mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Playing with Token and Debugger API
This commit is contained in:
Clement Rouault
@@ -16,19 +16,19 @@ class WinFunc(object):
|
||||
|
||||
def generate_ctypes(self):
|
||||
return self.generate_comment_ctypes() + "\n" + self.generate_prototype_ctypes() + "\n" + self.generate_paramflags_ctypes() + "\n"
|
||||
|
||||
|
||||
def generate_comment_ctypes(self):
|
||||
model = "# {0}({1}):"
|
||||
ctypes_param = [name for type, name in self.params]
|
||||
ctypes_param_str = ", ".join(ctypes_param)
|
||||
return model.format(self.name, ctypes_param_str)
|
||||
|
||||
|
||||
def generate_prototype_ctypes(self):
|
||||
model = "{0} = WINFUNCTYPE({1})"
|
||||
ctypes_param = [self.return_type] + [type for type, name in self.params]
|
||||
ctypes_param_str = ", ".join(ctypes_param)
|
||||
return model.format(self.name + "Prototype", ctypes_param_str)
|
||||
|
||||
|
||||
def generate_paramflags_ctypes(self):
|
||||
model = "{0} = {1}"
|
||||
ctypes_paramflags = tuple([(1, name) for type, name in self.params])
|
||||
@@ -37,14 +37,14 @@ class WinFunc(object):
|
||||
|
||||
class WinFuncParser(Parser):
|
||||
|
||||
known_io_info_type = ["__in", "__in_opt", "_In_", "_In_opt_", "_Inout_", "_Out_opt_", "_Out_", "_Reserved_", "_Inout_opt_", "__inout_opt", "__out", "__inout"]
|
||||
known_io_info_type = ["__in", "__in_opt", "_In_", "_In_opt_", "_Inout_", "_Out_opt_", "_Out_", "_Reserved_", "_Inout_opt_", "__inout_opt", "__out", "__inout", "__deref_out"]
|
||||
|
||||
def assert_argument_io_info(self):
|
||||
io_info = self.assert_token_type(NameToken)
|
||||
if io_info.value not in self.known_io_info_type:
|
||||
raise ParsingError("Was expection IO_INFO got {0} instead".format(io_info))
|
||||
return io_info
|
||||
|
||||
|
||||
def parse_func_arg(self, has_winapi):
|
||||
type_ptr = False
|
||||
if has_winapi:
|
||||
@@ -52,23 +52,23 @@ class WinFuncParser(Parser):
|
||||
arg_type = self.assert_token_type(NameToken)
|
||||
if arg_type.value.upper() == "CONST":
|
||||
arg_type = self.assert_token_type(NameToken)
|
||||
|
||||
|
||||
if type(self.peek()) == StarToken:
|
||||
type_ptr = True
|
||||
self.assert_token_type(StarToken)
|
||||
self.assert_token_type(StarToken)
|
||||
arg_name = self.assert_token_type(NameToken)
|
||||
if not type(self.peek()) == CloseParenthesisToken:
|
||||
self.assert_token_type(CommaToken)
|
||||
if not type_ptr:
|
||||
return (arg_type.value, arg_name.value)
|
||||
return ("POINTER({0})".format(arg_type.value), arg_name.value)
|
||||
|
||||
|
||||
def assert_winapi_token(self):
|
||||
winapi = self.assert_token_type(NameToken)
|
||||
if winapi.value != "WINAPI":
|
||||
raise ParsingError("Was expection NameToken(WINAPI) got {0} instead".format(winapi))
|
||||
return winapi
|
||||
|
||||
return winapi
|
||||
|
||||
def parse_winfunc(self):
|
||||
has_winapi = False
|
||||
try:
|
||||
@@ -80,7 +80,7 @@ class WinFuncParser(Parser):
|
||||
if func_name.upper() == "WINAPI":
|
||||
has_winapi = True
|
||||
func_name = self.assert_token_type(NameToken).value
|
||||
|
||||
|
||||
self.assert_token_type(OpenParenthesisToken)
|
||||
|
||||
params = []
|
||||
@@ -96,9 +96,9 @@ class WinFuncParser(Parser):
|
||||
