mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Get PEB of other process without injection
This commit is contained in:
Clement Rouault
@@ -30,6 +30,7 @@ else:
|
||||
winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION64
|
||||
|
||||
from . import winfuncs
|
||||
from . import windef
|
||||
|
||||
|
||||
|
||||
|
||||
+16
-3
@@ -7,13 +7,13 @@ if sys.version_info.major == 3:
|
||||
class Flag(long):
|
||||
def __new__(cls, name, value):
|
||||
return super(Flag, cls).__new__(cls, value)
|
||||
|
||||
|
||||
def __init__(self, name, value):
|
||||
self.name = name
|
||||
|
||||
def __repr__(self):
|
||||
return "{0}({1})".format(self.name, hex(self))
|
||||
|
||||
|
||||
__str__ = __repr__
|
||||
|
||||
NULL = Flag("NULL", 0)
|
||||
@@ -475,4 +475,17 @@ ERROR_NOT_ALL_ASSIGNED = Flag("ERROR_NOT_ALL_ASSIGNED", 1300)
|
||||
S_OK = Flag("S_OK", 0)
|
||||
S_FALSE = Flag("S_FALSE", 1)
|
||||
E_NOINTERFACE = Flag("E_NOINTERFACE", 0x80004002)
|
||||
E_FAIL = Flag("E_FAIL", 0x80004005)
|
||||
E_FAIL = Flag("E_FAIL", 0x80004005)
|
||||
DEBUG_EVENT_BREAKPOINT = Flag("DEBUG_EVENT_BREAKPOINT", 0x00000001)
|
||||
DEBUG_EVENT_EXCEPTION = Flag("DEBUG_EVENT_EXCEPTION", 0x00000002)
|
||||
DEBUG_EVENT_CREATE_THREAD = Flag("DEBUG_EVENT_CREATE_THREAD", 0x00000004)
|
||||
DEBUG_EVENT_EXIT_THREAD = Flag("DEBUG_EVENT_EXIT_THREAD", 0x00000008)
|
||||
DEBUG_EVENT_CREATE_PROCESS = Flag("DEBUG_EVENT_CREATE_PROCESS", 0x00000010)
|
||||
DEBUG_EVENT_EXIT_PROCESS = Flag("DEBUG_EVENT_EXIT_PROCESS", 0x00000020)
|
||||
DEBUG_EVENT_LOAD_MODULE = Flag("DEBUG_EVENT_LOAD_MODULE", 0x00000040)
|
||||
DEBUG_EVENT_UNLOAD_MODULE = Flag("DEBUG_EVENT_UNLOAD_MODULE", 0x00000080)
|
||||
DEBUG_EVENT_SYSTEM_ERROR = Flag("DEBUG_EVENT_SYSTEM_ERROR", 0x00000100)
|
||||
DEBUG_EVENT_SESSION_STATUS = Flag("DEBUG_EVENT_SESSION_STATUS", 0x00000200)
|
||||
DEBUG_EVENT_CHANGE_DEBUGGEE_STATE = Flag("DEBUG_EVENT_CHANGE_DEBUGGEE_STATE", 0x00000400)
|
||||
DEBUG_EVENT_CHANGE_ENGINE_STATE = Flag("DEBUG_EVENT_CHANGE_ENGINE_STATE", 0x00000800)
|
||||
DEBUG_EVENT_CHANGE_SYMBOL_STATE = Flag("DEBUG_EVENT_CHANGE_SYMBOL_STATE", 0x00001000)
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'SetConsoleCtrlHandler']
|
||||
|
||||
# ExitProcess(uExitCode):
|
||||
ExitProcessPrototype = WINFUNCTYPE(VOID, UINT)
|
||||
@@ -33,6 +33,14 @@ CreateFileWParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode
|
||||
NtQuerySystemInformationPrototype = WINFUNCTYPE(NTSTATUS, SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG)
|
||||
NtQuerySystemInformationParams = ((1, 'SystemInformationClass'), (1, 'SystemInformation'), (1, 'SystemInformationLength'), (1, 'ReturnLength'))
|
||||
|
||||
# NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength):
|
||||
NtQueryInformationProcessPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG)
|
||||
NtQueryInformationProcessParams = ((1, 'ProcessHandle'), (1, 'ProcessInformationClass'), (1, 'ProcessInformation'), (1, 'ProcessInformationLength'), (1, 'ReturnLength'))
|
||||
|
||||
# NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength):
|
||||
NtQueryVirtualMemoryPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T)
|
||||
NtQueryVirtualMemoryParams = ((1, 'ProcessHandle'), (1, 'BaseAddress'), (1, 'MemoryInformationClass'), (1, 'MemoryInformation'), (1, 'MemoryInformationLength'), (1, 'ReturnLength'))
|
||||
|
||||
# VirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect):
|
||||
VirtualAllocPrototype = WINFUNCTYPE(LPVOID, LPVOID, SIZE_T, DWORD, DWORD)
|
||||
VirtualAllocParams = ((1, 'lpAddress'), (1, 'dwSize'), (1, 'flAllocationType'), (1, 'flProtect'))
|
||||
@@ -57,6 +65,10 @@ VirtualProtectParams = ((1, 'lpAddress'), (1, 'dwSize'), (1, 'flNewProtect'), (1
|
||||
VirtualQueryPrototype = WINFUNCTYPE(DWORD, LPCVOID, PMEMORY_BASIC_INFORMATION, DWORD)
|
||||
VirtualQueryParams = ((1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength'))
|
||||
|
||||
# VirtualQueryEx(hProcess, lpAddress, lpBuffer, dwLength):
|
||||
VirtualQueryExPrototype = WINFUNCTYPE(SIZE_T, HANDLE, LPCVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)
|
||||
VirtualQueryExParams = ((1, 'hProcess'), (1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength'))
|
||||
|
||||
# GetModuleFileNameA(hModule, lpFilename, nSize):
|
||||
GetModuleFileNameAPrototype = WINFUNCTYPE(DWORD, HMODULE, LPSTR, DWORD)
|
||||
GetModuleFileNameAParams = ((1, 'hModule'), (1, 'lpFilename'), (1, 'nSize'))
|
||||
@@ -357,3 +369,7 @@ Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),)
|
||||
Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
|
||||
Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
|
||||
|
||||
# SetConsoleCtrlHandler(HandlerRoutine, Add):
|
||||
SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL)
|
||||
SetConsoleCtrlHandlerParams = ((1, 'HandlerRoutine'), (1, 'Add'))
|
||||
|
||||
|
||||
+538
-2
@@ -5,6 +5,7 @@ from .windef import *
|
||||
|
||||
PWSTR = LPWSTR
|
||||
SIZE_T = c_ulong
|
||||
PSIZE_T = POINTER(SIZE_T)
|
||||
PVOID = c_void_p
|
||||
PPS_POST_PROCESS_INIT_ROUTINE = PVOID
|
||||
NTSTATUS = DWORD
|
||||
@@ -12,6 +13,7 @@ PULONG = POINTER(ULONG)
|
||||
PDWORD = POINTER(DWORD)
|
||||
LPDWORD = POINTER(DWORD)
|
||||
LPTHREAD_START_ROUTINE = PVOID
|
||||
PHANDLER_ROUTINE = PVOID
|
||||
LPBYTE = POINTER(BYTE)
|
||||
ULONG_PTR = PULONG
|
||||
CHAR = c_char
|
||||
@@ -30,11 +32,13 @@ PHKEY = POINTER(HKEY)
|
||||
ACCESS_MASK = DWORD
|
||||
REGSAM = ACCESS_MASK
|
||||
LPCONTEXT = PVOID
|
||||
HCERTSTORE = PVOID
|
||||
HCRYPTMSG = PVOID
|
||||
VOID = DWORD
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO']
