mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Update samples output
This commit is contained in:
hakril
@@ -1,15 +1,15 @@
|
||||
(cmd) python com\com_inetfwpolicy2.py
|
||||
Initialisation of COM
|
||||
Creating INetFwPolicy2 variable
|
||||
<INetFwPolicy2 object at 0x060677B0> (value = None)
|
||||
<INetFwPolicy2<NULL> at 0x2925a3e2350> (value = None)
|
||||
|
||||
Generating CLSID
|
||||
<IID "E2B3C97F-6AE1-41AC-817A-F6F92166D7DD">
|
||||
<GUID "E2B3C97F-6AE1-41AC-817A-F6F92166D7DD">
|
||||
|
||||
Creating COM instance
|
||||
<INetFwPolicy2 object at 0x060677B0> (value = 0x85678080)
|
||||
<INetFwPolicy2 at 0x2925a3e2350> (value = 0x2827524184096)
|
||||
|
||||
Checking for enabled profiles
|
||||
* NET_FW_PROFILE2_DOMAIN(0x1L) -> True
|
||||
* NET_FW_PROFILE2_PRIVATE(0x2L) -> True
|
||||
* NET_FW_PROFILE2_PUBLIC(0x4L) -> True
|
||||
* NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_DOMAIN(0x1) -> True
|
||||
* NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_PRIVATE(0x2) -> True
|
||||
* NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_PUBLIC(0x4) -> True
|
||||
|
||||
@@ -4,12 +4,12 @@ Catching call to <INetFwPolicy2.FirewallEnabled>
|
||||
Info about parameters 0:
|
||||
* param0info.fIn -> 0x1
|
||||
* param0info.fOut -> 0x0
|
||||
* param0info.stackOffset -> 0x4L
|
||||
* param0info.cbParam -> 0x4L
|
||||
* param0info.stackOffset -> 0x8
|
||||
* param0info.cbParam -> 0x8
|
||||
param0 value = 2
|
||||
Leaving the sink !
|
||||
return value = 1234
|
||||
firewall enabled = VARIANT_BOOL(True)
|
||||
Testing a function taking a PTR to a COM interface
|
||||
Before call: (<ICallFrameEvents object at 0x066EF3F0>, None)
|
||||
After call: (<ICallFrameEvents object at 0x066EF3F0>, 107934504)
|
||||
Before call: (<ICallFrameEvents<NULL> at 0x1fb65de5550>, None)
|
||||
After call: (<ICallFrameEvents at 0x1fb65de5550>, 2179257488408)
|
||||
|
||||
@@ -16,18 +16,18 @@ Chain 0:
|
||||
* issuer: <Microsoft Root Certificate Authority 2010>
|
||||
|
||||
Looking for <Microsoft Root Certificate Authority 2010> in trusted certificates
|
||||
matches = [<Certificate "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">]
|
||||
Found it !
