYPE(BOOL, HANDLE)
RollbackTransactionParams = ((1, 'TransactionHandle'),)
#def OpenTransaction(dwDesiredAccess, TransactionId):
# return OpenTransaction.ctypes_function(dwDesiredAccess, TransactionId)
OpenTransactionPrototype = WINFUNCTYPE(HANDLE, DWORD, LPGUID)
OpenTransactionParams = ((1, 'dwDesiredAccess'), (1, 'TransactionId'))
#def CoInitializeEx(pvReserved, dwCoInit):
# return CoInitializeEx.ctypes_function(pvReserved, dwCoInit)
CoInitializeExPrototype = WINFUNCTYPE(HRESULT, LPVOID, DWORD)
CoInitializeExParams = ((1, 'pvReserved'), (1, 'dwCoInit'))
#def CoInitializeSecurity(pSecDesc, cAuthSvc, asAuthSvc, pReserved1, dwAuthnLevel, dwImpLevel, pAuthList, dwCapabilities, pReserved3):
# return CoInitializeSecurity.ctypes_function(pSecDesc, cAuthSvc, asAuthSvc, pReserved1, dwAuthnLevel, dwImpLevel, pAuthList, dwCapabilities, pReserved3)
CoInitializeSecurityPrototype = WINFUNCTYPE(HRESULT, PSECURITY_DESCRIPTOR, LONG, POINTER(SOLE_AUTHENTICATION_SERVICE), PVOID, DWORD, DWORD, PVOID, DWORD, PVOID)
CoInitializeSecurityParams = ((1, 'pSecDesc'), (1, 'cAuthSvc'), (1, 'asAuthSvc'), (1, 'pReserved1'), (1, 'dwAuthnLevel'), (1, 'dwImpLevel'), (1, 'pAuthList'), (1, 'dwCapabilities'), (1, 'pReserved3'))
#def CoCreateInstance(rclsid, pUnkOuter, dwClsContext, riid, ppv):
# return CoCreateInstance.ctypes_function(rclsid, pUnkOuter, dwClsContext, riid, ppv)
CoCreateInstancePrototype = WINFUNCTYPE(HRESULT, REFCLSID, LPUNKNOWN, DWORD, REFIID, POINTER(LPVOID))
CoCreateInstanceParams = ((1, 'rclsid'), (1, 'pUnkOuter'), (1, 'dwClsContext'), (1, 'riid'), (1, 'ppv'))
#def CoCreateInstanceEx(rclsid, punkOuter, dwClsCtx, pServerInfo, dwCount, pResults):
# return CoCreateInstanceEx.ctypes_function(rclsid, punkOuter, dwClsCtx, pServerInfo, dwCount, pResults)
CoCreateInstanceExPrototype = WINFUNCTYPE(HRESULT, REFCLSID, POINTER(IUnknown), DWORD, POINTER(COSERVERINFO), DWORD, POINTER(MULTI_QI))
CoCreateInstanceExParams = ((1, 'rclsid'), (1, 'punkOuter'), (1, 'dwClsCtx'), (1, 'pServerInfo'), (1, 'dwCount'), (1, 'pResults'))
#def CoGetInterceptor(iidIntercepted, punkOuter, iid, ppv):
# return CoGetInterceptor.ctypes_function(iidIntercepted, punkOuter, iid, ppv)
CoGetInterceptorPrototype = WINFUNCTYPE(HRESULT, REFIID, POINTER(IUnknown), REFIID, POINTER(PVOID))
CoGetInterceptorParams = ((1, 'iidIntercepted'), (1, 'punkOuter'), (1, 'iid'), (1, 'ppv'))
#def TpCallbackSendAlpcMessageOnCompletion(TpHandle, PortHandle, Flags, SendMessage):
# return TpCallbackSendAlpcMessageOnCompletion.ctypes_function(TpHandle, PortHandle, Flags, SendMessage)
TpCallbackSendAlpcMessageOnCompletionPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, ULONG, PPORT_MESSAGE)
TpCallbackSendAlpcMessageOnCompletionParams = ((1, 'TpHandle'), (1, 'PortHandle'), (1, 'Flags'), (1, 'SendMessage'))
#def CryptCATAdminCalcHashFromFileHandle(hFile, pcbHash, pbHash, dwFlags):