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
|
||||
# Enum _SYSTEM_INFORMATION_CLASS definitions
|
||||
_SYSTEM_INFORMATION_CLASS = DWORD
|
||||
@@ -124,6 +128,12 @@ SystemMemoryListInformation = 0x50
|
||||
SystemFileCacheInformationEx = 0x51
|
||||
MaxSystemInfoClass = 0x52
|
||||
|
||||
# Enum _MEMORY_INFORMATION_CLASS definitions
|
||||
_MEMORY_INFORMATION_CLASS = DWORD
|
||||
MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
|
||||
|
||||
MemoryBasicInformation = 0x0
|
||||
|
||||
# Enum _TCP_TABLE_CLASS definitions
|
||||
_TCP_TABLE_CLASS = DWORD
|
||||
TCP_TABLE_CLASS = _TCP_TABLE_CLASS
|
||||
@@ -307,6 +317,13 @@ TI_GET_IS_REFERENCE = 0x1f
|
||||
TI_GET_INDIRECTVIRTUALBASECLASS = 0x20
|
||||
IMAGEHLP_SYMBOL_TYPE_INFO_MAX = 0x21
|
||||
|
||||
# Enum _PROCESSINFOCLASS definitions
|
||||
_PROCESSINFOCLASS = DWORD
|
||||
PROCESSINFOCLASS = _PROCESSINFOCLASS
|
||||
|
||||
ProcessBasicInformation = 0x0
|
||||
ProcessWow64Information = 0x1a
|
||||
|
||||
# Struct _LIST_ENTRY definitions
|
||||
# Self referencing struct tricks
|
||||
class _LIST_ENTRY(Structure): pass
|
||||
@@ -619,6 +636,36 @@ class _MEMORY_BASIC_INFORMATION(Structure):
|
||||
PMEMORY_BASIC_INFORMATION = POINTER(_MEMORY_BASIC_INFORMATION)
|
||||
MEMORY_BASIC_INFORMATION = _MEMORY_BASIC_INFORMATION
|
||||
|
||||
# Struct _MEMORY_BASIC_INFORMATION32 definitions
|
||||
class _MEMORY_BASIC_INFORMATION32(Structure):
|
||||
_fields_ = [
|
||||
("BaseAddress", DWORD),
|
||||
("AllocationBase", DWORD),
|
||||
("AllocationProtect", DWORD),
|
||||
("RegionSize", DWORD),
|
||||
("State", DWORD),
|
||||
("Protect", DWORD),
|
||||
("Type", DWORD),
|
||||
]
|
||||
MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32
|
||||
PMEMORY_BASIC_INFORMATION32 = POINTER(_MEMORY_BASIC_INFORMATION32)
|
||||
|
||||
# Struct _MEMORY_BASIC_INFORMATION64 definitions
|
||||
class _MEMORY_BASIC_INFORMATION64(Structure):
|
||||
_fields_ = [
|
||||
("BaseAddress", ULONGLONG),
|
||||
("AllocationBase", ULONGLONG),
|
||||
("AllocationProtect", DWORD),
|
||||
("__alignment1", DWORD),
|
||||
("RegionSize", ULONGLONG),
|
||||
("State", DWORD),
|
||||
("Protect", DWORD),
|
||||
("Type", DWORD),
|
||||
("__alignment2", DWORD),
|
||||
]
|
||||
PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64)
|
||||
MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64
|
||||
|
||||
# Struct _STARTUPINFOA definitions
|
||||
class _STARTUPINFOA(Structure):
|
||||
_fields_ = [
|
||||
@@ -1087,6 +1134,33 @@ _EXCEPTION_RECORD._fields_ = [
|
||||
PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD)
|
||||
EXCEPTION_RECORD = _EXCEPTION_RECORD
|
||||
|
||||
# Struct _EXCEPTION_RECORD32 definitions
|
||||
class _EXCEPTION_RECORD32(Structure):
|
||||
_fields_ = [
|
||||
("ExceptionCode", DWORD),
|
||||
("ExceptionFlags", DWORD),
|
||||
("ExceptionRecord", DWORD),
|
||||
("ExceptionAddress", DWORD),
|
||||
("NumberParameters", DWORD),
|
||||
("ExceptionInformation", DWORD * EXCEPTION_MAXIMUM_PARAMETERS),
|
||||
]
|
||||
EXCEPTION_RECORD32 = _EXCEPTION_RECORD32
|
||||
PEXCEPTION_RECORD32 = POINTER(_EXCEPTION_RECORD32)
|
||||
|
||||
# Struct _EXCEPTION_RECORD64 definitions
|
||||
class _EXCEPTION_RECORD64(Structure):
|
||||
_fields_ = [
|
||||
("ExceptionCode", DWORD),
|
||||
("ExceptionFlags", DWORD),
|
||||
("ExceptionRecord", DWORD64),
|
||||
("ExceptionAddress", DWORD64),
|
||||
("NumberParameters", DWORD),
|
||||
("__unusedAlignment", DWORD),
|
||||
("ExceptionInformation", DWORD64 * EXCEPTION_MAXIMUM_PARAMETERS),
|
||||
]
|
||||
PEXCEPTION_RECORD64 = POINTER(_EXCEPTION_RECORD64)
|
||||
EXCEPTION_RECORD64 = _EXCEPTION_RECORD64
|
||||
|
||||
# Struct _EXCEPTION_POINTERS64 definitions
|
||||
class _EXCEPTION_POINTERS64(Structure):
|
||||
_fields_ = [
|
||||
@@ -1274,3 +1348,465 @@ class tagSAFEARRAY(Structure):
|
||||
]
|
||||
SAFEARRAY = tagSAFEARRAY
|
||||
|
||||
# Struct _DEBUG_BREAKPOINT_PARAMETERS definitions
|
||||
class _DEBUG_BREAKPOINT_PARAMETERS(Structure):
|
||||
_fields_ = [
|
||||
("Offset", ULONG64),
|
||||
("Id", ULONG),
|
||||
("BreakType", ULONG),
|
||||
("ProcType", ULONG),
|
||||
("Flags", ULONG),
|
||||
("DataSize", ULONG),
|
||||
("DataAccessType", ULONG),
|
||||
("PassCount", ULONG),
|
||||
("CurrentPassCount", ULONG),
|
||||
("MatchThread", ULONG),
|
||||
("CommandSize", ULONG),
|
||||
("OffsetExpressionSize", ULONG),
|
||||
]
|
||||
PDEBUG_BREAKPOINT_PARAMETERS = POINTER(_DEBUG_BREAKPOINT_PARAMETERS)
|
||||
DEBUG_BREAKPOINT_PARAMETERS = _DEBUG_BREAKPOINT_PARAMETERS
|
||||
|
||||
# Struct _DEBUG_REGISTER_DESCRIPTION definitions
|
||||
class _DEBUG_REGISTER_DESCRIPTION(Structure):
|
||||
_fields_ = [
|
||||
("Type", ULONG),
|
||||
("Flags", ULONG),
|
||||
("SubregMaster", ULONG),
|
||||
("SubregLength", ULONG),
|
||||
("SubregMask", ULONG64),
|
||||
("SubregShift", ULONG),
|
||||
("Reserved0", ULONG),
|
||||
]
|
||||
DEBUG_REGISTER_DESCRIPTION = _DEBUG_REGISTER_DESCRIPTION
|
||||
PDEBUG_REGISTER_DESCRIPTION = POINTER(_DEBUG_REGISTER_DESCRIPTION)
|
||||
|
||||
# Struct _DEBUG_STACK_FRAME definitions
|
||||
class _DEBUG_STACK_FRAME(Structure):
|
||||
_fields_ = [
|
||||
("InstructionOffset", ULONG64),
|
||||
("ReturnOffset", ULONG64),
|
||||
("FrameOffset", ULONG64),
|
||||
("StackOffset", ULONG64),
|
||||
("FuncTableEntry", ULONG64),
|
||||
("Params", ULONG64 * 4),
|
||||
("Reserved", ULONG64 * 6),
|
||||
("Virtual", BOOL),
|
||||
("FrameNumber", ULONG),
|
||||
]
|
||||
PDEBUG_STACK_FRAME = POINTER(_DEBUG_STACK_FRAME)
|
||||
DEBUG_STACK_FRAME = _DEBUG_STACK_FRAME
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_BREAKPOINT definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_BREAKPOINT(Structure):