|
||||
matches = []
|
||||
Not found :(
|
||||
|
||||
== PE Analysis ==
|
||||
Target sha1 = <339e4c236e716d4b6f6b10359c425eb3d1478df7>
|
||||
Analysing <CryptObject "C:\windows\system32\ntdll.dll" content_type=CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED(0xaL)>
|
||||
Target sha1 = <5f7905b56952e28316edcbce0206d7bec34de2a1>
|
||||
Analysing <CryptObject "C:\windows\system32\ntdll.dll" content_type=CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED(0xa)>
|
||||
File has 1 signer(s):
|
||||
Signer 0:
|
||||
* Issuer: bytearray(b'0\x81\x841\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\nWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\n\x13\x15Microsoft Corporation1.0,\x06\x03U\x04\x03\x13%Microsoft Windows Production PCA 2011')
|
||||
* HashAlgorithme: 2.16.840.1.101.3.4.2.1
|
||||
* Certificate: <Certificate "Microsoft Windows" serial="33 00 00 01 73 30 31 07 26 65 b8 b9 b3 00 00 00 00 01 73">
|
||||
* HashAlgorithme: b'2.16.840.1.101.3.4.2.1'
|
||||
* Certificate: <Certificate "Microsoft Windows" serial="33 00 00 04 5c 3d 56 72 66 6c b7 54 17 00 00 00 00 04 5c">
|
||||
|
||||
File embdeds 2 certificate(s):
|
||||
* 0) <Certificate "Microsoft Windows" serial="33 00 00 01 73 30 31 07 26 65 b8 b9 b3 00 00 00 00 01 73">
|
||||
* 0) <Certificate "Microsoft Windows" serial="33 00 00 04 5c 3d 56 72 66 6c b7 54 17 00 00 00 00 04 5c">
|
||||
* 1) <Certificate "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">
|
||||
|
||||
@@ -4,12 +4,12 @@ Checking signature of <C:\windows\system32\ntdll.dll>
|
||||
check_signature: <0>
|
||||
full_signature_information:
|
||||
* signed <True>
|
||||
* catalog <C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_802_for_KB4054517~31bf3856ad364e35~amd64~~10.0.1.6.cat>
|
||||
* catalog <C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package051420~31bf3856ad364e35~amd64~~10.0.22621.3593.cat>
|
||||
* catalogsigned <True>
|
||||
* additionalinfo <0>
|
||||
Checking signature of some loaded DLL
|
||||
<c:\python27\python.exe> : False (TRUST_E_NOSIGNATURE(0x800b0100L))
|
||||
<c:\users\cleme\appdata\local\programs\python\python311\python.exe> : True
|
||||
<c:\windows\system32\ntdll.dll> : True
|
||||
<c:\windows\system32\kernel32.dll> : True
|
||||
<c:\windows\system32\kernelbase.dll> : True
|
||||
<c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcr90.dll> : True
|
||||
<c:\windows\system32\ucrtbase.dll> : True
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
(cmd) python debug\attach.py
|
||||
Finding process with pid <12252>
|
||||
Target is <WinProcess "notepad.exe" pid 12252 at 0x66971b0>
|
||||
Debugger attached: <windows.debug.debugger.Debugger object at 0x0667CFD0>
|
||||
Finding process with pid <27576>
|
||||
Target is <WinProcess "winver.exe" pid 27576 at 0x223f0862d90>
|
||||
Debugger attached: <windows.debug.debugger.Debugger object at 0x00000223F084A110>
|
||||
|
||||
NtCreateFile of <10573272>: handle = 0x144
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui>
|
||||
NtCreateFile of <54203712>: handle = 0x1c8
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume3\Windows\Globalization\Sorting\SortDefault.nls>
|
||||
|
||||
NtCreateFile of <1996168876>: handle = 0x170
|
||||
Handle manually found! typename=<File>, name=<\Device\DeviceApi>
|
||||
NtCreateFile of <54268840>: handle = 0x1f0
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume3\Windows\Fonts\StaticCache.dat>
|
||||
|
||||
NtCreateFile of <10504328>: handle = 0x2a8
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
|
||||
NtCreateFile of <54280288>: handle = 0x200
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume3\Windows\Branding\Basebrd\basebrd.dll>
|
||||
|
||||
Exiting process
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
(cmd) python debug\debug_functionbp.py
|
||||
NtCreateFile of <86250608>: handle = 0x124
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui>
|
||||
NtCreateFile of <50173784>: handle = 0x1c4
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume3\Windows\Globalization\Sorting\SortDefault.nls>