while self.peek() is not None:
|
||||
res.append(self.parse_winfunc())
|
||||
return res
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
def dbg_lexer(data):
|
||||
for i in Lexer(data).token_generation():
|
||||
@@ -109,11 +109,11 @@ def dbg_parser(data):
|
||||
|
||||
def dbg_validate(data):
|
||||
return validate_structs(Parser(data).parse())
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
data = open(sys.argv[1], 'r').read()
|
||||
funcs = generate_ctypes(data)
|
||||
print(funcs)
|
||||
print(funcs)
|
||||
|
||||
@@ -24,8 +24,10 @@ TYPE_EQUIVALENCE = [
|
||||
('ULONG_PTR','PULONG'),
|
||||
('CHAR', 'c_char'),
|
||||
('UCHAR', 'c_char'),
|
||||
('PUCHAR', 'POINTER(UCHAR)'),
|
||||
('FARPROC', 'PVOID'),
|
||||
('HGLOBAL', 'PVOID'),
|
||||
('PSID', 'PVOID'),
|
||||
('PVECTORED_EXCEPTION_HANDLER', 'PVOID'),
|
||||
#('HRESULT', 'c_long'), # VERY BAD : real HRESULT raise by itself -> way better
|
||||
('ULONGLONG', 'c_ulonglong'),
|
||||
|
||||
@@ -653,4 +653,76 @@ LONG WINAPI WinVerifyTrust(
|
||||
_In_ HWND hWnd,
|
||||
_In_ GUID *pgActionID,
|
||||
_In_ LPVOID pWVTData
|
||||
);
|
||||
);
|
||||
|
||||
BOOL WINAPI OpenProcessToken (
|
||||
__in HANDLE ProcessHandle,
|
||||
__in DWORD DesiredAccess,
|
||||
__deref_out PHANDLE TokenHandle
|
||||
);
|
||||
|
||||
BOOL WINAPI OpenThreadToken (
|
||||
__in HANDLE ThreadHandle,
|
||||
__in DWORD DesiredAccess,
|
||||
__in BOOL OpenAsSelf,
|
||||
__deref_out PHANDLE TokenHandle
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI GetTokenInformation (
|
||||
__in HANDLE TokenHandle,
|
||||
__in TOKEN_INFORMATION_CLASS TokenInformationClass,
|
||||
__out LPVOID TokenInformation,
|
||||
__in DWORD TokenInformationLength,
|
||||
__out PDWORD ReturnLength
|
||||
);
|
||||
|
||||
BOOL WINAPI SetTokenInformation (
|
||||
__in HANDLE TokenHandle,
|
||||
__in TOKEN_INFORMATION_CLASS TokenInformationClass,
|
||||
__in LPVOID TokenInformation,
|
||||
__in DWORD TokenInformationLength
|
||||
);
|
||||
|
||||
PSID_IDENTIFIER_AUTHORITY WINAPI GetSidIdentifierAuthority (
|
||||
__in PSID pSid
|
||||
);
|
||||
|
||||
PDWORD WINAPI GetSidSubAuthority (
|
||||
__in PSID pSid,
|
||||
__in DWORD nSubAuthority
|
||||
);
|
||||
|
||||
PUCHAR WINAPI GetSidSubAuthorityCount (
|
||||
__in PSID pSid
|
||||
);
|
||||
|
||||
|
||||
VOID DebugBreak();
|
||||
|
||||
BOOL WINAPI WaitForDebugEvent(
|
||||
__in LPDEBUG_EVENT lpDebugEvent,
|
||||
__in DWORD dwMilliseconds
|
||||
);
|
||||
|
||||
BOOL WINAPI ContinueDebugEvent(
|
||||
__in DWORD dwProcessId,
|
||||
__in DWORD dwThreadId,
|
||||
__in DWORD dwContinueStatus
|
||||
);
|
||||
|
||||
BOOL WINAPI DebugActiveProcess(
|
||||
__in DWORD dwProcessId
|
||||
);
|
||||
|
||||
BOOL WINAPI DebugActiveProcessStop(
|
||||
__in DWORD dwProcessId
|
||||
);
|
||||
|
||||
BOOL WINAPI DebugSetProcessKillOnExit(
|
||||
__in BOOL KillOnExit
|
||||
);
|
||||
|
||||
BOOL WINAPI DebugBreakProcess (
|
||||
__in HANDLE Process
|
||||
);
|
||||
@@ -798,6 +798,17 @@ typedef struct _TOKEN_ELEVATION {
|
||||
DWORD TokenIsElevated;
|
||||
} TOKEN_ELEVATION, *PTOKEN_ELEVATION;
|
||||
|
||||
typedef struct _SID_AND_ATTRIBUTES {
|
||||
PSID Sid;
|
||||
DWORD Attributes;
|
||||
} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES;