|
||||
_fields_ = [
|
||||
("Id", ULONG),
|
||||
]
|
||||
DEBUG_LAST_EVENT_INFO_BREAKPOINT = _DEBUG_LAST_EVENT_INFO_BREAKPOINT
|
||||
PDEBUG_LAST_EVENT_INFO_BREAKPOINT = POINTER(_DEBUG_LAST_EVENT_INFO_BREAKPOINT)
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_EXCEPTION definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_EXCEPTION(Structure):
|
||||
_fields_ = [
|
||||
("ExceptionRecord", EXCEPTION_RECORD64),
|
||||
("FirstChance", ULONG),
|
||||
]
|
||||
DEBUG_LAST_EVENT_INFO_EXCEPTION = _DEBUG_LAST_EVENT_INFO_EXCEPTION
|
||||
PDEBUG_LAST_EVENT_INFO_EXCEPTION = POINTER(_DEBUG_LAST_EVENT_INFO_EXCEPTION)
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_EXIT_THREAD definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_EXIT_THREAD(Structure):
|
||||
_fields_ = [
|
||||
("ExitCode", ULONG),
|
||||
]
|
||||
PDEBUG_LAST_EVENT_INFO_EXIT_THREAD = POINTER(_DEBUG_LAST_EVENT_INFO_EXIT_THREAD)
|
||||
DEBUG_LAST_EVENT_INFO_EXIT_THREAD = _DEBUG_LAST_EVENT_INFO_EXIT_THREAD
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS(Structure):
|
||||
_fields_ = [
|
||||
("ExitCode", ULONG),
|
||||
]
|
||||
PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS = POINTER(_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS)
|
||||
DEBUG_LAST_EVENT_INFO_EXIT_PROCESS = _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_LOAD_MODULE definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_LOAD_MODULE(Structure):
|
||||
_fields_ = [
|
||||
("Base", ULONG64),
|
||||
]
|
||||
PDEBUG_LAST_EVENT_INFO_LOAD_MODULE = POINTER(_DEBUG_LAST_EVENT_INFO_LOAD_MODULE)
|
||||
DEBUG_LAST_EVENT_INFO_LOAD_MODULE = _DEBUG_LAST_EVENT_INFO_LOAD_MODULE
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE(Structure):
|
||||
_fields_ = [
|
||||
("Base", ULONG64),
|
||||
]
|
||||
PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE = POINTER(_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE)
|
||||
DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE = _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE
|
||||
|
||||
# Struct _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR definitions
|
||||
class _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR(Structure):
|
||||
_fields_ = [
|
||||
("Error", ULONG),
|
||||
("Level", ULONG),
|
||||
]
|
||||
PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR = POINTER(_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR)
|
||||
DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR = _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR
|
||||
|
||||
# Struct _DEBUG_SPECIFIC_FILTER_PARAMETERS definitions
|
||||
class _DEBUG_SPECIFIC_FILTER_PARAMETERS(Structure):
|
||||
_fields_ = [
|
||||
("ExecutionOption", ULONG),
|
||||
("ContinueOption", ULONG),
|
||||
("TextSize", ULONG),
|
||||
("CommandSize", ULONG),
|
||||
("ArgumentSize", ULONG),
|
||||
]
|
||||
DEBUG_SPECIFIC_FILTER_PARAMETERS = _DEBUG_SPECIFIC_FILTER_PARAMETERS
|
||||
PDEBUG_SPECIFIC_FILTER_PARAMETERS = POINTER(_DEBUG_SPECIFIC_FILTER_PARAMETERS)
|
||||
|
||||
# Struct _DEBUG_EXCEPTION_FILTER_PARAMETERS definitions
|
||||
class _DEBUG_EXCEPTION_FILTER_PARAMETERS(Structure):
|
||||
_fields_ = [
|
||||
("ExecutionOption", ULONG),
|
||||
("ContinueOption", ULONG),
|
||||
("TextSize", ULONG),
|
||||
("CommandSize", ULONG),
|
||||
("SecondCommandSize", ULONG),
|
||||
("ExceptionCode", ULONG),
|
||||
]
|
||||
PDEBUG_EXCEPTION_FILTER_PARAMETERS = POINTER(_DEBUG_EXCEPTION_FILTER_PARAMETERS)
|
||||
DEBUG_EXCEPTION_FILTER_PARAMETERS = _DEBUG_EXCEPTION_FILTER_PARAMETERS
|
||||
|
||||
# Struct _GUID definitions
|
||||
class _GUID(Structure):
|
||||
_fields_ = [
|
||||
("Data1", ULONG),
|
||||
("Data2", USHORT),
|
||||
("Data3", USHORT),
|
||||
("Data4", UCHAR * 8),
|
||||
]
|
||||
GUID = _GUID
|
||||
|
||||
# Struct _CRYPTOAPI_BLOB definitions
|
||||
class _CRYPTOAPI_BLOB(Structure):
|
||||
_fields_ = [
|
||||
("cbData", DWORD),
|
||||
("pbData", POINTER(BYTE)),
|
||||
]
|
||||
CRYPT_INTEGER_BLOB = _CRYPTOAPI_BLOB
|
||||
PCRYPT_DATA_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRYPT_OBJID_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRYPT_DER_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRL_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRYPT_UINT_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
CERT_NAME_BLOB = _CRYPTOAPI_BLOB
|
||||
PCRYPT_DIGEST_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRYPT_INTEGER_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
CERT_RDN_VALUE_BLOB = _CRYPTOAPI_BLOB
|
||||
PCERT_NAME_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRYPT_HASH_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
CRYPT_DATA_BLOB = _CRYPTOAPI_BLOB
|
||||
DATA_BLOB = _CRYPTOAPI_BLOB
|
||||
CRYPT_UINT_BLOB = _CRYPTOAPI_BLOB
|
||||
PCERT_RDN_VALUE_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
CRYPT_HASH_BLOB = _CRYPTOAPI_BLOB
|
||||
CRL_BLOB = _CRYPTOAPI_BLOB
|
||||
PCERT_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
CRYPT_DIGEST_BLOB = _CRYPTOAPI_BLOB
|
||||
CRYPT_OBJID_BLOB = _CRYPTOAPI_BLOB
|
||||
CERT_BLOB = _CRYPTOAPI_BLOB
|
||||
CRYPT_DER_BLOB = _CRYPTOAPI_BLOB
|
||||
PDATA_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
PCRYPT_ATTR_BLOB = POINTER(_CRYPTOAPI_BLOB)
|
||||
CRYPT_ATTR_BLOB = _CRYPTOAPI_BLOB
|
||||
|
||||
# Struct WINTRUST_FILE_INFO_ definitions
|
||||
class WINTRUST_FILE_INFO_(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("pcwszFilePath", LPCWSTR),
|
||||
("hFile", HANDLE),
|
||||
("pgKnownSubject", POINTER(GUID)),
|
||||
]
|
||||