|
||||
|
||||
NtCreateFile of <1996168876>: handle = 0x150
|
||||
Handle manually found! typename=<File>, name=<\Device\DeviceApi>
|
||||
NtCreateFile of <50181528>: handle = 0x1ec
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume3\Windows\Fonts\StaticCache.dat>
|
||||
|
||||
NtCreateFile of <86206640>: handle = 0x280
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
|
||||
NtCreateFile of <50195912>: handle = 0x1fc
|
||||
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume3\Windows\Branding\Basebrd\basebrd.dll>
|
||||
|
||||
Exiting process
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
(cmd) python debug\debugger_membp_singlestep.py
|
||||
Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e0dadf
|
||||
Instruction at <0x520006> wrote at <0x530000>
|
||||
Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x52000c
|
||||
Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520011
|
||||
Instruction at <0x520011> wrote at <0x530004>
|
||||
Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520017
|
||||
Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x52001c
|
||||
Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520022
|
||||
Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520023
|
||||
Got exception EXCEPTION_BREAKPOINT(0x80000003) at 0x7ff8e5aebd44
|
||||
Got exception UNKNOW_EXCEPTION(0x4000001f) at 0x77e58727
|
||||
Instruction at <0xa50006> wrote at <0xa60000>
|
||||
Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa5000c
|
||||
Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50011
|
||||
Instruction at <0xa50011> wrote at <0xa60004>
|
||||
Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50017
|
||||
Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa5001c
|
||||
Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50022
|
||||
Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50023
|
||||
No more single step: exiting
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
(cmd) python debug\debugger_print_LdrLoaddll.py
|
||||
Got exception EXCEPTION_BREAKPOINT(0x80000003) at 0x7ff8e5aebd44
|
||||
Loading <kernel32.dll>
|
||||
Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e0dadf
|
||||
Got exception UNKNOW_EXCEPTION(0x4000001f) at 0x77e58727
|
||||
Loading <api-ms-win-core-synch-l1-2-0>
|
||||
Loading <api-ms-win-core-fibers-l1-1-1>
|
||||
Loading <api-ms-win-core-fibers-l1-1-1>
|
||||
Loading <api-ms-win-core-fibers-l1-1-0>
|
||||
Loading <api-ms-win-core-synch-l1-2-0>
|
||||
Loading <api-ms-win-core-localization-l1-2-1>
|
||||
Loading <kernel32>
|
||||
@@ -11,14 +12,5 @@ Loading <api-ms-win-core-string-l1-1-0>
|
||||
Loading <api-ms-win-core-datetime-l1-1-1>
|
||||
Loading <api-ms-win-core-localization-obsolete-l1-2-0>
|
||||
Loading <c:\windows\system32\imm32.dll>
|
||||
Loading <api-ms-win-core-processthreads-l1-1-2.dll>
|
||||
Loading <c:\windows\system32\uxtheme.dll>
|
||||
Loading <c:\windows\system32\mrmcorer.dll>
|
||||
Loading <c:\windows\system32\windows.storage.dll>
|
||||
Loading <c:\windows\system32\efswrt.dll>
|
||||
Loading <c:\windows\system32\twinapi.appcore.dll>
|
||||
Loading <rpcrt4.dll>
|
||||
Loading <c:\windows\system32\wintypes.dll>
|
||||
Loading <c:\windows\syswow64\wintypes.dll>
|
||||
Loading <comctl32.dll>
|
||||
Ask to load <comctl32.dll>: exiting process
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
(cmd) python debug\local_debugger.py
|
||||
Code addr = 0x5450002
|
||||
GOT AN HXBP at 0x5450002
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450003
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450004
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450005
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x76948654
|
||||
Code addr = 0x25f8532000e
|
||||
GOT AN HXBP at 0x25f8532000e
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e377257d
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e5a6aa80
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e5aafde0
|
||||
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e5aafdf4
|
||||
Done!