|
||||
|
||||
typedef struct _TOKEN_MANDATORY_LABEL {
|
||||
SID_AND_ATTRIBUTES Label;
|
||||
} TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;
|
||||
|
||||
|
||||
|
||||
typedef struct _OSVERSIONINFOA {
|
||||
DWORD dwOSVersionInfoSize;
|
||||
DWORD dwMajorVersion;
|
||||
@@ -1469,4 +1480,84 @@ typedef struct _JIT_DEBUG_INFO {
|
||||
ULONG64 lpExceptionAddress;
|
||||
ULONG64 lpExceptionRecord;
|
||||
ULONG64 lpContextRecord;
|
||||
} JIT_DEBUG_INFO, *LPJIT_DEBUG_INFO;
|
||||
} JIT_DEBUG_INFO, *LPJIT_DEBUG_INFO;
|
||||
|
||||
typedef struct _SID_IDENTIFIER_AUTHORITY {
|
||||
BYTE Value[6];
|
||||
} SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY;
|
||||
|
||||
typedef struct _EXCEPTION_DEBUG_INFO {
|
||||
EXCEPTION_RECORD ExceptionRecord;
|
||||
DWORD dwFirstChance;
|
||||
} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO;
|
||||
|
||||
typedef struct _CREATE_THREAD_DEBUG_INFO {
|
||||
HANDLE hThread;
|
||||
LPVOID lpThreadLocalBase;
|
||||
LPTHREAD_START_ROUTINE lpStartAddress;
|
||||
} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO;
|
||||
|
||||
typedef struct _CREATE_PROCESS_DEBUG_INFO {
|
||||
HANDLE hFile;
|
||||
HANDLE hProcess;
|
||||
HANDLE hThread;
|
||||
LPVOID lpBaseOfImage;
|
||||
DWORD dwDebugInfoFileOffset;
|
||||
DWORD nDebugInfoSize;
|
||||
LPVOID lpThreadLocalBase;
|
||||
LPTHREAD_START_ROUTINE lpStartAddress;
|
||||
LPVOID lpImageName;
|
||||
WORD fUnicode;
|
||||
} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO;
|
||||
|
||||
|
||||
typedef struct _EXIT_THREAD_DEBUG_INFO {
|
||||
DWORD dwExitCode;
|
||||
} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO;
|
||||
|
||||
typedef struct _EXIT_PROCESS_DEBUG_INFO {
|
||||
DWORD dwExitCode;
|
||||
} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO;
|
||||
|
||||
typedef struct _LOAD_DLL_DEBUG_INFO {
|
||||
HANDLE hFile;
|
||||
LPVOID lpBaseOfDll;
|
||||
DWORD dwDebugInfoFileOffset;
|
||||
DWORD nDebugInfoSize;
|
||||
LPVOID lpImageName;
|
||||
WORD fUnicode;
|
||||
} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO;
|
||||
|
||||
typedef struct _UNLOAD_DLL_DEBUG_INFO {
|
||||
LPVOID lpBaseOfDll;
|
||||
} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO;
|
||||
|
||||
typedef struct _OUTPUT_DEBUG_STRING_INFO {
|
||||
LPSTR lpDebugStringData;
|
||||
WORD fUnicode;
|
||||
WORD nDebugStringLength;
|
||||
} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO;
|
||||
|
||||
typedef struct _RIP_INFO {
|
||||
DWORD dwError;
|
||||
DWORD dwType;
|
||||
} RIP_INFO, *LPRIP_INFO;
|
||||
|
||||
typedef union _TMP_UNION_DEBUG_INFO {
|
||||
EXCEPTION_DEBUG_INFO Exception;
|
||||
CREATE_THREAD_DEBUG_INFO CreateThread;
|
||||
CREATE_PROCESS_DEBUG_INFO CreateProcessInfo;
|
||||
EXIT_THREAD_DEBUG_INFO ExitThread;
|
||||
EXIT_PROCESS_DEBUG_INFO ExitProcess;
|
||||
LOAD_DLL_DEBUG_INFO LoadDll;
|
||||
UNLOAD_DLL_DEBUG_INFO UnloadDll;
|
||||
OUTPUT_DEBUG_STRING_INFO DebugString;
|
||||
RIP_INFO RipInfo;
|
||||
} TMP_UNION_DEBUG_INFO;
|
||||
|
||||
typedef struct _DEBUG_EVENT {
|
||||
DWORD dwDebugEventCode;
|
||||
DWORD dwProcessId;
|
||||
DWORD dwThreadId;
|
||||
_TMP_UNION_DEBUG_INFO u;
|
||||
} DEBUG_EVENT, *LPDEBUG_EVENT;
|
||||