# return CryptCATAdminCalcHashFromFileHandle.ctypes_function(hFile, pcbHash, pbHash, dwFlags)
CryptCATAdminCalcHashFromFileHandlePrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(DWORD), POINTER(BYTE), DWORD)
@@ -350,66 +410,6 @@ CryptMsgVerifyCountersignatureEncodedExParams = ((1, 'hCryptProv'), (1, 'dwEncod
CryptHashCertificatePrototype = WINFUNCTYPE(BOOL, HCRYPTPROV_LEGACY, ALG_ID, DWORD, POINTER(BYTE), DWORD, POINTER(BYTE), POINTER(DWORD))
CryptHashCertificateParams = ((1, 'hCryptProv'), (1, 'Algid'), (1, 'dwFlags'), (1, 'pbEncoded'), (1, 'cbEncoded'), (1, 'pbComputedHash'), (1, 'pcbComputedHash'))
#def CreateFileTransactedA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter):
# return CreateFileTransactedA.ctypes_function(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter)
CreateFileTransactedAPrototype = WINFUNCTYPE(HANDLE, LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE, HANDLE, PUSHORT, PVOID)
CreateFileTransactedAParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode'), (1, 'lpSecurityAttributes'), (1, 'dwCreationDisposition'), (1, 'dwFlagsAndAttributes'), (1, 'hTemplateFile'), (1, 'hTransaction'), (1, 'pusMiniVersion'), (1, 'pExtendedParameter'))
#def CreateFileTransactedW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter):
# return CreateFileTransactedW.ctypes_function(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, hTransaction, pusMiniVersion, pExtendedParameter)
CreateFileTransactedWPrototype = WINFUNCTYPE(HANDLE, LPWSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE, HANDLE, PUSHORT, PVOID)
CreateFileTransactedWParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode'), (1, 'lpSecurityAttributes'), (1, 'dwCreationDisposition'), (1, 'dwFlagsAndAttributes'), (1, 'hTemplateFile'), (1, 'hTransaction'), (1, 'pusMiniVersion'), (1, 'pExtendedParameter'))
#def CommitTransaction(TransactionHandle):
# return CommitTransaction.ctypes_function(TransactionHandle)
CommitTransactionPrototype = WINFUNCTYPE(BOOL, HANDLE)
CommitTransactionParams = ((1, 'TransactionHandle'),)
#def CreateTransaction(lpTransactionAttributes, UOW, CreateOptions, IsolationLevel, IsolationFlags, Timeout, Description):
# return CreateTransaction.ctypes_function(lpTransactionAttributes, UOW, CreateOptions, IsolationLevel, IsolationFlags, Timeout, Description)
CreateTransactionPrototype = WINFUNCTYPE(HANDLE, LPSECURITY_ATTRIBUTES, LPGUID, DWORD, DWORD, DWORD, DWORD, LPWSTR)
CreateTransactionParams = ((1, 'lpTransactionAttributes'), (1, 'UOW'), (1, 'CreateOptions'), (1, 'IsolationLevel'), (1, 'IsolationFlags'), (1, 'Timeout'), (1, 'Description'))
#def RollbackTransaction(TransactionHandle):
# return RollbackTransaction.ctypes_function(TransactionHandle)
RollbackTransactionPrototype = WINFUNCTYPE(BOOL, HANDLE)
RollbackTransactionParams = ((1, 'TransactionHandle'),)
#def OpenTransaction(dwDesiredAccess, TransactionId):