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
(cmd) python debug\symbol_debugger.py
|
||||
Namespace(dbghelp=None)
|
||||
Breakpoint triggered at: ntdll!LdrpInitializeProcess
|
||||
<SymbolInfoA name="LdrpInitializeProcess" start=0x77c676c0 tag=SymTagPublicSymbol>
|
||||
<SymbolInfoW name="LdrpInitializeProcess" start=0x7ff8e5aecca0 tag=SymTagPublicSymbol>
|
||||
|
||||
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
|
||||
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
|
||||
Breakpoint triggered at: KERNELBASE!CreateFileInternal
|
||||
<SymbolInfoW name="CreateFileInternal" start=0x7ff8e33b4b70 tag=SymTagPublicSymbol>
|
||||
|
||||
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
|
||||
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
|
||||
Breakpoint triggered at: KERNELBASE!CreateFileInternal
|
||||
<SymbolInfoW name="CreateFileInternal" start=0x7ff8e33b4b70 tag=SymTagPublicSymbol>
|
||||
|
||||
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
|
||||
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
|
||||
Breakpoint triggered at: KERNELBASE!CreateFileInternal
|
||||
<SymbolInfoW name="CreateFileInternal" start=0x7ff8e33b4b70 tag=SymTagPublicSymbol>
|
||||
Quitting
|
||||
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
(cmd) python debug\symbols\processsymdemo.py
|
||||
Namespace(dbghelp=None)
|
||||
Target is <WinProcess "notepad.exe" pid 14280 at 0x4e177b0>
|
||||
Target is <WinProcess "winver.exe" pid 18600 at 0x23a15d4cdd0>
|
||||
Some loaded modules are:
|
||||
* <SymbolModule name="notepad" type=SymDeferred pdb="" addr=0xc10000>
|
||||
* <SymbolModule name="ntdll" type=SymDeferred pdb="" addr=0x77bc0000>
|
||||
* <SymbolModule name="KERNEL32" type=SymDeferred pdb="" addr=0x77480000>
|
||||
* <SymbolModule name="winver" type=SymDeferred pdb="" addr=0x7ff658a30000>
|
||||
* <SymbolModule name="ntdll" type=SymDeferred pdb="" addr=0x7ff8e5a10000>
|
||||
* <SymbolModule name="KERNEL32" type=SymDeferred pdb="" addr=0x7ff8e3760000>
|
||||
|
||||
Resolving function <advapi32!CreateServiceEx>
|
||||
Symbol found !
|
||||
* __repr__: <SymbolInfoA name="CreateServiceEx" start=0x764647b0 tag=SymTagPublicSymbol>
|
||||
* __repr__: <SymbolInfoW name="CreateServiceEx" start=0x7ff8e4b2d2e0 tag=SymTagPublicSymbol>
|
||||
* __str__: advapi32!CreateServiceEx
|
||||
* addr: 0x764647b0
|
||||
* addr: 0x7ff8e4b2d2e0
|
||||
* name: CreateServiceEx
|
||||
* fullname: advapi32!CreateServiceEx
|
||||
* module: <SymbolModule name="advapi32" type=SymPdb pdb="advapi32.pdb" addr=0x76440000>
|
||||
* module: <SymbolModule name="advapi32" type=SymPdb pdb="advapi32.pdb" addr=0x7ff8e4b10000>
|
||||
|
||||
@@ -1,30 +1,30 @@
|
||||
(cmd) python debug\symbols\virtsymdemo.py
|
||||
Namespace(dbghelp=None)
|
||||
Ntdll module is: <SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>
|
||||
Ntdll module is: <SymbolModule name="ntdll" type=SymPdb pdb="ntdll.pdb" addr=0x420000>
|
||||
* name = ntdll
|
||||
* addr = 0x420000
|
||||
* path = c:\windows\system32\ntdll.dll
|
||||
* type = <SYM_TYPE SymPdb(0x3L)>
|
||||
* pdb = d:\symbols\wntdll.pdb\3D038F31BBBF51C701937460DBAB1F531\wntdll.pdb
|
||||
* type = <SYM_TYPE SymPdb(0x3)>
|
||||
* pdb = c:\Symbols\ntdll.pdb\8D5D5ED5D5B8AA609A82600C14E3004D1\ntdll.pdb
|
||||
|
||||
Resolving function <LdrLoadDll>
|
||||
Symbol found !
