diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7e99e36 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.pyc \ No newline at end of file diff --git a/ctypes_generation/README b/ctypes_generation/README new file mode 100644 index 0000000..f371d91 --- /dev/null +++ b/ctypes_generation/README @@ -0,0 +1,13 @@ +== ctypes_generation == + +I promise i will make a real README at the root of the project. +I don't have the need (nor want to code) a full C parser but i need to parse some windows definition +to generate some python function/struct/flags. +So, there are 3 dumb parser used to generate: + - function prototype + - ctypes struct definition + - flags (int with name) + +Maybe one day I will do something clean and sane. +But not today. +sorry :( \ No newline at end of file diff --git a/ctypes_generation/def_parser.py b/ctypes_generation/def_parser.py new file mode 100644 index 0000000..e019f8b --- /dev/null +++ b/ctypes_generation/def_parser.py @@ -0,0 +1,34 @@ +from winstruct import WinStruct, WinStructType, Ptr +import dummy_wintypes +from simpleparser import * +import re + +class WinDef(object): + def __init__(self, name, code): + self.name = name + self.code = code + + def generate_ctypes(self): + return """{0} = Flag("{0}", {1})""".format(self.name, self.code) + +class WinDefParser(Parser): + + def parse_define(self): + self.assert_token_type(SharpToken) + define = self.assert_token_type(NameToken) + if define.value.lower() != "define": + raise ValueError("Expection #define got #{0} instead".format(define.value)) + define_name = self.assert_token_type(NameToken) + define_value = [] + while self.peek() is not None and type(self.peek()) is not SharpToken: + v = self.next_token().value + if v.lower().startswith("0x") and v[-1] == "L": + v = v[:-1] + define_value.append(v) + return WinDef(define_name.value, " ".join(define_value)) + + def parse(self): + res = [] + while self.peek() is not None: + res.append(self.parse_define()) + return res \ No newline at end of file diff --git a/ctypes_generation/dummy_wintypes.py b/ctypes_generation/dummy_wintypes.py new file mode 100644 index 0000000..95177c3 --- /dev/null +++ b/ctypes_generation/dummy_wintypes.py @@ -0,0 +1 @@ +names = ['ATOM', 'BOOL', 'BOOLEAN', 'BYTE', 'COLORREF', 'DOUBLE', 'DWORD', 'FILETIME', 'FLOAT', 'HACCEL', 'HANDLE', 'HBITMAP', ' HBRUSH', 'HCOLORSPACE', 'HDC', 'HDESK', 'HDWP', 'HENHMETAFILE', 'HFONT', 'HGDIOBJ', 'HGLOBAL', 'HHOOK', 'HICON', 'HINSTA NCE', 'HKEY', 'HKL', 'HLOCAL', 'HMENU', 'HMETAFILE', 'HMODULE', 'HMONITOR', 'HPALETTE', 'HPEN', 'HRGN', 'HRSRC', 'HSTR', 'HTASK', 'HWINSTA', 'HWND', 'INT', 'LANGID', 'LARGE_INTEGER', 'LCID', 'LCTYPE', 'LGRPID', 'LONG', 'LPARAM', 'LPCOLESTR' , 'LPCSTR', 'LPCVOID', 'LPCWSTR', 'LPOLESTR', 'LPSTR', 'LPVOID', 'LPWSTR', 'MAX_PATH', 'MSG', 'OLESTR', 'POINT', 'POINTL ', 'RECT', 'RECTL', 'RGB', 'SC_HANDLE', 'SERVICE_STATUS_HANDLE', 'SHORT', 'SIZE', 'SIZEL', 'SMALL_RECT', 'UINT', 'ULARGE _INTEGER', 'ULONG', 'USHORT', 'VARIANT_BOOL', 'WCHAR', 'WIN32_FIND_DATAA', 'WIN32_FIND_DATAW', 'WORD', 'WPARAM', '_COORD ', '_FILETIME', '_LARGE_INTEGER', '_POINTL', '_RECTL', '_SMALL_RECT', '_ULARGE_INTEGER', 'tagMSG', 'tagPOINT', 'tagRECT' , 'tagSIZE'] diff --git a/ctypes_generation/func_parser.py b/ctypes_generation/func_parser.py new file mode 100644 index 0000000..4444b0e --- /dev/null +++ b/ctypes_generation/func_parser.py @@ -0,0 +1,119 @@ +from winstruct import WinStruct, WinStructType, Ptr +import dummy_wintypes +from simpleparser import * + + +class WinFunc(object): + def __init__(self, return_type, name, params=()): + self.name = name + self.return_type = return_type + self.params = params + #if return_type not in dummy_wintypes.names: + # print("Non-standard return type {0}".format(return_type)) + #for (type, name) in params: + # if type not in dummy_wintypes.names: + # print("Non-standard type {0}".format(type)) + + def generate_ctypes(self): + return self.generate_comment_ctypes() + "\n" + self.generate_prototype_ctypes() + "\n" + self.generate_paramflags_ctypes() + "\n" + + def generate_comment_ctypes(self): + model = "# {0}({1}):" + ctypes_param = [name for type, name in self.params] + ctypes_param_str = ", ".join(ctypes_param) + return model.format(self.name, ctypes_param_str) + + def generate_prototype_ctypes(self): + model = "{0} = WINFUNCTYPE({1})" + ctypes_param = [self.return_type] + [type for type, name in self.params] + ctypes_param_str = ", ".join(ctypes_param) + return model.format(self.name + "Prototype", ctypes_param_str) + + def generate_paramflags_ctypes(self): + model = "{0} = {1}" + ctypes_paramflags = tuple([(1, name) for type, name in self.params]) + return model.format(self.name + "Params", ctypes_paramflags) + + +class WinFuncParser(Parser): + + known_io_info_type = ["__in", "__in_opt", "_In_", "_In_opt_", "_Inout_", "_Out_opt_", "_Out_", "_Reserved_", "_Inout_opt_", "__inout_opt", "__out", "__inout"] + + def assert_argument_io_info(self): + io_info = self.assert_token_type(NameToken) + if io_info.value not in self.known_io_info_type: + raise ParsingError("Was expection IO_INFO got {0} instead".format(io_info)) + return io_info + + def parse_func_arg(self, has_winapi): + type_ptr = False + if has_winapi: + self.assert_argument_io_info() + arg_type = self.assert_token_type(NameToken) + if arg_type.value.upper() == "CONST": + arg_type = self.assert_token_type(NameToken) + + if type(self.peek()) == StarToken: + type_ptr = True + self.assert_token_type(StarToken) + arg_name = self.assert_token_type(NameToken) + if not type(self.peek()) == CloseParenthesisToken: + self.assert_token_type(CommaToken) + if not type_ptr: + return (arg_type.value, arg_name.value) + return ("POINTER({0})".format(arg_type.value), arg_name.value) + + def assert_winapi_token(self): + winapi = self.assert_token_type(NameToken) + if winapi.value != "WINAPI": + raise ParsingError("Was expection NameToken(WINAPI) got {0} instead".format(winapi)) + return winapi + + def parse_winfunc(self): + has_winapi = False + try: + return_type = self.assert_token_type(NameToken).value + except StopIteration: + raise NormalParsingTerminaison() + + func_name = self.assert_token_type(NameToken).value + if func_name.upper() == "WINAPI": + has_winapi = True + func_name = self.assert_token_type(NameToken).value + + self.assert_token_type(OpenParenthesisToken) + + params = [] + while type(self.peek()) != CloseParenthesisToken: + params.append(self.parse_func_arg(has_winapi)) + + self.assert_token_type(CloseParenthesisToken) + self.assert_token_type(ColonToken) + return WinFunc(return_type, func_name, params) + + def parse(self): + res = [] + while self.peek() is not None: + res.append(self.parse_winfunc()) + return res + + + + +def dbg_lexer(data): + for i in Lexer(data).token_generation(): + print i + +def dbg_parser(data): + return WinFuncParser(data).parse() + +def dbg_validate(data): + return validate_structs(Parser(data).parse()) + + + +if __name__ == "__main__": + import sys + data = open(sys.argv[1], 'r').read() + funcs = generate_ctypes(data) + print(funcs) diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py new file mode 100644 index 0000000..b634451 --- /dev/null +++ b/ctypes_generation/generate.py @@ -0,0 +1,212 @@ +import sys +import os +import os.path + +import dummy_wintypes +import struct_parser +import func_parser +import def_parser + + +TYPE_EQUIVALENCE = [ + ('PWSTR', 'LPWSTR'), + ('SIZE_T', 'c_ulong'), + ('PSIZE_T', 'POINTER(SIZE_T)'), + ('PVOID', 'c_void_p'), + ('PPS_POST_PROCESS_INIT_ROUTINE', 'PVOID'), + ('NTSTATUS', 'DWORD'), + ('PULONG', 'POINTER(ULONG)'), + ('PDWORD', 'POINTER(DWORD)'), + ('LPDWORD', 'POINTER(DWORD)'), + ('LPTHREAD_START_ROUTINE', 'PVOID'), + ('PHANDLER_ROUTINE', 'PVOID'), + ('LPBYTE', 'POINTER(BYTE)'), + ('ULONG_PTR','PULONG'), + ('CHAR', 'c_char'), + ('UCHAR', 'c_char'), + ('FARPROC', 'PVOID'), + ('HGLOBAL', 'PVOID'), + ('PVECTORED_EXCEPTION_HANDLER', 'PVOID'), + #('HRESULT', 'c_long'), # VERY BAD : real HRESULT raise by itself -> way better + ('ULONGLONG', 'c_ulonglong'), + ('LONGLONG', 'c_longlong'), + ('ULONG64', 'c_ulonglong'), + ('DWORD64', 'ULONG64'), + ('PULONG64', 'POINTER(ULONG64)'), + ('PHANDLE', 'POINTER(HANDLE)'), + ('HKEY', 'HANDLE'), + ('PHKEY', 'POINTER(HKEY)'), + ('ACCESS_MASK', 'DWORD'), + ('REGSAM', 'ACCESS_MASK'), + # Will be changed at import time + ('LPCONTEXT', 'PVOID'), + ('HCERTSTORE', 'PVOID'), + ('HCRYPTMSG', 'PVOID'), + ] + +# For functions returning void +TYPE_EQUIVALENCE.append(('VOID', 'DWORD')) + +known_type = dummy_wintypes.names + list([x[0] for x in TYPE_EQUIVALENCE]) + +FUNC_FILE = "winfunc.txt" +STRUCT_FILE = "winstruct.txt" +DEF_FILE = "windef.txt" + +GENERATED_STRUCT_FILE = "winstructs" +GENERATED_FUNC_FILE = "winfuncs" +GENERATED_DEF_FILE = "windef" + +OUT_DIRS = ["..\windows\generated_def"] +if len(sys.argv) > 1: + OUT_DIRS.append(sys.argv[1]) + +def get_all_struct_name(structs, enums): + res = [] + for s in structs + enums: + res.append(s.name) + res.extend(s.typedef) + return res + +def generate_type_equiv_code(type_equiv): + ctypes_str = "" + for type_equiv in type_equiv: + ctypes_str += "{0} = {1}\n".format(*type_equiv) + ctypes_str += "\n" + return ctypes_str + +def verif_funcs_type(funcs, structs, enums): + all_struct_name = get_all_struct_name(structs, enums) + for f in funcs: + ret_type = f.return_type + if ret_type not in known_type and ret_type not in all_struct_name: + import pdb; pdb.set_trace() + raise ValueError("UNKNOW RET TYPE {0}".format(ret_type)) + + for param_type, _ in f.params: + # Crappy but fuck it ! + if param_type.startswith("POINTER(") and param_type.endswith(")"): + param_type = param_type[len("POINTER("): -1] + if param_type not in known_type and param_type not in all_struct_name: + import pdb; pdb.set_trace() + raise ValueError("UNKNOW PARAM TYPE {0}".format(param_type)) + +def check_in_define(name, defs): + return any(name == d.name for d in defs) + +def validate_structs(structs, enums, defs): + all_struct_name = get_all_struct_name(structs, enums) + for struct in structs: + for field_type, field_name, nb_rep in struct.fields: + if field_type.name not in known_type + all_struct_name: + import pdb; pdb.set_trace() + raise ValueError("UNKNOW TYPE {0}".format(field_type)) + try: + int(nb_rep) + except ValueError: + if not check_in_define(nb_rep, defs): + raise ValueError("UNKNOW DEFINE {0}".format(nb_rep)) + +common_header = "#Generated file\n" + +defs_header = common_header + """ +import sys +if sys.version_info.major == 3: + long = int + +class Flag(long): + def __new__(cls, name, value): + return super(Flag, cls).__new__(cls, value) + + def __init__(self, name, value): + self.name = name + + def __repr__(self): + return "{0}({1})".format(self.name, hex(self)) + + __str__ = __repr__ +""" + +def generate_defs_ctypes(defs): + ctypes_lines = [defs_header] + [d.generate_ctypes() for d in defs] + ctypes_code = "\n".join(ctypes_lines) + return ctypes_code + + +funcs_header = common_header + """ +from ctypes import * +from ctypes.wintypes import * +from .