# return OpenTransaction.ctypes_function(dwDesiredAccess, TransactionId)
OpenTransactionPrototype = WINFUNCTYPE(HANDLE, DWORD, LPGUID)
OpenTransactionParams = ((1, 'dwDesiredAccess'), (1, 'TransactionId'))
#def CoInitializeEx(pvReserved, dwCoInit):
# return CoInitializeEx.ctypes_function(pvReserved, dwCoInit)
CoInitializeExPrototype = WINFUNCTYPE(HRESULT, LPVOID, DWORD)
CoInitializeExParams = ((1, 'pvReserved'), (1, 'dwCoInit'))
#def CoInitializeSecurity(pSecDesc, cAuthSvc, asAuthSvc, pReserved1, dwAuthnLevel, dwImpLevel, pAuthList, dwCapabilities, pReserved3):
# return CoInitializeSecurity.ctypes_function(pSecDesc, cAuthSvc, asAuthSvc, pReserved1, dwAuthnLevel, dwImpLevel, pAuthList, dwCapabilities, pReserved3)
CoInitializeSecurityPrototype = WINFUNCTYPE(HRESULT, PSECURITY_DESCRIPTOR, LONG, POINTER(SOLE_AUTHENTICATION_SERVICE), PVOID, DWORD, DWORD, PVOID, DWORD, PVOID)
CoInitializeSecurityParams = ((1, 'pSecDesc'), (1, 'cAuthSvc'), (1, 'asAuthSvc'), (1, 'pReserved1'), (1, 'dwAuthnLevel'), (1, 'dwImpLevel'), (1, 'pAuthList'), (1, 'dwCapabilities'), (1, 'pReserved3'))
#def CoCreateInstance(rclsid, pUnkOuter, dwClsContext, riid, ppv):
# return CoCreateInstance.ctypes_function(rclsid, pUnkOuter, dwClsContext, riid, ppv)
CoCreateInstancePrototype = WINFUNCTYPE(HRESULT, REFCLSID, LPUNKNOWN, DWORD, REFIID, POINTER(LPVOID))
CoCreateInstanceParams = ((1, 'rclsid'), (1, 'pUnkOuter'), (1, 'dwClsContext'), (1, 'riid'), (1, 'ppv'))
#def CoCreateInstanceEx(rclsid, punkOuter, dwClsCtx, pServerInfo, dwCount, pResults):
# return CoCreateInstanceEx.ctypes_function(rclsid, punkOuter, dwClsCtx, pServerInfo, dwCount, pResults)
CoCreateInstanceExPrototype = WINFUNCTYPE(HRESULT, REFCLSID, POINTER(IUnknown), DWORD, POINTER(COSERVERINFO), DWORD, POINTER(MULTI_QI))
CoCreateInstanceExParams = ((1, 'rclsid'), (1, 'punkOuter'), (1, 'dwClsCtx'), (1, 'pServerInfo'), (1, 'dwCount'), (1, 'pResults'))
#def CoGetInterceptor(iidIntercepted, punkOuter, iid, ppv):
# return CoGetInterceptor.ctypes_function(iidIntercepted, punkOuter, iid, ppv)
CoGetInterceptorPrototype = WINFUNCTYPE(HRESULT, REFIID, POINTER(IUnknown), REFIID, POINTER(PVOID))
CoGetInterceptorParams = ((1, 'iidIntercepted'), (1, 'punkOuter'), (1, 'iid'), (1, 'ppv'))
#def TpCallbackSendAlpcMessageOnCompletion(TpHandle, PortHandle, Flags, SendMessage):
# return TpCallbackSendAlpcMessageOnCompletion.ctypes_function(TpHandle, PortHandle, Flags, SendMessage)
TpCallbackSendAlpcMessageOnCompletionPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, ULONG, PPORT_MESSAGE)
TpCallbackSendAlpcMessageOnCompletionParams = ((1, 'TpHandle'), (1, 'PortHandle'), (1, 'Flags'), (1, 'SendMessage'))
#def CreateNamedPipeA(lpName, dwOpenMode, dwPipeMode, nMaxInstances, nOutBufferSize, nInBufferSize, nDefaultTimeOut, lpSecurityAttributes):