@@ -0,0 +1,63 @@
|
||||
import windows
|
||||
import windows.winproxy as winproxy
|
||||
|
||||
import windows.native_exec.simple_x86 as x86
|
||||
import windows.native_exec.simple_x64 as x64
|
||||
|
||||
from windows.generated_def.winstructs import *
|
||||
from .generated_def import windef
|
||||
|
||||
|
||||
|
||||
|
||||
class DEBUG_EVENT(DEBUG_EVENT):
|
||||
KNOWN_EVENT_CODE = dict((x,x) for x in [EXCEPTION_DEBUG_EVENT,
|
||||
CREATE_THREAD_DEBUG_EVENT, CREATE_PROCESS_DEBUG_EVENT,
|
||||
EXIT_THREAD_DEBUG_EVENT, EXIT_PROCESS_DEBUG_EVENT, LOAD_DLL_DEBUG_EVENT,
|
||||
UNLOAD_DLL_DEBUG_EVENT, OUTPUT_DEBUG_STRING_EVENT, RIP_EVENT])
|
||||
|
||||
@property
|
||||
def code(self):
|
||||
return self.KNOWN_EVENT_CODE.get(self.dwDebugEventCode, self.dwDebugEventCode)
|
||||
|
||||
class Debugger(object):
|
||||
|
||||
#define EXCEPTION_DEBUG_EVENT 1
|
||||
#define CREATE_THREAD_DEBUG_EVENT 2
|
||||
#define CREATE_PROCESS_DEBUG_EVENT 3
|
||||
#define EXIT_THREAD_DEBUG_EVENT 4
|
||||
#define EXIT_PROCESS_DEBUG_EVENT 5
|
||||
#define LOAD_DLL_DEBUG_EVENT 6
|
||||
#define UNLOAD_DLL_DEBUG_EVENT 7
|
||||
#define OUTPUT_DEBUG_STRING_EVENT 8
|
||||
#define RIP_EVENT 9
|
||||
|
||||
|
||||
|
||||
def __init__(self, target):
|
||||
# Todo: accept PID / String / WinProcess
|
||||
self.target = target
|
||||
winproxy.DebugActiveProcess(target.pid)
|
||||
self._handle_initial_debug_event()
|
||||
|
||||
def _handle_initial_debug_event(self):
|
||||
pass
|
||||
|
||||
def _debug_event_generator(self):
|
||||
while True:
|
||||
debug_event = DEBUG_EVENT()
|
||||
winproxy.WaitForDebugEvent(debug_event)
|
||||
yield debug_event
|
||||
|
||||
def _finish_debug_event(self, event, action):
|
||||
if action not in [windef.DBG_CONTINUE, windef.DBG_EXCEPTION_NOT_HANDLED]:
|
||||
raise ValueError('Unknow action : <0>'.format(action))
|
||||
winproxy.ContinueDebugEvent(event.dwProcessId, event.dwThreadId, action)
|
||||
|
||||
def loop(self):
|
||||
for x, i in enumerate(self._debug_event_generator()):
|
||||
print(i, i.code)
|
||||
self._finish_debug_event(i, windef.DBG_CONTINUE)
|
||||
# TODO: exit on process exit
|
||||
if x == 100:
|
||||
break
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess']
|
||||
|
||||
# ExitProcess(uExitCode):
|
||||
ExitProcessPrototype = WINFUNCTYPE(VOID, UINT)
|
||||
@@ -453,3 +453,59 @@ GetClipboardFormatNameWParams = ((1, 'format'), (1, 'lpszFormatName'), (1, 'cchM
|
||||
WinVerifyTrustPrototype = WINFUNCTYPE(LONG, HWND, POINTER(GUID), LPVOID)
|
||||
WinVerifyTrustParams = ((1, 'hWnd'), (1, 'pgActionID'), (1, 'pWVTData'))
|
||||
|
||||
# OpenProcessToken(ProcessHandle, DesiredAccess, TokenHandle):
|
||||
OpenProcessTokenPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, PHANDLE)
|
||||
OpenProcessTokenParams = ((1, 'ProcessHandle'), (1, 'DesiredAccess'), (1, 'TokenHandle'))
|
||||
|
||||
# OpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle):
|
||||
OpenThreadTokenPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, BOOL, PHANDLE)
|
||||
OpenThreadTokenParams = ((1, 'ThreadHandle'), (1, 'DesiredAccess'), (1, 'OpenAsSelf'), (1, 'TokenHandle'))
|
||||
|
||||
# GetTokenInformation(TokenHandle, TokenInformationClass, TokenInformation, TokenInformationLength, ReturnLength):
|