{0} import * + +"""[1:].format(GENERATED_STRUCT_FILE) + +def generate_funcs_ctypes(funcs): + ctypes_code = funcs_header + + all_funcs_name = [f.name for f in funcs] + ctypes_code += "functions = {0}\n\n".format(str(all_funcs_name)) + for func in funcs: + ctypes_code += func.generate_ctypes() + "\n" + return ctypes_code + +structs_header = common_header + """ +from ctypes import * +from ctypes.wintypes import * +from .windef import * + +"""[1:] + +def generate_struct_ctypes(structs, enums): + ctypes_str = structs_header + ctypes_str += generate_type_equiv_code(TYPE_EQUIVALENCE) + + all_struct_name = [s.name for s in structs] + ctypes_str += "structs = {0}\n\n".format(str(all_struct_name)) + + all_enum_name = [e.name for e in enums] + ctypes_str += "enums = {0}\n\n".format(str(all_enum_name)) + + # Enums declarations + for enum in enums: + ctypes_str += "# Enum {0} definitions\n".format(enum.name) + ctypes_str += enum.generate_ctypes() + "\n" + + # Struct declarations + for struct in structs: + ctypes_str += "# Struct {0} definitions\n".format(struct.name) + ctypes_str += struct.generate_ctypes() + "\n" + + return ctypes_str + +def write_to_out_file(name, data): + for out_dir in OUT_DIRS: + f = open("{0}/{1}.py".format(out_dir, name), 'w') + f.write(data) + f.close() + +def_code = open(DEF_FILE, 'r').read() +funcs_code = open(FUNC_FILE, 'r').read() +structs_code = open(STRUCT_FILE, 'r').read() + +defs = def_parser.WinDefParser(def_code).parse() +funcs = func_parser.WinFuncParser(funcs_code).parse() +structs, enums = struct_parser.WinStructParser(structs_code).parse() + + +validate_structs(structs, enums, defs) +verif_funcs_type(funcs, structs, enums) + +defs_ctypes = generate_defs_ctypes(defs) +funcs_ctypes = generate_funcs_ctypes(funcs) +structs_ctypes = generate_struct_ctypes(structs, enums) + +for out_dir in OUT_DIRS: + if not os.path.exists(out_dir): + os.mkdir(out_dir) + +write_to_out_file(GENERATED_DEF_FILE, defs_ctypes) +write_to_out_file(GENERATED_FUNC_FILE, funcs_ctypes) +write_to_out_file(GENERATED_STRUCT_FILE, structs_ctypes) + +for out_dir in OUT_DIRS: + print("Files generated in <{0}>".format(os.path.abspath(out_dir))) diff --git a/ctypes_generation/simpleparser.py b/ctypes_generation/simpleparser.py new file mode 100644 index 0000000..733e461 --- /dev/null +++ b/ctypes_generation/simpleparser.py @@ -0,0 +1,211 @@ +import collections + +TupleToken = collections.namedtuple('Token', ['value']) + +class Token(TupleToken): + def __repr__(self): + return "{0}(value={1})".format(type(self).__name__, self.value) + +TupleNoValueToken = collections.namedtuple('Token', []) + +class NoValueToken(TupleNoValueToken): + value = None + def __repr__(self): + return "{0}()".format(type(self).__name__) + +class KeywordToken(Token): + pass + +class TypeToken(Token): + pass + +class NameToken(Token): + pass + +class ColonToken(NoValueToken): + value = ";" + pass + +class CommaToken(NoValueToken): + value = "," + pass + +class StarToken(NoValueToken): + value = "*" + pass + +class OpenBracketToken(NoValueToken): + value = "{" + pass + +class CloseBracketToken(NoValueToken): + value = "}" + pass + +class OpenSquareBracketToken(NoValueToken): + value = "[" + pass + +class CloseSquareBracketToken(NoValueToken): + value = "]" + pass + +class OpenParenthesisToken(NoValueToken): + value = "(" + pass + +class CloseParenthesisToken(NoValueToken): + value = ")" + pass + +class SharpToken(NoValueToken): + value = "#" + pass + +class EqualToken(NoValueToken): + value = "=" + pass + +class Lexer(object): + keywords = ["typedef", "struct", "enum", "union"] + + token_chr = {"*" : StarToken, "[" : OpenSquareBracketToken, "]" : CloseSquareBracketToken, + "{" : OpenBracketToken, "}" : CloseBracketToken, ";" : ColonToken, + "," : CommaToken, "(" : OpenParenthesisToken, ")" : CloseParenthesisToken, "#" : SharpToken, "=" : EqualToken} + + def __init__(self, code): + self.code = code + + def split_line(self, line): + return line.strip().split() + + def is_keyword(self, word): + return word in self.keywords + + def split_word(self, word): + """Slit a dummy name with all token_chr""" + queue = [None, word] + for name in iter(queue.pop, None): + if name in self.token_chr: + yield self.token_chr[name]() + continue + if not any(spec_chr in name for spec_chr in self.token_chr): + yield NameToken(name) + continue + new_tokens = [name] + for spec_chr in self.token_chr: + new_tokens = list(new_tokens[0].partition(spec_chr)) + new_tokens[1:] + queue.extend(reversed([x for x in new_tokens if x])) + + def __iter__(self): + for line in self.code.split("\n"): + for word in self.split_line(line): + if self.is_keyword(word): + yield KeywordToken(word) + continue + for tok in self.split_word(word): + yield tok + + + +class ParsingError(Exception): + pass + +class Parser(object): + + def __init__(self, data): + self.lexer = iter(Lexer(data)) + self.peek_token = None + + def assert_keyword(self, expected_keyword, n=None): + if n is None: + n = self.assert_token_type(KeywordToken) + if n.value != expected_keyword: + raise ParsingError("Expected Keyword {0} got {1} instead".format(expected_keyword, n.value)) + return n + + def assert_token_type(self, expected_type, n=None): + if n is None: + n = self.next_token() + if type(n) != expected_type: + raise ParsingError("Expected type {0} and got {1} instead".format(expected_type.__name__, n)) + return n + + def assert_argument_io_info(self): + io_info = self.assert_token_type(NameToken) + if io_info.value not in self.known_io_info_type: + raise ParsingError("Was expection IO_INFO got {0} instead".format(winapi)) + return io_info + + def promote_to_type(self, token): + self.assert_token_type(NameToken, token) + return TypeToken(token.value) + + def promote_to_int(self, token): + self.assert_token_type(NameToken, token) + try: + return int(token.value) + except ValueError: + return int(token.value, 0) + + def next_token(self): + if self.peek_token is not None: + res = self.peek_token + self.peek_token = None + return res + return next(self.lexer, None) + + def peek(self): + if self.peek_token is None: + self.peek_token = self.next_token() + return self.peek_token + + def parse(self): + raise NotImplementedError("Parser.parse()") + + +#KNOWN_TYPE = ["BYTE", "USHORT", "DWORD", "PVOID", "ULONG", "HANDLE", "PWSTR"] +# +#def validate_structs(structs): +# by_name = dict([(struct.name, struct) for struct in structs]) +# if len(by_name) != len(structs): +# raise ValueError('2 structs with the same name') +# +# for struct in structs: +# for name, value in struct.typedef.items(): +# by_name[name] = value +# +# for struct in structs: +# for field_type, field_name, nb_rep in struct.fields: +# if field_type.name not in KNOWN_TYPE: +# print("non standard type : {0}".format(field_type)) +# if field_type.name not in by_name: +# print("UNKNOW TYPE {0}".format(field_type)) +# +# return structs +# +# +# +#data = open("winfunc.txt", "r").read() +# +# +#def dbg_lexer(data): +# for i in Lexer(data).token_generation(): +# print i +# +#def dbg_parser(data): +# return Parser(data).parse() +# +#def dbg_validate(data): +# return validate_structs(Parser(data).parse()) +# +# +#def tst(x): +# print("=== TEST FOR <{0}> === ".format(x)) +# g = Lexer("").split_word(x) +# for i in g: +# print (i) +# +#x = dbg_parser(data) +#for i in x: +# print i diff --git a/ctypes_generation/struct_parser.py b/ctypes_generation/struct_parser.py new file mode 100644 index 0000000..3aff89f --- /dev/null +++ b/ctypes_generation/struct_parser.py @@ -0,0 +1,133 @@ +import dummy_wintypes +import itertools +from winstruct import WinStruct, WinUnion, WinStructType, Ptr, WinEnum +from simpleparser import * + +class WinStructParser(Parser): + + def parse_array(self, ): + self.assert_token_type(OpenSquareBracketToken) + number = self.assert_token_type(NameToken).value + self.assert_token_type(CloseSquareBracketToken) + return number + + def parse_def(self): + if self.peek() == KeywordToken("struct"): + discard = self.next_token() + + def_type_tok = self.assert_token_type(NameToken) + def_type = WinStructType(def_type_tok.value) + if type(self.peek()) == StarToken: + def_type = Ptr(def_type) + discard_star = self.next_token() + + def_name = self.assert_token_type(NameToken) + + if type(self.peek()) == ColonToken: + self.next_token() + return (def_type, def_name, 1) + + number_rep = self.parse_array() + self.assert_token_type(ColonToken) + return (def_type, def_name, number_rep) + + def parse_typedef(self, struct): + sep = CommaToken() + while type(sep) == CommaToken: + add_to_typedef = struct.add_typedef + if type(self.peek()) == StarToken: + self.next_token() + add_to_typedef = struct.add_ptr_typedef + name = self.assert_token_type(NameToken) + # UGLY HACK for LDR definition + if name.value == "RESTRICTED_POINTER": + name = self.assert_token_type(NameToken) + add_to_typedef(name.value) + sep = self.next_token() + self.assert_token_type(ColonToken, sep) + + def parse_enum(self): + """Handle enum typedef with no value assignement and 1 typedef after""" + enum_name = self.assert_token_type(NameToken).value + res_enum = WinEnum(enum_name) + self.assert_token_type(OpenBracketToken) + count = itertools.count() + assigned_value = False + while type(self.peek()) != CloseBracketToken: + i = next(count) + name = self.assert_token_type(NameToken) + if type(self.peek()) == EqualToken: + if i != 0 and not assigned_value: + raise ParsingError("Enum {0} mix def with and without equal".format(enum_name)) + assigned_value = True + self.assert_token_type(EqualToken) + i = self.promote_to_int(self.next_token()) + else: + if assigned_value: + raise ParsingError("Enum {0} mix def with and without equal".format(enum_name)) + + res_enum.add_enum_entry(i, name.value) + if not type(self.peek()) == CloseBracketToken: + self.assert_token_type(CommaToken) + + self.assert_token_type(CloseBracketToken) + self.parse_typedef(res_enum) + #other_name = self.assert_token_type(NameToken).value + #res_enum.add_typedef(other_name) + #self.assert_token_type(ColonToken) + return res_enum + + + + def parse_winstruct(self): + self.assert_keyword("typedef") + + def_type = self.assert_token_type(KeywordToken) + if def_type.value == "enum": + return self.parse_enum() + if def_type.value == "struct": + WinDefType = WinStruct + elif def_type.value == "union": + WinDefType = WinUnion + else: + raise ParsingError("Expecting union or struct got <{0}> instead".format(def_type.value)) + struct_name = self.assert_token_type(NameToken) + self.assert_token_type(OpenBracketToken) + + result = WinDefType(struct_name.value) + + while type(self.peek()) != CloseBracketToken: + tok_type, tok_name, nb_rep = self.parse_def() + result.add_field((tok_type, tok_name.value, nb_rep)) + self.assert_token_type(CloseBracketToken) + self.parse_typedef(result) + return result + + def parse(self): + strucs = [] + enums = [] + while self.peek() is not None: + x = self.parse_winstruct() + if type(x) == WinStruct or type(x) == WinUnion: + strucs.append(x) + elif type(x) == WinEnum: + enums.append(x) + else: + raise ValueError("Unknow returned type {0}".format(x)) + return strucs, enums + +def dbg_lexer(data): + for i in Lexer(data).token_generation(): + print i + +def dbg_parser(data): + return WinStructParser(data).parse() + +def dbg_validate(data): + return validate_structs(Parser(data).parse()) + + +if __name__ == "__main__": + import sys + data = open(sys.argv[1], 'r').read() + ctypes_code = generate_ctypes(data) diff --git a/ctypes_generation/windef.txt b/ctypes_generation/windef.txt new file mode 100644 index 0000000..901b335 --- /dev/null +++ b/ctypes_generation/windef.txt @@ -0,0 +1,541 @@ +#define NULL 0 +#define MAX_PATH 260 +#define ANYSIZE_ARRAY 1 +#define ANY_SIZE 1 +#define IMAGE_SIZEOF_SHORT_NAME 8 +#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 +#define INFINITE 0xFFFFFFFF + +#define STD_INPUT_HANDLE -10 +#define STD_OUTPUT_HANDLE -11 +#define STD_ERROR_HANDLE -12 + +#define WARMING_NOT_SAME_FLAG_FOR_WINXP 0 +#define PROCESS_ALL_ACCESS 0x001F0FFF +#define THREAD_ALL_ACCESS 0x001F03FF + + +#define STARTF_USESHOWWINDOW 0x00000001 +#define STARTF_USESIZE 0x00000002 +#define STARTF_USEPOSITION 0x00000004 +#define STARTF_USECOUNTCHARS 0x00000008 +#define STARTF_USEFILLATTRIBUTE 0x00000010 +#define STARTF_RUNFULLSCREEN 0x00000020 +#define STARTF_FORCEONFEEDBACK 0x00000040 +#define STARTF_FORCEOFFFEEDBACK 0x00000080 +#define STARTF_USESTDHANDLES 0x00000100 + +#define SW_HIDE 0 +#define SW_SHOWNORMAL 1 +#define SW_NORMAL 1 +#define SW_SHOWMINIMIZED 2 +#define SW_SHOWMAXIMIZED 3 +#define SW_MAXIMIZE 3 +#define SW_SHOWNOACTIVATE 4 +#define SW_SHOW 5 +#define SW_MINIMIZE 6 +#define SW_SHOWMINNOACTIVE 7 +#define SW_SHOWNA 8 +#define SW_RESTORE 9 +#define SW_SHOWDEFAULT 10 +#define SW_FORCEMINIMIZE 11 +#define SW_MAX 11 + + +#define DEBUG_PROCESS 0x00000001 +#define DEBUG_ONLY_THIS_PROCESS 0x00000002 +#define CREATE_SUSPENDED 0x00000004 +#define DETACHED_PROCESS 0x00000008 + +#define CREATE_NEW_CONSOLE 0x00000010 +#define NORMAL_PRIORITY_CLASS 0x00000020 +#define IDLE_PRIORITY_CLASS 0x00000040 +#define HIGH_PRIORITY_CLASS 0x00000080 + +#define REALTIME_PRIORITY_CLASS 0x00000100 +#define CREATE_NEW_PROCESS_GROUP 0x00000200 +#define