Add samples for current_process and remote process interface

samples/current_process.py

@@ -0,0 +1,46 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.native_exec.simple_x86 as x86
+import windows.native_exec.simple_x64 as x64
+# Here is our current process
+cp = windows.current_process
+
+print("current process is {cp}".format(cp=windows.current_process))
+print("current process is a <{cp.bitness}> bits process".format(cp=cp))
+print("current process is a SysWow64 process ? <{cp.is_wow_64}>".format(cp=cp))
+print("current process pid <{cp.pid}>  and ppid <{cp.ppid}>".format(cp=cp))
+print("Here are the current process threads: <{cp.threads}>".format(cp=cp))
+
+print("Let's execute some native code ! (0x41 + 1)")
+
+if windows.current_process.bitness == 32:
+    # Let's generate some native code
+    code =  x86.MultipleInstr()
+    code += x86.Mov("Eax", 0x41)
+    code += x86.Inc("EAX")
+    code += x86.Ret()
+else:
+    code =  x64.MultipleInstr()
+    code += x64.Mov("RAX", 0x41)
+    code += x64.Inc("RAX")
+    code += x64.Ret()
+    
+native_code = code.get_code()
+
+v = windows.current_process.execute(native_code)
+print("Waiting for execution to finish !")
+v.wait()
+print("Native code returned <{0}>".format(hex(v.exit_code)))
+
+print("Allocating memory in current process")
+addr = cp.virtual_alloc(0x1000) # Default alloc is RWX (so secure !)
+print("Allocated memory is at <{0}>".format(hex(addr)))
+
+print("Writing 'SOME STUFF' in allocation memory")
+cp.write_memory(addr, "SOME STUFF")
+print("Reading memory : <{0}>".format(repr(cp.read_memory(addr, 20))))
+
+

samples/remote_calc.py

@@ -0,0 +1,92 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.native_exec.simple_x86 as x86
+import windows.native_exec.simple_x64 as x64
+
+print("Creating a calc")
+calc = windows.utils.create_process(r"C:\windows\system32\calc.exe")
+# You don't need to do that in our case, but it's useful to now
+print("Looking for calcs in the processes")
+all_calcs = [proc for proc in windows.system.processes if proc.name == "calc.exe"]
+print("They are currently <{0}> calcs running on the system".format(len(all_calcs)))
+
+print("Let's play with our calc: <{calc}>".format(calc=calc))
+print("Our calc pid is {calc.pid}".format(calc=calc))
+print("Our calc is a <{calc.bitness}> bits process".format(calc=calc))
+print("Our calc is a SysWow64 process ? <{calc.is_wow_64}>".format(calc=calc))
+print("Our calc have threads ! <{calc.threads}>".format(calc=calc))
+
+# PEB STUFF
+peb = calc.peb
+print("Exploring our calc PEB ! {peb}".format(peb=peb))
+print("Command line is {peb.commandline}".format(peb=peb))
+modules = peb.modules
+print("Here are 3 loaded modules: {0}".format(modules[:3]))
+# See iat_hook.py for module exploration
+
+
+# Remote alloc / read / write
+
+print("Allocating memory in our calc")
+addr = calc.virtual_alloc(0x1000)
+print("Allocated memory is at <{0}>".format(hex(addr)))
+print("Writing 'SOME STUFF' in allocated memory")
+calc.write_memory(addr, "SOME STUFF")
+print("Reading allocated memory : <{0}>".format(repr(calc.read_memory(addr, 20))))
+
+
+# Remote Execution
+
+print("Execution some native code in our calc (write 0x424242 at allocated address + return 0x1337")
+
+if calc.bitness == 32:
+    # Let's generate some native code
+    code =  x86.MultipleInstr()
+    code += x86.Mov(x86.deref(addr), 0x42424242)
+    code += x86.Mov("EAX", 0x1337)
+    code += x86.Ret()
+else:
+    code =  x64.MultipleInstr()
+    code += x64.Mov('RAX', addr)
+    code += x64.Mov(x64.mem("[RAX]"), 0x42424242)
+    code += x64.Mov("RAX", 0x1337)
+    code += x64.Ret()
+    
+print("Executing native code !")
+t = calc.execute(code.get_code())
+t.wait()
+print("Return code = {0}".format(hex(t.exit_code)))
+print("Reading allocated memory : <{0}>".format(repr(calc.read_memory(addr, 20))))
+
+print("Executing python code !")
+# Make 'windows' importable in remote python
+calc.execute_python("import sys; sys.path.append(r'{0}')".format(sys.path[-1]))
+
+calc.execute_python("import windows")
+# Let's write in the calc 'current_process' memory :)
+calc.execute_python("addr = {addr}; windows.current_process.write_memory(addr, 'HELLO FROM CALC')".format(addr=addr))
+print("Reading allocated memory : <{0}>".format(repr(calc.read_memory(addr, 20))))
+
+# python_execute is 'safe':
+# - it waits for the thread completion
+# - it raise an error if remote code raised some
+
+try:
+    print("Trying to import in remote module 'FAKE_MODULE'")
+    calc.execute_python("def func():\n   import FAKE_MODULE\nfunc()")
+except windows.injection.RemotePythonError as e:
+    print("Remote ERROR !")
+    print(e)
+    
+print("That's all ! killing the calc")
+calc.exit()
+    
+
+
+
+
+
+