# return CreateNamedPipeA.ctypes_function(lpName, dwOpenMode, dwPipeMode, nMaxInstances, nOutBufferSize, nInBufferSize, nDefaultTimeOut, lpSecurityAttributes)
CreateNamedPipeAPrototype = WINFUNCTYPE(HANDLE, LPCSTR, DWORD, DWORD, DWORD, DWORD, DWORD, DWORD, LPSECURITY_ATTRIBUTES)
+134 -134
View File
@@ -470,140 +470,6 @@ class _BG_JOB_TIMES(Structure):
]
BG_JOB_TIMES = _BG_JOB_TIMES
class tagRGBTRIPLE(Structure):
_fields_ = [
("rgbtBlue", BYTE),
("rgbtGreen", BYTE),
("rgbtRed", BYTE),
]
NPRGBTRIPLE = POINTER(tagRGBTRIPLE)
LPRGBTRIPLE = POINTER(tagRGBTRIPLE)
RGBTRIPLE = tagRGBTRIPLE
PRGBTRIPLE = POINTER(tagRGBTRIPLE)
class tagBITMAPFILEHEADER(Structure):
_pack_ = 2
_fields_ = [
("bfType", WORD),
("bfSize", DWORD),
("bfReserved1", WORD),
("bfReserved2", WORD),
("bfOffBits", DWORD),
]
BITMAPFILEHEADER = tagBITMAPFILEHEADER
PBITMAPFILEHEADER = POINTER(tagBITMAPFILEHEADER)
LPBITMAPFILEHEADER = POINTER(tagBITMAPFILEHEADER)
class tagBITMAPCOREHEADER(Structure):
_fields_ = [
("bcSize", DWORD),
("bcWidth", WORD),
("bcHeight", WORD),
("bcPlanes", WORD),
("bcBitCount", WORD),
]
LPBITMAPCOREHEADER = POINTER(tagBITMAPCOREHEADER)
PBITMAPCOREHEADER = POINTER(tagBITMAPCOREHEADER)
BITMAPCOREHEADER = tagBITMAPCOREHEADER
class tagBITMAP(Structure):
_fields_ = [
("bmType", LONG),
("bmWidth", LONG),
("bmHeight", LONG),
("bmWidthBytes", LONG),
("bmPlanes", WORD),
("bmBitsPixel", WORD),
("bmBits", LPVOID),
]
NPBITMAP = POINTER(tagBITMAP)
LPBITMAP = POINTER(tagBITMAP)
PBITMAP = POINTER(tagBITMAP)
BITMAP = tagBITMAP
class tagBITMAPINFOHEADER(Structure):
_fields_ = [
("biSize", DWORD),
("biWidth", LONG),
("biHeight", LONG),
("biPlanes", WORD),
("biBitCount", WORD),
("biCompression", DWORD),
("biSizeImage", DWORD),
("biXPelsPerMeter", LONG),
("biYPelsPerMeter", LONG),
("biClrUsed", DWORD),
("biClrImportant", DWORD),
]
BITMAPINFOHEADER = tagBITMAPINFOHEADER
PBITMAPINFOHEADER = POINTER(tagBITMAPINFOHEADER)
LPBITMAPINFOHEADER = POINTER(tagBITMAPINFOHEADER)
class tagRGBQUAD(Structure):
_fields_ = [
("rgbBlue", BYTE),
("rgbGreen", BYTE),
("rgbRed", BYTE),
("rgbReserved", BYTE),
]
RGBQUAD = tagRGBQUAD
class tagBITMAPINFO(Structure):
_fields_ = [
("bmiHeader", BITMAPINFOHEADER),
("bmiColors", RGBQUAD * 1),
]
LPBITMAPINFO = POINTER(tagBITMAPINFO)
PBITMAPINFO = POINTER(tagBITMAPINFO)
BITMAPINFO = tagBITMAPINFO
class tagBITMAPCOREINFO(Structure):
_fields_ = [
("bmciHeader", BITMAPCOREHEADER),
("bmciColors", RGBTRIPLE * 1),
]
LPBITMAPCOREINFO = POINTER(tagBITMAPCOREINFO)
BITMAPCOREINFO = tagBITMAPCOREINFO
PBITMAPCOREINFO = POINTER(tagBITMAPCOREINFO)
class tagWNDCLASSEXA(Structure):
_fields_ = [
("cbSize", UINT),
("style", UINT),
("lpfnWndProc", WNDPROC),
("cbClsExtra", INT),
("cbWndExtra", INT),
("hInstance", HINSTANCE),
("hIcon", HICON),
("hCursor", HCURSOR),
("hbrBackground", HBRUSH),
("lpszMenuName", LPCSTR),
("lpszClassName", LPCSTR),
("hIconSm", HICON),
]
PWNDCLASSEXA = POINTER(tagWNDCLASSEXA)
LPWNDCLASSEXA = POINTER(tagWNDCLASSEXA)
WNDCLASSEXA = tagWNDCLASSEXA
class tagWNDCLASSEXW(Structure):