CREATE_UNICODE_ENVIRONMENT 0x00000400 +#define CREATE_SEPARATE_WOW_VDM 0x00000800 + +#define CREATE_SHARED_WOW_VDM 0x00001000 +#define CREATE_FORCEDOS 0x00002000 +#define BELOW_NORMAL_PRIORITY_CLASS 0x00004000 +#define ABOVE_NORMAL_PRIORITY_CLASS 0x00008000 + +#define INHERIT_PARENT_AFFINITY 0x00010000 +#define INHERIT_CALLER_PRIORITY 0x00020000 +#define CREATE_PROTECTED_PROCESS 0x00040000 +#define EXTENDED_STARTUPINFO_PRESENT 0x00080000 + +#define PROCESS_MODE_BACKGROUND_BEGIN 0x00100000 +#define PROCESS_MODE_BACKGROUND_END 0x00200000 + +#define CREATE_BREAKAWAY_FROM_JOB 0x01000000 +#define CREATE_PRESERVE_CODE_AUTHZ_LEVEL 0x02000000 +#define CREATE_DEFAULT_ERROR_MODE 0x04000000 +#define CREATE_NO_WINDOW 0x08000000 + +#define PROFILE_USER 0x10000000 +#define PROFILE_KERNEL 0x20000000 +#define PROFILE_SERVER 0x40000000 +#define CREATE_IGNORE_SYSTEM_DEFAULT 0x80000000 + + +#define STATUS_WAIT_0 (0x00000000L) +#define STATUS_ABANDONED_WAIT_0 (0x00000080L) +#define STATUS_USER_APC (0x000000C0L) +#define STATUS_TIMEOUT (0x00000102L) +#define STATUS_PENDING (0x00000103L) +#define DBG_EXCEPTION_HANDLED (0x00010001L) +#define DBG_CONTINUE (0x00010002L) +#define STATUS_SEGMENT_NOTIFICATION (0x40000005L) +#define DBG_TERMINATE_THREAD (0x40010003L) +#define DBG_TERMINATE_PROCESS (0x40010004L) +#define DBG_CONTROL_C (0x40010005L) +#define DBG_PRINTEXCEPTION_C (0x40010006L) +#define DBG_RIPEXCEPTION (0x40010007L) +#define DBG_CONTROL_BREAK (0x40010008L) +#define DBG_COMMAND_EXCEPTION (0x40010009L) +#define STATUS_GUARD_PAGE_VIOLATION (0x80000001L) +#define STATUS_DATATYPE_MISALIGNMENT (0x80000002L) +#define STATUS_BREAKPOINT (0x80000003L) +#define STATUS_SINGLE_STEP (0x80000004L) +#define STATUS_LONGJUMP (0x80000026L) +#define STATUS_UNWIND_CONSOLIDATE (0x80000029L) +#define DBG_EXCEPTION_NOT_HANDLED (0x80010001L) +#define STATUS_ACCESS_VIOLATION (0xC0000005L) +#define STATUS_IN_PAGE_ERROR (0xC0000006L) +#define STATUS_INVALID_HANDLE (0xC0000008L) +#define STATUS_INVALID_PARAMETER (0xC000000DL) +#define STATUS_NO_MEMORY (0xC0000017L) +#define STATUS_ILLEGAL_INSTRUCTION (0xC000001DL) +#define STATUS_NONCONTINUABLE_EXCEPTION (0xC0000025L) +#define STATUS_INVALID_DISPOSITION (0xC0000026L) +#define STATUS_ARRAY_BOUNDS_EXCEEDED (0xC000008CL) +#define STATUS_FLOAT_DENORMAL_OPERAND (0xC000008DL) +#define STATUS_FLOAT_DIVIDE_BY_ZERO (0xC000008EL) +#define STATUS_FLOAT_INEXACT_RESULT (0xC000008FL) +#define STATUS_FLOAT_INVALID_OPERATION (0xC0000090L) +#define STATUS_FLOAT_OVERFLOW (0xC0000091L) +#define STATUS_FLOAT_STACK_CHECK (0xC0000092L) +#define STATUS_FLOAT_UNDERFLOW (0xC0000093L) +#define STATUS_INTEGER_DIVIDE_BY_ZERO (0xC0000094L) +#define STATUS_INTEGER_OVERFLOW (0xC0000095L) +#define STATUS_PRIVILEGED_INSTRUCTION (0xC0000096L) +#define STATUS_STACK_OVERFLOW (0xC00000FDL) +#define STATUS_DLL_NOT_FOUND (0xC0000135L) +#define STATUS_ORDINAL_NOT_FOUND (0xC0000138L) +#define STATUS_ENTRYPOINT_NOT_FOUND (0xC0000139L) +#define STATUS_CONTROL_C_EXIT (0xC000013AL) +#define STATUS_DLL_INIT_FAILED (0xC0000142L) +#define STATUS_FLOAT_MULTIPLE_FAULTS (0xC00002B4L) +#define STATUS_FLOAT_MULTIPLE_TRAPS (0xC00002B5L) +#define STATUS_REG_NAT_CONSUMPTION (0xC00002C9L) +#define STATUS_STACK_BUFFER_OVERRUN (0xC0000409L) +#define STATUS_INVALID_CRUNTIME_PARAMETER (0xC0000417L) +#define STATUS_ASSERTION_FAILURE (0xC0000420L) +#define STATUS_POSSIBLE_DEADLOCK (0xC0000194) + + +#define WAIT_IO_COMPLETION STATUS_USER_APC +#define STILL_ACTIVE STATUS_PENDING +#define EXCEPTION_ACCESS_VIOLATION STATUS_ACCESS_VIOLATION +#define EXCEPTION_DATATYPE_MISALIGNMENT STATUS_DATATYPE_MISALIGNMENT +#define EXCEPTION_BREAKPOINT STATUS_BREAKPOINT +#define EXCEPTION_SINGLE_STEP STATUS_SINGLE_STEP +#define EXCEPTION_ARRAY_BOUNDS_EXCEEDED STATUS_ARRAY_BOUNDS_EXCEEDED +#define EXCEPTION_FLT_DENORMAL_OPERAND STATUS_FLOAT_DENORMAL_OPERAND +#define EXCEPTION_FLT_DIVIDE_BY_ZERO STATUS_FLOAT_DIVIDE_BY_ZERO +#define EXCEPTION_FLT_INEXACT_RESULT STATUS_FLOAT_INEXACT_RESULT +#define EXCEPTION_FLT_INVALID_OPERATION STATUS_FLOAT_INVALID_OPERATION +#define EXCEPTION_FLT_OVERFLOW STATUS_FLOAT_OVERFLOW +#define EXCEPTION_FLT_STACK_CHECK STATUS_FLOAT_STACK_CHECK +#define EXCEPTION_FLT_UNDERFLOW STATUS_FLOAT_UNDERFLOW +#define EXCEPTION_INT_DIVIDE_BY_ZERO STATUS_INTEGER_DIVIDE_BY_ZERO +#define EXCEPTION_INT_OVERFLOW STATUS_INTEGER_OVERFLOW +#define EXCEPTION_PRIV_INSTRUCTION STATUS_PRIVILEGED_INSTRUCTION +#define EXCEPTION_IN_PAGE_ERROR STATUS_IN_PAGE_ERROR +#define EXCEPTION_ILLEGAL_INSTRUCTION STATUS_ILLEGAL_INSTRUCTION +#define EXCEPTION_NONCONTINUABLE_EXCEPTION STATUS_NONCONTINUABLE_EXCEPTION +#define EXCEPTION_STACK_OVERFLOW STATUS_STACK_OVERFLOW +#define EXCEPTION_INVALID_DISPOSITION STATUS_INVALID_DISPOSITION +#define EXCEPTION_GUARD_PAGE STATUS_GUARD_PAGE_VIOLATION +#define EXCEPTION_INVALID_HANDLE STATUS_INVALID_HANDLE +#define EXCEPTION_POSSIBLE_DEADLOCK STATUS_POSSIBLE_DEADLOCK +#define CONTROL_C_EXIT STATUS_CONTROL_C_EXIT + +#define EXCEPTION_DEBUG_EVENT 1 +#define CREATE_THREAD_DEBUG_EVENT 2 +#define CREATE_PROCESS_DEBUG_EVENT 3 +#define EXIT_THREAD_DEBUG_EVENT 4 +#define EXIT_PROCESS_DEBUG_EVENT 5 +#define LOAD_DLL_DEBUG_EVENT 6 +#define UNLOAD_DLL_DEBUG_EVENT 7 +#define OUTPUT_DEBUG_STRING_EVENT 8 +#define RIP_EVENT 9 + + +#define TH32CS_SNAPHEAPLIST 0x00000001 +#define TH32CS_SNAPPROCESS 0x00000002 +#define TH32CS_SNAPTHREAD 0x00000004 +#define TH32CS_SNAPMODULE 0x00000008 +#define TH32CS_SNAPMODULE32 0x00000010 +#define TH32CS_SNAPALL (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE) +#define TH32CS_INHERIT 0x80000000 + +#define CONTEXT_I386 0x00010000 + +#define CONTEXT_CONTROL 0x00000001L +#define CONTEXT_INTEGER 0x00000002L +#define CONTEXT_SEGMENTS 0x00000004L +#define CONTEXT_FLOATING_POINT 0x00000008L +#define CONTEXT_DEBUG_REGISTERS 0x00000010L +#define CONTEXT_EXTENDED_REGISTERS 0x00000020L +#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS) +#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS) + +#define CONTEXT_FULL CONTEXT_I386 | CONTEXT_FULL +#define CONTEXT_ALL CONTEXT_I386 | CONTEXT_ALL + + +#define PAGE_NOACCESS 0x01 +#define PAGE_READONLY 0x02 +#define PAGE_READWRITE 0x04 +#define PAGE_WRITECOPY 0x08 +#define PAGE_EXECUTE 0x10 +#define PAGE_EXECUTE_READ 0x20 +#define PAGE_EXECUTE_READWRITE 0x40 +#define PAGE_EXECUTE_WRITECOPY 0x80 +#define PAGE_GUARD 0x100 +#define PAGE_NOCACHE 0x200 +#define PAGE_WRITECOMBINE 0x400 +#define MEM_COMMIT 0x1000 +#define MEM_RESERVE 0x2000 +#define MEM_DECOMMIT 0x4000 +#define MEM_RELEASE 0x8000 +#define MEM_FREE 0x10000 +#define MEM_PRIVATE 0x20000 +#define MEM_MAPPED 0x40000 +#define MEM_RESET 0x80000 +#define MEM_TOP_DOWN 0x100000 +#define MEM_WRITE_WATCH 0x200000 +#define MEM_PHYSICAL 0x400000 +#define MEM_ROTATE 0x800000 +#define MEM_LARGE_PAGES 0x20000000 +#define MEM_4MB_PAGES 0x80000000 + +#define SEC_FILE 0x800000 +#define SEC_IMAGE 0x1000000 +#define SEC_PROTECTED_IMAGE 0x2000000 +#define SEC_RESERVE 0x4000000 +#define SEC_COMMIT 0x8000000 +#define SEC_NOCACHE 0x10000000 +#define SEC_WRITECOMBINE 0x40000000 +#define SEC_LARGE_PAGES 0x80000000 +#define MEM_IMAGE SEC_IMAGE +#define WRITE_WATCH_FLAG_RESET 0x01 + +#define DELETE (0x00010000L) +#define READ_CONTROL (0x00020000L) +#define WRITE_DAC (0x00040000L) +#define WRITE_OWNER (0x00080000L) +#define SYNCHRONIZE (0x00100000L) +#define STANDARD_RIGHTS_REQUIRED (0x000F0000L) +#define STANDARD_RIGHTS_READ (READ_CONTROL) +#define STANDARD_RIGHTS_WRITE (READ_CONTROL) +#define STANDARD_RIGHTS_EXECUTE (READ_CONTROL) + +#define STANDARD_RIGHTS_ALL (0x001F0000L) + +#define SPECIFIC_RIGHTS_ALL (0x0000FFFFL) + +#define TOKEN_ASSIGN_PRIMARY (0x0001) +#define TOKEN_DUPLICATE (0x0002) +#define TOKEN_IMPERSONATE (0x0004) +#define TOKEN_QUERY (0x0008) +#define TOKEN_QUERY_SOURCE (0x0010) +#define TOKEN_ADJUST_PRIVILEGES (0x0020) +#define TOKEN_ADJUST_GROUPS (0x0040) +#define TOKEN_ADJUST_DEFAULT (0x0080) +#define TOKEN_ADJUST_SESSIONID (0x0100) + +#define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT) + + +#define TOKEN_ALL_ACCESS (TOKEN_ALL_ACCESS_P | TOKEN_ADJUST_SESSIONID ) + +#define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L) +#define SE_PRIVILEGE_ENABLED (0x00000002L) +#define SE_PRIVILEGE_REMOVED (0X00000004L) +#define SE_PRIVILEGE_USED_FOR_ACCESS (0x80000000L) + + +#define AF_UNSPEC 0 +#define AF_UNIX 1 +#define AF_INET 2 +#define AF_IMPLINK 3 +#define AF_PUP 4 +#define AF_CHAOS 5 +#define AF_NS 6 +#define AF_IPX AF_NS +#define AF_ISO 7 +#define AF_OSI AF_ISO +#define AF_ECMA 8 +#define AF_DATAKIT 9 +#define AF_CCITT 10 +#define AF_SNA 11 +#define AF_DECnet 12 +#define AF_DLI 13 +#define AF_LAT 14 +#define AF_HYLINK 15 +#define AF_APPLETALK 16 +#define AF_NETBIOS 17 +#define AF_VOICEVIEW 18 +#define AF_FIREFOX 19 +#define AF_UNKNOWN1 20 +#define AF_BAN 21 +#define AF_ATM 22 +#define AF_INET6 23 +#define AF_CLUSTER 24 +#define AF_12844 25 +#define AF_IRDA 26 +#define AF_NETDES 28 + + +#define EXCEPTION_NONCONTINUABLE 0x1 +#define EXCEPTION_MAXIMUM_PARAMETERS 15 + + +#define STATUS_WAIT_0 (0x00000000) +#define STATUS_ABANDONED_WAIT_0 (0x00000080) +#define STATUS_USER_APC (0x000000C0) +#define STATUS_TIMEOUT (0x00000102) +#define STATUS_PENDING (0x00000103) +#define DBG_EXCEPTION_HANDLED (0x00010001) +#define DBG_CONTINUE (0x00010002) +#define STATUS_SEGMENT_NOTIFICATION (0x40000005) +#define DBG_TERMINATE_THREAD (0x40010003) +#define DBG_TERMINATE_PROCESS (0x40010004) +#define DBG_CONTROL_C (0x40010005) +#define DBG_PRINTEXCEPTION_C (0x40010006) +#define DBG_RIPEXCEPTION (0x40010007) +#define DBG_CONTROL_BREAK (0x40010008) +#define DBG_COMMAND_EXCEPTION (0x40010009) +#define STATUS_GUARD_PAGE_VIOLATION (0x80000001) +#define STATUS_DATATYPE_MISALIGNMENT (0x80000002) +#define STATUS_BREAKPOINT (0x80000003) +#define STATUS_SINGLE_STEP (0x80000004) +#define STATUS_LONGJUMP (0x80000026) +#define STATUS_UNWIND_CONSOLIDATE (0x80000029) +#define DBG_EXCEPTION_NOT_HANDLED (0x80010001) +#define STATUS_ACCESS_VIOLATION (0xC0000005) +#define STATUS_IN_PAGE_ERROR (0xC0000006) +#define STATUS_INVALID_HANDLE (0xC0000008) +#define STATUS_INVALID_PARAMETER (0xC000000D) +#define STATUS_NO_MEMORY (0xC0000017) +#define STATUS_ILLEGAL_INSTRUCTION (0xC000001D) +#define STATUS_NONCONTINUABLE_EXCEPTION (0xC0000025) +#define STATUS_INVALID_DISPOSITION (0xC0000026) +#define STATUS_ARRAY_BOUNDS_EXCEEDED (0xC000008C) +#define STATUS_FLOAT_DENORMAL_OPERAND (0xC000008D) +#define STATUS_FLOAT_DIVIDE_BY_ZERO (0xC000008E) +#define STATUS_FLOAT_INEXACT_RESULT (0xC000008F) +#define STATUS_FLOAT_INVALID_OPERATION (0xC0000090) +#define STATUS_FLOAT_OVERFLOW (0xC0000091) +#define STATUS_FLOAT_STACK_CHECK (0xC0000092) +#define STATUS_FLOAT_UNDERFLOW (0xC0000093) +#define STATUS_INTEGER_DIVIDE_BY_ZERO (0xC0000094) +#define STATUS_INTEGER_OVERFLOW (0xC0000095) +#define STATUS_PRIVILEGED_INSTRUCTION (0xC0000096) +#define STATUS_STACK_OVERFLOW (0xC00000FD) +#define STATUS_DLL_NOT_FOUND (0xC0000135) +#define STATUS_ORDINAL_NOT_FOUND (0xC0000138) +#define STATUS_ENTRYPOINT_NOT_FOUND (0xC0000139) +#define STATUS_CONTROL_C_EXIT (0xC000013A) +#define STATUS_DLL_INIT_FAILED (0xC0000142) +#define STATUS_FLOAT_MULTIPLE_FAULTS (0xC00002B4) +#define STATUS_FLOAT_MULTIPLE_TRAPS (0xC00002B5) +#define STATUS_REG_NAT_CONSUMPTION (0xC00002C9) +#define STATUS_STACK_BUFFER_OVERRUN (0xC0000409) +#define STATUS_INVALID_CRUNTIME_PARAMETER (0xC0000417) +#define STATUS_ASSERTION_FAILURE (0xC0000420) + + +#define WAIT_IO_COMPLETION STATUS_USER_APC +#define STILL_ACTIVE STATUS_PENDING +#define EXCEPTION_ACCESS_VIOLATION STATUS_ACCESS_VIOLATION +#define EXCEPTION_DATATYPE_MISALIGNMENT STATUS_DATATYPE_MISALIGNMENT +#define EXCEPTION_BREAKPOINT STATUS_BREAKPOINT +#define EXCEPTION_SINGLE_STEP STATUS_SINGLE_STEP +#define EXCEPTION_ARRAY_BOUNDS_EXCEEDED STATUS_ARRAY_BOUNDS_EXCEEDED +#define EXCEPTION_FLT_DENORMAL_OPERAND STATUS_FLOAT_DENORMAL_OPERAND +#define EXCEPTION_FLT_DIVIDE_BY_ZERO STATUS_FLOAT_DIVIDE_BY_ZERO +#define EXCEPTION_FLT_INEXACT_RESULT STATUS_FLOAT_INEXACT_RESULT +#define EXCEPTION_FLT_INVALID_OPERATION STATUS_FLOAT_INVALID_OPERATION +#define EXCEPTION_FLT_OVERFLOW STATUS_FLOAT_OVERFLOW +#define EXCEPTION_FLT_STACK_CHECK STATUS_FLOAT_STACK_CHECK +#define EXCEPTION_FLT_UNDERFLOW STATUS_FLOAT_UNDERFLOW +#define EXCEPTION_INT_DIVIDE_BY_ZERO STATUS_INTEGER_DIVIDE_BY_ZERO +#define EXCEPTION_INT_OVERFLOW STATUS_INTEGER_OVERFLOW +#define EXCEPTION_PRIV_INSTRUCTION STATUS_PRIVILEGED_INSTRUCTION +#define EXCEPTION_IN_PAGE_ERROR STATUS_IN_PAGE_ERROR +#define EXCEPTION_ILLEGAL_INSTRUCTION STATUS_ILLEGAL_INSTRUCTION +#define EXCEPTION_NONCONTINUABLE_EXCEPTION STATUS_NONCONTINUABLE_EXCEPTION +#define EXCEPTION_STACK_OVERFLOW STATUS_STACK_OVERFLOW +#define EXCEPTION_INVALID_DISPOSITION STATUS_INVALID_DISPOSITION +#define EXCEPTION_GUARD_PAGE STATUS_GUARD_PAGE_VIOLATION +#define EXCEPTION_INVALID_HANDLE STATUS_INVALID_HANDLE +#define EXCEPTION_POSSIBLE_DEADLOCK STATUS_POSSIBLE_DEADLOCK +#define CONTROL_C_EXIT STATUS_CONTROL_C_EXIT + + +#define EXCEPTION_EXECUTE_HANDLER 1 +#define EXCEPTION_CONTINUE_SEARCH 0 +#define EXCEPTION_CONTINUE_EXECUTION -1 + + +#define GENERIC_READ (0x80000000) +#define GENERIC_WRITE (0x40000000) +#define GENERIC_EXECUTE (0x20000000) +#define GENERIC_ALL (0x10000000) + +#define FILE_FLAG_WRITE_THROUGH 0x80000000 +#define FILE_FLAG_OVERLAPPED 0x40000000 +#define FILE_FLAG_NO_BUFFERING 0x20000000 +#define FILE_FLAG_RANDOM_ACCESS 0x10000000 +#define FILE_FLAG_SEQUENTIAL_SCAN 0x08000000 +#define FILE_FLAG_DELETE_ON_CLOSE 0x04000000 +#define FILE_FLAG_BACKUP_SEMANTICS 0x02000000 +#define FILE_FLAG_POSIX_SEMANTICS 0x01000000 +#define FILE_FLAG_OPEN_REPARSE_POINT 0x00200000 +#define FILE_FLAG_OPEN_NO_RECALL 0x00100000 +#define FILE_FLAG_FIRST_PIPE_INSTANCE 0x00080000 + +#define CREATE_NEW 1 +#define CREATE_ALWAYS 2 +#define OPEN_EXISTING 3 +#define OPEN_ALWAYS 4 +#define TRUNCATE_EXISTING 5 + + +#define FILE_SHARE_READ 0x00000001 +#define FILE_SHARE_WRITE 0x00000002 +#define FILE_SHARE_DELETE 0x00000004 +#define FILE_ATTRIBUTE_READONLY 0x00000001 +#define FILE_ATTRIBUTE_HIDDEN 0x00000002 +#define FILE_ATTRIBUTE_SYSTEM 0x00000004 +#define FILE_ATTRIBUTE_DIRECTORY 0x00000010 +#define FILE_ATTRIBUTE_ARCHIVE 0x00000020 +#define FILE_ATTRIBUTE_DEVICE 0x00000040 +#define FILE_ATTRIBUTE_NORMAL 0x00000080 +#define FILE_ATTRIBUTE_TEMPORARY 0x00000100 +#define FILE_ATTRIBUTE_SPARSE_FILE 0x00000200 +#define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400 +#define FILE_ATTRIBUTE_COMPRESSED 0x00000800 +#define FILE_ATTRIBUTE_OFFLINE 0x00001000 +#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000 +#define FILE_ATTRIBUTE_ENCRYPTED 0x00004000 +#define FILE_ATTRIBUTE_VIRTUAL 0x00010000 +#define FILE_NOTIFY_CHANGE_FILE_NAME 0x00000001 +#define FILE_NOTIFY_CHANGE_DIR_NAME 0x00000002 +#define FILE_NOTIFY_CHANGE_ATTRIBUTES 0x00000004 +#define FILE_NOTIFY_CHANGE_SIZE 0x00000008 +#define FILE_NOTIFY_CHANGE_LAST_WRITE 0x00000010 +#define FILE_NOTIFY_CHANGE_LAST_ACCESS 0x00000020 +#define FILE_NOTIFY_CHANGE_CREATION 0x00000040 +#define FILE_NOTIFY_CHANGE_SECURITY 0x00000100 +#define FILE_ACTION_ADDED 0x00000001 +#define FILE_ACTION_REMOVED 0x00000002 +#define FILE_ACTION_MODIFIED 0x00000003 +#define FILE_ACTION_RENAMED_OLD_NAME 0x00000004 +#define FILE_ACTION_RENAMED_NEW_NAME 0x00000005 +#define MAILSLOT_NO_MESSAGE (-1) +#define MAILSLOT_WAIT_FOREVER (-1) +#define FILE_CASE_SENSITIVE_SEARCH 0x00000001 +#define FILE_CASE_PRESERVED_NAMES 0x00000002 +#define FILE_UNICODE_ON_DISK 0x00000004 +#define FILE_PERSISTENT_ACLS 0x00000008 +#define FILE_FILE_COMPRESSION 0x00000010 +#define FILE_VOLUME_QUOTAS 0x00000020 +#define FILE_SUPPORTS_SPARSE_FILES 0x00000040 +#define FILE_SUPPORTS_REPARSE_POINTS 0x00000080 +#define FILE_SUPPORTS_REMOTE_STORAGE 0x00000100 +#define FILE_VOLUME_IS_COMPRESSED 0x00008000 +#define FILE_SUPPORTS_OBJECT_IDS 0x00010000 +#define FILE_SUPPORTS_ENCRYPTION 0x00020000 +#define FILE_NAMED_STREAMS 0x00040000 +#define FILE_READ_ONLY_VOLUME 0x00080000 +#define FILE_SEQUENTIAL_WRITE_ONCE 0x00100000 +#define FILE_SUPPORTS_TRANSACTIONS 0x00200000 +#define FILE_SUPPORTS_HARD_LINKS 0x00400000 +#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES 0x00800000 +#define FILE_SUPPORTS_OPEN_BY_FILE_ID 0x01000000 +#define FILE_SUPPORTS_USN_JOURNAL 0x02000000 + + +#define HKEY_CLASSES_ROOT (0x80000000) +#define HKEY_CURRENT_USER (0x80000001) +#define HKEY_LOCAL_MACHINE (0x80000002) +#define HKEY_USERS (0x80000003) +#define HKEY_PERFORMANCE_DATA (0x80000004) +#define HKEY_PERFORMANCE_TEXT (0x80000050) +#define HKEY_PERFORMANCE_NLSTEXT (0x80000060) + + +#define RRF_RT_REG_NONE 0x00000001 +#define RRF_RT_REG_SZ 0x00000002 +#define RRF_RT_REG_EXPAND_SZ 0x00000004 +#define RRF_RT_REG_BINARY 0x00000008 +#define RRF_RT_REG_DWORD 0x00000010 +#define RRF_RT_REG_MULTI_SZ 0x00000020 +#define RRF_RT_REG_QWORD 0x00000040 +#define RRF_RT_DWORD (RRF_RT_REG_BINARY | RRF_RT_REG_DWORD) +#define RRF_RT_QWORD (RRF_RT_REG_BINARY | RRF_RT_REG_QWORD) +#define RRF_RT_ANY 0x0000ffff +#define RRF_NOEXPAND 0x10000000 +#define RRF_ZEROONFAILURE 0x20000000 + + +#define KEY_QUERY_VALUE (0x0001) +#define KEY_SET_VALUE (0x0002) +#define KEY_CREATE_SUB_KEY (0x0004) +#define KEY_ENUMERATE_SUB_KEYS (0x0008) +#define KEY_NOTIFY (0x0010) +#define KEY_CREATE_LINK (0x0020) +#define KEY_WOW64_32KEY (0x0200) +#define KEY_WOW64_64KEY (0x0100) +#define KEY_WOW64_RES (0x0300) + + +#define KEY_READ ((STANDARD_RIGHTS_READ|KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY)&(~SYNCHRONIZE)) +#define KEY_WRITE ((STANDARD_RIGHTS_WRITE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY)&(~SYNCHRONIZE)) +#define KEY_EXECUTE ((KEY_READ)&(~SYNCHRONIZE)) +#define KEY_ALL_ACCESS ((STANDARD_RIGHTS_ALL|KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK)&(~SYNCHRONIZE)) + +#define STATUS_INFO_LENGTH_MISMATCH (0xC0000004L) + +#define ERROR_NOT_ALL_ASSIGNED 1300 + + +#define S_OK 0 +#define S_FALSE 1 +#define E_NOINTERFACE 0x80004002 +#define E_FAIL 0x80004005 + + +#define DEBUG_EVENT_BREAKPOINT 0x00000001 +#define DEBUG_EVENT_EXCEPTION 0x00000002 +#define DEBUG_EVENT_CREATE_THREAD 0x00000004 +#define DEBUG_EVENT_EXIT_THREAD 0x00000008 +#define DEBUG_EVENT_CREATE_PROCESS 0x00000010 +#define DEBUG_EVENT_EXIT_PROCESS 0x00000020 +#define DEBUG_EVENT_LOAD_MODULE 0x00000040 +#define DEBUG_EVENT_UNLOAD_MODULE 0x00000080 +#define DEBUG_EVENT_SYSTEM_ERROR 0x00000100 +#define DEBUG_EVENT_SESSION_STATUS 0x00000200 +#define DEBUG_EVENT_CHANGE_DEBUGGEE_STATE 0x00000400 +#define DEBUG_EVENT_CHANGE_ENGINE_STATE 0x00000800 +#define DEBUG_EVENT_CHANGE_SYMBOL_STATE 0x00001000 + +#define WOW64_MAXIMUM_SUPPORTED_EXTENSION 512 +#define WOW64_SIZE_OF_80387_REGISTERS 80 \ No newline at end of file diff --git a/ctypes_generation/winfunc.txt b/ctypes_generation/winfunc.txt new file mode 100644 index 0000000..f111712 --- /dev/null +++ b/ctypes_generation/winfunc.txt @@ -0,0 +1,650 @@ +VOID WINAPI ExitProcess( + _In_ UINT uExitCode +); + +BOOL WINAPI TerminateProcess( + _In_ HANDLE hProcess, + _In_ UINT uExitCode +); + +DWORD WINAPI GetLastError(); + +HANDLE WINAPI GetCurrentProcess(); + +HANDLE WINAPI CreateFileA( + __in LPCSTR lpFileName, + __in DWORD dwDesiredAccess, + __in DWORD dwShareMode, + __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, + __in DWORD dwCreationDisposition, + __in DWORD dwFlagsAndAttributes, + __in_opt HANDLE hTemplateFile + ); + +HANDLE WINAPI CreateFileW( + __in LPCWSTR lpFileName, + __in DWORD dwDesiredAccess, + __in DWORD dwShareMode, + __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, + __in DWORD dwCreationDisposition, + __in DWORD dwFlagsAndAttributes, + __in_opt HANDLE hTemplateFile + ); + + +NTSTATUS WINAPI NtQuerySystemInformation( + _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, + _Inout_ PVOID SystemInformation, + _In_ ULONG SystemInformationLength, + _Out_opt_ PULONG ReturnLength +); + +NTSTATUS WINAPI NtQueryInformationProcess( + _In_ HANDLE ProcessHandle, + _In_ PROCESSINFOCLASS ProcessInformationClass, + _Out_ PVOID ProcessInformation, + _In_ ULONG ProcessInformationLength, + _Out_opt_ PULONG ReturnLength +); + +NTSTATUS WINAPI NtQueryVirtualMemory( + _In_ HANDLE ProcessHandle, + _In_opt_ PVOID BaseAddress, + _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass, + _Out_ PVOID MemoryInformation, + _In_ SIZE_T MemoryInformationLength, + _Out_opt_ PSIZE_T ReturnLength +); + +NTSTATUS NtCreateThreadEx( + PHANDLE ThreadHandle, + ACCESS_MASK DesiredAccess, + LPVOID ObjectAttributes, + HANDLE ProcessHandle, + LPTHREAD_START_ROUTINE lpStartAddress, + LPVOID lpParameter, + BOOL CreateSuspended, + DWORD dwStackSize, + DWORD Unknown1, + DWORD Unknown2, + LPVOID Unknown3 +); + +NTSTATUS WINAPI NtQueryInformationThread ( + _In_ HANDLE ThreadHandle, + _In_ THREAD_INFORMATION_CLASS ThreadInformationClass, + _Out_ PVOID ThreadInformation, + _In_ ULONG ThreadInformationLength, + _Out_ PULONG ReturnLength +); + +BOOL WINAPI GetExitCodeThread( + _In_ HANDLE hThread, + _Out_ LPDWORD lpExitCode +); + +BOOL WINAPI GetExitCodeProcess( + __in HANDLE hProcess, + __out LPDWORD lpExitCode +); + +LPVOID WINAPI VirtualAlloc( + _In_opt_ LPVOID lpAddress, + _In_ SIZE_T dwSize, + _In_ DWORD flAllocationType, + _In_ DWORD flProtect +); + +LPVOID WINAPI VirtualAllocEx( + _In_ HANDLE hProcess, + _In_opt_ LPVOID lpAddress, + _In_ SIZE_T dwSize, + _In_ DWORD flAllocationType, + _In_ DWORD flProtect +); + +BOOL WINAPI VirtualFree( + _In_ LPVOID lpAddress, + _In_ SIZE_T dwSize, + _In_ DWORD dwFreeType +); + +BOOL WINAPI VirtualFreeEx( + _In_ HANDLE hProcess, + _In_ LPVOID lpAddress, + _In_ SIZE_T dwSize, + _In_ DWORD dwFreeType +); + +BOOL WINAPI VirtualProtect( + _In_ LPVOID lpAddress, + _In_ SIZE_T dwSize, + _In_ DWORD flNewProtect, + _Out_ PDWORD lpflOldProtect +); + +DWORD VirtualQuery( + LPCVOID lpAddress, + PMEMORY_BASIC_INFORMATION lpBuffer, + DWORD dwLength +); + +SIZE_T WINAPI VirtualQueryEx( + _In_ HANDLE hProcess, + _In_opt_ LPCVOID lpAddress, + _Out_ PMEMORY_BASIC_INFORMATION lpBuffer, + _In_ SIZE_T dwLength + ); + + +DWORD WINAPI GetModuleFileNameA( + _In_opt_ HMODULE hModule, + _Out_ LPSTR lpFilename, + _In_ DWORD nSize +); + +DWORD WINAPI GetModuleFileNameW( + _In_opt_ HMODULE hModule, + _Out_ LPWSTR lpFilename, + _In_ DWORD nSize +); + +HANDLE WINAPI CreateThread( + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ SIZE_T dwStackSize, + _In_ LPTHREAD_START_ROUTINE lpStartAddress, + _In_opt_ LPVOID lpParameter, + _In_ DWORD dwCreationFlags, + _Out_opt_ LPDWORD lpThreadId +); + +HANDLE WINAPI CreateRemoteThread( + _In_ HANDLE hProcess, + _In_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ SIZE_T dwStackSize, + _In_ LPTHREAD_START_ROUTINE lpStartAddress, + _In_ LPVOID lpParameter, + _In_ DWORD dwCreationFlags, + _Out_ LPDWORD lpThreadId +); + +BOOL WINAPI VirtualProtect( + _In_ LPVOID lpAddress, + _In_ SIZE_T dwSize, + _In_ DWORD flNewProtect, + _Out_ PDWORD lpflOldProtect +); + +BOOL WINAPI CreateProcessA( + __in_opt LPCSTR lpApplicationName, + __inout_opt LPSTR lpCommandLine, + __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, + __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, + __in BOOL bInheritHandles, + __in DWORD dwCreationFlags, + __in_opt LPVOID lpEnvironment, + __in_opt LPCSTR lpCurrentDirectory, + __in LPSTARTUPINFOA lpStartupInfo, + __out LPPROCESS_INFORMATION lpProcessInformation +); + +BOOL WINAPI CreateProcessW( + __in_opt LPCWSTR lpApplicationName, + __inout_opt LPWSTR lpCommandLine, + __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, + __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, + __in BOOL bInheritHandles, + __in DWORD dwCreationFlags, + __in_opt LPVOID lpEnvironment, + __in_opt LPCWSTR lpCurrentDirectory, + __in LPSTARTUPINFOW lpStartupInfo, + __out LPPROCESS_INFORMATION lpProcessInformation +); + +BOOL WINAPI GetThreadContext( + __in HANDLE hThread, + __inout LPCONTEXT lpContext +); + +BOOL WINAPI NtGetContextThread( + __in HANDLE hThread, + __inout LPCONTEXT lpContext +); + +BOOL WINAPI SetThreadContext( + __in HANDLE hThread, + __in CONST LPCONTEXT lpContext +); + +HANDLE WINAPI OpenThread( + __in DWORD dwDesiredAccess, + __in BOOL bInheritHandle, + __in DWORD dwThreadId +); + +HANDLE WINAPI OpenProcess( + __in DWORD dwDesiredAccess, + __in BOOL bInheritHandle, + __in DWORD