diff --git a/generated_def/__init__.py b/generated_def/__init__.py index f9e9c02..a6c911d 100644 --- a/generated_def/__init__.py +++ b/generated_def/__init__.py @@ -30,6 +30,7 @@ else: winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION64 from . import winfuncs +from . import windef diff --git a/generated_def/windef.py b/generated_def/windef.py index e64c7a9..6649369 100644 --- a/generated_def/windef.py +++ b/generated_def/windef.py @@ -7,13 +7,13 @@ if sys.version_info.major == 3: class Flag(long): def __new__(cls, name, value): return super(Flag, cls).__new__(cls, value) - + def __init__(self, name, value): self.name = name def __repr__(self): return "{0}({1})".format(self.name, hex(self)) - + __str__ = __repr__ NULL = Flag("NULL", 0) @@ -475,4 +475,17 @@ ERROR_NOT_ALL_ASSIGNED = Flag("ERROR_NOT_ALL_ASSIGNED", 1300) S_OK = Flag("S_OK", 0) S_FALSE = Flag("S_FALSE", 1) E_NOINTERFACE = Flag("E_NOINTERFACE", 0x80004002) -E_FAIL = Flag("E_FAIL", 0x80004005) \ No newline at end of file +E_FAIL = Flag("E_FAIL", 0x80004005) +DEBUG_EVENT_BREAKPOINT = Flag("DEBUG_EVENT_BREAKPOINT", 0x00000001) +DEBUG_EVENT_EXCEPTION = Flag("DEBUG_EVENT_EXCEPTION", 0x00000002) +DEBUG_EVENT_CREATE_THREAD = Flag("DEBUG_EVENT_CREATE_THREAD", 0x00000004) +DEBUG_EVENT_EXIT_THREAD = Flag("DEBUG_EVENT_EXIT_THREAD", 0x00000008) +DEBUG_EVENT_CREATE_PROCESS = Flag("DEBUG_EVENT_CREATE_PROCESS", 0x00000010) +DEBUG_EVENT_EXIT_PROCESS = Flag("DEBUG_EVENT_EXIT_PROCESS", 0x00000020) +DEBUG_EVENT_LOAD_MODULE = Flag("DEBUG_EVENT_LOAD_MODULE", 0x00000040) +DEBUG_EVENT_UNLOAD_MODULE = Flag("DEBUG_EVENT_UNLOAD_MODULE", 0x00000080) +DEBUG_EVENT_SYSTEM_ERROR = Flag("DEBUG_EVENT_SYSTEM_ERROR", 0x00000100) +DEBUG_EVENT_SESSION_STATUS = Flag("DEBUG_EVENT_SESSION_STATUS", 0x00000200) +DEBUG_EVENT_CHANGE_DEBUGGEE_STATE = Flag("DEBUG_EVENT_CHANGE_DEBUGGEE_STATE", 0x00000400) +DEBUG_EVENT_CHANGE_ENGINE_STATE = Flag("DEBUG_EVENT_CHANGE_ENGINE_STATE", 0x00000800) +DEBUG_EVENT_CHANGE_SYMBOL_STATE = Flag("DEBUG_EVENT_CHANGE_SYMBOL_STATE", 0x00001000) \ No newline at end of file diff --git a/generated_def/winfuncs.py b/generated_def/winfuncs.py index 61bde23..92d3187 100644 --- a/generated_def/winfuncs.py +++ b/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'SetConsoleCtrlHandler'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -33,6 +33,14 @@ CreateFileWParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode NtQuerySystemInformationPrototype = WINFUNCTYPE(NTSTATUS, SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG) NtQuerySystemInformationParams = ((1, 'SystemInformationClass'), (1, 'SystemInformation'), (1, 'SystemInformationLength'), (1, 'ReturnLength')) +# NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength): +NtQueryInformationProcessPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG) +NtQueryInformationProcessParams = ((1, 'ProcessHandle'), (1, 'ProcessInformationClass'), (1, 'ProcessInformation'), (1, 'ProcessInformationLength'), (1, 'ReturnLength')) + +# NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength): +NtQueryVirtualMemoryPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T) +NtQueryVirtualMemoryParams = ((1, 'ProcessHandle'), (1, 'BaseAddress'), (1, 'MemoryInformationClass'), (1, 