diff --git a/ctypes_generation/definitions/structures/system_info.txt b/ctypes_generation/definitions/structures/system_info.txt new file mode 100644 index 0000000..4a27618 --- /dev/null +++ b/ctypes_generation/definitions/structures/system_info.txt @@ -0,0 +1,71 @@ +/* Based on +winternl.h +& +https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm +*/ + +typedef struct _SYSTEM_PROCESS_INFORMATION { + ULONG NextEntryOffset; + ULONG NumberOfThreads; + BYTE Reserved1[24]; + LARGE_INTEGER CreateTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER KernelTime; + UNICODE_STRING ImageName; + LONG BasePriority; + HANDLE UniqueProcessId; + PVOID InheritedFromUniqueProcessId; + ULONG HandleCount; + BYTE Reserved4[4]; + PVOID Reserved5[1]; + PVOID PeakVirtualSize; + PVOID VirtualSize; + PVOID PageFaultCount; + PVOID PeakWorkingSetSize; + PVOID WorkingSetSize; + PVOID QuotaPeakPagedPoolUsage; + PVOID QuotaPagedPoolUsage; + PVOID QuotaPeakNonPagedPoolUsage; + PVOID QuotaNonPagedPoolUsage; + PVOID PagefileUsage; + SIZE_T PeakPagefileUsage; + SIZE_T PrivatePageCount; + LARGE_INTEGER Reserved6[6]; +} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; + + +typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION { + LARGE_INTEGER IdleTime; + LARGE_INTEGER KernelTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER Reserved1[2]; + ULONG Reserved2; +} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION; + + +typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION { + ULONG RegistryQuotaAllowed; + ULONG RegistryQuotaUsed; + PVOID Reserved1; +} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION; + +typedef struct _SYSTEM_BASIC_INFORMATION { + BYTE Reserved1[24]; + PVOID Reserved2[4]; + CHAR NumberOfProcessors; +} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; + + +typedef struct _SYSTEM_PROCESS_INFORMATION_ORIG { + ULONG NextEntryOffset; + BYTE Reserved1[52]; + PVOID Reserved2[3]; + HANDLE UniqueProcessId; + PVOID Reserved3; + ULONG HandleCount; + BYTE Reserved4[4]; + PVOID Reserved5[11]; + SIZE_T PeakPagefileUsage; + SIZE_T PrivatePageCount; + LARGE_INTEGER Reserved6[6]; +} SYSTEM_PROCESS_INFORMATION_ORIG, *PSYSTEM_PROCESS_INFORMATION_ORIG; \ No newline at end of file diff --git a/tests/test_generated_def.py b/tests/test_generated_def.py index c059c62..b38a6d4 100644 --- a/tests/test_generated_def.py +++ b/tests/test_generated_def.py @@ -12,9 +12,13 @@ def assert_struct_offset(struct, field, offset): if windows.current_process.bitness == 32: PEB32 = windows.generated_def.PEB PEB64 = rctypes.transform_type_to_remote64bits(windows.generated_def.PEB) + SYSTEM_PROCESS_INFORMATION32 = windows.generated_def.SYSTEM_PROCESS_INFORMATION + SYSTEM_PROCESS_INFORMATION64 = rctypes.transform_type_to_remote64bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION) else: PEB32 = rctypes.transform_type_to_remote32bits(windows.generated_def.PEB) PEB64 = windows.generated_def.PEB + SYSTEM_PROCESS_INFORMATION32 = rctypes.transform_type_to_remote32bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION) + SYSTEM_PROCESS_INFORMATION64 = windows.generated_def.SYSTEM_PROCESS_INFORMATION def test_peb32_fields(): assert_peb_offset = lambda field, offset: assert_struct_offset(PEB32, field, offset) @@ -49,6 +53,50 @@ def test_peb64_fields(): assert_peb_offset("CSDVersion", 0x02E8) assert_peb_offset("MinimumStackCommit", 0x0318) +def test_system_process_information32_fields(): + assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION32, field, offset) + # Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm + # And some symbol files :) + assert_spi_offset("NextEntryOffset", 0) + assert_spi_offset('NumberOfThreads', 4) + assert_spi_offset('CreateTime', 0x20) + assert_spi_offset('UserTime', 0x28) + assert_spi_offset('KernelTime', 0x30) + assert_spi_offset('ImageName', 0x38) + assert_spi_offset('BasePriority', 0x40) + assert_spi_offset('UniqueProcessId', 0x44) + assert_spi_offset('InheritedFromUniqueProcessId', 0x48) + assert_spi_offset('PeakVirtualSize', 0x58) + assert_spi_offset('VirtualSize', 