dwProcessId +); + +BOOL WINAPI CloseHandle( + __in HANDLE hObject +); + +BOOL WINAPI ReadProcessMemory( + _In_ HANDLE hProcess, + _In_ LPCVOID lpBaseAddress, + _Out_ LPVOID lpBuffer, + _In_ SIZE_T nSize, + _Out_ SIZE_T *lpNumberOfBytesRead +); + +BOOL WINAPI NtWow64ReadVirtualMemory64( + _In_ HANDLE hProcess, + _In_ ULONG64 lpBaseAddress, + _Out_ LPVOID lpBuffer, + _In_ ULONG64 nSize, + _Out_ PULONG64 *lpNumberOfBytesRead +); + +BOOL WINAPI WriteProcessMemory( + _In_ HANDLE hProcess, + _In_ LPVOID lpBaseAddress, + _In_ LPCVOID lpBuffer, + _In_ SIZE_T nSize, + _Out_ SIZE_T *lpNumberOfBytesWritten +); + +HANDLE WINAPI CreateToolhelp32Snapshot( + _In_ DWORD dwFlags, + _In_ DWORD th32ProcessID +); + +BOOL WINAPI Thread32First( + _In_ HANDLE hSnapshot, + _Inout_ LPTHREADENTRY32 lpte +); + +BOOL WINAPI Thread32Next( + _In_ HANDLE hSnapshot, + _Out_ LPTHREADENTRY32 lpte +); + +BOOL WINAPI Process32First( + _In_ HANDLE hSnapshot, + _Inout_ LPPROCESSENTRY32 lppe +); + +BOOL WINAPI Process32Next( + _In_ HANDLE hSnapshot, + _Out_ LPPROCESSENTRY32 lppe +); + +BOOL Process32FirstW( + HANDLE hSnapshot, + LPPROCESSENTRY32W lppe +); + +BOOL Process32NextW( + HANDLE hSnapshot, + LPPROCESSENTRY32W lppe +); + +FARPROC WINAPI GetProcAddress( + _In_ HMODULE hModule, + _In_ LPCSTR lpProcName +); + + +HMODULE WINAPI LoadLibraryA( + __in LPCSTR lpFileName +); + +HMODULE WINAPI LoadLibraryW( + __in LPCWSTR lpFileName +); + +BOOL WINAPI OpenProcessToken( + _In_ HANDLE ProcessHandle, + _In_ DWORD DesiredAccess, + _Out_ PHANDLE TokenHandle +); + +BOOL WINAPI LookupPrivilegeValueA( + __in_opt LPCSTR lpSystemName, + __in LPCSTR lpName, + __out PLUID lpLuid +); + +BOOL WINAPI LookupPrivilegeValueW( + __in_opt LPCWSTR lpSystemName, + __in LPCWSTR lpName, + __out PLUID lpLuid +); + +BOOL WINAPI AdjustTokenPrivileges( + _In_ HANDLE TokenHandle, + _In_ BOOL DisableAllPrivileges, + _In_opt_ PTOKEN_PRIVILEGES NewState, + _In_ DWORD BufferLength, + _Out_opt_ PTOKEN_PRIVILEGES PreviousState, + _Out_opt_ PDWORD ReturnLength +); + +HRSRC WINAPI FindResourceA( + __in_opt HMODULE hModule, + __in LPCSTR lpName, + __in LPCSTR lpType +); + +HRSRC WINAPI FindResourceW( + __in_opt HMODULE hModule, + __in LPCWSTR lpName, + __in LPCWSTR lpType +); + +DWORD WINAPI SizeofResource( + _In_opt_ HMODULE hModule, + _In_ HRSRC hResInfo +); + +HGLOBAL WINAPI LoadResource( + _In_opt_ HMODULE hModule, + _In_ HRSRC hResInfo +); + +LPVOID WINAPI LockResource( + _In_ HGLOBAL hResData +); + +BOOL WINAPI GetVersionExA( + __inout LPOSVERSIONINFOA lpVersionInformation +); + +BOOL WINAPI GetVersionExW( + __inout LPOSVERSIONINFOW lpVersionInformation +); + +DWORD GetVersion(); + +HANDLE GetCurrentThread(); + +DWORD GetCurrentThreadId(); + +DWORD GetCurrentProcessorNumber(); + +BOOL AllocConsole(); + +BOOL FreeConsole(); + +HANDLE WINAPI GetStdHandle( + _In_ DWORD nStdHandle +); + +BOOL WINAPI SetStdHandle( + _In_ DWORD nStdHandle, + _In_ HANDLE hHandle +); + +DWORD WINAPI SetThreadAffinityMask( + _In_ HANDLE hThread, + _In_ DWORD dwThreadAffinityMask +); + +BOOL WINAPI WriteFile( + _In_ HANDLE hFile, + _In_ LPCVOID lpBuffer, + _In_ DWORD nNumberOfBytesToWrite, + _Out_opt_ LPDWORD lpNumberOfBytesWritten, + _Inout_opt_ LPOVERLAPPED lpOverlapped +); + +DWORD WINAPI GetExtendedTcpTable( + _Out_ PVOID pTcpTable, + _Inout_ PDWORD pdwSize, + _In_ BOOL bOrder, + _In_ ULONG ulAf, + _In_ TCP_TABLE_CLASS TableClass, + _In_ ULONG Reserved +); + +DWORD WINAPI GetExtendedUdpTable( + _Out_ PVOID pUdpTable, + _Inout_ PDWORD pdwSize, + _In_ BOOL bOrder, + _In_ ULONG ulAf, + _In_ UDP_TABLE_CLASS TableClass, + _In_ ULONG Reserved +); + +DWORD WINAPI SetTcpEntry( + _In_ PMIB_TCPROW pTcpRow +); + +PVOID WINAPI AddVectoredContinueHandler( + _In_ ULONG FirstHandler, + _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler +); + + +PVOID WINAPI AddVectoredExceptionHandler( + _In_ ULONG FirstHandler, + _In_ PVECTORED_EXCEPTION_HANDLER VectoredHandler +); + +BOOL WINAPI TerminateThread( + _Inout_ HANDLE hThread, + _In_ DWORD dwExitCode +); + +VOID WINAPI ExitThread( + _In_ DWORD dwExitCode +); + +ULONG WINAPI RemoveVectoredExceptionHandler( + _In_ PVOID Handler +); + +DWORD WINAPI ResumeThread( + _In_ HANDLE hThread +); + +DWORD WINAPI SuspendThread( + _In_ HANDLE hThread +); + + + +DWORD WINAPI WaitForSingleObject( + _In_ HANDLE hHandle, + _In_ DWORD dwMilliseconds +); + +DWORD WINAPI GetThreadId( + _In_ HANDLE Thread + ); + +HMODULE WINAPI LoadLibraryExA( + _In_ LPCSTR lpFileName, + _Reserved_ HANDLE hFile, + _In_ DWORD dwFlags +); + +HMODULE WINAPI LoadLibraryExW( + _In_ LPCWSTR lpFileName, + _Reserved_ HANDLE hFile, + _In_ DWORD dwFlags +); + +BOOL WINAPI SymInitialize( + _In_ HANDLE hProcess, + _In_opt_ LPCSTR UserSearchPath, + _In_ BOOL fInvadeProcess +); + +BOOL WINAPI SymFromName( + _In_ HANDLE hProcess, + _In_ LPCSTR Name, + _Inout_ PSYMBOL_INFO Symbol +); + +DWORD64 WINAPI SymLoadModuleEx( + _In_ HANDLE hProcess, + _In_ HANDLE hFile, + _In_ LPCSTR ImageName, + _In_ LPCSTR ModuleName, + _In_ DWORD64 BaseOfDll, + _In_ DWORD DllSize, + _In_ PMODLOAD_DATA Data, + _In_ DWORD Flags +); + +DWORD WINAPI SymSetOptions( + _In_ DWORD SymOptions +); + +BOOL WINAPI SymGetTypeInfo( + _In_ HANDLE hProcess, + _In_ DWORD64 ModBase, + _In_ ULONG TypeId, + _In_ IMAGEHLP_SYMBOL_TYPE_INFO GetType, + _Out_ PVOID pInfo +); + +BOOL WINAPI DeviceIoControl( + _In_ HANDLE hDevice, + _In_ DWORD dwIoControlCode, + _In_opt_ LPVOID lpInBuffer, + _In_ DWORD nInBufferSize, + _Out_opt_ LPVOID lpOutBuffer, + _In_ DWORD nOutBufferSize, + _Out_opt_ LPDWORD lpBytesReturned, + _Inout_opt_ LPOVERLAPPED lpOverlapped +); + +BOOL WINAPI GetTokenInformation( + _In_ HANDLE TokenHandle, + _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, + _Out_opt_ LPVOID TokenInformation, + _In_ DWORD TokenInformationLength, + _Out_ PDWORD ReturnLength +); + +LONG WINAPI RegOpenKeyExA( + _In_ HKEY hKey, + _In_opt_ LPCSTR lpSubKey, + _In_ DWORD ulOptions, + _In_ REGSAM samDesired, + _Out_ PHKEY phkResult +); + +LONG WINAPI RegOpenKeyExW( + _In_ HKEY hKey, + _In_opt_ LPWSTR lpSubKey, + _In_ DWORD ulOptions, + _In_ REGSAM samDesired, + _Out_ PHKEY phkResult +); + +LONG WINAPI RegGetValueA( + _In_ HKEY hkey, + _In_opt_ LPCSTR lpSubKey, + _In_opt_ LPCSTR lpValue, + _In_opt_ DWORD dwFlags, + _Out_opt_ LPDWORD pdwType, + _Out_opt_ PVOID pvData, + _Inout_opt_ LPDWORD pcbData +); + +LONG WINAPI RegGetValueW( + _In_ HKEY hkey, + _In_opt_ LPWSTR lpSubKey, + _In_opt_ LPWSTR lpValue, + _In_opt_ DWORD dwFlags, + _Out_opt_ LPDWORD pdwType, + _Out_opt_ PVOID pvData, + _Inout_opt_ LPDWORD pcbData +); + +LONG WINAPI RegCloseKey( + _In_ HKEY hKey +); + +BOOL WINAPI Wow64DisableWow64FsRedirection( + _Out_ PVOID *OldValue +); + +BOOL WINAPI Wow64RevertWow64FsRedirection( + _In_ PVOID OldValue +); + +BOOLEAN WINAPI Wow64EnableWow64FsRedirection( + _In_ BOOLEAN Wow64FsEnableRedirection +); + +BOOL WINAPI Wow64GetThreadContext( + _In_ HANDLE hThread, + _Inout_ PWOW64_CONTEXT lpContext +); + +BOOL WINAPI SetConsoleCtrlHandler( + _In_opt_ PHANDLER_ROUTINE HandlerRoutine, + _In_ BOOL Add +); + +LONG WINAPI WinVerifyTrust( + _In_opt_ HWND hwnd, + _In_ GUID *pgActionID, + _Inout_ LPVOID pWVTData +); + +HGLOBAL WINAPI GlobalAlloc( + _In_ UINT uFlags, + _In_ SIZE_T dwBytes +); + +HGLOBAL WINAPI GlobalFree( + _In_ HGLOBAL hMem +); + +BOOL WINAPI GlobalUnlock( + _In_ HGLOBAL hMem +); + +LPVOID WINAPI GlobalLock( + _In_ HGLOBAL hMem +); + +BOOL WINAPI OpenClipboard( + _In_opt_ HWND hWndNewOwner +); + +BOOL WINAPI EmptyClipboard(); + +BOOL WINAPI CloseClipboard(); + +HANDLE WINAPI SetClipboardData( + _In_ UINT uFormat, + _In_opt_ HANDLE hMem +); + +HANDLE WINAPI GetClipboardData( + _In_ UINT uFormat +); + +UINT WINAPI EnumClipboardFormats( + _In_ UINT format +); + +INT WINAPI GetClipboardFormatNameA( + _In_ UINT format, + _Out_ LPCSTR lpszFormatName, + _In_ INT cchMaxCount +); + +INT WINAPI GetClipboardFormatNameW( + _In_ UINT format, + _Out_ LPCWSTR lpszFormatName, + _In_ INT cchMaxCount +); \ No newline at end of file diff --git a/ctypes_generation/winstruct.py b/ctypes_generation/winstruct.py new file mode 100644 index 0000000..776d649 --- /dev/null +++ b/ctypes_generation/winstruct.py @@ -0,0 +1,130 @@ +import collections + +#WinStructType = collections.namedtuple('WinStructType', ['name']) + +#Ptr = collections.namedtuple('Ptr', ['']) + +class WinStructType(object): + def __init__(self, name): + self.name = name + + def __repr__(self): + return "{0}({1})".format(type(self).__name__, self.name) + + def generate_ctypes(self): + return self.name + +class Ptr(object): + + def __init__(self, struct): + self.type = struct + self.name = struct.name + + def generate_ctypes(self): + return "POINTER({0})".format(self.name) + + def __repr__(self): + return "Ptr({0})".format(repr(self.type)) + + +class WinStruct(object): + ctypes_type = "Structure" + def __init__(self, name): + self.name = name + self.fields = [] + self.typedef = {} + + def add_field(self, field): + self.fields.append(field) + + def add_typedef(self, name): + if name in self.typedef: + raise ValueError("nop") + self.typedef[name] = self + + def add_ptr_typedef(self, name): + if name in self.typedef: + raise ValueError("nop") + self.typedef[name] = Ptr(self) + + def is_self_referencing(self): + for type in [f[0] for f in self.fields]: + if type.name == self.name: + return True + return False + + def generate_selfref_ctypes_class(self): + res = "# Self referencing struct tricks\n" + res += """class {0}(Structure): pass\n""".format(self.name) + res += "{0}._fields_ = [\n".format(self.name) + + for (ftype, name, nb_rep) in self.fields: + if nb_rep == 1: + res+= ' ("{0}", {1}),\n'.format(name, ftype.generate_ctypes()) + else: + res+= ' ("{0}", {1} * {2}),\n'.format(name, ftype.generate_ctypes(), nb_rep) + res += "]\n" + return res + + def generate_ctypes_class(self): + if self.is_self_referencing(): + return self.generate_selfref_ctypes_class() + res = """class {0}({1}): + _fields_ = [\n""".format(self.name, self.ctypes_type) + + for (ftype, name, nb_rep) in self.fields: + if nb_rep == 1: + res+= ' ("{0}", {1}),\n'.format(name, ftype.generate_ctypes()) + else: + res+= ' ("{0}", {1} * {2}),\n'.format(name, ftype.generate_ctypes(), nb_rep) + res += " ]\n" + return res + + def generate_ctypes(self): + ctypes_class = self.generate_ctypes_class() + for typedef_name, value in self.typedef.items(): + str_value = self.name + if type(value) == Ptr: + str_value = "POINTER({0})".format(self.name) + ctypes_class += "{0} = {1}\n".format(typedef_name, str_value) + return ctypes_class + +class WinUnion(WinStruct): + ctypes_type = "Union" + +class WinEnum(object): + def __init__(self, name): + self.name = name + self.fields = [] + self.typedef = {} + + def add_enum_entry(self, number, name): + self.fields.append((number, name)) + + def add_typedef(self, name): + if name in self.typedef: + raise ValueError("nop") + self.typedef[name] = self + + def add_ptr_typedef(self, name): + if name in self.typedef: + raise ValueError("nop") + self.typedef[name] = Ptr(self) + + # Assert that enum are DWORD + def generate_ctypes(self): + lines = ["{0} = DWORD".format(self.name)] + for typedef_name, value in self.typedef.items(): + str_value = self.name + if type(value) == Ptr: + str_value = "POINTER({0})".format(self.name) + lines += ["{0} = {1}".format(typedef_name, str_value)] + #lines += ["{0} = {1}".format(t, self.name) for t in self.typedef] + lines += [""] + + for i, name in self.fields: + lines.append("{0} = {1}".format(name, hex(i))) + ctypes_class = "\n".join(lines) + + return ctypes_class + "\n" + \ No newline at end of file diff --git a/ctypes_generation/winstruct.txt b/ctypes_generation/winstruct.txt new file mode 100644 index 0000000..21b8d4f --- /dev/null +++ b/ctypes_generation/winstruct.txt @@ -0,0 +1,1462 @@ +typedef struct _LIST_ENTRY { + struct _LIST_ENTRY *Flink; + struct _LIST_ENTRY *Blink; +} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; + + +typedef struct _PEB_LDR_DATA { + BYTE Reserved1[8]; + PVOID Reserved2[3]; + LIST_ENTRY InMemoryOrderModuleList; +} PEB_LDR_DATA, *PPEB_LDR_DATA; + + +typedef struct _LSA_UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; + +typedef struct _RTL_USER_PROCESS_PARAMETERS { + BYTE Reserved1[16]; + PVOID Reserved2[10]; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; +} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; + + +typedef struct _PEB { + BYTE Reserved1[2]; + BYTE BeingDebugged; + BYTE Reserved2[1]; + PVOID Reserved3[2]; + PPEB_LDR_DATA Ldr; + PRTL_USER_PROCESS_PARAMETERS ProcessParameters; + BYTE Reserved4[104]; + PVOID Reserved5[52]; + PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine; + BYTE Reserved6[128]; + PVOID Reserved7[1]; + ULONG SessionId; +} PEB, *PPEB; + + +typedef struct _SECURITY_ATTRIBUTES { + DWORD nLength; + LPVOID lpSecurityDescriptor; + BOOL bInheritHandle; +} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES; + + +typedef struct _SYSTEM_VERIFIER_INFORMATION { + ULONG NextEntryOffset; + ULONG Level; + UNICODE_STRING DriverName; + + ULONG RaiseIrqls; + ULONG AcquireSpinLocks; + ULONG SynchronizeExecutions; + ULONG AllocationsAttempted; + + ULONG AllocationsSucceeded; + ULONG AllocationsSucceededSpecialPool; + ULONG AllocationsWithNoTag; + ULONG TrimRequests; + + ULONG Trims; + ULONG AllocationsFailed; + ULONG AllocationsFailedDeliberately; + ULONG Loads; + + ULONG Unloads; + ULONG UnTrackedPool; + ULONG CurrentPagedPoolAllocations; + ULONG CurrentNonPagedPoolAllocations; + + ULONG PeakPagedPoolAllocations; + ULONG PeakNonPagedPoolAllocations; + + SIZE_T PagedPoolUsageInBytes; + SIZE_T NonPagedPoolUsageInBytes; + SIZE_T PeakPagedPoolUsageInBytes; + SIZE_T PeakNonPagedPoolUsageInBytes; + +} SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION; + +typedef enum _SYSTEM_INFORMATION_CLASS { + SystemBasicInformation, + SystemProcessorInformation, + SystemPerformanceInformation, + SystemTimeOfDayInformation, + SystemPathInformation, + SystemProcessInformation, + SystemCallCountInformation, + SystemDeviceInformation, + SystemProcessorPerformanceInformation, + SystemFlagsInformation, + SystemCallTimeInformation, + SystemModuleInformation, + SystemLocksInformation, + SystemStackTraceInformation, + SystemPagedPoolInformation, + SystemNonPagedPoolInformation, + SystemHandleInformation, + SystemObjectInformation, + SystemPageFileInformation, + SystemVdmInstemulInformation, + SystemVdmBopInformation, + SystemFileCacheInformation, + SystemPoolTagInformation, + SystemInterruptInformation, + SystemDpcBehaviorInformation, + SystemFullMemoryInformation, + SystemLoadGdiDriverInformation, + SystemUnloadGdiDriverInformation, + SystemTimeAdjustmentInformation, + SystemSummaryMemoryInformation, + SystemMirrorMemoryInformation, + SystemPerformanceTraceInformation, + SystemObsolete0, + SystemExceptionInformation, + SystemCrashDumpStateInformation, + SystemKernelDebuggerInformation, + SystemContextSwitchInformation, + SystemRegistryQuotaInformation, + SystemExtendServiceTableInformation, + SystemPrioritySeperation, + SystemVerifierAddDriverInformation, + SystemVerifierRemoveDriverInformation, + SystemProcessorIdleInformation, + SystemLegacyDriverInformation, + SystemCurrentTimeZoneInformation, + SystemLookasideInformation, + SystemTimeSlipNotification, + SystemSessionCreate, + SystemSessionDetach, + SystemSessionInformation, + SystemRangeStartInformation, + SystemVerifierInformation, + SystemVerifierThunkExtend, + SystemSessionProcessInformation, + SystemLoadGdiDriverInSystemSpace, + SystemNumaProcessorMap, + SystemPrefetcherInformation, + SystemExtendedProcessInformation, + SystemRecommendedSharedDataAlignment, + SystemComPlusPackage, + SystemNumaAvailableMemory, + SystemProcessorPowerInformation, + SystemEmulationBasicInformation, + SystemEmulationProcessorInformation, + SystemExtendedHandleInformation, + SystemLostDelayedWriteInformation, + SystemBigPoolInformation, + SystemSessionPoolTagInformation, + SystemSessionMappedViewInformation, + SystemHotpatchInformation, + SystemObjectSecurityMode, + SystemWatchdogTimerHandler, + SystemWatchdogTimerInformation, + SystemLogicalProcessorInformation, + SystemWow64SharedInformation, + SystemRegisterFirmwareTableInformationHandler, + SystemFirmwareTableInformation, + SystemModuleInformationEx, + SystemVerifierTriageInformation, + SystemSuperfetchInformation, + SystemMemoryListInformation, + SystemFileCacheInformationEx, + MaxSystemInfoClass +} SYSTEM_INFORMATION_CLASS; + + +typedef enum _MEMORY_INFORMATION_CLASS { + MemoryBasicInformation +} MEMORY_INFORMATION_CLASS; + +typedef enum _THREAD_INFORMATION_CLASS { + ThreadBasicInformation, + ThreadTimes, + ThreadPriority, + ThreadBasePriority, + ThreadAffinityMask, + ThreadImpersonationToken, + ThreadDescriptorTableEntry, + ThreadEnableAlignmentFaultFixup, + ThreadEventPair, + ThreadQuerySetWin32StartAddress, + ThreadZeroTlsCell, + ThreadPerformanceCount, + ThreadAmILastThread, + ThreadIdealProcessor, + ThreadPriorityBoost, + ThreadSetTlsArrayAddress, + ThreadIsIoPending, + ThreadHideFromDebugger +} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS; + +typedef enum _TCP_TABLE_CLASS { + TCP_TABLE_BASIC_LISTENER, + TCP_TABLE_BASIC_CONNECTIONS, + TCP_TABLE_BASIC_ALL, + TCP_TABLE_OWNER_PID_LISTENER, + TCP_TABLE_OWNER_PID_CONNECTIONS, + TCP_TABLE_OWNER_PID_ALL, + TCP_TABLE_OWNER_MODULE_LISTENER, + TCP_TABLE_OWNER_MODULE_CONNECTIONS, + TCP_TABLE_OWNER_MODULE_ALL +} TCP_TABLE_CLASS; + +typedef enum _VARENUM{ + VT_EMPTY = 0, + VT_NULL = 1, + VT_I2 = 2, + VT_I4 = 3, + VT_R4 = 4, + VT_R8 = 5, + VT_CY = 6, + VT_DATE = 7, + VT_BSTR = 8, + VT_DISPATCH = 9, + VT_ERROR = 10, + VT_BOOL = 11, + VT_VARIANT = 12, + VT_UNKNOWN = 13, + VT_DECIMAL = 14, + VT_I1 = 16, + VT_UI1 = 17, + VT_UI2 = 18, + VT_UI4 = 19, + VT_I8 = 20, + VT_UI8 = 21, + VT_INT = 22, + VT_UINT = 23, + VT_VOID = 24, + VT_HRESULT = 25, + VT_PTR = 26, + VT_SAFEARRAY = 27, + VT_CARRAY = 28, + VT_USERDEFINED = 29, + VT_LPSTR = 30, + VT_LPWSTR = 31, + VT_RECORD = 36, + VT_INT_PTR = 37, + VT_UINT_PTR = 38, + VT_FILETIME = 64, + VT_BLOB = 65, + VT_STREAM = 66, + VT_STORAGE = 67, + VT_STREAMED_OBJECT = 68, + VT_STORED_OBJECT = 69, + VT_BLOB_OBJECT = 70, + VT_CF = 71, + VT_CLSID = 72, + VT_VERSIONED_STREAM = 73, + VT_BSTR_BLOB = 0xfff, + VT_VECTOR = 0x1000, + VT_ARRAY = 0x2000, + VT_BYREF = 0x4000, + VT_RESERVED = 0x8000, + VT_ILLEGAL = 0xffff, + VT_ILLEGALMASKED = 0xfff, + VT_TYPEMASK = 0xfff +} VARENUM; + +typedef enum _UDP_TABLE_CLASS{ + UDP_TABLE_BASIC, + UDP_TABLE_OWNER_PID, + UDP_TABLE_OWNER_MODULE +} UDP_TABLE_CLASS; + +typedef enum _MIB_TCP_STATE{ + MIB_TCP_STATE_CLOSED = 1, + MIB_TCP_STATE_LISTEN = 2, + MIB_TCP_STATE_SYN_SENT = 3, + MIB_TCP_STATE_SYN_RCVD = 4, + MIB_TCP_STATE_ESTAB = 5, + MIB_TCP_STATE_FIN_WAIT1 = 6, + MIB_TCP_STATE_FIN_WAIT2 = 7, + MIB_TCP_STATE_CLOSE_WAIT = 8, + MIB_TCP_STATE_CLOSING = 9, + MIB_TCP_STATE_LAST_ACK = 10, + MIB_TCP_STATE_TIME_WAIT = 11, + MIB_TCP_STATE_DELETE_TCB = 12, +} MIB_TCP_STATE; + +typedef enum _TOKEN_INFORMATION_CLASS { + TokenInvalid, + TokenUser, + TokenGroups, + TokenPrivileges, + TokenOwner, + TokenPrimaryGroup, + TokenDefaultDacl, + TokenSource, + TokenType, + TokenImpersonationLevel, + TokenStatistics, + TokenRestrictedSids, + TokenSessionId, + TokenGroupsAndPrivileges, + TokenSessionReference, + TokenSandBoxInert, + TokenAuditPolicy, + TokenOrigin, + TokenElevationType, + TokenLinkedToken, + TokenElevation, + TokenHasRestrictions, + TokenAccessInformation, + TokenVirtualizationAllowed, + TokenVirtualizationEnabled, + TokenIntegrityLevel, + TokenUIAccess, + TokenMandatoryPolicy, + TokenLogonSid, + TokenIsAppContainer, + TokenCapabilities, + TokenAppContainerSid, + TokenAppContainerNumber, + TokenUserClaimAttributes, + TokenDeviceClaimAttributes, + TokenRestrictedUserClaimAttributes, + TokenRestrictedDeviceClaimAttributes, + TokenDeviceGroups, + TokenRestrictedDeviceGroups, + TokenSecurityAttributes, + TokenIsRestricted, + MaxTokenInfoClass, +} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS; + +typedef struct _LDR_DATA_TABLE_ENTRY { + PVOID Reserved1[2]; + LIST_ENTRY InMemoryOrderLinks; + PVOID Reserved2[2]; + PVOID DllBase; + PVOID EntryPoint; + PVOID Reserved3; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + PVOID Reserved5[3]; + ULONG CheckSum; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + + +typedef struct _IMAGE_FILE_HEADER { + WORD Machine; + WORD NumberOfSections; + DWORD TimeDateStamp; + DWORD PointerToSymbolTable; + DWORD NumberOfSymbols; + WORD SizeOfOptionalHeader; + WORD Characteristics; +} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; + +typedef struct _IMAGE_DATA_DIRECTORY { + DWORD VirtualAddress; + DWORD Size; +} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; + + +typedef struct _IMAGE_SECTION_HEADER { + BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; + DWORD VirtualSize; + DWORD VirtualAddress; + DWORD SizeOfRawData; + DWORD PointerToRawData; + DWORD PointerToRelocations; + DWORD PointerToLinenumbers; + WORD NumberOfRelocations; + WORD NumberOfLinenumbers; + DWORD Characteristics; +} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; + +typedef struct _IMAGE_OPTIONAL_HEADER64 { + WORD Magic; + BYTE MajorLinkerVersion; + BYTE MinorLinkerVersion; + DWORD SizeOfCode; + DWORD SizeOfInitializedData; + DWORD SizeOfUninitializedData; + DWORD AddressOfEntryPoint; + DWORD BaseOfCode; + ULONGLONG ImageBase; + DWORD SectionAlignment; + DWORD FileAlignment; + WORD MajorOperatingSystemVersion; + WORD MinorOperatingSystemVersion; + WORD MajorImageVersion; + WORD MinorImageVersion; + WORD MajorSubsystemVersion; + WORD MinorSubsystemVersion; + DWORD Win32VersionValue; + DWORD SizeOfImage; + DWORD SizeOfHeaders; + DWORD CheckSum; + WORD Subsystem; + WORD DllCharacteristics; + ULONGLONG SizeOfStackReserve; + ULONGLONG SizeOfStackCommit; + ULONGLONG SizeOfHeapReserve; + ULONGLONG SizeOfHeapCommit; + DWORD LoaderFlags; + DWORD NumberOfRvaAndSizes; + IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; +} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64; + + +typedef struct _IMAGE_OPTIONAL_HEADER { + WORD Magic; + BYTE MajorLinkerVersion; + BYTE MinorLinkerVersion; + DWORD SizeOfCode; + DWORD SizeOfInitializedData; + DWORD SizeOfUninitializedData; + DWORD AddressOfEntryPoint; + DWORD BaseOfCode; + DWORD BaseOfData; + DWORD ImageBase; + DWORD SectionAlignment; + DWORD FileAlignment; + WORD MajorOperatingSystemVersion; + WORD MinorOperatingSystemVersion; + WORD MajorImageVersion; + WORD MinorImageVersion; + WORD MajorSubsystemVersion; + WORD MinorSubsystemVersion; + DWORD Win32VersionValue; + DWORD SizeOfImage; + DWORD SizeOfHeaders; + DWORD CheckSum; + WORD Subsystem; + WORD DllCharacteristics; + DWORD SizeOfStackReserve; + DWORD SizeOfStackCommit; + DWORD SizeOfHeapReserve; + DWORD SizeOfHeapCommit; + DWORD LoaderFlags; + DWORD NumberOfRvaAndSizes; + IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; +} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; + +typedef struct _IMAGE_NT_HEADERS64 { + DWORD Signature; + IMAGE_FILE_HEADER FileHeader; + IMAGE_OPTIONAL_HEADER64 OptionalHeader; +} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64; + +typedef struct _IMAGE_NT_HEADERS { + DWORD Signature; + IMAGE_FILE_HEADER FileHeader; + IMAGE_OPTIONAL_HEADER32 OptionalHeader; +} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; + +typedef struct _IMAGE_IMPORT_DESCRIPTOR { + DWORD OriginalFirstThunk; + DWORD TimeDateStamp; + DWORD ForwarderChain; + DWORD Name; + DWORD FirstThunk; +} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR; + +typedef struct _IMAGE_IMPORT_BY_NAME { + WORD Hint; + BYTE Name[1]; +} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME; + +typedef struct _IMAGE_EXPORT_DIRECTORY { + DWORD Characteristics; + DWORD TimeDateStamp; + WORD MajorVersion; + WORD MinorVersion; + DWORD Name; + DWORD Base; + DWORD NumberOfFunctions; + DWORD NumberOfNames; + DWORD AddressOfFunctions; + DWORD AddressOfNames; + DWORD AddressOfNameOrdinals; +} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; + +typedef struct _MEMORY_BASIC_INFORMATION { + PVOID BaseAddress; + PVOID AllocationBase; + DWORD AllocationProtect; + SIZE_T RegionSize; + DWORD State; + DWORD Protect; + DWORD Type; +} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION; + +typedef