||||
GetTokenInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD)
|
||||
GetTokenInformationParams = ((1, 'TokenHandle'), (1, 'TokenInformationClass'), (1, 'TokenInformation'), (1, 'TokenInformationLength'), (1, 'ReturnLength'))
|
||||
|
||||
# SetTokenInformation(TokenHandle, TokenInformationClass, TokenInformation, TokenInformationLength):
|
||||
SetTokenInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD)
|
||||
SetTokenInformationParams = ((1, 'TokenHandle'), (1, 'TokenInformationClass'), (1, 'TokenInformation'), (1, 'TokenInformationLength'))
|
||||
|
||||
# GetSidIdentifierAuthority(pSid):
|
||||
GetSidIdentifierAuthorityPrototype = WINFUNCTYPE(PSID_IDENTIFIER_AUTHORITY, PSID)
|
||||
GetSidIdentifierAuthorityParams = ((1, 'pSid'),)
|
||||
|
||||
# GetSidSubAuthority(pSid, nSubAuthority):
|
||||
GetSidSubAuthorityPrototype = WINFUNCTYPE(PDWORD, PSID, DWORD)
|
||||
GetSidSubAuthorityParams = ((1, 'pSid'), (1, 'nSubAuthority'))
|
||||
|
||||
# GetSidSubAuthorityCount(pSid):
|
||||
GetSidSubAuthorityCountPrototype = WINFUNCTYPE(PUCHAR, PSID)
|
||||
GetSidSubAuthorityCountParams = ((1, 'pSid'),)
|
||||
|
||||
# DebugBreak():
|
||||
DebugBreakPrototype = WINFUNCTYPE(VOID)
|
||||
DebugBreakParams = ()
|
||||
|
||||
# WaitForDebugEvent(lpDebugEvent, dwMilliseconds):
|
||||
WaitForDebugEventPrototype = WINFUNCTYPE(BOOL, LPDEBUG_EVENT, DWORD)
|
||||
WaitForDebugEventParams = ((1, 'lpDebugEvent'), (1, 'dwMilliseconds'))
|
||||
|
||||
# ContinueDebugEvent(dwProcessId, dwThreadId, dwContinueStatus):
|
||||
ContinueDebugEventPrototype = WINFUNCTYPE(BOOL, DWORD, DWORD, DWORD)
|
||||
ContinueDebugEventParams = ((1, 'dwProcessId'), (1, 'dwThreadId'), (1, 'dwContinueStatus'))
|
||||
|
||||
# DebugActiveProcess(dwProcessId):
|
||||
DebugActiveProcessPrototype = WINFUNCTYPE(BOOL, DWORD)
|
||||
DebugActiveProcessParams = ((1, 'dwProcessId'),)
|
||||
|
||||
# DebugActiveProcessStop(dwProcessId):
|
||||
DebugActiveProcessStopPrototype = WINFUNCTYPE(BOOL, DWORD)
|
||||
DebugActiveProcessStopParams = ((1, 'dwProcessId'),)
|
||||
|
||||
# DebugSetProcessKillOnExit(KillOnExit):
|
||||
DebugSetProcessKillOnExitPrototype = WINFUNCTYPE(BOOL, BOOL)
|
||||
DebugSetProcessKillOnExitParams = ((1, 'KillOnExit'),)
|
||||
|
||||
# DebugBreakProcess(Process):
|
||||
DebugBreakProcessPrototype = WINFUNCTYPE(BOOL, HANDLE)
|
||||
DebugBreakProcessParams = ((1, 'Process'),)
|
||||
|
||||
|
||||
@@ -18,8 +18,10 @@ LPBYTE = POINTER(BYTE)
|
||||
ULONG_PTR = PULONG
|
||||
CHAR = c_char
|
||||
UCHAR = c_char
|
||||
PUCHAR = POINTER(UCHAR)
|
||||
FARPROC = PVOID
|
||||
HGLOBAL = PVOID
|
||||
PSID = PVOID
|
||||
PVECTORED_EXCEPTION_HANDLER = PVOID
|
||||
ULONGLONG = c_ulonglong
|
||||
LONGLONG = c_longlong
|
||||
@@ -36,7 +38,7 @@ HCERTSTORE = PVOID
|
||||
HCRYPTMSG = PVOID
|
||||
VOID = DWORD
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
|
||||
@@ -1013,6 +1015,23 @@ class _TOKEN_ELEVATION(Structure):
|
||||
TOKEN_ELEVATION = _TOKEN_ELEVATION
|
||||
PTOKEN_ELEVATION = POINTER(_TOKEN_ELEVATION)
|
||||
|
||||
# Struct _SID_AND_ATTRIBUTES definitions
|
||||
class _SID_AND_ATTRIBUTES(Structure):
|
||||
_fields_ = [
|
||||
("Sid", PSID),
|
||||
("Attributes", DWORD),