'MemoryInformation'), (1, 'MemoryInformationLength'), (1, 'ReturnLength')) + # VirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect): VirtualAllocPrototype = WINFUNCTYPE(LPVOID, LPVOID, SIZE_T, DWORD, DWORD) VirtualAllocParams = ((1, 'lpAddress'), (1, 'dwSize'), (1, 'flAllocationType'), (1, 'flProtect')) @@ -57,6 +65,10 @@ VirtualProtectParams = ((1, 'lpAddress'), (1, 'dwSize'), (1, 'flNewProtect'), (1 VirtualQueryPrototype = WINFUNCTYPE(DWORD, LPCVOID, PMEMORY_BASIC_INFORMATION, DWORD) VirtualQueryParams = ((1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength')) +# VirtualQueryEx(hProcess, lpAddress, lpBuffer, dwLength): +VirtualQueryExPrototype = WINFUNCTYPE(SIZE_T, HANDLE, LPCVOID, PMEMORY_BASIC_INFORMATION, SIZE_T) +VirtualQueryExParams = ((1, 'hProcess'), (1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength')) + # GetModuleFileNameA(hModule, lpFilename, nSize): GetModuleFileNameAPrototype = WINFUNCTYPE(DWORD, HMODULE, LPSTR, DWORD) GetModuleFileNameAParams = ((1, 'hModule'), (1, 'lpFilename'), (1, 'nSize')) @@ -357,3 +369,7 @@ Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),) Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN) Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),) +# SetConsoleCtrlHandler(HandlerRoutine, Add): +SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL) +SetConsoleCtrlHandlerParams = ((1, 'HandlerRoutine'), (1, 'Add')) + diff --git a/generated_def/winstructs.py b/generated_def/winstructs.py index 0aadaaf..a099c73 100644 --- a/generated_def/winstructs.py +++ b/generated_def/winstructs.py @@ -5,6 +5,7 @@ from .windef import * PWSTR = LPWSTR SIZE_T = c_ulong +PSIZE_T = POINTER(SIZE_T) PVOID = c_void_p PPS_POST_PROCESS_INIT_ROUTINE = PVOID NTSTATUS = DWORD @@ -12,6 +13,7 @@ PULONG = POINTER(ULONG) PDWORD = POINTER(DWORD) LPDWORD = POINTER(DWORD) LPTHREAD_START_ROUTINE = PVOID +PHANDLER_ROUTINE = PVOID LPBYTE = POINTER(BYTE) ULONG_PTR = PULONG CHAR = c_char @@ -30,11 +32,13 @@ PHKEY = POINTER(HKEY) ACCESS_MASK = DWORD REGSAM = ACCESS_MASK LPCONTEXT = PVOID +HCERTSTORE = PVOID +HCRYPTMSG = PVOID VOID = DWORD -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION'] -enums = ['_SYSTEM_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO'] +enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] # Enum _SYSTEM_INFORMATION_CLASS definitions _SYSTEM_INFORMATION_CLASS = DWORD @@ -124,6 +128,12 @@ SystemMemoryListInformation = 0x50 SystemFileCacheInformationEx = 0x51 MaxSystemInfoClass = 0x52 +# Enum _MEMORY_INFORMATION_CLASS definitions +_MEMORY_INFORMATION_CLASS = DWORD +MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS + +MemoryBasicInformation = 0x0 + # Enum _TCP_TABLE_CLASS definitions _TCP_TABLE_CLASS = DWORD TCP_TABLE_CLASS = _TCP_TABLE_CLASS @@ -307,6 +317,13 @@ TI_GET_IS_REFERENCE = 0x1f TI_GET_INDIRECTVIRTUALBASECLASS = 0x20 IMAGEHLP_SYMBOL_TYPE_INFO_MAX = 0x21 +# Enum _PROCESSINFOCLASS definitions +_PROCESSINFOCLASS = DWORD +PROCESSINFOCLASS = _PROCESSINFOCLASS + +ProcessBasicInformation = 0x0 +ProcessWow64Information = 0x1a + # Struct _LIST_ENTRY definitions # Self referencing struct tricks class _LIST_ENTRY(Structure): pass @@ -619,6 +636,36 @@ class _MEMORY_BASIC_INFORMATION(Structure): PMEMORY_BASIC_INFORMATION = POINTER(_MEMORY_BASIC_INFORMATION) MEMORY_BASIC_INFORMATION = _MEMORY_BASIC_INFORMATION +# Struct _MEMORY_BASIC_INFORMATION32 definitions +class _MEMORY_BASIC_INFORMATION32(Structure): + _fields_ = [ + ("BaseAddress", DWORD), + ("AllocationBase", DWORD), + ("AllocationProtect", DWORD), + ("RegionSize", DWORD), + ("State", DWORD), + ("Protect", DWORD), + ("Type", DWORD), + ] +MEMORY_BASIC_INFORMATION32 = _MEMORY_BASIC_INFORMATION32 +PMEMORY_BASIC_INFORMATION32 = POINTER(_MEMORY_BASIC_INFORMATION32) + +# Struct _MEMORY_BASIC_INFORMATION64 definitions +class _MEMORY_BASIC_INFORMATION64(Structure): + _fields_ = [ + ("BaseAddress", ULONGLONG), + ("AllocationBase", ULONGLONG), + ("AllocationProtect", DWORD), + ("__alignment1", DWORD), + ("RegionSize", ULONGLONG), + ("State", DWORD), + ("Protect", DWORD), + ("Type", DWORD), + ("__alignment2", DWORD), + ] +PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64) +MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64 + # Struct _STARTUPINFOA definitions class _STARTUPINFOA(Structure): _fields_ = [ @@ -1087,6 +1134,33 @@ _EXCEPTION_RECORD._fields_ = [ PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD) EXCEPTION_RECORD = _EXCEPTION_RECORD +# Struct _EXCEPTION_RECORD32 definitions +class _EXCEPTION_RECORD32(Structure): + _fields_ = [ + ("ExceptionCode", DWORD), + ("ExceptionFlags", DWORD), + ("ExceptionRecord", DWORD), + ("ExceptionAddress", DWORD), + ("NumberParameters", DWORD), + ("ExceptionInformation", DWORD * EXCEPTION_MAXIMUM_PARAMETERS), + ] +EXCEPTION_RECORD32 = _EXCEPTION_RECORD32 +PEXCEPTION_RECORD32 = POINTER(_EXCEPTION_RECORD32) + +# Struct _EXCEPTION_RECORD64 definitions +class _EXCEPTION_RECORD64(Structure): + _fields_ = [ + ("ExceptionCode", DWORD), + ("ExceptionFlags", DWORD), + ("ExceptionRecord", DWORD64), + ("ExceptionAddress", DWORD64), + ("NumberParameters", DWORD), + ("__unusedAlignment", DWORD), + ("ExceptionInformation", DWORD64 * EXCEPTION_MAXIMUM_PARAMETERS), + ] +PEXCEPTION_RECORD64 = POINTER(_EXCEPTION_RECORD64) +EXCEPTION_RECORD64 = _EXCEPTION_RECORD64 + # Struct _EXCEPTION_POINTERS64 definitions class _EXCEPTION_POINTERS64(Structure): _fields_ = [ @@ -1274,3 +1348,465 @@ class tagSAFEARRAY(Structure): ] SAFEARRAY = tagSAFEARRAY +# Struct _DEBUG_BREAKPOINT_PARAMETERS definitions +class _DEBUG_BREAKPOINT_PARAMETERS(Structure): + _fields_ = [ + ("Offset", ULONG64), + ("Id", ULONG), + ("BreakType", ULONG), + ("ProcType", ULONG), + ("Flags", ULONG), + ("DataSize", ULONG), + ("DataAccessType", ULONG), + ("PassCount", ULONG), + ("CurrentPassCount", ULONG), + ("MatchThread", ULONG), + ("CommandSize", ULONG), + ("OffsetExpressionSize", ULONG), + ] +PDEBUG_BREAKPOINT_PARAMETERS = POINTER(_DEBUG_BREAKPOINT_PARAMETERS) +DEBUG_BREAKPOINT_PARAMETERS = _DEBUG_BREAKPOINT_PARAMETERS + +# Struct _DEBUG_REGISTER_DESCRIPTION definitions +class _DEBUG_REGISTER_DESCRIPTION(Structure): + _fields_ = [ + ("Type", ULONG), + ("Flags", ULONG), + ("SubregMaster", ULONG), + ("SubregLength", ULONG), + ("SubregMask", ULONG64), + ("SubregShift", ULONG), + ("Reserved0", ULONG), + ] +DEBUG_REGISTER_DESCRIPTION = _DEBUG_REGISTER_DESCRIPTION +PDEBUG_REGISTER_DESCRIPTION = POINTER(_DEBUG_REGISTER_DESCRIPTION) + +# Struct _DEBUG_STACK_FRAME