0x5C) + assert_spi_offset('PageFaultCount', 0x60) + assert_spi_offset('PeakWorkingSetSize', 0x64) + assert_spi_offset('WorkingSetSize', 0x68) + assert_spi_offset('PagefileUsage', 0x7C) + assert_spi_offset('PeakPagefileUsage', 0x80) + + +def test_system_process_information64_fields(): + assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION64, field, offset) + # Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm + # And some symbol files :) + assert_spi_offset("NextEntryOffset", 0) + assert_spi_offset('NumberOfThreads', 4) + assert_spi_offset('CreateTime', 0x20) + assert_spi_offset('UserTime', 0x28) + assert_spi_offset('KernelTime', 0x30) + assert_spi_offset('ImageName', 0x38) + assert_spi_offset('BasePriority', 0x48) + assert_spi_offset('UniqueProcessId', 0x50) + assert_spi_offset('InheritedFromUniqueProcessId', 0x58) + assert_spi_offset('PeakVirtualSize', 0x70) + assert_spi_offset('VirtualSize', 0x78) + assert_spi_offset('PageFaultCount', 0x80) + assert_spi_offset('PeakWorkingSetSize', 0x88) + assert_spi_offset('WorkingSetSize', 0x90) + assert_spi_offset('PagefileUsage', 0xB8) + assert_spi_offset('PeakPagefileUsage', 0xC0) + + def test_cs_custom_define(): assert windows.generated_def.CS_USER_32B == 0x23 assert windows.generated_def.CS_USER_64B == 0x33 diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index e5682cd..18f28aa 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -9331,6 +9331,84 @@ PEXPLICIT_ACCESSW = POINTER(_EXPLICIT_ACCESS_W) PEXPLICIT_ACCESS_W = POINTER(_EXPLICIT_ACCESS_W) EXPLICIT_ACCESS_W = _EXPLICIT_ACCESS_W +class _SYSTEM_PROCESS_INFORMATION(Structure): + _fields_ = [ + ("NextEntryOffset", ULONG), + ("NumberOfThreads", ULONG), + ("Reserved1", BYTE * (24)), + ("CreateTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("ImageName", UNICODE_STRING), + ("BasePriority", LONG), + ("UniqueProcessId", HANDLE), + ("InheritedFromUniqueProcessId", PVOID), + ("HandleCount", ULONG), + ("Reserved4", BYTE * (4)), + ("Reserved5", PVOID * (1)), + ("PeakVirtualSize", PVOID), + ("VirtualSize", PVOID), + ("PageFaultCount", PVOID), + ("PeakWorkingSetSize", PVOID), + ("WorkingSetSize", PVOID), + ("QuotaPeakPagedPoolUsage", PVOID), + ("QuotaPagedPoolUsage", PVOID), + ("QuotaPeakNonPagedPoolUsage", PVOID), + ("QuotaNonPagedPoolUsage", PVOID), + ("PagefileUsage", PVOID), + ("PeakPagefileUsage", SIZE_T), + ("PrivatePageCount", SIZE_T), + ("Reserved6", LARGE_INTEGER * (6)), + ] +SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION +PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) + +class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): + _fields_ = [ + ("IdleTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("Reserved1", LARGE_INTEGER * (2)), + ("Reserved2", ULONG), + ] +SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION +PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) + +class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): + _fields_ = [ + ("RegistryQuotaAllowed", ULONG), + ("RegistryQuotaUsed", ULONG), + ("Reserved1", PVOID), + ] +SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION +PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) + +class _SYSTEM_BASIC_INFORMATION(Structure): + _fields_ = [ + ("Reserved1", BYTE * (24)), + ("Reserved2", PVOID * (4)), + ("NumberOfProcessors", CHAR), + ] +PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) +SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION + +class _SYSTEM_PROCESS_INFORMATION_ORIG(Structure): + _fields_ = [ + ("NextEntryOffset", ULONG), + ("Reserved1", BYTE * (52)), + ("Reserved2", PVOID * (3)), + ("UniqueProcessId", HANDLE), + ("Reserved3", PVOID), + ("HandleCount", ULONG), + ("Reserved4", BYTE * (4)), + ("Reserved5", PVOID * (11)), + ("PeakPagefileUsage", SIZE_T), + ("PrivatePageCount", SIZE_T), + ("Reserved6", LARGE_INTEGER * (6)), + ] +SYSTEM_PROCESS_INFORMATION_ORIG = _SYSTEM_PROCESS_INFORMATION_ORIG +PSYSTEM_PROCESS_INFORMATION_ORIG = POINTER(_SYSTEM_PROCESS_INFORMATION_ORIG) + class _TIME_ZONE_INFORMATION(Structure): _fields_ = [ ("Bias", LONG),