WINTRUST_FILE_INFO = WINTRUST_FILE_INFO_
|
||||
PWINTRUST_FILE_INFO = POINTER(WINTRUST_FILE_INFO_)
|
||||
|
||||
# Struct _CRYPT_ATTRIBUTE definitions
|
||||
class _CRYPT_ATTRIBUTE(Structure):
|
||||
_fields_ = [
|
||||
("pszObjId", LPSTR),
|
||||
("cValue", DWORD),
|
||||
("rgValue", PCRYPT_ATTR_BLOB),
|
||||
]
|
||||
PCRYPT_ATTRIBUTE = POINTER(_CRYPT_ATTRIBUTE)
|
||||
CRYPT_ATTRIBUTE = _CRYPT_ATTRIBUTE
|
||||
|
||||
# Struct _CTL_ENTRY definitions
|
||||
class _CTL_ENTRY(Structure):
|
||||
_fields_ = [
|
||||
("SubjectIdentifier", CRYPT_DATA_BLOB),
|
||||
("cAttribute", DWORD),
|
||||
("rgAttribute", PCRYPT_ATTRIBUTE),
|
||||
]
|
||||
PCTL_ENTRY = POINTER(_CTL_ENTRY)
|
||||
CTL_ENTRY = _CTL_ENTRY
|
||||
|
||||
# Struct _CRYPT_ATTRIBUTE definitions
|
||||
class _CRYPT_ATTRIBUTE(Structure):
|
||||
_fields_ = [
|
||||
("pszObjId", LPSTR),
|
||||
("cValue", DWORD),
|
||||
("rgValue", PCRYPT_ATTR_BLOB),
|
||||
]
|
||||
PCRYPT_ATTRIBUTE = POINTER(_CRYPT_ATTRIBUTE)
|
||||
CRYPT_ATTRIBUTE = _CRYPT_ATTRIBUTE
|
||||
|
||||
# Struct _CRYPT_ATTRIBUTES definitions
|
||||
class _CRYPT_ATTRIBUTES(Structure):
|
||||
_fields_ = [
|
||||
("cAttr", DWORD),
|
||||
("rgAttr", PCRYPT_ATTRIBUTE),
|
||||
]
|
||||
CRYPT_ATTRIBUTES = _CRYPT_ATTRIBUTES
|
||||
PCRYPT_ATTRIBUTES = POINTER(_CRYPT_ATTRIBUTES)
|
||||
|
||||
# Struct _CRYPT_ALGORITHM_IDENTIFIER definitions
|
||||
class _CRYPT_ALGORITHM_IDENTIFIER(Structure):
|
||||
_fields_ = [
|
||||
("pszObjId", LPSTR),
|
||||
("Parameters", CRYPT_OBJID_BLOB),
|
||||
]
|
||||
CRYPT_ALGORITHM_IDENTIFIER = _CRYPT_ALGORITHM_IDENTIFIER
|
||||
PCRYPT_ALGORITHM_IDENTIFIER = POINTER(_CRYPT_ALGORITHM_IDENTIFIER)
|
||||
|
||||
# Struct _CMSG_SIGNER_INFO definitions
|
||||
class _CMSG_SIGNER_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwVersion", DWORD),
|
||||
("Issuer", CERT_NAME_BLOB),
|
||||
("SerialNumber", CRYPT_INTEGER_BLOB),
|
||||
("HashAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("HashEncryptionAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("EncryptedHash", CRYPT_DATA_BLOB),
|
||||
("AuthAttrs", CRYPT_ATTRIBUTES),
|
||||
("UnauthAttrs", CRYPT_ATTRIBUTES),
|
||||
]
|
||||
CMSG_SIGNER_INFO = _CMSG_SIGNER_INFO
|
||||
PCMSG_SIGNER_INFO = POINTER(_CMSG_SIGNER_INFO)
|
||||
|
||||
# Struct _CERT_EXTENSION definitions
|
||||
class _CERT_EXTENSION(Structure):
|
||||
_fields_ = [
|
||||
("pszObjId", LPSTR),
|
||||
("fCritical", BOOL),
|
||||
("Value", CRYPT_OBJID_BLOB),
|
||||
]
|
||||
CERT_EXTENSION = _CERT_EXTENSION
|
||||
PCERT_EXTENSION = POINTER(_CERT_EXTENSION)
|
||||
|
||||
# Struct _CTL_USAGE definitions
|
||||
class _CTL_USAGE(Structure):
|
||||
_fields_ = [
|
||||
("cUsageIdentifier", DWORD),
|
||||
("rgpszUsageIdentifier", POINTER(LPSTR)),
|
||||
]
|
||||
CERT_ENHKEY_USAGE = _CTL_USAGE
|
||||
PCTL_USAGE = POINTER(_CTL_USAGE)
|
||||
CTL_USAGE = _CTL_USAGE
|
||||
PCERT_ENHKEY_USAGE = POINTER(_CTL_USAGE)
|
||||
|
||||
# Struct _CTL_INFO definitions
|
||||
class _CTL_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwVersion", DWORD),
|
||||
("SubjectUsage", CTL_USAGE),
|
||||
("ListIdentifier", CRYPT_DATA_BLOB),
|
||||
("SequenceNumber", CRYPT_INTEGER_BLOB),
|
||||
("ThisUpdate", FILETIME),
|
||||
("NextUpdate", FILETIME),
|
||||
("SubjectAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("cCTLEntry", DWORD),
|
||||
("rgCTLEntry", PCTL_ENTRY),
|
||||
("cExtension", DWORD),
|
||||
("rgExtension", PCERT_EXTENSION),
|
||||
]
|
||||
CTL_INFO = _CTL_INFO
|
||||
PCTL_INFO = POINTER(_CTL_INFO)
|
||||
|
||||
# Struct _CTL_CONTEXT definitions
|
||||
class _CTL_CONTEXT(Structure):
|
||||
_fields_ = [
|
||||
("dwMsgAndCertEncodingType", DWORD),
|
||||
("pbCtlEncoded", POINTER(BYTE)),
|
||||
("cbCtlEncoded", DWORD),
|
||||
("pCtlInfo", PCTL_INFO),
|
||||
("hCertStore", HCERTSTORE),
|
||||
("hCryptMsg", HCRYPTMSG),
|
||||
("pbCtlContent", POINTER(BYTE)),
|
||||
("cbCtlContent", DWORD),
|
||||
]
|
||||
PCTL_CONTEXT = POINTER(_CTL_CONTEXT)
|
||||
CTL_CONTEXT = _CTL_CONTEXT
|
||||
PCCTL_CONTEXT = POINTER(_CTL_CONTEXT)
|
||||
|
||||
# Struct WINTRUST_CATALOG_INFO_ definitions
|
||||
class WINTRUST_CATALOG_INFO_(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("dwCatalogVersion", DWORD),
|
||||
("pcwszCatalogFilePath", LPCWSTR),
|
||||
("pcwszMemberTag", LPCWSTR),
|
||||
("pcwszMemberFilePath", LPCWSTR),
|
||||
("hMemberFile", HANDLE),
|
||||
("pbCalculatedFileHash", POINTER(BYTE)),
|
||||
("cbCalculatedFileHash", DWORD),
|
||||
("pcCatalogContext", PCCTL_CONTEXT),
|
||||
]
|
||||
PWINTRUST_CATALOG_INFO = POINTER(WINTRUST_CATALOG_INFO_)
|
||||
WINTRUST_CATALOG_INFO = WINTRUST_CATALOG_INFO_
|
||||
|
||||
# Struct WINTRUST_BLOB_INFO_ definitions
|
||||
class WINTRUST_BLOB_INFO_(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("gSubject", GUID),
|
||||
("pcwszDisplayName", LPCWSTR),
|
||||
("cbMemObject", DWORD),
|
||||
("pbMemObject", POINTER(BYTE)),
|
||||
("cbMemSignedMsg", DWORD),
|
||||
("pbMemSignedMsg", POINTER(BYTE)),
|
||||
]
|
||||
PWINTRUST_BLOB_INFO = POINTER(WINTRUST_BLOB_INFO_)
|
||||
WINTRUST_BLOB_INFO = WINTRUST_BLOB_INFO_
|
||||
|
||||
# Struct _CRYPT_BIT_BLOB definitions
|
||||
class _CRYPT_BIT_BLOB(Structure):
|
||||
_fields_ = [
|
||||
("cbData", DWORD),
|
||||
("pbData", POINTER(BYTE)),
|
||||
("cUnusedBits", DWORD),
|
||||
]
|
||||
CRYPT_BIT_BLOB = _CRYPT_BIT_BLOB
|
||||
PCRYPT_BIT_BLOB = POINTER(_CRYPT_BIT_BLOB)
|
||||
|
||||
# Struct _CERT_PUBLIC_KEY_INFO definitions
|
||||
class _CERT_PUBLIC_KEY_INFO(Structure):
|
||||
_fields_ = [
|
||||
("Algorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("PublicKey", CRYPT_BIT_BLOB),
|
||||
]
|
||||