struct _MEMORY_BASIC_INFORMATION32 { + DWORD BaseAddress; + DWORD AllocationBase; + DWORD AllocationProtect; + DWORD RegionSize; + DWORD State; + DWORD Protect; + DWORD Type; +} MEMORY_BASIC_INFORMATION32, *PMEMORY_BASIC_INFORMATION32; + +typedef struct _MEMORY_BASIC_INFORMATION64 { + ULONGLONG BaseAddress; + ULONGLONG AllocationBase; + DWORD AllocationProtect; + DWORD __alignment1; + ULONGLONG RegionSize; + DWORD State; + DWORD Protect; + DWORD Type; + DWORD __alignment2; +} MEMORY_BASIC_INFORMATION64, *PMEMORY_BASIC_INFORMATION64; + +typedef struct _STARTUPINFOA { + DWORD cb; + LPSTR lpReserved; + LPSTR lpDesktop; + LPSTR lpTitle; + DWORD dwX; + DWORD dwY; + DWORD dwXSize; + DWORD dwYSize; + DWORD dwXCountChars; + DWORD dwYCountChars; + DWORD dwFillAttribute; + DWORD dwFlags; + WORD wShowWindow; + WORD cbReserved2; + LPBYTE lpReserved2; + HANDLE hStdInput; + HANDLE hStdOutput; + HANDLE hStdError; +} STARTUPINFOA, *LPSTARTUPINFOA; +typedef struct _STARTUPINFOW { + DWORD cb; + LPWSTR lpReserved; + LPWSTR lpDesktop; + LPWSTR lpTitle; + DWORD dwX; + DWORD dwY; + DWORD dwXSize; + DWORD dwYSize; + DWORD dwXCountChars; + DWORD dwYCountChars; + DWORD dwFillAttribute; + DWORD dwFlags; + WORD wShowWindow; + WORD cbReserved2; + LPBYTE lpReserved2; + HANDLE hStdInput; + HANDLE hStdOutput; + HANDLE hStdError; +} STARTUPINFOW, *LPSTARTUPINFOW; + +typedef struct _PROCESS_INFORMATION { + HANDLE hProcess; + HANDLE hThread; + DWORD dwProcessId; + DWORD dwThreadId; +} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; + + +typedef struct _FLOATING_SAVE_AREA { + DWORD ControlWord; + DWORD StatusWord; + DWORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + BYTE RegisterArea[80]; + DWORD Cr0NpxState; +} FLOATING_SAVE_AREA; + +typedef struct _CONTEXT32 { + + DWORD ContextFlags; + + DWORD Dr0; + DWORD Dr1; + DWORD Dr2; + DWORD Dr3; + DWORD Dr6; + DWORD Dr7; + + FLOATING_SAVE_AREA FloatSave; + + DWORD SegGs; + DWORD SegFs; + DWORD SegEs; + DWORD SegDs; + + DWORD Edi; + DWORD Esi; + DWORD Ebx; + DWORD Edx; + DWORD Ecx; + DWORD Eax; + + DWORD Ebp; + DWORD Eip; + DWORD SegCs; + DWORD EFlags; + DWORD Esp; + DWORD SegSs; + + BYTE ExtendedRegisters[512]; + +} CONTEXT32, *PCONTEXT32, *LPCONTEXT32; + +typedef struct _WOW64_FLOATING_SAVE_AREA { + DWORD ControlWord; + DWORD StatusWord; + DWORD TagWord; + DWORD ErrorOffset; + DWORD ErrorSelector; + DWORD DataOffset; + DWORD DataSelector; + BYTE RegisterArea[WOW64_SIZE_OF_80387_REGISTERS]; + DWORD Cr0NpxState; +} WOW64_FLOATING_SAVE_AREA; + +typedef struct _WOW64_CONTEXT { + + DWORD ContextFlags; + + DWORD Dr0; + DWORD Dr1; + DWORD Dr2; + DWORD Dr3; + DWORD Dr6; + DWORD Dr7; + + WOW64_FLOATING_SAVE_AREA FloatSave; + + DWORD SegGs; + DWORD SegFs; + DWORD SegEs; + DWORD SegDs; + + DWORD Edi; + DWORD Esi; + DWORD Ebx; + DWORD Edx; + DWORD Ecx; + DWORD Eax; + DWORD Ebp; + DWORD Eip; + DWORD SegCs; + DWORD EFlags; + DWORD Esp; + DWORD SegSs; + + BYTE ExtendedRegisters[WOW64_MAXIMUM_SUPPORTED_EXTENSION]; + +} WOW64_CONTEXT, *PWOW64_CONTEXT; + + +typedef struct _M128A { + ULONGLONG Low; + LONGLONG High; +} M128A, *PM128A; + +typedef struct _CONTEXT64 { + + DWORD64 P1Home; + DWORD64 P2Home; + DWORD64 P3Home; + DWORD64 P4Home; + DWORD64 P5Home; + DWORD64 P6Home; + + DWORD ContextFlags; + DWORD MxCsr; + + WORD SegCs; + WORD SegDs; + WORD SegEs; + WORD SegFs; + WORD SegGs; + WORD SegSs; + DWORD EFlags; + + DWORD64 Dr0; + DWORD64 Dr1; + DWORD64 Dr2; + DWORD64 Dr3; + DWORD64 Dr6; + DWORD64 Dr7; + + + DWORD64 Rax; + DWORD64 Rcx; + DWORD64 Rdx; + DWORD64 Rbx; + DWORD64 Rsp; + DWORD64 Rbp; + DWORD64 Rsi; + DWORD64 Rdi; + DWORD64 R8; + DWORD64 R9; + DWORD64 R10; + DWORD64 R11; + DWORD64 R12; + DWORD64 R13; + DWORD64 R14; + DWORD64 R15; + + DWORD64 Rip; + + M128A Header[2]; + M128A Legacy[8]; + M128A Xmm0; + M128A Xmm1; + M128A Xmm2; + M128A Xmm3; + M128A Xmm4; + M128A Xmm5; + M128A Xmm6; + M128A Xmm7; + M128A Xmm8; + M128A Xmm9; + M128A Xmm10; + M128A Xmm11; + M128A Xmm12; + M128A Xmm13; + M128A Xmm14; + M128A Xmm15; + + M128A VectorRegister[26]; + DWORD64 VectorControl; + + DWORD64 DebugControl; + DWORD64 LastBranchToRip; + DWORD64 LastBranchFromRip; + DWORD64 LastExceptionToRip; + DWORD64 LastExceptionFromRip; +} CONTEXT64, *PCONTEXT64, *LPCONTEXT64; + + +typedef struct tagPROCESSENTRY32W +{ + DWORD dwSize; + DWORD cntUsage; + DWORD th32ProcessID; + ULONG_PTR th32DefaultHeapID; + DWORD th32ModuleID; + DWORD cntThreads; + DWORD th32ParentProcessID; + LONG pcPriClassBase; + DWORD dwFlags; + WCHAR szExeFile[MAX_PATH]; +} PROCESSENTRY32W, *PPROCESSENTRY32W, *LPPROCESSENTRY32W; + + +typedef struct tagPROCESSENTRY32 +{ + DWORD dwSize; + DWORD cntUsage; + DWORD th32ProcessID; + ULONG_PTR th32DefaultHeapID; + DWORD th32ModuleID; + DWORD cntThreads; + DWORD th32ParentProcessID; + LONG pcPriClassBase; + DWORD dwFlags; + CHAR szExeFile[MAX_PATH]; +} PROCESSENTRY32, *PPROCESSENTRY32, *LPPROCESSENTRY32; + + +typedef struct tagTHREADENTRY32 { + DWORD dwSize; + DWORD cntUsage; + DWORD th32ThreadID; + DWORD th32OwnerProcessID; + LONG tpBasePri; + LONG tpDeltaPri; + DWORD dwFlags; +} THREADENTRY32, *PTHREADENTRY32, *LPTHREADENTRY32; + +typedef struct _LUID { + DWORD LowPart; + LONG HighPart; +} LUID, *PLUID; + + +typedef struct _LUID_AND_ATTRIBUTES { + LUID Luid; + DWORD Attributes; +} LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES; + +typedef struct _TOKEN_PRIVILEGES { + DWORD PrivilegeCount; + LUID_AND_ATTRIBUTES Privileges[ANYSIZE_ARRAY]; +} TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES; + +typedef struct _TOKEN_ELEVATION { + DWORD TokenIsElevated; +} TOKEN_ELEVATION, *PTOKEN_ELEVATION; + +typedef struct _OSVERSIONINFOA { + DWORD dwOSVersionInfoSize; + DWORD dwMajorVersion; + DWORD dwMinorVersion; + DWORD dwBuildNumber; + DWORD dwPlatformId; + CHAR szCSDVersion[ 128 ]; +} OSVERSIONINFOA, *POSVERSIONINFOA, *LPOSVERSIONINFOA; + +typedef struct _OSVERSIONINFOW { + DWORD dwOSVersionInfoSize; + DWORD dwMajorVersion; + DWORD dwMinorVersion; + DWORD dwBuildNumber; + DWORD dwPlatformId; + WCHAR szCSDVersion[ 128 ]; +} OSVERSIONINFOW, *POSVERSIONINFOW, *LPOSVERSIONINFOW, RTL_OSVERSIONINFOW, *PRTL_OSVERSIONINFOW; + +typedef struct _OSVERSIONINFOEXA { + DWORD dwOSVersionInfoSize; + DWORD dwMajorVersion; + DWORD dwMinorVersion; + DWORD dwBuildNumber; + DWORD dwPlatformId; + CHAR szCSDVersion[ 128 ]; + WORD wServicePackMajor; + WORD wServicePackMinor; + WORD wSuiteMask; + BYTE wProductType; + BYTE wReserved; +} OSVERSIONINFOEXA, *POSVERSIONINFOEXA, *LPOSVERSIONINFOEXA; + +typedef struct _OSVERSIONINFOEXW { + DWORD dwOSVersionInfoSize; + DWORD dwMajorVersion; + DWORD dwMinorVersion; + DWORD dwBuildNumber; + DWORD dwPlatformId; + WCHAR szCSDVersion[ 128 ]; + WORD wServicePackMajor; + WORD wServicePackMinor; + WORD wSuiteMask; + BYTE wProductType; + BYTE wReserved; +} OSVERSIONINFOEXW, *POSVERSIONINFOEXW, *LPOSVERSIONINFOEXW, RTL_OSVERSIONINFOEXW, *PRTL_OSVERSIONINFOEXW; + + +typedef struct _OVERLAPPED { + ULONG_PTR Internal; + ULONG_PTR InternalHigh; + PVOID Pointer; + HANDLE hEvent; +} OVERLAPPED, *LPOVERLAPPED; + +typedef struct _MIB_TCPROW_OWNER_PID { + DWORD dwState; + DWORD dwLocalAddr; + DWORD dwLocalPort; + DWORD dwRemoteAddr; + DWORD dwRemotePort; + DWORD dwOwningPid; +} MIB_TCPROW_OWNER_PID, *PMIB_TCPROW_OWNER_PID; + +typedef struct _MIB_TCPTABLE_OWNER_PID{ + DWORD dwNumEntries; + MIB_TCPROW_OWNER_PID table[ANY_SIZE]; +} MIB_TCPTABLE_OWNER_PID, *PMIB_TCPTABLE_OWNER_PID; + +typedef struct _MIB_UDPROW_OWNER_PID { + DWORD dwLocalAddr; + DWORD dwLocalPort; + DWORD dwOwningPid; +} MIB_UDPROW_OWNER_PID, *PMIB_UDPROW_OWNER_PID; + +typedef struct _MIB_UDPTABLE_OWNER_PID { + DWORD dwNumEntries; + MIB_UDPROW_OWNER_PID table[ANY_SIZE]; +} MIB_UDPTABLE_OWNER_PID, *PMIB_UDPTABLE_OWNER_PID; + + +typedef struct _MIB_UDP6ROW_OWNER_PID { + UCHAR ucLocalAddr[16]; + DWORD dwLocalScopeId; + DWORD dwLocalPort; + DWORD dwOwningPid; +} MIB_UDP6ROW_OWNER_PID, *PMIB_UDP6ROW_OWNER_PID; + +typedef struct _MIB_UDP6TABLE_OWNER_PID{ + DWORD dwNumEntries; + MIB_UDP6ROW_OWNER_PID table[ANY_SIZE]; +} MIB_UDP6TABLE_OWNER_PID, *PMIB_UDP6TABLE_OWNER_PID; + +typedef struct _MIB_TCP6ROW_OWNER_PID { + UCHAR ucLocalAddr[16]; + DWORD dwLocalScopeId; + DWORD dwLocalPort; + UCHAR ucRemoteAddr[16]; + DWORD dwRemoteScopeId; + DWORD dwRemotePort; + DWORD dwState; + DWORD dwOwningPid; +} MIB_TCP6ROW_OWNER_PID, *PMIB_TCP6ROW_OWNER_PID; + +typedef struct _MIB_TCP6TABLE_OWNER_PID { + DWORD dwNumEntries; + MIB_TCP6ROW_OWNER_PID table[ANY_SIZE]; +} MIB_TCP6TABLE_OWNER_PID, *PMIB_TCP6TABLE_OWNER_PID; + +typedef struct _MIB_TCPROW { + DWORD dwState; + DWORD dwLocalAddr; + DWORD dwLocalPort; + DWORD dwRemoteAddr; + DWORD dwRemotePort; +} MIB_TCPROW, *PMIB_TCPROW; + +typedef struct _EXCEPTION_RECORD { + DWORD ExceptionCode; + DWORD ExceptionFlags; + struct _EXCEPTION_RECORD *ExceptionRecord; + PVOID ExceptionAddress; + DWORD NumberParameters; + ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; +} EXCEPTION_RECORD, *PEXCEPTION_RECORD; + +typedef struct _EXCEPTION_RECORD32 { + DWORD ExceptionCode; + DWORD ExceptionFlags; + DWORD ExceptionRecord; + DWORD ExceptionAddress; + DWORD NumberParameters; + DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; +} EXCEPTION_RECORD32, *PEXCEPTION_RECORD32; + +typedef struct _EXCEPTION_RECORD64 { + DWORD ExceptionCode; + DWORD ExceptionFlags; + DWORD64 ExceptionRecord; + DWORD64 ExceptionAddress; + DWORD NumberParameters; + DWORD __unusedAlignment; + DWORD64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; +} EXCEPTION_RECORD64, *PEXCEPTION_RECORD64; + + +typedef struct _EXCEPTION_POINTERS64 { + PEXCEPTION_RECORD ExceptionRecord; + PCONTEXT64 ContextRecord; +} EXCEPTION_POINTERS64, *PEXCEPTION_POINTERS64; + + +typedef struct _EXCEPTION_POINTERS32 { + PEXCEPTION_RECORD ExceptionRecord; + PCONTEXT32 ContextRecord; +} EXCEPTION_POINTERS32, *PEXCEPTION_POINTERS32; + + +typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_ALPHA +{ + ULONG Type; + ULONG Revision; +} DEBUG_PROCESSOR_IDENTIFICATION_ALPHA, *PDEBUG_PROCESSOR_IDENTIFICATION_ALPHA; + +typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_AMD64 +{ + ULONG Family; + ULONG Model; + ULONG Stepping; + CHAR VendorString[16]; +} DEBUG_PROCESSOR_IDENTIFICATION_AMD64, *PDEBUG_PROCESSOR_IDENTIFICATION_AMD64; + +typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_IA64 +{ + ULONG Model; + ULONG Revision; + ULONG Family; + ULONG ArchRev; + CHAR VendorString[16]; +} DEBUG_PROCESSOR_IDENTIFICATION_IA64, *PDEBUG_PROCESSOR_IDENTIFICATION_IA64; + +typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_X86 +{ + ULONG Family; + ULONG Model; + ULONG Stepping; + CHAR VendorString[16]; +} DEBUG_PROCESSOR_IDENTIFICATION_X86, *PDEBUG_PROCESSOR_IDENTIFICATION_X86; + +typedef struct _DEBUG_PROCESSOR_IDENTIFICATION_ARM +{ + ULONG Type; + ULONG Revision; +} DEBUG_PROCESSOR_IDENTIFICATION_ARM, *PDEBUG_PROCESSOR_IDENTIFICATION_ARM; + +typedef union _DEBUG_PROCESSOR_IDENTIFICATION_ALL +{ + DEBUG_PROCESSOR_IDENTIFICATION_ALPHA Alpha; + DEBUG_PROCESSOR_IDENTIFICATION_AMD64 Amd64; + DEBUG_PROCESSOR_IDENTIFICATION_IA64 Ia64; + DEBUG_PROCESSOR_IDENTIFICATION_X86 X86; + DEBUG_PROCESSOR_IDENTIFICATION_ARM Arm; +} DEBUG_PROCESSOR_IDENTIFICATION_ALL, *PDEBUG_PROCESSOR_IDENTIFICATION_ALL; + +typedef enum _IMAGEHLP_SYMBOL_TYPE_INFO { + TI_GET_SYMTAG, + TI_GET_SYMNAME, + TI_GET_LENGTH, + TI_GET_TYPE, + TI_GET_TYPEID, + TI_GET_BASETYPE, + TI_GET_ARRAYINDEXTYPEID, + TI_FINDCHILDREN, + TI_GET_DATAKIND, + TI_GET_ADDRESSOFFSET, + TI_GET_OFFSET, + TI_GET_VALUE, + TI_GET_COUNT, + TI_GET_CHILDRENCOUNT, + TI_GET_BITPOSITION, + TI_GET_VIRTUALBASECLASS, + TI_GET_VIRTUALTABLESHAPEID, + TI_GET_VIRTUALBASEPOINTEROFFSET, + TI_GET_CLASSPARENTID, + TI_GET_NESTED, + TI_GET_SYMINDEX, + TI_GET_LEXICALPARENT, + TI_GET_ADDRESS, + TI_GET_THISADJUST, + TI_GET_UDTKIND, + TI_IS_EQUIV_TO, + TI_GET_CALLING_CONVENTION, + TI_IS_CLOSE_EQUIV_TO, + TI_GTIEX_REQS_VALID, + TI_GET_VIRTUALBASEOFFSET, + TI_GET_VIRTUALBASEDISPINDEX, + TI_GET_IS_REFERENCE, + TI_GET_INDIRECTVIRTUALBASECLASS, + IMAGEHLP_SYMBOL_TYPE_INFO_MAX, +} IMAGEHLP_SYMBOL_TYPE_INFO; + +typedef struct _SYMBOL_INFO { + ULONG SizeOfStruct; + ULONG