diff --git a/docs/source/samples_output/com_com_inetfwpolicy2.txt b/docs/source/samples_output/com_com_inetfwpolicy2.txt index f6b1045..a089b64 100644 --- a/docs/source/samples_output/com_com_inetfwpolicy2.txt +++ b/docs/source/samples_output/com_com_inetfwpolicy2.txt @@ -1,15 +1,15 @@ (cmd) python com\com_inetfwpolicy2.py Initialisation of COM Creating INetFwPolicy2 variable - (value = None) + at 0x2925a3e2350> (value = None) Generating CLSID - + Creating COM instance - (value = 0x85678080) + (value = 0x2827524184096) Checking for enabled profiles - * NET_FW_PROFILE2_DOMAIN(0x1L) -> True - * NET_FW_PROFILE2_PRIVATE(0x2L) -> True - * NET_FW_PROFILE2_PUBLIC(0x4L) -> True + * NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_DOMAIN(0x1) -> True + * NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_PRIVATE(0x2) -> True + * NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_PUBLIC(0x4) -> True diff --git a/docs/source/samples_output/com_icallinterceptor.txt b/docs/source/samples_output/com_icallinterceptor.txt index 54b52b2..5d423e5 100644 --- a/docs/source/samples_output/com_icallinterceptor.txt +++ b/docs/source/samples_output/com_icallinterceptor.txt @@ -4,12 +4,12 @@ Catching call to Info about parameters 0: * param0info.fIn -> 0x1 * param0info.fOut -> 0x0 - * param0info.stackOffset -> 0x4L - * param0info.cbParam -> 0x4L + * param0info.stackOffset -> 0x8 + * param0info.cbParam -> 0x8 param0 value = 2 Leaving the sink ! return value = 1234 firewall enabled = VARIANT_BOOL(True) Testing a function taking a PTR to a COM interface -Before call: (, None) -After call: (, 107934504) +Before call: ( at 0x1fb65de5550>, None) +After call: (, 2179257488408) diff --git a/docs/source/samples_output/crypto_certificate.txt b/docs/source/samples_output/crypto_certificate.txt index af22603..b96c8d0 100644 --- a/docs/source/samples_output/crypto_certificate.txt +++ b/docs/source/samples_output/crypto_certificate.txt @@ -16,18 +16,18 @@ Chain 0: * issuer: Looking for in trusted certificates -matches = [] -Found it ! +matches = [] +Not found :( == PE Analysis == -Target sha1 = <339e4c236e716d4b6f6b10359c425eb3d1478df7> -Analysing +Target sha1 = <5f7905b56952e28316edcbce0206d7bec34de2a1> +Analysing File has 1 signer(s): Signer 0: * Issuer: bytearray(b'0\x81\x841\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\nWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\n\x13\x15Microsoft Corporation1.0,\x06\x03U\x04\x03\x13%Microsoft Windows Production PCA 2011') - * HashAlgorithme: 2.16.840.1.101.3.4.2.1 - * Certificate: + * HashAlgorithme: b'2.16.840.1.101.3.4.2.1' + * Certificate: File embdeds 2 certificate(s): - * 0) + * 0) * 1) diff --git a/docs/source/samples_output/crypto_wintrust.txt b/docs/source/samples_output/crypto_wintrust.txt index 89478ae..3350f10 100644 --- a/docs/source/samples_output/crypto_wintrust.txt +++ b/docs/source/samples_output/crypto_wintrust.txt @@ -4,12 +4,12 @@ Checking signature of check_signature: <0> full_signature_information: * signed - * catalog + * catalog * catalogsigned * additionalinfo <0> Checking signature of some loaded DLL - : False (TRUST_E_NOSIGNATURE(0x800b0100L)) + : True : True : True : True - : True + : True diff --git a/docs/source/samples_output/debug_attach.txt b/docs/source/samples_output/debug_attach.txt index f837d25..a29147b 100644 --- a/docs/source/samples_output/debug_attach.txt +++ b/docs/source/samples_output/debug_attach.txt @@ -1,15 +1,15 @@ (cmd) python