Adding Process.priority + fix in WMI raised exceptions + add x86.Iret

ctypes_generation/definitions/winfunc.txt

@@ -110,6 +110,16 @@ BOOL WINAPI GetExitCodeProcess(
     __out LPDWORD lpExitCode
 );
 
+
+BOOL WINAPI SetPriorityClass(
+  _In_ HANDLE hProcess,
+  _In_ DWORD  dwPriorityClass
+);
+
+DWORD WINAPI GetPriorityClass(
+  _In_ HANDLE hProcess
+);
+
 LPVOID WINAPI VirtualAlloc(
   _In_opt_  LPVOID lpAddress,
   _In_      SIZE_T dwSize,

windows/generated_def/windef.py

@@ -1940,14 +1940,4 @@ RPC_RESPONSE_TYPE_FAIL = make_flag("RPC_RESPONSE_TYPE_FAIL", 2)
 RPC_RESPONSE_TYPE_SUCESS = make_flag("RPC_RESPONSE_TYPE_SUCESS", 3)
 BIND_IF_SYNTAX_NDR32 = make_flag("BIND_IF_SYNTAX_NDR32", 1)
 BIND_IF_SYNTAX_NDR64 = make_flag("BIND_IF_SYNTAX_NDR64", 2)
-BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4)
-EVENTLOG_SUCCESS = make_flag("EVENTLOG_SUCCESS", 0x0000)
-EVENTLOG_ERROR_TYPE = make_flag("EVENTLOG_ERROR_TYPE", 0x0001)
-EVENTLOG_WARNING_TYPE = make_flag("EVENTLOG_WARNING_TYPE", 0x0002)
-EVENTLOG_INFORMATION_TYPE = make_flag("EVENTLOG_INFORMATION_TYPE", 0x0004)
-EVENTLOG_AUDIT_SUCCESS = make_flag("EVENTLOG_AUDIT_SUCCESS", 0x0008)
-EVENTLOG_AUDIT_FAILURE = make_flag("EVENTLOG_AUDIT_FAILURE", 0x0010)
-EVENTLOG_SEQUENTIAL_READ = make_flag("EVENTLOG_SEQUENTIAL_READ", 0x0001)
-EVENTLOG_SEEK_READ = make_flag("EVENTLOG_SEEK_READ", 0x0002)
-EVENTLOG_FORWARDS_READ = make_flag("EVENTLOG_FORWARDS_READ", 0x0004)
-EVENTLOG_BACKWARDS_READ = make_flag("EVENTLOG_BACKWARDS_READ", 0x0008)
+BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4)

windows/generated_def/winstructs.py

@@ -4410,32 +4410,3 @@ class _RPC_IF_ID(INITIAL_RPC_IF_ID):
     def __repr__(self):
         return '<RPC_IF_ID "{0}" ({1}, {2})>'.format(self.Uuid.to_string(), self.VersMajor, self.VersMinor)
 RPC_IF_ID = _RPC_IF_ID
-
-class _EVENTLOGRECORD(Structure):
-    _fields_ = [
-        ("Length", DWORD),
-        ("Reserved", DWORD),
-        ("RecordNumber", DWORD),
-        ("TimeGenerated", DWORD),
-        ("TimeWritten", DWORD),
-        ("EventID", DWORD),
-        ("EventType", WORD),
-        ("NumStrings", WORD),
-        ("EventCategory", WORD),
-        ("ReservedFlags", WORD),
-        ("ClosingRecordNumber", DWORD),
-        ("StringOffset", DWORD),
-        ("UserSidLength", DWORD),
-        ("UserSidOffset", DWORD),
-        ("DataLength", DWORD),
-        ("DataOffset", DWORD),
-    ]
-PEVENTLOGRECORD = POINTER(_EVENTLOGRECORD)
-EVENTLOGRECORD = _EVENTLOGRECORD
-
-class _EVENTLOG_FULL_INFORMATION(Structure):
-    _fields_ = [
-        ("dwFull", DWORD),
-    ]
-EVENTLOG_FULL_INFORMATION = _EVENTLOG_FULL_INFORMATION
-LPEVENTLOG_FULL_INFORMATION = POINTER(_EVENTLOG_FULL_INFORMATION)

windows/native_exec/simple_x86.py

@@ -817,6 +817,9 @@ class Retf(Instruction):
 class Int3(Instruction):
     encoding = [(RawBits.from_int(8, 0xcc),)]
 
+class Iret(Instruction):
+    encoding = [(RawBits.from_int(8, 0xcf),)]
+
 
 class _NopArtifact(Nop):
     """Special NOP used in shellcode reduction"""

windows/winobject/process.py

@@ -681,6 +681,15 @@ class Process(AutoHandle):
         user = (UserTime.dwHighDateTime << 32) + UserTime.dwLowDateTime
         return TimeInfo(creation, exit, kernel, user)
 
+    def get_priority(self):
+        return winproxy.GetPriorityClass(self.handle)
+
+    def set_priority(self, priority):
+        return winproxy.SetPriorityClass(self.handle, priority)
+
+    priority = property(get_priority, set_priority)
+    """The priority of the process"""
+
 
     def open_token(self, flags=TOKEN_QUERY):
         token_handle = HANDLE()

windows/winobject/wmi.py

@@ -51,7 +51,7 @@ class WmiRequester(object):
             self.service.ExecQuery("WQL", query, 0x20, 0, ctypes.byref(enumerator))
         except WindowsError as e:
             if (e.winerror & 0xffffffff) ==  WBEM_E_INVALID_CLASS:
-                raise WindowsError(e.winerror, 'WBEM_E_INVALID_CLASS <Invalid WMI class "{0}">'.format(frm))
+                raise WindowsError(e.winerror, 'WBEM_E_INVALID_CLASS <Invalid WMI class "{0}">'.format(query))
             elif (e.winerror & 0xffffffff) in WBEMSTATUS.values:
                 raise WindowsError(e.winerror, WBEMSTATUS(e.winerror & 0xffffffff).value)
             raise

windows/winproxy.py

@@ -498,11 +498,18 @@ def Thread32Next(hSnapshot, lpte):
 def Process32First(hSnapshot, lpte):
     return Process32First.ctypes_function(hSnapshot, lpte)
 
-
 @Kernel32Proxy("Process32Next", no_error_check)
 def Process32Next(hSnapshot, lpte):
     return Process32Next.ctypes_function(hSnapshot, lpte)
 
+@Kernel32Proxy("GetPriorityClass")
+def GetPriorityClass(hProcess):
+    return GetPriorityClass.ctypes_function(hProcess)
+
+@Kernel32Proxy("SetPriorityClass")
+def SetPriorityClass(hProcess, dwPriorityClass):
+    return SetPriorityClass.ctypes_function(hProcess, dwPriorityClass)
+
 @Kernel32Proxy("OpenEventA")
 def OpenEventA(dwDesiredAccess, bInheritHandle, lpName):
     return OpenEventA.ctypes_function(dwDesiredAccess, bInheritHandle, lpName)
@@ -750,7 +757,6 @@ def GetWindowsDirectoryW(lpBuffer, uSize=None):
     return GetWindowsDirectoryW.ctypes_function(lpBuffer, uSize)
 
 
-
 # ### NTDLL #### #
 
 @NtdllProxy('NtReadVirtualMemory', error_ntstatus)