PCERT_PUBLIC_KEY_INFO = POINTER(_CERT_PUBLIC_KEY_INFO)
|
||||
CERT_PUBLIC_KEY_INFO = _CERT_PUBLIC_KEY_INFO
|
||||
|
||||
# Struct _CERT_INFO definitions
|
||||
class _CERT_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwVersion", DWORD),
|
||||
("SerialNumber", CRYPT_INTEGER_BLOB),
|
||||
("SignatureAlgorithm", CRYPT_ALGORITHM_IDENTIFIER),
|
||||
("Issuer", CERT_NAME_BLOB),
|
||||
("NotBefore", FILETIME),
|
||||
("NotAfter", FILETIME),
|
||||
("Subject", CERT_NAME_BLOB),
|
||||
("SubjectPublicKeyInfo", CERT_PUBLIC_KEY_INFO),
|
||||
("IssuerUniqueId", CRYPT_BIT_BLOB),
|
||||
("SubjectUniqueId", CRYPT_BIT_BLOB),
|
||||
("cExtension", DWORD),
|
||||
("rgExtension", PCERT_EXTENSION),
|
||||
]
|
||||
CERT_INFO = _CERT_INFO
|
||||
PCERT_INFO = POINTER(_CERT_INFO)
|
||||
|
||||
# Struct _CERT_CONTEXT definitions
|
||||
class _CERT_CONTEXT(Structure):
|
||||
_fields_ = [
|
||||
("dwCertEncodingType", DWORD),
|
||||
("pbCertEncoded", POINTER(BYTE)),
|
||||
("cbCertEncoded", DWORD),
|
||||
("pCertInfo", PCERT_INFO),
|
||||
("hCertStore", HCERTSTORE),
|
||||
]
|
||||
CERT_CONTEXT = _CERT_CONTEXT
|
||||
PCERT_CONTEXT = POINTER(_CERT_CONTEXT)
|
||||
|
||||
# Struct WINTRUST_SGNR_INFO_ definitions
|
||||
class WINTRUST_SGNR_INFO_(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("pcwszDisplayName", LPCWSTR),
|
||||
("psSignerInfo", POINTER(CMSG_SIGNER_INFO)),
|
||||
("chStores", DWORD),
|
||||
("pahStores", POINTER(HCERTSTORE)),
|
||||
]
|
||||
WINTRUST_SGNR_INFO = WINTRUST_SGNR_INFO_
|
||||
PWINTRUST_SGNR_INFO = POINTER(WINTRUST_SGNR_INFO_)
|
||||
|
||||
# Struct _FILETIME definitions
|
||||
class _FILETIME(Structure):
|
||||
_fields_ = [
|
||||
("dwLowDateTime", DWORD),
|
||||
("dwHighDateTime", DWORD),
|
||||
]
|
||||
LPFILETIME = POINTER(_FILETIME)
|
||||
PFILETIME = POINTER(_FILETIME)
|
||||
FILETIME = _FILETIME
|
||||
|
||||
# Struct WINTRUST_CERT_INFO_ definitions
|
||||
class WINTRUST_CERT_INFO_(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("pcwszDisplayName", LPCWSTR),
|
||||
("psCertContext", POINTER(CERT_CONTEXT)),
|
||||
("chStores", DWORD),
|
||||
("pahStores", POINTER(HCERTSTORE)),
|
||||
("dwFlags", DWORD),
|
||||
("psftVerifyAsOf", POINTER(FILETIME)),
|
||||
]
|
||||
WINTRUST_CERT_INFO = WINTRUST_CERT_INFO_
|
||||
PWINTRUST_CERT_INFO = POINTER(WINTRUST_CERT_INFO_)
|
||||
|
||||
# Struct _TMP_WINTRUST_UNION_TYPE definitions
|
||||
class _TMP_WINTRUST_UNION_TYPE(Union):
|
||||
_fields_ = [
|
||||
("pFile", POINTER(WINTRUST_FILE_INFO_)),
|
||||
("pCatalog", POINTER(WINTRUST_CATALOG_INFO_)),
|
||||
("pBlob", POINTER(WINTRUST_BLOB_INFO_)),
|
||||
("pSgnr", POINTER(WINTRUST_SGNR_INFO_)),
|
||||
("pCert", POINTER(WINTRUST_CERT_INFO_)),
|
||||
]
|
||||
TMP_WINTRUST_UNION_TYPE = _TMP_WINTRUST_UNION_TYPE
|
||||
|
||||
# Struct _WINTRUST_DATA definitions
|
||||
class _WINTRUST_DATA(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("pPolicyCallbackData", LPVOID),
|
||||
("pSIPClientData", LPVOID),
|
||||
("dwUIChoice", DWORD),
|
||||
("fdwRevocationChecks", DWORD),
|
||||
("dwUnionChoice", DWORD),
|
||||
("tmp_union", TMP_WINTRUST_UNION_TYPE),
|
||||
("dwStateAction", DWORD),
|
||||
("hWVTStateData", HANDLE),
|
||||
("pwszURLReference", POINTER(WCHAR)),
|
||||
("dwProvFlags", DWORD),
|
||||
("dwUIContext", DWORD),
|
||||
]
|
||||
PWINTRUST_DATA = POINTER(_WINTRUST_DATA)
|
||||
WINTRUST_DATA = _WINTRUST_DATA
|
||||
|
||||
# Struct _PROCESS_BASIC_INFORMATION definitions
|
||||
class _PROCESS_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", PVOID),
|
||||
("PebBaseAddress", PPEB),
|
||||
("Reserved2", PVOID * 2),
|
||||
("UniqueProcessId", ULONG_PTR),
|
||||
("Reserved3", PVOID),
|
||||
]
|
||||
PPROCESS_BASIC_INFORMATION = POINTER(_PROCESS_BASIC_INFORMATION)
|
||||
PROCESS_BASIC_INFORMATION = _PROCESS_BASIC_INFORMATION
|
||||
|
||||
|
||||
+3
-3
@@ -225,10 +225,10 @@ def PEFile(baseaddr, target=None):
|
||||
else:
|
||||
import_by_name = create_structure_at(IMPORT_BY_NAME, baseaddr + int_entry.AddressOfData)
|
||||
name_address = baseaddr + int_entry.AddressOfData + type(import_by_name).Name.offset
|
||||
if proc_bitness == 32 and targetedbitness == 64:
|
||||
name = rctypes.Remote_c_char_p64(name_address, target=target).value
|
||||
else:
|
||||
if target is None:
|
||||
name = ctypes.c_char_p(name_address).value
|
||||
else:
|
||||
name = create_structure_at(ctypes.c_char_p, name_address).value.decode()
|
||||
res.append((import_by_name.Hint, name))
|
||||
int_addr += ctypes.sizeof(type(int_entry))
|
||||
int_entry = create_structure_at(THUNK_DATA, int_addr)
|
||||
|
||||
+227
-16
@@ -22,7 +22,7 @@ dummy_jump = "\xea" + struct.pack("<I", 0) + chr(CS_64bits) + "\x00\x00"
|
||||
|
||||
|
||||
def execute_64bits_code_from_syswow(shellcode):
|
||||
"""shellcode must not end by a ret"""
|
||||
"""shellcode must NOT end by a ret"""
|
||||
if not windows.current_process.is_wow_64:
|
||||
raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process")
|
||||
addr = windows.winproxy.VirtualAlloc(dwSize=0x1000)
|
||||
@@ -44,8 +44,9 @@ def execute_64bits_code_from_syswow(shellcode):
|
||||
return exec_stub()
|
||||
|
||||
|
||||
|
||||
def NtCreateThreadEx_32_to_64(process, addr, param):
|
||||
NtCreateThreadEx = get_NtCreateThreadEx_syswow_addr()
|
||||
NtCreateThreadEx = get_syswow_ntdll_exports()['NtCreateThreadEx']
|
||||
create_thread = x64.MultipleInstr()
|
||||
# Save registers
|
||||
create_thread += x64.Push('RBX')
|
||||
@@ -98,21 +99,218 @@ def NtCreateThreadEx_32_to_64(process, addr, param):
|
||||
create_thread += x64.Pop('RBX')
|
||||
return execute_64bits_code_from_syswow(create_thread.get_code())