debug\attach.py -Finding process with pid <12252> -Target is -Debugger attached: +Finding process with pid <27576> +Target is +Debugger attached: -NtCreateFile of <10573272>: handle = 0x144 -Handle manually found! typename=, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui> +NtCreateFile of <54203712>: handle = 0x1c8 +Handle manually found! typename=, name=<\Device\HarddiskVolume3\Windows\Globalization\Sorting\SortDefault.nls> -NtCreateFile of <1996168876>: handle = 0x170 -Handle manually found! typename=, name=<\Device\DeviceApi> +NtCreateFile of <54268840>: handle = 0x1f0 +Handle manually found! typename=, name=<\Device\HarddiskVolume3\Windows\Fonts\StaticCache.dat> -NtCreateFile of <10504328>: handle = 0x2a8 -Handle manually found! typename=, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat> +NtCreateFile of <54280288>: handle = 0x200 +Handle manually found! typename=, name=<\Device\HarddiskVolume3\Windows\Branding\Basebrd\basebrd.dll> Exiting process diff --git a/docs/source/samples_output/debug_debug_functionbp.txt b/docs/source/samples_output/debug_debug_functionbp.txt index 767d912..ec58fb7 100644 --- a/docs/source/samples_output/debug_debug_functionbp.txt +++ b/docs/source/samples_output/debug_debug_functionbp.txt @@ -1,11 +1,11 @@ (cmd) python debug\debug_functionbp.py -NtCreateFile of <86250608>: handle = 0x124 -Handle manually found! typename=, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui> +NtCreateFile of <50173784>: handle = 0x1c4 +Handle manually found! typename=, name=<\Device\HarddiskVolume3\Windows\Globalization\Sorting\SortDefault.nls> -NtCreateFile of <1996168876>: handle = 0x150 -Handle manually found! typename=, name=<\Device\DeviceApi> +NtCreateFile of <50181528>: handle = 0x1ec +Handle manually found! typename=, name=<\Device\HarddiskVolume3\Windows\Fonts\StaticCache.dat> -NtCreateFile of <86206640>: handle = 0x280 -Handle manually found! typename=, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat> +NtCreateFile of <50195912>: handle = 0x1fc +Handle manually found! typename=, name=<\Device\HarddiskVolume3\Windows\Branding\Basebrd\basebrd.dll> Exiting process diff --git a/docs/source/samples_output/debug_debugger_membp_singlestep.txt b/docs/source/samples_output/debug_debugger_membp_singlestep.txt index e3e231b..017135b 100644 --- a/docs/source/samples_output/debug_debugger_membp_singlestep.txt +++ b/docs/source/samples_output/debug_debugger_membp_singlestep.txt @@ -1,11 +1,12 @@ (cmd) python debug\debugger_membp_singlestep.py -Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e0dadf -Instruction at <0x520006> wrote at <0x530000> -Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x52000c -Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520011 -Instruction at <0x520011> wrote at <0x530004> -Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520017 -Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x52001c -Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520022 -Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520023 +Got exception EXCEPTION_BREAKPOINT(0x80000003) at 0x7ff8e5aebd44 +Got exception UNKNOW_EXCEPTION(0x4000001f) at 0x77e58727 +Instruction at <0xa50006> wrote at <0xa60000> +Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa5000c +Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50011 +Instruction at <0xa50011> wrote at <0xa60004> +Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50017 +Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa5001c +Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50022 +Got single_step UNKNOW_EXCEPTION(0x4000001e) at 0xa50023 No more single step: exiting diff --git a/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt b/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt index 7b30c78..a5f213d 100644 --- a/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt +++ b/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt @@ -1,9 +1,10 @@ (cmd) python debug\debugger_print_LdrLoaddll.py +Got exception EXCEPTION_BREAKPOINT(0x80000003) at 0x7ff8e5aebd44 Loading -Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e0dadf +Got exception UNKNOW_EXCEPTION(0x4000001f) at 0x77e58727 Loading Loading -Loading +Loading Loading Loading Loading @@ -11,14 +12,5 @@ Loading Loading Loading Loading -Loading -Loading -Loading -Loading -Loading -Loading -Loading -Loading -Loading Loading Ask to load : exiting process diff --git a/docs/source/samples_output/debug_local_debugger.txt b/docs/source/samples_output/debug_local_debugger.txt index 3a50a81..3123682 100644 --- a/docs/source/samples_output/debug_local_debugger.txt +++ b/docs/source/samples_output/debug_local_debugger.txt @@ -1,8 +1,8 @@ (cmd) python debug\local_debugger.py -Code addr = 0x5450002 -GOT AN HXBP at 0x5450002 -EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450003 -EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450004 -EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450005 -EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x76948654 +Code addr = 0x25f8532000e +GOT AN HXBP at 0x25f8532000e +EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e377257d +EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e5a6aa80 +EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e5aafde0 +EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004) at 0x7ff8e5aafdf4 Done! diff --git a/docs/source/samples_output/debug_symbol_debugger.txt b/docs/source/samples_output/debug_symbol_debugger.txt index e780223..f0ef769 100644 --- a/docs/source/samples_output/debug_symbol_debugger.txt +++ b/docs/source/samples_output/debug_symbol_debugger.txt @@ -1,15 +1,15 @@ (cmd) python debug\symbol_debugger.py Namespace(dbghelp=None) Breakpoint triggered at: ntdll!LdrpInitializeProcess - + -Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2 - +Breakpoint triggered at: KERNELBASE!CreateFileInternal + -Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2 - +Breakpoint triggered at: KERNELBASE!CreateFileInternal + -Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2 - +Breakpoint triggered at: KERNELBASE!CreateFileInternal + Quitting diff --git a/docs/source/samples_output/debug_symbol_processsymdemo.txt b/docs/source/samples_output/debug_symbol_processsymdemo.txt index 3eb4a6d..8348ac0 100644 --- a/docs/source/samples_output/debug_symbol_processsymdemo.txt +++ b/docs/source/samples_output/debug_symbol_processsymdemo.txt @@ -1,16 +1,16 @@ (cmd) python debug\symbols\processsymdemo.py Namespace(dbghelp=None) -Target is +Target is Some loaded modules are: - * - * - * + * + * + * Resolving function Symbol found ! - * __repr__: + * __repr__: * __str__: advapi32!CreateServiceEx - * addr: 0x764647b0 + * addr: 0x7ff8e4b2d2e0 * name: CreateServiceEx * fullname: advapi32!CreateServiceEx - * module: + * module: diff --git a/docs/source/samples_output/debug_symbol_virtsymdemo.txt b/docs/source/samples_output/debug_symbol_virtsymdemo.txt index 