_fields_ = [
("cbSize", UINT),
("style", UINT),
("lpfnWndProc", WNDPROC),
("cbClsExtra", INT),
("cbWndExtra", INT),
("hInstance", HINSTANCE),
("hIcon", HICON),
("hCursor", HCURSOR),
("hbrBackground", HBRUSH),
("lpszMenuName", LPWSTR),
("lpszClassName", LPWSTR),
("hIconSm", HICON),
]
WNDCLASSEXW = tagWNDCLASSEXW
LPWNDCLASSEXW = POINTER(tagWNDCLASSEXW)
PWNDCLASSEXW = POINTER(tagWNDCLASSEXW)
FakeFileInformationZero = EnumValue("_FILE_INFORMATION_CLASS", "FakeFileInformationZero", 0x0)
FileDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileDirectoryInformation", 0x1)
FileFullDirectoryInformation = EnumValue("_FILE_INFORMATION_CLASS", "FileFullDirectoryInformation", 0x2)
@@ -813,6 +679,140 @@ class _FILE_ALL_INFORMATION(Structure):
PFILE_ALL_INFORMATION = POINTER(_FILE_ALL_INFORMATION)
FILE_ALL_INFORMATION = _FILE_ALL_INFORMATION
class tagRGBTRIPLE(Structure):
_fields_ = [
("rgbtBlue", BYTE),
("rgbtGreen", BYTE),
("rgbtRed", BYTE),
]
NPRGBTRIPLE = POINTER(tagRGBTRIPLE)
LPRGBTRIPLE = POINTER(tagRGBTRIPLE)
RGBTRIPLE = tagRGBTRIPLE
PRGBTRIPLE = POINTER(tagRGBTRIPLE)
class tagBITMAPFILEHEADER(Structure):
_pack_ = 2
_fields_ = [
("bfType", WORD),
("bfSize", DWORD),
("bfReserved1", WORD),
("bfReserved2", WORD),
("bfOffBits", DWORD),
]
BITMAPFILEHEADER = tagBITMAPFILEHEADER
PBITMAPFILEHEADER = POINTER(tagBITMAPFILEHEADER)
LPBITMAPFILEHEADER = POINTER(tagBITMAPFILEHEADER)
class tagBITMAPCOREHEADER(Structure):
_fields_ = [
("bcSize", DWORD),
("bcWidth", WORD),
("bcHeight", WORD),
("bcPlanes", WORD),
("bcBitCount", WORD),
]
LPBITMAPCOREHEADER = POINTER(tagBITMAPCOREHEADER)
PBITMAPCOREHEADER = POINTER(tagBITMAPCOREHEADER)
BITMAPCOREHEADER = tagBITMAPCOREHEADER
class tagBITMAP(Structure):
_fields_ = [
("bmType", LONG),
("bmWidth", LONG),
("bmHeight", LONG),
("bmWidthBytes", LONG),
("bmPlanes", WORD),
("bmBitsPixel", WORD),
("bmBits", LPVOID),
]
NPBITMAP = POINTER(tagBITMAP)
LPBITMAP = POINTER(tagBITMAP)
PBITMAP = POINTER(tagBITMAP)
BITMAP = tagBITMAP
class tagBITMAPINFOHEADER(Structure):
_fields_ = [
("biSize", DWORD),
("biWidth", LONG),
("biHeight", LONG),
("biPlanes", WORD),
("biBitCount", WORD),
("biCompression", DWORD),
("biSizeImage", DWORD),
("biXPelsPerMeter", LONG),
("biYPelsPerMeter", LONG),
("biClrUsed", DWORD),
("biClrImportant", DWORD),
]
BITMAPINFOHEADER = tagBITMAPINFOHEADER
PBITMAPINFOHEADER = POINTER(tagBITMAPINFOHEADER)
LPBITMAPINFOHEADER = POINTER(tagBITMAPINFOHEADER)
class tagRGBQUAD(Structure):
_fields_ = [
("rgbBlue", BYTE),
("rgbGreen", BYTE),
("rgbRed", BYTE),
("rgbReserved", BYTE),
]
RGBQUAD = tagRGBQUAD
class tagBITMAPINFO(Structure):
_fields_ = [
("bmiHeader", BITMAPINFOHEADER),
("bmiColors", RGBQUAD * 1),
]
LPBITMAPINFO = POINTER(tagBITMAPINFO)
PBITMAPINFO = POINTER(tagBITMAPINFO)
BITMAPINFO = tagBITMAPINFO
class tagBITMAPCOREINFO(Structure):
_fields_ = [
("bmciHeader", BITMAPCOREHEADER),
("bmciColors", RGBTRIPLE * 1),