|
||||
* __repr__: <SymbolInfoA name="LdrLoadDll" start=0x464d30 tag=SymTagFunction>
|
||||
* __repr__: <SymbolInfoW name="LdrLoadDll" start=0x44a160 tag=SymTagFunction>
|
||||
* __str__: ntdll!LdrLoadDll
|
||||
* addr: 0x464d30
|
||||
* addr: 0x44a160
|
||||
* name: LdrLoadDll
|
||||
* fullname: ntdll!LdrLoadDll
|
||||
* module: <SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>
|
||||
* module: <SymbolModule name="ntdll" type=SymPdb pdb="ntdll.pdb" addr=0x420000>
|
||||
|
||||
Loading kernelbase
|
||||
Loaded modules are: [<SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>, <SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x1230000>]
|
||||
Loaded modules are: [<SymbolModule name="ntdll" type=SymPdb pdb="ntdll.pdb" addr=0x420000>, <SymbolModule name="kernelbase" type=SymPdb pdb="kernelbase.pdb" addr=0x1230000>]
|
||||
Looking up address: 0x1231242
|
||||
Symbol resolved !
|
||||
* __repr__: <SymbolInfoA name="__load_config_used" start=0x1231230 displacement=0x12 tag=SymTagPublicSymbol>
|
||||
* __str__: kernelbase!__load_config_used+0x12
|
||||
* start: 0x1231230
|
||||
* __repr__: <SymbolInfoW name="PsspThunkWin32Nt_HANDLE_ENTRY" start=0x1231240 displacement=0x2 tag=SymTagPublicSymbol>
|
||||
* __str__: kernelbase!PsspThunkWin32Nt_HANDLE_ENTRY+0x2
|
||||
* start: 0x1231240
|
||||
* addr: 0x1231242
|
||||
* displacement: 0x12
|
||||
* name: __load_config_used
|
||||
* fullname: kernelbase!__load_config_used+0x12
|
||||
* module: <SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x1230000>
|
||||
* displacement: 0x2
|
||||
* name: PsspThunkWin32Nt_HANDLE_ENTRY
|
||||
* fullname: kernelbase!PsspThunkWin32Nt_HANDLE_ENTRY+0x2
|
||||
* module: <SymbolModule name="kernelbase" type=SymPdb pdb="kernelbase.pdb" addr=0x1230000>
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
(cmd) python process\current_process.py
|
||||
current process is <windows.winobject.process.CurrentProcess object at 0x06407430>
|
||||
current process is a <32> bits process
|
||||
current process is a SysWow64 process ? <True>
|
||||
current process pid <11344> and ppid <14984>
|
||||
Here are the current process threads: <[<WinThread 17288 owner "CurrentProcess" at 0x6a68870>, <WinThread 15176 owner "CurrentProcess" at 0x6a687b0>, <WinThread 8972 owner "CurrentProcess" at 0x6a68bf0>, <WinThread 5568 owner "CurrentProcess" at 0x6a68dd0>]>
|
||||
current process is <windows.winobject.process.CurrentProcess object at 0x000001DD8BC5CA10>
|
||||
current process is a <64> bits process
|
||||
current process is a SysWow64 process ? <False>
|
||||
current process pid <26976> and ppid <28256>
|
||||
Here are the current process threads: <[<WinThread 15220 owner "CurrentProcess" at 0x1dd8d20b0d0>, <WinThread 27912 owner "CurrentProcess" at 0x1dd8d20afd0>, <WinThread 27832 owner "CurrentProcess" at 0x1dd8d20af10>, <WinThread 26820 owner "CurrentProcess" at 0x1dd8d20ae90>]>
|
||||
Let's execute some native code ! (0x41 + 1)
|
||||
Native code returned <0x42>
|
||||
Allocating memory in current process
|
||||