2336f0d..5698f61 100644 --- a/docs/source/samples_output/debug_symbol_virtsymdemo.txt +++ b/docs/source/samples_output/debug_symbol_virtsymdemo.txt @@ -1,30 +1,30 @@ (cmd) python debug\symbols\virtsymdemo.py Namespace(dbghelp=None) -Ntdll module is: +Ntdll module is: * name = ntdll * addr = 0x420000 * path = c:\windows\system32\ntdll.dll - * type = - * pdb = d:\symbols\wntdll.pdb\3D038F31BBBF51C701937460DBAB1F531\wntdll.pdb + * type = + * pdb = c:\Symbols\ntdll.pdb\8D5D5ED5D5B8AA609A82600C14E3004D1\ntdll.pdb Resolving function Symbol found ! - * __repr__: + * __repr__: * __str__: ntdll!LdrLoadDll - * addr: 0x464d30 + * addr: 0x44a160 * name: LdrLoadDll * fullname: ntdll!LdrLoadDll - * module: + * module: Loading kernelbase -Loaded modules are: [, ] +Loaded modules are: [, ] Looking up address: 0x1231242 Symbol resolved ! - * __repr__: - * __str__: kernelbase!__load_config_used+0x12 - * start: 0x1231230 + * __repr__: + * __str__: kernelbase!PsspThunkWin32Nt_HANDLE_ENTRY+0x2 + * start: 0x1231240 * addr: 0x1231242 - * displacement: 0x12 - * name: __load_config_used - * fullname: kernelbase!__load_config_used+0x12 - * module: + * displacement: 0x2 + * name: PsspThunkWin32Nt_HANDLE_ENTRY + * fullname: kernelbase!PsspThunkWin32Nt_HANDLE_ENTRY+0x2 + * module: diff --git a/docs/source/samples_output/process_current_process.txt b/docs/source/samples_output/process_current_process.txt index b7906dc..66a158a 100644 --- a/docs/source/samples_output/process_current_process.txt +++ b/docs/source/samples_output/process_current_process.txt @@ -1,12 +1,12 @@ (cmd) python process\current_process.py -current process is -current process is a <32> bits process -current process is a SysWow64 process ? -current process pid <11344> and ppid <14984> -Here are the current process threads: <[, , , ]> +current process is +current process is a <64> bits process +current process is a SysWow64 process ? +current process pid <26976> and ppid <28256> +Here are the current process threads: <[, , , ]> Let's execute some native code ! (0x41 + 1) Native code returned <0x42> Allocating memory in current process -Allocated memory is at <0x5510000> +Allocated memory is at <0x1dd8d2f0000> Writing 'SOME STUFF' in allocation memory -Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'> +Reading memory : diff --git a/docs/source/samples_output/process_veh_segv.txt b/docs/source/samples_output/process_veh_segv.txt index ffa1b05..043b1e6 100644 --- a/docs/source/samples_output/process_veh_segv.txt +++ b/docs/source/samples_output/process_veh_segv.txt @@ -1,19 +1,19 @@ (cmd) python process\veh_segv.py -Protected page is at <0x7270000> +Protected page is at <0x289b6bc0000> Setting page protection to ==Entry of VEH handler== -Instr at 0x6a54c166 accessed to addr 0x7270000 +Instr at 0x7ff8bda3e718 accessed to addr 0x289b6bc0000 Resetting page protection to ==Entry of VEH handler== -Exception of type EXCEPTION_SINGLE_STEP(0x80000004L) +Exception of type EXCEPTION_SINGLE_STEP(0x80000004) Resetting page protection to Value 1 read ==Entry of VEH handler== -Instr at 0x6a54c166 accessed to addr 0x7270010 +Instr at 0x7ff8bda3e718 accessed to addr 0x289b6bc0010 Resetting page protection to ==Entry of VEH handler== -Exception of type EXCEPTION_SINGLE_STEP(0x80000004L) +Exception of type EXCEPTION_SINGLE_STEP(0x80000004) Resetting page protection to Value 2 read diff --git a/docs/source/samples_output/security_security_descriptor.txt