]
LPBITMAPCOREINFO = POINTER(tagBITMAPCOREINFO)
BITMAPCOREINFO = tagBITMAPCOREINFO
PBITMAPCOREINFO = POINTER(tagBITMAPCOREINFO)
class tagWNDCLASSEXA(Structure):
_fields_ = [
("cbSize", UINT),
("style", UINT),
("lpfnWndProc", WNDPROC),
("cbClsExtra", INT),
("cbWndExtra", INT),
("hInstance", HINSTANCE),
("hIcon", HICON),
("hCursor", HCURSOR),
("hbrBackground", HBRUSH),
("lpszMenuName", LPCSTR),
("lpszClassName", LPCSTR),
("hIconSm", HICON),
]
PWNDCLASSEXA = POINTER(tagWNDCLASSEXA)
LPWNDCLASSEXA = POINTER(tagWNDCLASSEXA)
WNDCLASSEXA = tagWNDCLASSEXA
class tagWNDCLASSEXW(Structure):
_fields_ = [
("cbSize", UINT),
("style", UINT),
("lpfnWndProc", WNDPROC),
("cbClsExtra", INT),
("cbWndExtra", INT),
("hInstance", HINSTANCE),
("hIcon", HICON),
("hCursor", HCURSOR),
("hbrBackground", HBRUSH),
("lpszMenuName", LPWSTR),
("lpszClassName", LPWSTR),
("hIconSm", HICON),
]
WNDCLASSEXW = tagWNDCLASSEXW
LPWNDCLASSEXW = POINTER(tagWNDCLASSEXW)
PWNDCLASSEXW = POINTER(tagWNDCLASSEXW)
class _API_SET_VALUE_ENTRY(Structure):
_fields_ = [
("Flags", ULONG),
+7 -6
View File
@@ -194,7 +194,8 @@ class IphlpapiProxy(ApiProxy):
class NtdllProxy(ApiProxy):
APIDLL = "ntdll"
default_error_check = staticmethod(should_return_zero_check)
default_error_check = staticmethod(should_return_zero_check) # Setup to: error_ntstatus ?
class WinTrustProxy(ApiProxy):
APIDLL = "wintrust"
@@ -1146,23 +1147,23 @@ def TpCallbackSendAlpcMessageOnCompletion(TpHandle, PortHandle, Flags, SendMessa
# low level registry
@NtdllProxy("NtOpenKey")
@NtdllProxy("NtOpenKey", error_ntstatus)
def NtOpenKey(KeyHandle, DesiredAccess, ObjectAttributes):
return NtOpenKey.ctypes_function(KeyHandle, DesiredAccess, ObjectAttributes)
@NtdllProxy("NtCreateKey")
@NtdllProxy("NtCreateKey", error_ntstatus)
def NtCreateKey(pKeyHandle, DesiredAccess, ObjectAttributes, TitleIndex, Class, CreateOptions, Disposition):
return NtCreateKey.ctypes_function(pKeyHandle, DesiredAccess, ObjectAttributes, TitleIndex, Class, CreateOptions, Disposition)
@NtdllProxy("NtSetValueKey")
@NtdllProxy("NtSetValueKey", error_ntstatus)
def NtSetValueKey(KeyHandle, ValueName, TitleIndex, Type, Data, DataSize):
return NtSetValueKey.ctypes_function(KeyHandle, ValueName, TitleIndex, Type, Data, DataSize)
@NtdllProxy("NtQueryValueKey")
@NtdllProxy("NtQueryValueKey", error_ntstatus)
def NtQueryValueKey(KeyHandle, ValueName, KeyValueInformationClass, KeyValueInformation, Length, ResultLength):
return NtQueryValueKey.ctypes_function(KeyHandle, ValueName, KeyValueInformationClass, KeyValueInformation, Length, ResultLength)
@NtdllProxy("NtEnumerateValueKey")
@NtdllProxy("NtEnumerateValueKey", error_ntstatus)
def NtEnumerateValueKey(KeyHandle, Index, KeyValueInformationClass, KeyValueInformation, Length, ResultLength):
return NtEnumerateValueKey.ctypes_function(KeyHandle, Index, KeyValueInformationClass, KeyValueInformation, Length, ResultLength)