Allocated memory is at <0x5510000>
|
||||
Allocated memory is at <0x1dd8d2f0000>
|
||||
Writing 'SOME STUFF' in allocation memory
|
||||
Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
||||
Reading memory : <b'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
(cmd) python process\veh_segv.py
|
||||
Protected page is at <0x7270000>
|
||||
Protected page is at <0x289b6bc0000>
|
||||
Setting page protection to <PAGE_NOACCESS>
|
||||
|
||||
==Entry of VEH handler==
|
||||
Instr at 0x6a54c166 accessed to addr 0x7270000
|
||||
Instr at 0x7ff8bda3e718 accessed to addr 0x289b6bc0000
|
||||
Resetting page protection to <PAGE_READWRITE>
|
||||
==Entry of VEH handler==
|
||||
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
||||
Exception of type EXCEPTION_SINGLE_STEP(0x80000004)
|
||||
Resetting page protection to <PAGE_NOACCESS>
|
||||
Value 1 read
|
||||
|
||||
==Entry of VEH handler==
|
||||
Instr at 0x6a54c166 accessed to addr 0x7270010
|
||||
Instr at 0x7ff8bda3e718 accessed to addr 0x289b6bc0010
|
||||
Resetting page protection to <PAGE_READWRITE>
|
||||
==Entry of VEH handler==
|
||||
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
||||
Exception of type EXCEPTION_SINGLE_STEP(0x80000004)
|
||||
Resetting page protection to <PAGE_NOACCESS>
|
||||
Value 2 read
|
||||
|
||||
@@ -1,23 +1,23 @@
|
||||
(cmd) python security\security_descriptor.py
|
||||
Security descriptor is: <SecurityDescriptor object at 0x03E151C0>
|
||||
Security descriptor is: O:BAG:AND:(A;OI;CCDCLCSWRPWPRCWDWOGA;;;S-1-0-0)(D;CIIO;CCDCLCSWRPWPRCWDWOGA;;;S-1-0-0)
|
||||
Owner: S-1-5-32-544
|
||||
- lookup: (u'BUILTIN', u'Administrateurs')
|
||||
- lookup: ('BUILTIN', 'Administrators')
|
||||
Group: S-1-5-7
|
||||
- lookup: (u'AUTORITE NT', u'ANONYMOUS LOGON')
|
||||
- lookup: ('NT AUTHORITY', 'ANONYMOUS LOGON')
|
||||
Dacl: <Acl count=2>
|
||||
|
||||
ACE [0]: <AccessAllowedACE mask=269353023>
|
||||
- Header-AceType: ACCESS_ALLOWED_ACE_TYPE(0x0L)
|
||||
- Header-AceType: ACCESS_ALLOWED_ACE_TYPE(0x0)
|
||||
- Header-AceFlags: 1
|
||||
- Header-flags: [OBJECT_INHERIT_ACE(0x1L)]
|
||||
- Header-flags: [OBJECT_INHERIT_ACE(0x1)]
|
||||
- Mask: 269353023
|
||||
- mask: [1L, 2L, 4L, 8L, 16L, 32L, READ_CONTROL(0x20000L), WRITE_DAC(0x40000L), WRITE_OWNER(0x80000L), GENERIC_ALL(0x10000000L)]
|
||||
- mask: [1, 2, 4, 8, 16, 32, READ_CONTROL(0x20000), WRITE_DAC(0x40000), WRITE_OWNER(0x80000), GENERIC_ALL(0x10000000)]
|
||||
- Sid: S-1-0-0
|
||||
|
||||
ACE [1]: <AccessDeniedACE mask=269353023>
|
||||
- Header-AceType: ACCESS_DENIED_ACE_TYPE(0x1L)
|
||||
- Header-AceType: ACCESS_DENIED_ACE_TYPE(0x1)
|
||||
- Header-AceFlags: 10
|
||||
- Header-flags: [CONTAINER_INHERIT_ACE(0x2L), INHERIT_ONLY_ACE(0x8L)]
|
||||
- Header-flags: [CONTAINER_INHERIT_ACE(0x2), INHERIT_ONLY_ACE(0x8)]
|
||||
- Mask: 269353023
|
||||
- mask: [1L, 2L, 4L, 8L, 16L, 32L, READ_CONTROL(0x20000L), WRITE_DAC(0x40000L), WRITE_OWNER(0x80000L), GENERIC_ALL(0x10000000L)]
|
||||
- mask: [1, 2, 4, 8, 16, 32, READ_CONTROL(0x20000), WRITE_DAC(0x40000), WRITE_OWNER(0x80000), GENERIC_ALL(0x10000000)]