definitions +class _DEBUG_STACK_FRAME(Structure): + _fields_ = [ + ("InstructionOffset", ULONG64), + ("ReturnOffset", ULONG64), + ("FrameOffset", ULONG64), + ("StackOffset", ULONG64), + ("FuncTableEntry", ULONG64), + ("Params", ULONG64 * 4), + ("Reserved", ULONG64 * 6), + ("Virtual", BOOL), + ("FrameNumber", ULONG), + ] +PDEBUG_STACK_FRAME = POINTER(_DEBUG_STACK_FRAME) +DEBUG_STACK_FRAME = _DEBUG_STACK_FRAME + +# Struct _DEBUG_LAST_EVENT_INFO_BREAKPOINT definitions +class _DEBUG_LAST_EVENT_INFO_BREAKPOINT(Structure): + _fields_ = [ + ("Id", ULONG), + ] +DEBUG_LAST_EVENT_INFO_BREAKPOINT = _DEBUG_LAST_EVENT_INFO_BREAKPOINT +PDEBUG_LAST_EVENT_INFO_BREAKPOINT = POINTER(_DEBUG_LAST_EVENT_INFO_BREAKPOINT) + +# Struct _DEBUG_LAST_EVENT_INFO_EXCEPTION definitions +class _DEBUG_LAST_EVENT_INFO_EXCEPTION(Structure): + _fields_ = [ + ("ExceptionRecord", EXCEPTION_RECORD64), + ("FirstChance", ULONG), + ] +DEBUG_LAST_EVENT_INFO_EXCEPTION = _DEBUG_LAST_EVENT_INFO_EXCEPTION +PDEBUG_LAST_EVENT_INFO_EXCEPTION = POINTER(_DEBUG_LAST_EVENT_INFO_EXCEPTION) + +# Struct _DEBUG_LAST_EVENT_INFO_EXIT_THREAD definitions +class _DEBUG_LAST_EVENT_INFO_EXIT_THREAD(Structure): + _fields_ = [ + ("ExitCode", ULONG), + ] +PDEBUG_LAST_EVENT_INFO_EXIT_THREAD = POINTER(_DEBUG_LAST_EVENT_INFO_EXIT_THREAD) +DEBUG_LAST_EVENT_INFO_EXIT_THREAD = _DEBUG_LAST_EVENT_INFO_EXIT_THREAD + +# Struct _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS definitions +class _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS(Structure): + _fields_ = [ + ("ExitCode", ULONG), + ] +PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS = POINTER(_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS) +DEBUG_LAST_EVENT_INFO_EXIT_PROCESS = _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS + +# Struct _DEBUG_LAST_EVENT_INFO_LOAD_MODULE definitions +class _DEBUG_LAST_EVENT_INFO_LOAD_MODULE(Structure): + _fields_ = [ + ("Base", ULONG64), + ] +PDEBUG_LAST_EVENT_INFO_LOAD_MODULE = POINTER(_DEBUG_LAST_EVENT_INFO_LOAD_MODULE) +DEBUG_LAST_EVENT_INFO_LOAD_MODULE = _DEBUG_LAST_EVENT_INFO_LOAD_MODULE + +# Struct _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE definitions +class _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE(Structure): + _fields_ = [ + ("Base", ULONG64), + ] +PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE = POINTER(_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE) +DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE = _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE + +# Struct _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR definitions +class _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR(Structure): + _fields_ = [ + ("Error", ULONG), + ("Level", ULONG), + ] +PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR = POINTER(_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR) +DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR = _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR + +# Struct _DEBUG_SPECIFIC_FILTER_PARAMETERS definitions +class _DEBUG_SPECIFIC_FILTER_PARAMETERS(Structure): + _fields_ = [ + ("ExecutionOption", ULONG), + ("ContinueOption", ULONG), + ("TextSize", ULONG), + ("CommandSize", ULONG), + ("ArgumentSize", ULONG), + ] +DEBUG_SPECIFIC_FILTER_PARAMETERS = _DEBUG_SPECIFIC_FILTER_PARAMETERS +PDEBUG_SPECIFIC_FILTER_PARAMETERS = POINTER(_DEBUG_SPECIFIC_FILTER_PARAMETERS) + +# Struct _DEBUG_EXCEPTION_FILTER_PARAMETERS definitions +class _DEBUG_EXCEPTION_FILTER_PARAMETERS(Structure): + _fields_ = [ + ("ExecutionOption", ULONG), + ("ContinueOption", ULONG), + ("TextSize", ULONG), + ("CommandSize", ULONG), + ("SecondCommandSize", ULONG), + ("ExceptionCode", ULONG), + ] +PDEBUG_EXCEPTION_FILTER_PARAMETERS = POINTER(_DEBUG_EXCEPTION_FILTER_PARAMETERS) +DEBUG_EXCEPTION_FILTER_PARAMETERS = _DEBUG_EXCEPTION_FILTER_PARAMETERS + +# Struct _GUID definitions +class _GUID(Structure): + _fields_ = [ + ("Data1", ULONG), + ("Data2", USHORT), + ("Data3", USHORT), + ("Data4", UCHAR * 8), + ] +GUID = _GUID + +# Struct _CRYPTOAPI_BLOB definitions +class _CRYPTOAPI_BLOB(Structure): + _fields_ = [ + ("cbData", DWORD), + ("pbData", POINTER(BYTE)), + ] +CRYPT_INTEGER_BLOB = _CRYPTOAPI_BLOB +PCRYPT_DATA_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRYPT_OBJID_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRYPT_DER_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRL_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRYPT_UINT_BLOB = POINTER(_CRYPTOAPI_BLOB) +CERT_NAME_BLOB = _CRYPTOAPI_BLOB +PCRYPT_DIGEST_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRYPT_INTEGER_BLOB = POINTER(_CRYPTOAPI_BLOB) +CERT_RDN_VALUE_BLOB = _CRYPTOAPI_BLOB +PCERT_NAME_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRYPT_HASH_BLOB = POINTER(_CRYPTOAPI_BLOB) +CRYPT_DATA_BLOB = _CRYPTOAPI_BLOB +DATA_BLOB = _CRYPTOAPI_BLOB +CRYPT_UINT_BLOB = _CRYPTOAPI_BLOB +PCERT_RDN_VALUE_BLOB = POINTER(_CRYPTOAPI_BLOB) +CRYPT_HASH_BLOB = _CRYPTOAPI_BLOB +CRL_BLOB = _CRYPTOAPI_BLOB +PCERT_BLOB = POINTER(_CRYPTOAPI_BLOB) +CRYPT_DIGEST_BLOB = _CRYPTOAPI_BLOB +CRYPT_OBJID_BLOB = _CRYPTOAPI_BLOB +CERT_BLOB = _CRYPTOAPI_BLOB +CRYPT_DER_BLOB = _CRYPTOAPI_BLOB +PDATA_BLOB = POINTER(_CRYPTOAPI_BLOB) +PCRYPT_ATTR_BLOB = POINTER(_CRYPTOAPI_BLOB) +CRYPT_ATTR_BLOB = _CRYPTOAPI_BLOB + +# Struct WINTRUST_FILE_INFO_ definitions +class WINTRUST_FILE_INFO_(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("pcwszFilePath", LPCWSTR), + ("hFile", HANDLE), + ("pgKnownSubject", POINTER(GUID)), + ] +WINTRUST_FILE_INFO = WINTRUST_FILE_INFO_ +PWINTRUST_FILE_INFO = POINTER(WINTRUST_FILE_INFO_) + +# Struct _CRYPT_ATTRIBUTE definitions +class _CRYPT_ATTRIBUTE(Structure): + _fields_ = [ + ("pszObjId", LPSTR), + ("cValue", DWORD), + ("rgValue", PCRYPT_ATTR_BLOB), + ] +PCRYPT_ATTRIBUTE = POINTER(_CRYPT_ATTRIBUTE) +CRYPT_ATTRIBUTE = _CRYPT_ATTRIBUTE + +# Struct _CTL_ENTRY definitions +class _CTL_ENTRY(Structure): + _fields_ = [ + ("SubjectIdentifier", CRYPT_DATA_BLOB), + ("cAttribute", DWORD), + ("rgAttribute", PCRYPT_ATTRIBUTE), + ] +PCTL_ENTRY = POINTER(_CTL_ENTRY) +CTL_ENTRY = _CTL_ENTRY + +# Struct _CRYPT_ATTRIBUTE definitions +class _CRYPT_ATTRIBUTE(Structure): + _fields_ = [ + ("pszObjId", LPSTR), + ("cValue", DWORD), + ("rgValue", PCRYPT_ATTR_BLOB), + ] +PCRYPT_ATTRIBUTE = POINTER(_CRYPT_ATTRIBUTE) +CRYPT_ATTRIBUTE = _CRYPT_ATTRIBUTE + +# Struct _CRYPT_ATTRIBUTES definitions +class _CRYPT_ATTRIBUTES(Structure): + _fields_ = [ + ("cAttr", DWORD), + ("rgAttr", PCRYPT_ATTRIBUTE), + ] +CRYPT_ATTRIBUTES = _CRYPT_ATTRIBUTES +PCRYPT_ATTRIBUTES = POINTER(_CRYPT_ATTRIBUTES) + +# Struct _CRYPT_ALGORITHM_IDENTIFIER definitions +class _CRYPT_ALGORITHM_IDENTIFIER(Structure): + _fields_ = [ + ("pszObjId", LPSTR), + ("Parameters", CRYPT_OBJID_BLOB), + ] +CRYPT_ALGORITHM_IDENTIFIER = _CRYPT_ALGORITHM_IDENTIFIER +PCRYPT_ALGORITHM_IDENTIFIER = POINTER(_CRYPT_ALGORITHM_IDENTIFIER) + +# Struct _CMSG_SIGNER_INFO definitions +class _CMSG_SIGNER_INFO(Structure): + _fields_ = [ + ("dwVersion", DWORD), + ("Issuer", CERT_NAME_BLOB), + ("SerialNumber", CRYPT_INTEGER_BLOB), + ("HashAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("HashEncryptionAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("EncryptedHash", CRYPT_DATA_BLOB), + ("AuthAttrs", CRYPT_ATTRIBUTES), + ("UnauthAttrs", CRYPT_ATTRIBUTES), + ] +CMSG_SIGNER_INFO = _CMSG_SIGNER_INFO +PCMSG_SIGNER_INFO = POINTER(_CMSG_SIGNER_INFO) + +# Struct _CERT_EXTENSION definitions +class _CERT_EXTENSION(Structure): + _fields_ = [ + ("pszObjId", LPSTR), + ("fCritical", BOOL), + ("Value", CRYPT_OBJID_BLOB), + ] +CERT_EXTENSION = _CERT_EXTENSION +PCERT_EXTENSION = POINTER(_CERT_EXTENSION) + +# Struct _CTL_USAGE definitions +class _CTL_USAGE(Structure): + _fields_ = [ + ("cUsageIdentifier", DWORD), + ("rgpszUsageIdentifier", POINTER(LPSTR)), + ] +CERT_ENHKEY_USAGE = _CTL_USAGE +PCTL_USAGE = POINTER(_CTL_USAGE) +CTL_USAGE = _CTL_USAGE +PCERT_ENHKEY_USAGE = POINTER(_CTL_USAGE) + +# Struct _CTL_INFO definitions +class _CTL_INFO(Structure): + _fields_ = [ + ("dwVersion", DWORD), + ("SubjectUsage", CTL_USAGE), + ("ListIdentifier", CRYPT_DATA_BLOB), + ("SequenceNumber", CRYPT_INTEGER_BLOB), + ("ThisUpdate", FILETIME), + ("NextUpdate", FILETIME), + ("SubjectAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("cCTLEntry", DWORD), + ("rgCTLEntry", PCTL_ENTRY), + ("cExtension", DWORD), + ("rgExtension", PCERT_EXTENSION), + ] +CTL_INFO = _CTL_INFO +PCTL_INFO = POINTER(_CTL_INFO) + +# Struct _CTL_CONTEXT definitions +class _CTL_CONTEXT(Structure): + _fields_ = [ + ("dwMsgAndCertEncodingType", DWORD), + ("pbCtlEncoded", POINTER(BYTE)), + ("cbCtlEncoded", DWORD), + ("pCtlInfo", PCTL_INFO), + ("hCertStore", HCERTSTORE), + ("hCryptMsg", HCRYPTMSG), + ("pbCtlContent", POINTER(BYTE)), + ("cbCtlContent", DWORD), + ] +PCTL_CONTEXT = POINTER(_CTL_CONTEXT) +CTL_CONTEXT = _CTL_CONTEXT +PCCTL_CONTEXT = POINTER(_CTL_CONTEXT) + +# Struct WINTRUST_CATALOG_INFO_ definitions +class WINTRUST_CATALOG_INFO_(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("dwCatalogVersion", DWORD), + ("pcwszCatalogFilePath", LPCWSTR), + ("pcwszMemberTag", LPCWSTR), + ("pcwszMemberFilePath", LPCWSTR), + ("hMemberFile", HANDLE), + ("pbCalculatedFileHash", POINTER(BYTE)), + ("cbCalculatedFileHash", DWORD), + ("pcCatalogContext", PCCTL_CONTEXT), + ] +PWINTRUST_CATALOG_INFO = POINTER(WINTRUST_CATALOG_INFO_) +WINTRUST_CATALOG_INFO = WINTRUST_CATALOG_INFO_ + +# Struct WINTRUST_BLOB_INFO_ definitions +class WINTRUST_BLOB_INFO_(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("gSubject", GUID), + ("pcwszDisplayName", LPCWSTR), + ("cbMemObject", DWORD), + ("pbMemObject", POINTER(BYTE)), + ("cbMemSignedMsg", DWORD), + ("pbMemSignedMsg", POINTER(BYTE)), + ] +PWINTRUST_BLOB_INFO = POINTER(WINTRUST_BLOB_INFO_) +WINTRUST_BLOB_INFO = WINTRUST_BLOB_INFO_ + +# Struct _CRYPT_BIT_BLOB definitions +class _CRYPT_BIT_BLOB(Structure): + _fields_ = [ + ("cbData", DWORD), + ("pbData", POINTER(BYTE)), + ("cUnusedBits", DWORD), + ] +CRYPT_BIT_BLOB = _CRYPT_BIT_BLOB +PCRYPT_BIT_BLOB = POINTER(_CRYPT_BIT_BLOB) + +# Struct _CERT_PUBLIC_KEY_INFO definitions +class _CERT_PUBLIC_KEY_INFO(Structure): + _fields_ = [ + ("Algorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("PublicKey", CRYPT_BIT_BLOB), + ] +PCERT_PUBLIC_KEY_INFO = POINTER(_CERT_PUBLIC_KEY_INFO) +CERT_PUBLIC_KEY_INFO = _CERT_PUBLIC_KEY_INFO + +# Struct _CERT_INFO definitions +class _CERT_INFO(Structure): + _fields_ = [ + ("dwVersion", DWORD), + ("SerialNumber", CRYPT_INTEGER_BLOB), + ("SignatureAlgorithm", CRYPT_ALGORITHM_IDENTIFIER), + ("Issuer", CERT_NAME_BLOB), + ("NotBefore", FILETIME), + ("NotAfter", FILETIME), + ("Subject", CERT_NAME_BLOB), + ("SubjectPublicKeyInfo", CERT_PUBLIC_KEY_INFO), + ("IssuerUniqueId", CRYPT_BIT_BLOB), + ("SubjectUniqueId", CRYPT_BIT_BLOB), + ("cExtension", DWORD), + ("rgExtension", PCERT_EXTENSION), + ] +CERT_INFO = _CERT_INFO +PCERT_INFO = POINTER(_CERT_INFO) + +# Struct _CERT_CONTEXT definitions +class _CERT_CONTEXT(Structure): + _fields_ = [ + ("dwCertEncodingType", DWORD), + ("pbCertEncoded", POINTER(BYTE)), + ("cbCertEncoded", DWORD), + ("pCertInfo", PCERT_INFO), + ("hCertStore", HCERTSTORE), + ] +CERT_CONTEXT = _CERT_CONTEXT +PCERT_CONTEXT = POINTER(_CERT_CONTEXT) + +# Struct WINTRUST_SGNR_INFO_ definitions +class WINTRUST_SGNR_INFO_(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("pcwszDisplayName", LPCWSTR), + ("psSignerInfo", POINTER(CMSG_SIGNER_INFO)), + ("chStores", DWORD), + ("pahStores", POINTER(HCERTSTORE)), + ] +WINTRUST_SGNR_INFO = WINTRUST_SGNR_INFO_ +PWINTRUST_SGNR_INFO = POINTER(WINTRUST_SGNR_INFO_) + +# Struct _FILETIME definitions +class _FILETIME(Structure): + _fields_ = [ + ("dwLowDateTime", DWORD), + ("dwHighDateTime", DWORD), + ] +LPFILETIME = POINTER(_FILETIME) +PFILETIME = POINTER(_FILETIME) +FILETIME = _FILETIME + +# Struct WINTRUST_CERT_INFO_ definitions +class WINTRUST_CERT_INFO_(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("pcwszDisplayName", LPCWSTR), + ("psCertContext", POINTER(CERT_CONTEXT)), + ("chStores", DWORD), + ("pahStores", POINTER(HCERTSTORE)), + ("dwFlags", DWORD), + ("psftVerifyAsOf", POINTER(FILETIME)), + ] +WINTRUST_CERT_INFO = WINTRUST_CERT_INFO_ +PWINTRUST_CERT_INFO = POINTER(WINTRUST_CERT_INFO_) + +# Struct _TMP_WINTRUST_UNION_TYPE definitions +class _TMP_WINTRUST_UNION_TYPE(Union): + _fields_ = [ + ("pFile", POINTER(WINTRUST_FILE_INFO_)), + ("pCatalog", POINTER(WINTRUST_CATALOG_INFO_)), + ("pBlob", POINTER(WINTRUST_BLOB_INFO_)), + ("pSgnr", POINTER(WINTRUST_SGNR_INFO_)), + ("pCert", POINTER(WINTRUST_CERT_INFO_)), + ] +TMP_WINTRUST_UNION_TYPE = _TMP_WINTRUST_UNION_TYPE + +# Struct _WINTRUST_DATA definitions +class _WINTRUST_DATA(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("pPolicyCallbackData", LPVOID), + ("pSIPClientData", LPVOID), + ("dwUIChoice", DWORD), + ("fdwRevocationChecks", DWORD), + ("dwUnionChoice", DWORD), + ("tmp_union", TMP_WINTRUST_UNION_TYPE), + ("dwStateAction", DWORD), + ("hWVTStateData", HANDLE), + ("pwszURLReference", POINTER(WCHAR)), + ("dwProvFlags", DWORD), + ("dwUIContext", DWORD), + ] +PWINTRUST_DATA = POINTER(_WINTRUST_DATA) +WINTRUST_DATA = _WINTRUST_DATA + +# Struct _PROCESS_BASIC_INFORMATION definitions +class _PROCESS_BASIC_INFORMATION(Structure): + _fields_ = [ + ("Reserved1", PVOID), + ("PebBaseAddress", PPEB), + ("Reserved2", PVOID * 2), + ("UniqueProcessId", ULONG_PTR), + ("Reserved3", PVOID), + ] +PPROCESS_BASIC_INFORMATION = POINTER(_PROCESS_BASIC_INFORMATION) +PROCESS_BASIC_INFORMATION = _PROCESS_BASIC_INFORMATION + diff --git a/pe_parse.py b/pe_parse.py index baa0eff..a5577b2 100644 --- a/pe_parse.py +++ b/pe_parse.py @@ -225,10 +225,10 @@ def PEFile(baseaddr, target=None): else: import_by_name = create_structure_at(IMPORT_BY_NAME, baseaddr + int_entry.AddressOfData) name_address = baseaddr + int_entry.AddressOfData + type(import_by_name).Name.offset - if proc_bitness == 32 and targetedbitness == 64: - name = rctypes.Remote_c_char_p64(name_address, target=target).value - else: + if target is None: name = ctypes.c_char_p(name_address).value + else: + name = create_structure_at(ctypes.c_char_p, name_address).value.decode() res.append((import_by_name.Hint, name)) int_addr += ctypes.sizeof(type(int_entry)) int_entry = create_structure_at(THUNK_DATA, int_addr) diff --git a/syswow64.py b/syswow64.py index 6e1a9e6..a177a24 100644 --- a/syswow64.py +++ b/syswow64.py @@ -22,7 +22,7 @@ dummy_jump = "\xea" + struct.pack("= 1: + code_64b += x64.Mov('RCX', x64.create_displacement(disp=argument_buffer)) + if nb_args >= 2: + code_64b += x64.Mov('RDX', x64.create_displacement(disp=argument_buffer + (8 * 1))) + if nb_args >= 3: + code_64b += x64.Mov('R8', x64.create_displacement(disp=argument_buffer + (8 * 2))) + if nb_args >= 4: + code_64b += x64.Mov('R9', x64.create_displacement(disp=argument_buffer + (8 * 3))) + for i in range(nb_args_on_stack): + code_64b += x64.Mov('RAX', x64.create_displacement(disp=argument_buffer + 8 * (nb_args - 1 - i))) + code_64b += x64.Push('RAX') + + # reserve space for register (calling convention) + code_64b += x64.Push('R9') + code_64b += x64.Push('R8') + code_64b += x64.Push('RDX') + code_64b += x64.Push('RCX') + # Call + code_64b += x64.Mov('R13', target_addr) + code_64b += x64.Call('R13') + # Clean stack + code_64b += x64.Add('RSP', (4 + nb_args_on_stack) * 8) + code_64b += x64.Pop('R13') + code_64b += x64.Pop('R12') + code_64b += x64.Pop('R11') + code_64b += x64.Pop('R10') + code_64b += x64.Pop('R9') + code_64b += x64.Pop('R8') + code_64b += x64.Pop('RDI') + code_64b += x64.Pop('RSI') + code_64b += x64.Pop('RDX') + code_64b += x64.Pop('RCX') + code_64b += x64.Pop('RBX') + return try_generate_stub_target(code_64b.get_code(), argument_buffer, target) + # TODO: this code should be a winfuct of type prototype :) + + +def try_generate_stub_target(shellcode, argument_buffer, target): + """shellcode must NOT end by a ret""" + if not windows.current_process.is_wow_64: + raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process") + addr = windows.winproxy.VirtualAlloc(dwSize=0x1000) + # post-exec 32bits stub (ret) + ret = "\xC3" + ret_addr = addr + shell_code_addr = ret_addr + len(ret) + len(dummy_jump) + # ljmp + jump = "\xea" + struct.pack("