|
||||
]
|
||||
SID_AND_ATTRIBUTES = _SID_AND_ATTRIBUTES
|
||||
PSID_AND_ATTRIBUTES = POINTER(_SID_AND_ATTRIBUTES)
|
||||
|
||||
# Struct _TOKEN_MANDATORY_LABEL definitions
|
||||
class _TOKEN_MANDATORY_LABEL(Structure):
|
||||
_fields_ = [
|
||||
("Label", SID_AND_ATTRIBUTES),
|
||||
]
|
||||
TOKEN_MANDATORY_LABEL = _TOKEN_MANDATORY_LABEL
|
||||
PTOKEN_MANDATORY_LABEL = POINTER(_TOKEN_MANDATORY_LABEL)
|
||||
|
||||
# Struct _OSVERSIONINFOA definitions
|
||||
class _OSVERSIONINFOA(Structure):
|
||||
_fields_ = [
|
||||
@@ -1895,3 +1914,129 @@ class _JIT_DEBUG_INFO(Structure):
|
||||
LPJIT_DEBUG_INFO = POINTER(_JIT_DEBUG_INFO)
|
||||
JIT_DEBUG_INFO = _JIT_DEBUG_INFO
|
||||
|
||||
# Struct _SID_IDENTIFIER_AUTHORITY definitions
|
||||
class _SID_IDENTIFIER_AUTHORITY(Structure):
|
||||
_fields_ = [
|
||||
("Value", BYTE * 6),
|
||||
]
|
||||
SID_IDENTIFIER_AUTHORITY = _SID_IDENTIFIER_AUTHORITY
|
||||
PSID_IDENTIFIER_AUTHORITY = POINTER(_SID_IDENTIFIER_AUTHORITY)
|
||||
|
||||
# Struct _EXCEPTION_DEBUG_INFO definitions
|
||||
class _EXCEPTION_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("ExceptionRecord", EXCEPTION_RECORD),
|
||||
("dwFirstChance", DWORD),
|
||||
]
|
||||
LPEXCEPTION_DEBUG_INFO = POINTER(_EXCEPTION_DEBUG_INFO)
|
||||
EXCEPTION_DEBUG_INFO = _EXCEPTION_DEBUG_INFO
|
||||
|
||||
# Struct _CREATE_THREAD_DEBUG_INFO definitions
|
||||
class _CREATE_THREAD_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("hThread", HANDLE),
|
||||
("lpThreadLocalBase", LPVOID),
|
||||
("lpStartAddress", LPTHREAD_START_ROUTINE),
|
||||
]
|
||||
LPCREATE_THREAD_DEBUG_INFO = POINTER(_CREATE_THREAD_DEBUG_INFO)
|
||||
CREATE_THREAD_DEBUG_INFO = _CREATE_THREAD_DEBUG_INFO
|
||||
|
||||
# Struct _CREATE_PROCESS_DEBUG_INFO definitions
|
||||
class _CREATE_PROCESS_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("hFile", HANDLE),
|
||||
("hProcess", HANDLE),
|
||||
("hThread", HANDLE),
|
||||
("lpBaseOfImage", LPVOID),
|
||||
("dwDebugInfoFileOffset", DWORD),
|
||||
("nDebugInfoSize", DWORD),
|
||||
("lpThreadLocalBase", LPVOID),
|
||||
("lpStartAddress", LPTHREAD_START_ROUTINE),
|
||||
("lpImageName", LPVOID),
|
||||
("fUnicode", WORD),
|
||||
]
|
||||
CREATE_PROCESS_DEBUG_INFO = _CREATE_PROCESS_DEBUG_INFO
|
||||
LPCREATE_PROCESS_DEBUG_INFO = POINTER(_CREATE_PROCESS_DEBUG_INFO)
|
||||
|
||||
# Struct _EXIT_THREAD_DEBUG_INFO definitions
|
||||
class _EXIT_THREAD_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwExitCode", DWORD),
|
||||
]
|
||||
EXIT_THREAD_DEBUG_INFO = _EXIT_THREAD_DEBUG_INFO
|
||||
LPEXIT_THREAD_DEBUG_INFO = POINTER(_EXIT_THREAD_DEBUG_INFO)
|
||||
|
||||
# Struct _EXIT_PROCESS_DEBUG_INFO definitions
|
||||
class _EXIT_PROCESS_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwExitCode", DWORD),
|
||||
]
|
||||
LPEXIT_PROCESS_DEBUG_INFO = POINTER(_EXIT_PROCESS_DEBUG_INFO)
|
||||
EXIT_PROCESS_DEBUG_INFO = _EXIT_PROCESS_DEBUG_INFO
|
||||
|
||||
# Struct _LOAD_DLL_DEBUG_INFO definitions
|
||||
class _LOAD_DLL_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("hFile", HANDLE),
|
||||
("lpBaseOfDll", LPVOID),
|
||||
("dwDebugInfoFileOffset", DWORD),
|
||||
("nDebugInfoSize", DWORD),
|
||||
("lpImageName", LPVOID),
|
||||
("fUnicode", WORD),