|
||||
|
||||
# We will soon need to generate thoses stub...
|
||||
|
||||
def get_NtCreateThreadEx_syswow_addr():
|
||||
if get_NtCreateThreadEx_syswow_addr.value is not None:
|
||||
return get_NtCreateThreadEx_syswow_addr.value
|
||||
peb64 = get_current_process_syswow_peb()
|
||||
ntdll64 = [m for m in peb64.modules if m.name == "ntdll.dll"]
|
||||
if not ntdll64:
|
||||
raise ValueError("Could not find ntdll.dll in syswow peb")
|
||||
ntdll64 = ntdll64[0]
|
||||
try:
|
||||
get_NtCreateThreadEx_syswow_addr.value = ntdll64.pe.exports['NtCreateThreadEx']
|
||||
except KeyError:
|
||||
raise ValueError("Could not find NtCreateThreadEx in syswow ntdll.dll")
|
||||
return get_NtCreateThreadEx_syswow_addr.value
|
||||
get_NtCreateThreadEx_syswow_addr.value = None
|
||||
def NtQueryVirtualMemory_32_to_64(process, addr, result):
|
||||
size = ctypes.sizeof(result)
|
||||
MemoryBasicInformation = 0
|
||||
LEN = SIZE_T()
|
||||
|
||||
NtQueryVirtualMemory = get_syswow_ntdll_exports()['NtQueryVirtualMemory']
|
||||
|
||||
query_memory = x64.MultipleInstr()
|
||||
# Save registers
|
||||
query_memory += x64.Push('RBX')
|
||||
query_memory += x64.Push('RCX')
|
||||
query_memory += x64.Push('RDX')
|
||||
query_memory += x64.Push('RSI')
|
||||
query_memory += x64.Push('RDI')
|
||||
query_memory += x64.Push('R8')
|
||||
query_memory += x64.Push('R9')
|
||||
query_memory += x64.Push('R10')
|
||||
query_memory += x64.Push('R11')
|
||||
query_memory += x64.Push('R12')
|
||||
query_memory += x64.Push('R13')
|
||||
# Setup args
|
||||
|
||||
query_memory += x64.Mov('RCX', process.handle) # Arg1
|
||||
query_memory += x64.Mov('RDX', addr) # Arg2
|
||||
query_memory += x64.Mov('R8', MemoryBasicInformation) # Arg3
|
||||
query_memory += x64.Mov('R9', ctypes.addressof(result)) # Arg4
|
||||
query_memory += x64.Mov('RAX', ctypes.addressof(LEN))
|
||||
query_memory += x64.Push('RAX') # Arg6
|
||||
query_memory += x64.Mov('RAX', size)
|
||||
query_memory += x64.Push('RAX') # Arg5
|
||||
# reserve space for register (calling convention)
|
||||
query_memory += x64.Push('R9')
|
||||
query_memory += x64.Push('R8')
|
||||
query_memory += x64.Push('RDX')
|
||||
query_memory += x64.Push('RCX')
|
||||
# Call
|
||||
query_memory += x64.Mov('R13', NtQueryVirtualMemory)
|
||||
query_memory += x64.Call('R13')
|
||||
# Clean stack
|
||||
query_memory += x64.Add('RSP', 6 * 8)
|
||||
query_memory += x64.Pop('R13')
|
||||
query_memory += x64.Pop('R12')
|
||||
query_memory += x64.Pop('R11')
|
||||
query_memory += x64.Pop('R10')
|
||||
query_memory += x64.Pop('R9')
|
||||
query_memory += x64.Pop('R8')
|
||||
query_memory += x64.Pop('RDI')
|
||||
query_memory += x64.Pop('RSI')
|
||||
query_memory += x64.Pop('RDX')
|
||||
query_memory += x64.Pop('RCX')
|
||||
query_memory += x64.Pop('RBX')
|
||||
return execute_64bits_code_from_syswow(query_memory.get_code())
|
||||
|
||||
|
||||
def NtQueryInformationProcess_32_to_64(process, result, size=None):
|
||||
ProcessBasicInformation = 0
|
||||
if size is None:
|
||||
size = ctypes.sizeof(size)
|
||||
ReturnLen = ULONG()
|
||||
|
||||
NtQueryInformationProcess = get_syswow_ntdll_exports()['NtQueryInformationProcess']
|
||||
|
||||
query_memory = x64.MultipleInstr()
|
||||
# Save registers
|
||||
query_memory += x64.Push('RBX')
|
||||
query_memory += x64.Push('RCX')
|
||||
query_memory += x64.Push('RDX')
|
||||
query_memory += x64.Push('RSI')
|
||||
query_memory += x64.Push('RDI')
|
||||
query_memory += x64.Push('R8')
|
||||
query_memory += x64.Push('R9')
|
||||
query_memory += x64.Push('R10')
|
||||
query_memory += x64.Push('R11')
|
||||
query_memory += x64.Push('R12')
|
||||
query_memory += x64.Push('R13')
|
||||
# Setup args
|
||||
|
||||
query_memory += x64.Mov('RCX', process.handle) # Arg1
|
||||
query_memory += x64.Mov('RDX', ProcessBasicInformation) # Arg2
|
||||
query_memory += x64.Mov('R8', ctypes.addressof(result)) # Arg3
|
||||
query_memory += x64.Mov('R9', size) # Arg4
|
||||
query_memory += x64.Mov('RAX', ctypes.addressof(ReturnLen))
|
||||
query_memory += x64.Push('RAX') # Arg5
|
||||
# reserve space for register (calling convention)
|
||||
query_memory += x64.Push('R9')
|
||||
query_memory += x64.Push('R8')
|
||||
query_memory += x64.Push('RDX')
|
||||
query_memory += x64.Push('RCX')
|
||||
# Call
|
||||
query_memory += x64.Mov('R13', NtQueryInformationProcess)
|
||||
query_memory += x64.Call('R13')
|
||||
# Clean stack
|
||||
query_memory += x64.Add('RSP', 5 * 8)
|
||||
query_memory += x64.Pop('R13')
|
||||
query_memory += x64.Pop('R12')
|
||||
query_memory += x64.Pop('R11')
|
||||
query_memory += x64.Pop('R10')
|
||||
query_memory += x64.Pop('R9')
|
||||
query_memory += x64.Pop('R8')
|
||||
query_memory += x64.Pop('RDI')
|
||||
query_memory += x64.Pop('RSI')
|
||||
query_memory += x64.Pop('RDX')
|
||||
query_memory += x64.Pop('RCX')
|
||||
query_memory += x64.Pop('RBX')
|
||||
return execute_64bits_code_from_syswow(query_memory.get_code())
|
||||
|
||||
|
||||
def generate_syswow64_call(target):
|
||||
nb_args = len(target.prototype._argtypes_)
|
||||
target_addr = get_syswow_ntdll_exports()[target.__name__]
|
||||
print hex(target_addr)
|
||||
|
||||
argument_buffer_len = (nb_args * 8)
|
||||
argument_buffer = windows.current_process.allocator.reserve_size(argument_buffer_len)
|
||||
|
||||
nb_args_on_stack = nb_args - 4
|
||||
|
||||
code_64b = x64.MultipleInstr()
|
||||
# Save registers
|
||||
code_64b += x64.Push('RBX')
|
||||
code_64b += x64.Push('RCX')
|
||||
code_64b += x64.Push('RDX')
|
||||
code_64b += x64.Push('RSI')
|
||||
code_64b += x64.Push('RDI')
|
||||
code_64b += x64.Push('R8')
|
||||
code_64b += x64.Push('R9')
|
||||
code_64b += x64.Push('R10')
|
||||
code_64b += x64.Push('R11')
|
||||
code_64b += x64.Push('R12')
|
||||
code_64b += x64.Push('R13')
|
||||
|
||||
# retrieve argument from the argument buffer
|
||||
if nb_args >= 1:
|
||||
code_64b += x64.Mov('RCX', x64.create_displacement(disp=argument_buffer))
|
||||
if nb_args >= 2:
|
||||
code_64b += x64.Mov('RDX', x64.create_displacement(disp=argument_buffer + (8 * 1)))