TypeIndex; + ULONG64 Reserved[2]; + ULONG Index; + ULONG Size; + ULONG64 ModBase; + ULONG Flags; + ULONG64 Value; + ULONG64 Address; + ULONG Register; + ULONG Scope; + ULONG Tag; + ULONG NameLen; + ULONG MaxNameLen; + CHAR Name[1]; +} SYMBOL_INFO, *PSYMBOL_INFO; + +typedef struct _MODLOAD_DATA { + DWORD ssize; + DWORD ssig; + PVOID data; + DWORD size; + DWORD flags; +} MODLOAD_DATA, *PMODLOAD_DATA; + +typedef struct _SYSTEM_MODULE32 +{ + ULONG Reserved[2]; + ULONG Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT Unknown; + USHORT LoadCount; + USHORT ModuleNameOffset; + CHAR ImageName[256]; +} SYSTEM_MODULE32, *PSYSTEM_MODULE32; + +typedef struct _SYSTEM_MODULE64 +{ + ULONG Reserved[4]; + ULONG64 Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT Unknown; + USHORT LoadCount; + USHORT ModuleNameOffset; + CHAR ImageName[256]; +} SYSTEM_MODULE64, *PSYSTEM_MODULE64; + +typedef struct _SYSTEM_MODULE_INFORMATION32 +{ + ULONG ModulesCount; + SYSTEM_MODULE32 Modules[0]; +} SYSTEM_MODULE_INFORMATION32, *PSYSTEM_MODULE_INFORMATION32; + +typedef struct _SYSTEM_MODULE_INFORMATION64 +{ + ULONG ModulesCount; + SYSTEM_MODULE64 Modules[0]; +} SYSTEM_MODULE_INFORMATION64, *PSYSTEM_MODULE_INFORMATION64; + + +typedef struct tagSAFEARRAYBOUND +{ + ULONG cElements; + LONG lLbound; +} SAFEARRAYBOUND, *LPSAFEARRAYBOUND; + + +typedef struct tagSAFEARRAY +{ + USHORT cDims; + USHORT fFeatures; + ULONG cbElements; + ULONG cLocks; + PVOID pvData; + SAFEARRAYBOUND rgsabound[ 1 ]; +} SAFEARRAY; + +typedef struct _DEBUG_BREAKPOINT_PARAMETERS { + ULONG64 Offset; + ULONG Id; + ULONG BreakType; + ULONG ProcType; + ULONG Flags; + ULONG DataSize; + ULONG DataAccessType; + ULONG PassCount; + ULONG CurrentPassCount; + ULONG MatchThread; + ULONG CommandSize; + ULONG OffsetExpressionSize; +} DEBUG_BREAKPOINT_PARAMETERS, *PDEBUG_BREAKPOINT_PARAMETERS; + + +typedef struct _DEBUG_REGISTER_DESCRIPTION { + ULONG Type; + ULONG Flags; + ULONG SubregMaster; + ULONG SubregLength; + ULONG64 SubregMask; + ULONG SubregShift; + ULONG Reserved0; +} DEBUG_REGISTER_DESCRIPTION, *PDEBUG_REGISTER_DESCRIPTION; + + +typedef struct _DEBUG_STACK_FRAME { + ULONG64 InstructionOffset; + ULONG64 ReturnOffset; + ULONG64 FrameOffset; + ULONG64 StackOffset; + ULONG64 FuncTableEntry; + ULONG64 Params[4]; + ULONG64 Reserved[6]; + BOOL Virtual; + ULONG FrameNumber; +} DEBUG_STACK_FRAME, *PDEBUG_STACK_FRAME; + + +typedef struct _DEBUG_LAST_EVENT_INFO_BREAKPOINT +{ + ULONG Id; +} DEBUG_LAST_EVENT_INFO_BREAKPOINT, *PDEBUG_LAST_EVENT_INFO_BREAKPOINT; + +typedef struct _DEBUG_LAST_EVENT_INFO_EXCEPTION +{ + EXCEPTION_RECORD64 ExceptionRecord; + ULONG FirstChance; +} DEBUG_LAST_EVENT_INFO_EXCEPTION, *PDEBUG_LAST_EVENT_INFO_EXCEPTION; + +typedef struct _DEBUG_LAST_EVENT_INFO_EXIT_THREAD +{ + ULONG ExitCode; +} DEBUG_LAST_EVENT_INFO_EXIT_THREAD, *PDEBUG_LAST_EVENT_INFO_EXIT_THREAD; + +typedef struct _DEBUG_LAST_EVENT_INFO_EXIT_PROCESS +{ + ULONG ExitCode; +} DEBUG_LAST_EVENT_INFO_EXIT_PROCESS, *PDEBUG_LAST_EVENT_INFO_EXIT_PROCESS; + +typedef struct _DEBUG_LAST_EVENT_INFO_LOAD_MODULE +{ + ULONG64 Base; +} DEBUG_LAST_EVENT_INFO_LOAD_MODULE, *PDEBUG_LAST_EVENT_INFO_LOAD_MODULE; + +typedef struct _DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE +{ + ULONG64 Base; +} DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE, *PDEBUG_LAST_EVENT_INFO_UNLOAD_MODULE; + +typedef struct _DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR +{ + ULONG Error; + ULONG Level; +} DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR, *PDEBUG_LAST_EVENT_INFO_SYSTEM_ERROR; + + +typedef struct _DEBUG_SPECIFIC_FILTER_PARAMETERS { + ULONG ExecutionOption; + ULONG ContinueOption; + ULONG TextSize; + ULONG CommandSize; + ULONG ArgumentSize; +} DEBUG_SPECIFIC_FILTER_PARAMETERS, *PDEBUG_SPECIFIC_FILTER_PARAMETERS; + + +typedef struct _DEBUG_EXCEPTION_FILTER_PARAMETERS { + ULONG ExecutionOption; + ULONG ContinueOption; + ULONG TextSize; + ULONG CommandSize; + ULONG SecondCommandSize; + ULONG ExceptionCode; +} DEBUG_EXCEPTION_FILTER_PARAMETERS, *PDEBUG_EXCEPTION_FILTER_PARAMETERS; + + +typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation = 0, + ProcessWow64Information = 26 +} PROCESSINFOCLASS; + +typedef struct _GUID { + ULONG Data1; + USHORT Data2; + USHORT Data3; + UCHAR Data4[ 8 ]; +} GUID; + +typedef struct _CRYPTOAPI_BLOB { + DWORD cbData; + BYTE *pbData; +} CRYPT_INTEGER_BLOB, *PCRYPT_INTEGER_BLOB, +CRYPT_UINT_BLOB, *PCRYPT_UINT_BLOB, +CRYPT_OBJID_BLOB, *PCRYPT_OBJID_BLOB, +CERT_NAME_BLOB, *PCERT_NAME_BLOB, +CERT_RDN_VALUE_BLOB, *PCERT_RDN_VALUE_BLOB, +CERT_BLOB, *PCERT_BLOB, +CRL_BLOB, *PCRL_BLOB, +DATA_BLOB, *PDATA_BLOB, +CRYPT_DATA_BLOB, *PCRYPT_DATA_BLOB, +CRYPT_HASH_BLOB, *PCRYPT_HASH_BLOB, +CRYPT_DIGEST_BLOB, *PCRYPT_DIGEST_BLOB, +CRYPT_DER_BLOB, *PCRYPT_DER_BLOB, +CRYPT_ATTR_BLOB, *PCRYPT_ATTR_BLOB; + +typedef struct WINTRUST_FILE_INFO_ +{ + DWORD cbStruct; + LPCWSTR pcwszFilePath; + HANDLE hFile; + GUID *pgKnownSubject; +} WINTRUST_FILE_INFO, *PWINTRUST_FILE_INFO; + + +typedef struct _CRYPT_ATTRIBUTE { + LPSTR pszObjId; + DWORD cValue; + PCRYPT_ATTR_BLOB rgValue; +} CRYPT_ATTRIBUTE, *PCRYPT_ATTRIBUTE; + + +typedef struct _CTL_ENTRY { + CRYPT_DATA_BLOB SubjectIdentifier; + DWORD cAttribute; + PCRYPT_ATTRIBUTE rgAttribute; +} CTL_ENTRY, *PCTL_ENTRY; + + +typedef struct _CRYPT_ATTRIBUTE { + LPSTR pszObjId; + DWORD cValue; + PCRYPT_ATTR_BLOB rgValue; +} CRYPT_ATTRIBUTE, *PCRYPT_ATTRIBUTE; + +typedef struct _CRYPT_ATTRIBUTES { + DWORD cAttr; + PCRYPT_ATTRIBUTE rgAttr; +} CRYPT_ATTRIBUTES, *PCRYPT_ATTRIBUTES; + + +typedef struct _CRYPT_ALGORITHM_IDENTIFIER { + LPSTR pszObjId; + CRYPT_OBJID_BLOB Parameters; +} CRYPT_ALGORITHM_IDENTIFIER, *PCRYPT_ALGORITHM_IDENTIFIER; + +typedef struct _CMSG_SIGNER_INFO { + DWORD dwVersion; + CERT_NAME_BLOB Issuer; + CRYPT_INTEGER_BLOB SerialNumber; + CRYPT_ALGORITHM_IDENTIFIER HashAlgorithm; + CRYPT_ALGORITHM_IDENTIFIER HashEncryptionAlgorithm; + CRYPT_DATA_BLOB EncryptedHash; + CRYPT_ATTRIBUTES AuthAttrs; + CRYPT_ATTRIBUTES UnauthAttrs; +} CMSG_SIGNER_INFO, *PCMSG_SIGNER_INFO; + + +typedef struct _CERT_EXTENSION { + LPSTR pszObjId; + BOOL fCritical; + CRYPT_OBJID_BLOB Value; +} CERT_EXTENSION, *PCERT_EXTENSION; + +typedef struct _CTL_USAGE { + DWORD cUsageIdentifier; + LPSTR *rgpszUsageIdentifier; +} CTL_USAGE, *PCTL_USAGE, CERT_ENHKEY_USAGE, *PCERT_ENHKEY_USAGE; + +typedef struct _CTL_INFO { + DWORD dwVersion; + CTL_USAGE SubjectUsage; + CRYPT_DATA_BLOB ListIdentifier; + CRYPT_INTEGER_BLOB SequenceNumber; + FILETIME ThisUpdate; + FILETIME NextUpdate; + CRYPT_ALGORITHM_IDENTIFIER SubjectAlgorithm; + DWORD cCTLEntry; + PCTL_ENTRY rgCTLEntry; + DWORD cExtension; + PCERT_EXTENSION rgExtension; +} CTL_INFO, *PCTL_INFO; + +typedef struct _CTL_CONTEXT { + DWORD dwMsgAndCertEncodingType; + BYTE *pbCtlEncoded; + DWORD cbCtlEncoded; + PCTL_INFO pCtlInfo; + HCERTSTORE hCertStore; + HCRYPTMSG hCryptMsg; + BYTE *pbCtlContent; + DWORD cbCtlContent; +} CTL_CONTEXT, *PCTL_CONTEXT, *PCCTL_CONTEXT; + + +typedef struct WINTRUST_CATALOG_INFO_ +{ + DWORD cbStruct; + DWORD dwCatalogVersion; + LPCWSTR pcwszCatalogFilePath; + LPCWSTR pcwszMemberTag; + LPCWSTR pcwszMemberFilePath; + HANDLE hMemberFile; + BYTE *pbCalculatedFileHash; + DWORD cbCalculatedFileHash; + PCCTL_CONTEXT pcCatalogContext; +} WINTRUST_CATALOG_INFO, *PWINTRUST_CATALOG_INFO; + + +typedef struct WINTRUST_BLOB_INFO_ +{ + DWORD cbStruct; + GUID gSubject; + LPCWSTR pcwszDisplayName; + DWORD cbMemObject; + BYTE *pbMemObject; + DWORD cbMemSignedMsg; + BYTE *pbMemSignedMsg; +} WINTRUST_BLOB_INFO, *PWINTRUST_BLOB_INFO; + + +typedef struct _CRYPT_BIT_BLOB { + DWORD cbData; + BYTE *pbData; + DWORD cUnusedBits; +} CRYPT_BIT_BLOB, *PCRYPT_BIT_BLOB; + +typedef struct _CERT_PUBLIC_KEY_INFO { + CRYPT_ALGORITHM_IDENTIFIER Algorithm; + CRYPT_BIT_BLOB PublicKey; +} CERT_PUBLIC_KEY_INFO, *PCERT_PUBLIC_KEY_INFO; + +typedef struct _CERT_INFO { + DWORD dwVersion; + CRYPT_INTEGER_BLOB SerialNumber; + CRYPT_ALGORITHM_IDENTIFIER SignatureAlgorithm; + CERT_NAME_BLOB Issuer; + FILETIME NotBefore; + FILETIME NotAfter; + CERT_NAME_BLOB Subject; + CERT_PUBLIC_KEY_INFO SubjectPublicKeyInfo; + CRYPT_BIT_BLOB IssuerUniqueId; + CRYPT_BIT_BLOB SubjectUniqueId; + DWORD cExtension; + PCERT_EXTENSION rgExtension; +} CERT_INFO, *PCERT_INFO; + + +typedef struct _CERT_CONTEXT { + DWORD dwCertEncodingType; + BYTE *pbCertEncoded; + DWORD cbCertEncoded; + PCERT_INFO pCertInfo; + HCERTSTORE hCertStore; +} CERT_CONTEXT, *PCERT_CONTEXT; + + +typedef struct WINTRUST_SGNR_INFO_ +{ + DWORD cbStruct; + LPCWSTR pcwszDisplayName; + CMSG_SIGNER_INFO *psSignerInfo; + DWORD chStores; + HCERTSTORE *pahStores; +} WINTRUST_SGNR_INFO, *PWINTRUST_SGNR_INFO; + + +typedef struct _FILETIME { + DWORD dwLowDateTime; + DWORD dwHighDateTime; +} FILETIME, *PFILETIME, *LPFILETIME; + +typedef struct WINTRUST_CERT_INFO_ +{ + DWORD cbStruct; + LPCWSTR pcwszDisplayName; + CERT_CONTEXT *psCertContext; + DWORD chStores; + HCERTSTORE *pahStores; + DWORD dwFlags; + FILETIME *psftVerifyAsOf; +} WINTRUST_CERT_INFO, *PWINTRUST_CERT_INFO; + + +typedef union _TMP_WINTRUST_UNION_TYPE +{ + struct WINTRUST_FILE_INFO_ *pFile; + struct WINTRUST_CATALOG_INFO_ *pCatalog; + struct WINTRUST_BLOB_INFO_ *pBlob; + struct WINTRUST_SGNR_INFO_ *pSgnr; + struct WINTRUST_CERT_INFO_ *pCert; +} TMP_WINTRUST_UNION_TYPE; + + +typedef struct _WINTRUST_DATA +{ + DWORD cbStruct; + LPVOID pPolicyCallbackData; + LPVOID pSIPClientData; + DWORD dwUIChoice; + DWORD fdwRevocationChecks; + DWORD dwUnionChoice; + + TMP_WINTRUST_UNION_TYPE tmp_union; + + DWORD dwStateAction; + HANDLE hWVTStateData; + WCHAR *pwszURLReference; + DWORD dwProvFlags; + DWORD dwUIContext; +} WINTRUST_DATA, *PWINTRUST_DATA; + + +typedef struct _PROCESS_BASIC_INFORMATION { + PVOID Reserved1; + PPEB PebBaseAddress; + PVOID Reserved2[2]; + ULONG_PTR UniqueProcessId; + PVOID Reserved3; +} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION; \ No newline at end of file diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index a5ffb64..b3343e1 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -397,3 +397,55 @@ Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext')) SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL) SetConsoleCtrlHandlerParams = ((1, 'HandlerRoutine'), (1, 'Add')) +# WinVerifyTrust(hwnd, pgActionID, pWVTData): +WinVerifyTrustPrototype = WINFUNCTYPE(LONG, HWND, POINTER(GUID), LPVOID) +WinVerifyTrustParams = ((1, 'hwnd'), (1, 'pgActionID'), (1, 'pWVTData')) + +# GlobalAlloc(uFlags, dwBytes): +GlobalAllocPrototype = WINFUNCTYPE(HGLOBAL, UINT, SIZE_T) +GlobalAllocParams = ((1, 'uFlags'), (1, 'dwBytes')) + +# GlobalFree(hMem): +GlobalFreePrototype = WINFUNCTYPE(HGLOBAL, HGLOBAL) +GlobalFreeParams = ((1, 'hMem'),) + +# GlobalUnlock(hMem): +GlobalUnlockPrototype = WINFUNCTYPE(BOOL, HGLOBAL) +GlobalUnlockParams = ((1, 'hMem'),) + +# GlobalLock(hMem): +GlobalLockPrototype = WINFUNCTYPE(LPVOID, HGLOBAL) +GlobalLockParams = ((1, 'hMem'),) + +# OpenClipboard(hWndNewOwner): +OpenClipboardPrototype = WINFUNCTYPE(BOOL, HWND) +OpenClipboardParams = ((1, 'hWndNewOwner'),) + +# EmptyClipboard(): +EmptyClipboardPrototype = WINFUNCTYPE(BOOL) +EmptyClipboardParams = () + +# CloseClipboard(): +CloseClipboardPrototype = WINFUNCTYPE(BOOL) +CloseClipboardParams = () + +# SetClipboardData(uFormat, hMem): +SetClipboardDataPrototype = WINFUNCTYPE(HANDLE, UINT, HANDLE) +SetClipboardDataParams = ((1, 'uFormat'), (1, 'hMem')) + +# GetClipboardData(uFormat): +GetClipboardDataPrototype = WINFUNCTYPE(HANDLE, UINT) +GetClipboardDataParams = ((1, 'uFormat'),) + +# EnumClipboardFormats(format): +EnumClipboardFormatsPrototype = WINFUNCTYPE(UINT, UINT) +EnumClipboardFormatsParams = ((1, 'format'),) + +# GetClipboardFormatNameA(format, lpszFormatName, cchMaxCount): +GetClipboardFormatNameAPrototype = WINFUNCTYPE(INT, UINT, LPCSTR, INT) +GetClipboardFormatNameAParams = ((1, 'format'), (1, 'lpszFormatName'), (1, 'cchMaxCount')) + +# GetClipboardFormatNameW(format, lpszFormatName, cchMaxCount): +GetClipboardFormatNameWPrototype = WINFUNCTYPE(INT, UINT, LPCWSTR, INT) +GetClipboardFormatNameWParams = ((1, 'format'), (1, 'lpszFormatName'), (1, 'cchMaxCount')) +