|
||||
]
|
||||
LPLOAD_DLL_DEBUG_INFO = POINTER(_LOAD_DLL_DEBUG_INFO)
|
||||
LOAD_DLL_DEBUG_INFO = _LOAD_DLL_DEBUG_INFO
|
||||
|
||||
# Struct _UNLOAD_DLL_DEBUG_INFO definitions
|
||||
class _UNLOAD_DLL_DEBUG_INFO(Structure):
|
||||
_fields_ = [
|
||||
("lpBaseOfDll", LPVOID),
|
||||
]
|
||||
UNLOAD_DLL_DEBUG_INFO = _UNLOAD_DLL_DEBUG_INFO
|
||||
LPUNLOAD_DLL_DEBUG_INFO = POINTER(_UNLOAD_DLL_DEBUG_INFO)
|
||||
|
||||
# Struct _OUTPUT_DEBUG_STRING_INFO definitions
|
||||
class _OUTPUT_DEBUG_STRING_INFO(Structure):
|
||||
_fields_ = [
|
||||
("lpDebugStringData", LPSTR),
|
||||
("fUnicode", WORD),
|
||||
("nDebugStringLength", WORD),
|
||||
]
|
||||
OUTPUT_DEBUG_STRING_INFO = _OUTPUT_DEBUG_STRING_INFO
|
||||
LPOUTPUT_DEBUG_STRING_INFO = POINTER(_OUTPUT_DEBUG_STRING_INFO)
|
||||
|
||||
# Struct _RIP_INFO definitions
|
||||
class _RIP_INFO(Structure):
|
||||
_fields_ = [
|
||||
("dwError", DWORD),
|
||||
("dwType", DWORD),
|
||||
]
|
||||
LPRIP_INFO = POINTER(_RIP_INFO)
|
||||
RIP_INFO = _RIP_INFO
|
||||
|
||||
# Struct _TMP_UNION_DEBUG_INFO definitions
|
||||
class _TMP_UNION_DEBUG_INFO(Union):
|
||||
_fields_ = [
|
||||
("Exception", EXCEPTION_DEBUG_INFO),
|
||||
("CreateThread", CREATE_THREAD_DEBUG_INFO),
|
||||
("CreateProcessInfo", CREATE_PROCESS_DEBUG_INFO),
|
||||
("ExitThread", EXIT_THREAD_DEBUG_INFO),
|
||||
("ExitProcess", EXIT_PROCESS_DEBUG_INFO),
|
||||
("LoadDll", LOAD_DLL_DEBUG_INFO),
|
||||
("UnloadDll", UNLOAD_DLL_DEBUG_INFO),
|
||||
("DebugString", OUTPUT_DEBUG_STRING_INFO),
|
||||
("RipInfo", RIP_INFO),
|
||||
]
|
||||
TMP_UNION_DEBUG_INFO = _TMP_UNION_DEBUG_INFO
|
||||
|
||||
# Struct _DEBUG_EVENT definitions
|
||||
class _DEBUG_EVENT(Structure):
|
||||
_fields_ = [
|
||||
("dwDebugEventCode", DWORD),
|
||||
("dwProcessId", DWORD),
|
||||
("dwThreadId", DWORD),
|
||||
("u", _TMP_UNION_DEBUG_INFO),
|
||||
]
|
||||
LPDEBUG_EVENT = POINTER(_DEBUG_EVENT)
|
||||
DEBUG_EVENT = _DEBUG_EVENT
|
||||
|
||||
|
||||
+45
-1
@@ -27,6 +27,8 @@ import windows.pe_parse as pe_parse
|
||||
|
||||
class AutoHandle(object):
|
||||
"""An abstract class that allow easy handle creation/destruction/wait"""
|
||||
# Big bypass to prevent missing reference at programm close..
|
||||
CLOSE_FUNCTION = ctypes.WinDLL("kernel32").CloseHandle
|
||||
def _get_handle(self):
|
||||
raise NotImplementedError("{0} is abstract".format(type(self).__name__))
|
||||
|
||||
@@ -50,7 +52,7 @@ class AutoHandle(object):
|
||||
|
||||
def __del__(self):
|
||||
if hasattr(self, "_handle") and self._handle:
|
||||
winproxy.CloseHandle(self._handle)
|
||||
self.CLOSE_FUNCTION(self._handle)
|
||||
|
||||
|
||||
class System(object):
|
||||
@@ -358,6 +360,13 @@ class Process(AutoHandle):
|
||||
return
|
||||
addr += x.RegionSize
|
||||
|
||||
@utils.fixedpropety
|
||||
def token(self):
|
||||
"""TODO: DOC"""
|
||||
token_handle = HANDLE()
|
||||
winproxy.OpenProcessToken(self.handle, TOKEN_ALL_ACCESS, byref(token_handle))
|
||||
return Token(token_handle.value)
|
||||
|
||||
|
||||
class CurrentThread(AutoHandle):
|
||||
"""The current thread"""
|
||||
@@ -663,6 +672,41 @@ class WinProcess(PROCESSENTRY32, Process):
|
||||
"""Exit the process"""
|
||||
return winproxy.TerminateProcess(self.handle, code)