|
||||
if nb_args >= 3:
|
||||
code_64b += x64.Mov('R8', x64.create_displacement(disp=argument_buffer + (8 * 2)))
|
||||
if nb_args >= 4:
|
||||
code_64b += x64.Mov('R9', x64.create_displacement(disp=argument_buffer + (8 * 3)))
|
||||
for i in range(nb_args_on_stack):
|
||||
code_64b += x64.Mov('RAX', x64.create_displacement(disp=argument_buffer + 8 * (nb_args - 1 - i)))
|
||||
code_64b += x64.Push('RAX')
|
||||
|
||||
# reserve space for register (calling convention)
|
||||
code_64b += x64.Push('R9')
|
||||
code_64b += x64.Push('R8')
|
||||
code_64b += x64.Push('RDX')
|
||||
code_64b += x64.Push('RCX')
|
||||
# Call
|
||||
code_64b += x64.Mov('R13', target_addr)
|
||||
code_64b += x64.Call('R13')
|
||||
# Clean stack
|
||||
code_64b += x64.Add('RSP', (4 + nb_args_on_stack) * 8)
|
||||
code_64b += x64.Pop('R13')
|
||||
code_64b += x64.Pop('R12')
|
||||
code_64b += x64.Pop('R11')
|
||||
code_64b += x64.Pop('R10')
|
||||
code_64b += x64.Pop('R9')
|
||||
code_64b += x64.Pop('R8')
|
||||
code_64b += x64.Pop('RDI')
|
||||
code_64b += x64.Pop('RSI')
|
||||
code_64b += x64.Pop('RDX')
|
||||
code_64b += x64.Pop('RCX')
|
||||
code_64b += x64.Pop('RBX')
|
||||
return try_generate_stub_target(code_64b.get_code(), argument_buffer, target)
|
||||
# TODO: this code should be a winfuct of type prototype :)
|
||||
|
||||
|
||||
def try_generate_stub_target(shellcode, argument_buffer, target):
|
||||
"""shellcode must NOT end by a ret"""
|
||||
if not windows.current_process.is_wow_64:
|
||||
raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process")
|
||||
addr = windows.winproxy.VirtualAlloc(dwSize=0x1000)
|
||||
# post-exec 32bits stub (ret)
|
||||
ret = "\xC3"
|
||||
ret_addr = addr
|
||||
shell_code_addr = ret_addr + len(ret) + len(dummy_jump)
|
||||
# ljmp
|
||||
jump = "\xea" + struct.pack("<I", shell_code_addr) + chr(CS_64bits) + "\x00\x00"
|
||||
jump_addr = ret_addr + len(ret)
|
||||
# Return to 32bits stub
|
||||
shellcode += genere_return_32bits_stub(ret_addr)
|
||||
# WRITE ALL THE STUBS
|
||||
windows.current_process.write_memory(ret_addr, ret)
|
||||
windows.current_process.write_memory(jump_addr, jump)
|
||||
windows.current_process.write_memory(shell_code_addr, shellcode)
|
||||
# Execute
|
||||
native_caller = ctypes.CFUNCTYPE(c_ulong)(jump_addr)
|
||||
# Generate the wrapper function that fill the argument_buffer
|
||||
expected_arguments_number = len(target.prototype._argtypes_)
|
||||
|
||||
def wrapper(*args):
|
||||
if len(args) != expected_arguments_number:
|
||||
raise ValueError("{0} syswow accept {1} args ({2} given)".format(target.__name__, expected_arguments_number, len(args)))
|
||||
# Transform args (ctypes byref possibly) to int
|
||||
writable_args = []
|
||||
for value in args:
|
||||
if not isinstance(value, (int, long)):
|
||||
value = ctypes.cast(value, ctypes.c_void_p).value
|
||||
writable_args.append(value)
|
||||
|
||||
# Build buffer
|
||||
buffer = struct.pack("<" + "Q" * len(writable_args), *writable_args)
|
||||
ctypes.memmove(argument_buffer, buffer, len(buffer))
|
||||
# TODO : get 64bits returned value ?
|
||||
return native_caller()
|
||||
wrapper.__name__ = "{0}<syswow64>".format(target.__name__,)
|
||||
wrapper.__doc__ = "This is a wrapper to {0} in 64b mode, it accept <{1}> args".format(target.__name__, expected_arguments_number)
|
||||
return wrapper
|
||||
|
||||
|
||||
def get_current_process_syswow_peb_addr():
|
||||
@@ -139,3 +337,16 @@ def get_current_process_syswow_peb():
|
||||
bitness = 64
|
||||
peb_addr = get_current_process_syswow_peb_addr()
|
||||
return windows.winobject.RemotePEB64(peb_addr, CurrentProcessReadSyswow())
|
||||
|
||||
def get_syswow_ntdll_exports():
|
||||
if get_syswow_ntdll_exports.value is not None:
|
||||
return get_syswow_ntdll_exports.value
|
||||
peb64 = get_current_process_syswow_peb()
|
||||
ntdll64 = [m for m in peb64.modules if m.name == "ntdll.dll"]
|
||||
if not ntdll64:
|
||||
raise ValueError("Could not find ntdll.dll in syswow peb")
|
||||
ntdll64 = ntdll64[0]
|
||||
exports = ntdll64.pe.exports
|
||||
get_syswow_ntdll_exports.value = exports
|
||||
return exports
|
||||
get_syswow_ntdll_exports.value = None
|
||||
@@ -30,7 +30,6 @@ def get_remote_func_addr(target, dll_name, func_name):
|
||||
|
||||
|
||||
def is_wow_64(hProcess):
|
||||
import ipdb;ipdb.set_trace()
|
||||
try:
|
||||
fnIsWow64Process = get_func_addr("kernel32.dll", "IsWow64Process")
|
||||
except winproxy.Kernel32Error:
|
||||
|
||||
+53
-28
@@ -5,7 +5,9 @@ import time
|
||||
import struct
|
||||
|
||||
import windows
|
||||
import windows.network
|
||||
import windows.syswow64
|
||||
#import windows.vectored_exception
|
||||
import windows.winproxy as winproxy
|
||||
import windows.injection as injection
|
||||
import windows.native_exec as native_exec
|
||||
@@ -78,6 +80,11 @@ class System(object):
|
||||
return 64
|
||||
return 32
|
||||
|
||||
@property
|
||||
def network(self):
|
||||
return windows.network.Network()
|
||||
|
||||
|
||||
@staticmethod
|
||||
def enumerate_processes():
|
||||
process_entry = WinProcess()
|
||||
@@ -204,6 +211,34 @@ class Process(AutoHandle):
|
||||
self.write_memory(x, code)
|
||||
return self.create_thread(x, 0)
|
||||
|
||||
def query_memory(self, addr):
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
res = MEMORY_BASIC_INFORMATION64()
|
||||
try:
|
||||
v = windows.syswow64.NtQueryVirtualMemory_32_to_64(self, addr, res)
|
||||
except WindowsError as e:
|
||||
if e.winerror & 0xffffffff == 0XC000000D:
|
||||
raise winproxy.Kernel32Error("NtQueryVirtualMemory_32_to_64")
|
||||
raise
|
||||
return res
|
||||
|
||||
info_type = {32 : MEMORY_BASIC_INFORMATION32, 64 : MEMORY_BASIC_INFORMATION64}
|
||||
res = info_type[windows.current_process.bitness]()
|
||||
ptr = ctypes.cast(byref(res), POINTER(MEMORY_BASIC_INFORMATION))
|
||||
winproxy.VirtualQueryEx(self.handle, addr, ptr, sizeof(res))
|
||||
return res
|
||||
|
||||
def memory_state(self):
|
||||
addr = 0
|
||||
res = []
|
||||
while True:
|
||||
try:
|
||||
x = self.query_memory(addr)