|
||||
- Sid: S-1-0-0
|
||||
|
||||
@@ -2,13 +2,13 @@
|
||||
WMI namespace is <<WmiNamespace "root\cimv2">>
|
||||
Process class is <WmiObject class "Win32_Process">
|
||||
Method Create InParams is <<WmiObject class "__PARAMETERS">>
|
||||
Method Create InParams properties are <[u'CommandLine', u'CurrentDirectory', u'ProcessStartupInformation']>
|
||||
Method Create InParams properties are <['CommandLine', 'CurrentDirectory', 'ProcessStartupInformation']>
|
||||
Creating instance of inparam
|
||||
InParam instance is <<WmiObject instance of "__PARAMETERS">>
|
||||
Setting <CommandLine>
|
||||
Executing method
|
||||
OutParams is <WmiObject instance of "__PARAMETERS">
|
||||
Out params values are: [u'ProcessId', u'ReturnValue']
|
||||
Created process is <WinProcess "notepad.exe" pid 24036 at 0x3d04390>
|
||||
Out params values are: ['ProcessId', 'ReturnValue']
|
||||
Created process is <WinProcess "notepad.exe" pid 26744 at 0x180e84d48d0>
|
||||
Waiting 1s
|
||||
Killing the process
|
||||
|
||||
@@ -1,20 +1,17 @@
|
||||
(cmd) python wmi\wmi_request.py
|
||||
WMI requester is <windows.winobject.wmi.WmiManager object at 0x04258918>
|
||||
WMI requester is <windows.winobject.wmi.WmiManager object at 0x000001CD1A46E150>
|
||||
Selecting * from 'Win32_Process'
|
||||
They are <308> processes
|
||||
They are <329> processes
|
||||
Looking for ourself via pid
|
||||
Some info about our process:
|
||||
* Name -> python.exe
|
||||
* ProcessId -> 27144
|
||||
* OSName -> Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2
|
||||
* UserModeTime -> 2812500
|
||||
* WindowsVersion -> 10.0.17134
|
||||
* CommandLine -> C:\Python27\python.exe wmi\wmi_request.py
|
||||
* ProcessId -> 28460
|
||||
* OSName -> Microsoft Windows 11 Pro|C:\Windows|\Device\Harddisk0\Partition3
|
||||
* UserModeTime -> 0
|
||||
* WindowsVersion -> 10.0.22631
|
||||
* CommandLine -> C:\Users\cleme\AppData\Local\Programs\Python\Python311\python.exe wmi\wmi_request.py
|
||||
<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:
|
||||
* {u'Caption': u'B:', u'FreeSpace': None, u'FileSystem': None}
|
||||
* {u'Caption': u'C:', u'FreeSpace': u'5701517312', u'FileSystem': u'NTFS'}
|
||||
* {u'Caption': u'D:', u'FreeSpace': u'47657324544', u'FileSystem': u'NTFS'}
|
||||
* {u'Caption': u'E:', u'FreeSpace': u'89507512320', u'FileSystem': u'NTFS'}
|
||||
* {'Caption': 'C:', 'FileSystem': 'NTFS', 'FreeSpace': '925749731328'}
|
||||
|
||||
==== Advanced use ====
|
||||
Listing some namespaces:
|
||||
@@ -23,8 +20,8 @@ Listing some namespaces:
|
||||
* StandardCimv2
|
||||
Querying non-default namespace: <WmiNamespace "root\SecurityCenter2">
|
||||
Listing some available classes:
|
||||
* <WmiObject class "FirewallProduct">
|
||||
* <WmiObject class "AntiVirusProduct">
|
||||
* <WmiObject class "AntiSpywareProduct">
|
||||
* <WmiObject class "AntiVirusProduct">
|
||||
* <WmiObject class "FirewallProduct">
|
||||
Listing <AntiVirusProduct>:
|
||||
* Windows Defender
|
||||
|
||||
Reference in New Issue
Block a user