Add pe sections parsing + kernel module by NtQuery by w4kfu + small fixes

k32testing.py

@@ -379,7 +379,7 @@ def ntquerysysteminformation_error_check(func_name, result, func, args):
     # Ignore STATUS_INFO_LENGTH_MISMATCH if SystemInformation is None
     if result == STATUS_INFO_LENGTH_MISMATCH and args[1] is None:
         return args
-    raise Kernel32Error("{0} failed with NTStatus {1)".format(func_name, hex(result)))
+    raise Kernel32Error("{0} failed with NTStatus {1}".format(func_name, hex(result)))
 
 @NtdllProxy('NtQuerySystemInformation', ntquerysysteminformation_error_check)
 def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter):

native_exec/cpuid.py

@@ -96,7 +96,7 @@ def is_intel_proc():
 def is_amd_proc():
     return get_vendor_id() == "AuthenticAMD"
 
-def get_proc_model_family():
+def get_proc_family_model():
     cpuid_res = do_cpuid(1)
     if is_intel_proc():
         format = X86IntelCpuidFamilly
@@ -113,4 +113,4 @@ def get_proc_model_family():
         ComputedFamily = infos.FamilyID + infos.ExtendedFamily
     else:
         ComputedFamily = infos.FamilyID;
-    return ComputedModel, ComputedFamily
+    return ComputedFamily, ComputedModel

native_exec/native_function.py

@@ -79,7 +79,7 @@ class CustomAllocator(object):
 
     def reserve_size(self, size):
         if size + self.cur_offset > self.cur_page_size:
-            self.get_new_page((payload_size + 0x1000) & ~0xfff)
+            self.get_new_page((size + 0x1000) & ~0xfff)
         addr = self.maps[-1].addr + self.cur_offset
         self.cur_offset += size
         return addr

pe_parse.py

@@ -163,6 +163,14 @@ def PEFile(baseaddr, target=None):
             return create_structure_at(self._IMAGE_EXPORT_DIRECTORY, export_directory_addr)
             #return self._IMAGE_EXPORT_DIRECTORY.from_address(export_directory_addr)
 
+        @utils.fixedpropety
+        def sections(self):
+            nt_header = self.get_NT_HEADER()
+            nb_section = nt_header.FileHeader.NumberOfSections
+            base_section = ctypes.addressof(nt_header) + ctypes.sizeof(nt_header)
+            IMAGE_SECTION_H = ctypes_structure_transformer(IMAGE_SECTION_HEADER)
+            sections_array = create_structure_at(IMAGE_SECTION_H * nb_section, base_section)
+            return (sections_array)
 
         @utils.fixedpropety
         def exports(self):

utils.py

@@ -94,7 +94,14 @@ def pop_shell():
     create_console()
     FixedInteractiveConsole(locals()).interact()
 
-
+def get_kernel_modules():
+    cbsize = DWORD()
+    kernel32proxy.NtQuerySystemInformation(SystemModuleInformation, None, 0, byref(cbsize))
+    raw_buffer = (cbsize.value * c_char)()
+    buffer = SYSTEM_MODULE_INFORMATION.from_address(ctypes.addressof(raw_buffer))
+    kernel32proxy.NtQuerySystemInformation(SystemModuleInformation, byref(raw_buffer), sizeof(raw_buffer), byref(cbsize))
+    modules = (SYSTEM_MODULE * buffer.ModulesCount).from_address(addressof(buffer) + SYSTEM_MODULE_INFORMATION.Modules.offset)
+    return list(modules)
 
 class VirtualProtected(object):
     """A context manager usable like `VirtualProtect` that will restore the old protection at exit