|
||||
yield x
|
||||
except winproxy.Kernel32Error:
|
||||
return
|
||||
addr += x.RegionSize
|
||||
|
||||
|
||||
class CurrentThread(AutoHandle):
|
||||
"""The current thread"""
|
||||
@@ -430,40 +465,30 @@ class WinProcess(PROCESSENTRY32, Process):
|
||||
"""Execute Python code into the remote process"""
|
||||
return injection.execute_python_code(self, pycode)
|
||||
|
||||
def get_peb_addr(self):
|
||||
dest = self.virtual_alloc(0x1000)
|
||||
if self.bitness == 32:
|
||||
store_peb = x86.MultipleInstr()
|
||||
store_peb += x86.Mov('EAX', x86.mem('fs:[0x30]'))
|
||||
store_peb += x86.Mov(x86.create_displacement(disp=dest), 'EAX')
|
||||
store_peb += x86.Ret()
|
||||
get_peb_code = store_peb.get_code()
|
||||
self.write_memory(dest, "\x00" * 4)
|
||||
self.write_memory(dest + 4, get_peb_code)
|
||||
self.create_thread(dest + 4, 0)
|
||||
time.sleep(0.01)
|
||||
peb_addr = struct.unpack("<I", self.read_memory(dest, 4))[0]
|
||||
return peb_addr
|
||||
@utils.fixedpropety
|
||||
def peb_addr(self):
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
x = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION)
|
||||
# Fuck-it <3
|
||||
data = (ctypes.c_char * ctypes.sizeof(x))()
|
||||
windows.syswow64.NtQueryInformationProcess_32_to_64(self, data, ctypes.sizeof(x))
|
||||
peb_offset = x.PebBaseAddress.offset
|
||||
peb_addr = struct.unpack("<Q", data[x.PebBaseAddress.offset: x.PebBaseAddress.offset+8])[0]
|
||||
else:
|
||||
store_peb = x64.MultipleInstr()
|
||||
store_peb += x64.Mov('RAX', x64.mem('gs:[0x60]'))
|
||||
store_peb += x64.Mov(x64.create_displacement(disp=dest), 'RAX')
|
||||
store_peb += x64.Ret()
|
||||
get_peb_code = store_peb.get_code()
|
||||
self.write_memory(dest, "\x00" * 8)
|
||||
self.write_memory(dest + 8, get_peb_code)
|
||||
self.create_thread(dest + 8, 0)
|
||||
time.sleep(0.01)
|
||||
peb_addr = struct.unpack("<Q", self.read_memory(dest, 8))[0]
|
||||
return peb_addr
|
||||
x = PROCESS_BASIC_INFORMATION()
|
||||
windows.winproxy.NtQueryInformationProcess(self.handle, 0, x)
|
||||
peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value
|
||||
if peb_addr is None:
|
||||
raise ValueError("Could not get peb addr of process {0}".format(self.name))
|
||||
return peb_addr
|
||||
|
||||
@utils.fixedpropety
|
||||
def peb(self):
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
return RemotePEB64(self.get_peb_addr(), self)
|
||||
return RemotePEB64(self.peb_addr, self)
|
||||
if windows.current_process.bitness == 64 and self.bitness == 32:
|
||||
return RemotePEB32(self.get_peb_addr(), self)
|
||||
return RemotePEB(self.get_peb_addr(), self)
|
||||
return RemotePEB32(self.peb_addr, self)
|
||||
return RemotePEB(self.peb_addr, self)
|
||||
|
||||
def exit(self, code=0):
|
||||
"""Exit the process"""
|
||||
|
||||
+25
-1
@@ -115,6 +115,9 @@ class ApiProxy(object):
|
||||
doc = doc if doc else ""
|
||||
python_proxy.__doc__ = doc + "\nErrcheck:\n " + self.error_check.__doc__
|
||||
params_name = [param[1] for param in params]
|
||||
python_proxy.prototype = prototype
|
||||
python_proxy.params = params
|
||||
|
||||
|
||||
def perform_call(*args):
|
||||
if len(params_name) != len(args):
|
||||
@@ -221,12 +224,14 @@ ExitThread = TransparentKernel32Proxy("ExitThread")
|
||||
SuspendThread = TransparentKernel32Proxy("SuspendThread", minus_one_error_check)
|
||||
ResumeThread = TransparentKernel32Proxy("ResumeThread", minus_one_error_check)
|
||||
GetThreadId = TransparentKernel32Proxy("GetThreadId")
|
||||
VirtualQueryEx = TransparentKernel32Proxy("VirtualQueryEx")
|
||||
|
||||
Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection")
|
||||
Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection")
|
||||
Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection")
|
||||
|
||||
|
||||
|
||||
@Kernel32Proxy("CreateFileA")
|
||||
def CreateFileA(lpFileName, dwDesiredAccess=GENERIC_READ, dwShareMode=0, lpSecurityAttributes=None, dwCreationDisposition=OPEN_EXISTING, dwFlagsAndAttributes=FILE_ATTRIBUTE_NORMAL, hTemplateFile=None):
|
||||
return CreateFileA.ctypes_function(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile)
|
||||
@@ -447,10 +452,29 @@ def ntquerysysteminformation_error_check(func_name, result, func, args):
|
||||
|
||||
@NtdllProxy('NtQuerySystemInformation', ntquerysysteminformation_error_check)
|
||||
def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter):
|
||||
if SystemInformation is not None and SystemInformation == 0:
|
||||
if SystemInformation is not None and SystemInformationLength == 0:
|
||||
SystemInformationLength = ctypes.sizeof(SystemInformation)
|
||||
return NtQuerySystemInformation.ctypes_function(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength)
|
||||
|
||||
@OptionalExport(NtdllProxy('NtQueryInformationProcess', error_ntstatus))
|
||||
def NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength=0, ReturnLength=None):
|
||||
if ProcessInformation is not None and ProcessInformationLength == 0:
|
||||
ProcessInformationLength = ctypes.sizeof(ProcessInformation)
|
||||
if type(ProcessInformation) == PROCESS_BASIC_INFORMATION:
|
||||
ProcessInformation = byref(ProcessInformation)
|
||||
if ReturnLength is None:
|
||||
ReturnLength = byref(ULONG())
|
||||
return NtQueryInformationProcess.ctypes_function(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength)
|
||||
|
||||
@OptionalExport(NtdllProxy('NtQueryVirtualMemory', error_ntstatus))
|
||||
def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None):
|
||||
if ReturnLength is None:
|
||||
ReturnLength = byref(ULONG())
|
||||
if MemoryInformation is not None and MemoryInformationLength == 0:
|
||||
ProcessInformationLength = ctypes.sizeof(MemoryInformation)
|
||||
if type(MemoryInformation) == MEMORY_BASIC_INFORMATION64:
|
||||
MemoryInformation = byref(MemoryInformation)
|
||||
return NtQueryVirtualMemory.ctypes_function(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None)
|
||||
|
||||
# ##### ADVAPI32 ####### #
|
||||
|
||||
|
||||
Reference in New Issue
Block a user