From 5be7b185c26dd0bb9412f901bee931ffda59ee78 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Thu, 17 Sep 2015 15:58:58 +0200 Subject: [PATCH] Add pe sections parsing + kernel module by NtQuery by w4kfu + small fixes --- k32testing.py | 2 +- native_exec/cpuid.py | 4 ++-- native_exec/native_function.py | 2 +- pe_parse.py | 8 ++++++++ utils.py | 9 ++++++++- 5 files changed, 20 insertions(+), 5 deletions(-) diff --git a/k32testing.py b/k32testing.py index 7ffa38d..b34e95d 100644 --- a/k32testing.py +++ b/k32testing.py @@ -379,7 +379,7 @@ def ntquerysysteminformation_error_check(func_name, result, func, args): # Ignore STATUS_INFO_LENGTH_MISMATCH if SystemInformation is None if result == STATUS_INFO_LENGTH_MISMATCH and args[1] is None: return args - raise Kernel32Error("{0} failed with NTStatus {1)".format(func_name, hex(result))) + raise Kernel32Error("{0} failed with NTStatus {1}".format(func_name, hex(result))) @NtdllProxy('NtQuerySystemInformation', ntquerysysteminformation_error_check) def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter): diff --git a/native_exec/cpuid.py b/native_exec/cpuid.py index bef3042..400a7ae 100644 --- a/native_exec/cpuid.py +++ b/native_exec/cpuid.py @@ -96,7 +96,7 @@ def is_intel_proc(): def is_amd_proc(): return get_vendor_id() == "AuthenticAMD" -def get_proc_model_family(): +def get_proc_family_model(): cpuid_res = do_cpuid(1) if is_intel_proc(): format = X86IntelCpuidFamilly @@ -113,4 +113,4 @@ def get_proc_model_family(): ComputedFamily = infos.FamilyID + infos.ExtendedFamily else: ComputedFamily = infos.FamilyID; - return ComputedModel, ComputedFamily \ No newline at end of file + return ComputedFamily, ComputedModel \ No newline at end of file diff --git a/native_exec/native_function.py b/native_exec/native_function.py index 366e253..967e6f7 100644 --- a/native_exec/native_function.py +++ b/native_exec/native_function.py @@ -79,7 +79,7 @@ class CustomAllocator(object): def reserve_size(self, size): if size + self.cur_offset > self.cur_page_size: - self.get_new_page((payload_size + 0x1000) & ~0xfff) + self.get_new_page((size + 0x1000) & ~0xfff) addr = self.maps[-1].addr + self.cur_offset self.cur_offset += size return addr diff --git a/pe_parse.py b/pe_parse.py index 3eba2d5..bc01364 100644 --- a/pe_parse.py +++ b/pe_parse.py @@ -163,6 +163,14 @@ def PEFile(baseaddr, target=None): return create_structure_at(self._IMAGE_EXPORT_DIRECTORY, export_directory_addr) #return self._IMAGE_EXPORT_DIRECTORY.from_address(export_directory_addr) + @utils.fixedpropety + def sections(self): + nt_header = self.get_NT_HEADER() + nb_section = nt_header.FileHeader.NumberOfSections + base_section = ctypes.addressof(nt_header) + ctypes.sizeof(nt_header) + IMAGE_SECTION_H = ctypes_structure_transformer(IMAGE_SECTION_HEADER) + sections_array = create_structure_at(IMAGE_SECTION_H * nb_section, base_section) + return (sections_array) @utils.fixedpropety def exports(self): diff --git a/utils.py b/utils.py index 159e8f3..2a4f929 100644 --- a/utils.py +++ b/utils.py @@ -94,7 +94,14 @@ def pop_shell(): create_console() FixedInteractiveConsole(locals()).interact() - +def get_kernel_modules(): + cbsize = DWORD() + kernel32proxy.NtQuerySystemInformation(SystemModuleInformation, None, 0, byref(cbsize)) + raw_buffer = (cbsize.value * c_char)() + buffer = SYSTEM_MODULE_INFORMATION.from_address(ctypes.addressof(raw_buffer)) + kernel32proxy.NtQuerySystemInformation(SystemModuleInformation, byref(raw_buffer), sizeof(raw_buffer), byref(cbsize)) + modules = (SYSTEM_MODULE * buffer.ModulesCount).from_address(addressof(buffer) + SYSTEM_MODULE_INFORMATION.Modules.offset) + return list(modules) class VirtualProtected(object): """A context manager usable like `VirtualProtect` that will restore the old protection at exit