diff --git a/samples/process/thread.py b/samples/process/thread.py new file mode 100644 index 0000000..3942146 --- /dev/null +++ b/samples/process/thread.py @@ -0,0 +1,56 @@ +import sys +import os.path +sys.path.append(os.path.abspath(__file__ + "\..\..")) + +import windows +import windows.native_exec.simple_x86 as x86 +import windows.native_exec.simple_x64 as x64 + +print("Creating a notepad") ## Replaced calc.exe by notepad.exe cause of windows 10. +notepad = windows.utils.create_process(r"C:\windows\system32\notepad.exe") +# You don't need to do that in our case, but it's useful to now + +print("Priting threads") +for th in notepad.threads: + print(" * {0}".format(th)) + +print("Writing some code in memory") + + +if notepad.bitness == 32: + code = "mov eax, 0x42424242; label :start ; jmp :start; nop; nop; ret" + rawcode = x86.assemble(code) +else: + code = "mov rax, 0x4242424242424242; label :start ; jmp :start; nop; nop; ret" + rawcode = x64.assemble(code) + +print("Allocating memory") +with notepad.allocated_memory(0x1000) as addr: + print("Writing code at <{0:#x}>".format(addr)) + notepad.write_memory(addr, rawcode) + + print("Creating thread on injected code") + t = notepad.create_thread(addr, 0x11223344) + print("New thread is {0}".format(t)) + + print("Suspending thread") + t.suspend() + + ctx = t.context + print("Thread context is {0}".format(ctx)) + print("Dumping thread context:") + ctx.dump() + print("Changing context") + ctx.pc += 2 # EIP / RIP + ctx.func_result = 0x12345678 # EAX / RAX + print("Setting new thread context") + t.set_context(ctx) + print("Resuming thread") + t.resume() + print("Waiting thread") + t.wait() + print("Thread has exit: {0}".format(t.is_exit)) + print("Thread exit value = {0:#x}".format(t.exit_code)) + + + diff --git a/tests/test_system.py b/tests/test_system.py index 075be45..4aeb6ef 100644 --- a/tests/test_system.py +++ b/tests/test_system.py @@ -17,12 +17,27 @@ class TestSystemWithCheckGarbage(object): def test_services(self): return windows.system.services + def test_services_process(self): + services_with_process = [s for s in windows.system.services if s.ServiceStatusProcess.dwProcessId] + service = services_with_process[0] + proc = service.process + assert proc.pid == service.ServiceStatusProcess.dwProcessId + def test_logicaldrives(self): return windows.system.logicaldrives def test_wmi(self): return windows.system.wmi.select("Win32_Process", "*") + def test_handles(self): + return windows.system.handles + + def test_handle_process(self): + handle_with_process = [h for h in windows.system.handles if h.dwProcessId] + handle = handle_with_process[-1] + proc = handle.process + assert proc.pid == handle.dwProcessId + @check_for_gc_garbage class TestSystemWithCheckGarbageAndHandleLeak(object): diff --git a/windows/__init__.py b/windows/__init__.py index daa7bd0..6c97ec8 100644 --- a/windows/__init__.py +++ b/windows/__init__.py @@ -37,15 +37,3 @@ import windows.syswow64 import windows.com __all__ = ["system", 'current_process', 'current_thread'] - -import os -if bool(os.environ.get("SPHINX_BUILD", 0)): - # I know it's shameful - # But it's the only way I can think of right now to get a full class - # of PEFile for documentation purpose u_u - - ppe = windows.current_process.peb.modules[0].pe - windows.pe_parse.PEFile = type(ppe) - iat_entry = ppe.imports.values()[0][0] - windows.pe_parse.IATEntry = type(iat_entry) - diff --git a/windows/winobject/handle.py b/windows/winobject/handle.py index 0de08c0..0c099bf 100644 --- a/windows/winobject/handle.py +++ b/windows/winobject/handle.py @@ -19,8 +19,9 @@ class Handle(SYSTEM_HANDLE): """The process possessing the handle :type: :class:`WinProcess `""" - "TODO: something smart ? :D" - return [p for p in windows.system.processes if p.pid == self.dwProcessId][0] + # "TODO: something smart ? :D" + # return [p for p in windows.system.processes if p.pid == self.dwProcessId][0] + return windows.WinProcess(pid=self.dwProcessId) @windows.utils.fixedpropety def name(self): diff --git a/windows/winobject/service.py b/windows/winobject/service.py index 9dd3e6b..062fb4b 100644 --- a/windows/winobject/service.py +++ b/windows/winobject/service.py @@ -85,10 +85,8 @@ class Service(object): pid = self.ServiceStatusProcess.dwProcessId if not pid: return None - l = [p for p in windows.system.processes if p.pid == pid] - if not l: - return None # Other thing ? - return l[0] + l = windows.WinProcess(pid=pid) + return l class ServiceA(Service, ENUM_SERVICE_STATUS_PROCESSA):