b/docs/source/samples_output/security_security_descriptor.txt index e5632d9..fb74cb0 100644 --- a/docs/source/samples_output/security_security_descriptor.txt +++ b/docs/source/samples_output/security_security_descriptor.txt @@ -1,23 +1,23 @@ (cmd) python security\security_descriptor.py -Security descriptor is: +Security descriptor is: O:BAG:AND:(A;OI;CCDCLCSWRPWPRCWDWOGA;;;S-1-0-0)(D;CIIO;CCDCLCSWRPWPRCWDWOGA;;;S-1-0-0) Owner: S-1-5-32-544 - - lookup: (u'BUILTIN', u'Administrateurs') + - lookup: ('BUILTIN', 'Administrators') Group: S-1-5-7 - - lookup: (u'AUTORITE NT', u'ANONYMOUS LOGON') + - lookup: ('NT AUTHORITY', 'ANONYMOUS LOGON') Dacl: ACE [0]: - - Header-AceType: ACCESS_ALLOWED_ACE_TYPE(0x0L) + - Header-AceType: ACCESS_ALLOWED_ACE_TYPE(0x0) - Header-AceFlags: 1 - - Header-flags: [OBJECT_INHERIT_ACE(0x1L)] + - Header-flags: [OBJECT_INHERIT_ACE(0x1)] - Mask: 269353023 - - mask: [1L, 2L, 4L, 8L, 16L, 32L, READ_CONTROL(0x20000L), WRITE_DAC(0x40000L), WRITE_OWNER(0x80000L), GENERIC_ALL(0x10000000L)] + - mask: [1, 2, 4, 8, 16, 32, READ_CONTROL(0x20000), WRITE_DAC(0x40000), WRITE_OWNER(0x80000), GENERIC_ALL(0x10000000)] - Sid: S-1-0-0 ACE [1]: - - Header-AceType: ACCESS_DENIED_ACE_TYPE(0x1L) + - Header-AceType: ACCESS_DENIED_ACE_TYPE(0x1) - Header-AceFlags: 10 - - Header-flags: [CONTAINER_INHERIT_ACE(0x2L), INHERIT_ONLY_ACE(0x8L)] + - Header-flags: [CONTAINER_INHERIT_ACE(0x2), INHERIT_ONLY_ACE(0x8)] - Mask: 269353023 - - mask: [1L, 2L, 4L, 8L, 16L, 32L, READ_CONTROL(0x20000L), WRITE_DAC(0x40000L), WRITE_OWNER(0x80000L), GENERIC_ALL(0x10000000L)] + - mask: [1, 2, 4, 8, 16, 32, READ_CONTROL(0x20000), WRITE_DAC(0x40000), WRITE_OWNER(0x80000), GENERIC_ALL(0x10000000)] - Sid: S-1-0-0 diff --git a/docs/source/samples_output/wmi_create_process.txt b/docs/source/samples_output/wmi_create_process.txt index 58f02bc..8effc7b 100644 --- a/docs/source/samples_output/wmi_create_process.txt +++ b/docs/source/samples_output/wmi_create_process.txt @@ -2,13 +2,13 @@ WMI namespace is <> Process class is Method Create InParams is <> -Method Create InParams properties are <[u'CommandLine', u'CurrentDirectory', u'ProcessStartupInformation']> +Method Create InParams properties are <['CommandLine', 'CurrentDirectory', 'ProcessStartupInformation']> Creating instance of inparam InParam instance is <> Setting Executing method OutParams is -Out params values are: [u'ProcessId', u'ReturnValue'] -Created process is +Out params values are: ['ProcessId', 'ReturnValue'] +Created process is Waiting 1s Killing the process diff --git a/docs/source/samples_output/wmi_wmi_request.txt b/docs/source/samples_output/wmi_wmi_request.txt index bfc741b..dbe595c 100644 --- a/docs/source/samples_output/wmi_wmi_request.txt +++ b/docs/source/samples_output/wmi_wmi_request.txt @@ -1,20 +1,17 @@ (cmd) python wmi\wmi_request.py -WMI requester is +WMI requester is Selecting * from 'Win32_Process' -They are <308> processes +They are <329> processes Looking for ourself via pid Some info about our process: * Name -> python.exe - * ProcessId -> 27144 - * OSName -> Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2 - * UserModeTime -> 2812500 - * WindowsVersion -> 10.0.17134 - * CommandLine -> C:\Python27\python.exe wmi\wmi_request.py + * ProcessId -> 28460 + * OSName -> Microsoft Windows 11 Pro|C:\Windows|\Device\Harddisk0\Partition3 + * UserModeTime -> 0 + * WindowsVersion -> 10.0.22631 + * CommandLine -> C:\Users\cleme\AppData\Local\Programs\Python\Python311\python.exe wmi\wmi_request.py