|
||||
|
||||
# Create ProcessToken and Thread Token objects ?
|
||||
class Token(AutoHandle):
|
||||
def __init__(self, handle):
|
||||
self._handle = handle
|
||||
|
||||
@property
|
||||
def integrity(self):
|
||||
buffer_size = self.get_required_information_size(TokenIntegrityLevel)
|
||||
buffer = ctypes.c_buffer(buffer_size)
|
||||
self.get_informations(TokenIntegrityLevel, buffer)
|
||||
|
||||
sid = ctypes.cast(buffer, POINTER(TOKEN_MANDATORY_LABEL))[0].Label.Sid
|
||||
count = winproxy.GetSidSubAuthorityCount(sid)
|
||||
integrity = winproxy.GetSidSubAuthority(sid, ord(count[0]) - 1)[0]
|
||||
return integrity
|
||||
|
||||
@property
|
||||
def is_elevated(self):
|
||||
"""``True`` if process is Admin"""
|
||||
elevation = TOKEN_ELEVATION()
|
||||
self.get_informations(TokenElevation, elevation)
|
||||
return bool(elevation.TokenIsElevated)
|
||||
|
||||
def get_informations(self, info_type, data):
|
||||
cbsize = DWORD()
|
||||
winproxy.GetTokenInformation(self.handle, info_type, ctypes.byref(data), ctypes.sizeof(data), ctypes.byref(cbsize))
|
||||
return cbsize.value
|
||||
|
||||
def get_required_information_size(self, info_type):
|
||||
cbsize = DWORD()
|
||||
try:
|
||||
winproxy.GetTokenInformation(self.handle, info_type, None, 0, ctypes.byref(cbsize))
|
||||
except WindowsError:
|
||||
pass
|
||||
return cbsize.value
|
||||
|
||||
class LoadedModule(LDR_DATA_TABLE_ENTRY):
|
||||
"""An entry in the PEB Ldr list"""
|
||||
|
||||
+21
-1
@@ -461,6 +461,22 @@ def DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lp
|
||||
return DeviceIoControl.ctypes_function(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped)
|
||||
|
||||
|
||||
# Debug API
|
||||
|
||||
DebugBreak = TransparentKernel32Proxy("DebugBreak")
|
||||
ContinueDebugEvent = TransparentKernel32Proxy("ContinueDebugEvent")
|
||||
DebugActiveProcess = TransparentKernel32Proxy("DebugActiveProcess")
|
||||
DebugActiveProcessStop = TransparentKernel32Proxy("DebugActiveProcessStop")
|
||||
DebugSetProcessKillOnExit = TransparentKernel32Proxy("DebugSetProcessKillOnExit")
|
||||
DebugBreakProcess = TransparentKernel32Proxy("DebugBreakProcess")
|
||||
|
||||
@Kernel32Proxy("WaitForDebugEvent")
|
||||
def WaitForDebugEvent(lpDebugEvent, dwMilliseconds=INFINITE):
|
||||
return WaitForDebugEvent.ctypes_function(lpDebugEvent, dwMilliseconds)
|
||||
|
||||
|
||||
|
||||
|
||||
# ### NTDLL #### #
|
||||
|
||||
@OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus))
|
||||
@@ -553,7 +569,10 @@ def AdjustTokenPrivileges(TokenHandle, DisableAllPrivileges=False, NewState=Need
|
||||
return AdjustTokenPrivileges.ctypes_function(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength)
|
||||
|
||||
|
||||
# Registry stuff
|
||||
# Token stuff
|
||||
|
||||
GetSidSubAuthorityCount = TransparentAdvapi32Proxy("GetSidSubAuthorityCount")
|
||||
GetSidSubAuthority = TransparentAdvapi32Proxy("GetSidSubAuthority")
|
||||
|
||||
@Advapi32Proxy('GetTokenInformation')
|
||||
def GetTokenInformation(TokenHandle=NeededParameter, TokenInformationClass=NeededParameter, TokenInformation=None, TokenInformationLength=0, ReturnLength=None):
|
||||
@@ -566,6 +585,7 @@ def GetTokenInformation(TokenHandle=NeededParameter, TokenInformationClass=Neede
|
||||
def RegOpenKeyExA(hKey, lpSubKey, ulOptions, samDesired, phkResult):
|
||||
return RegOpenKeyExA.ctypes_function(hKey, lpSubKey, ulOptions, samDesired, phkResult)
|
||||
|
||||
# Registry stuff
|
||||
|
||||
# TODO: default values? which ones ?
|
||||
|
||||
|
||||
Reference in New Issue
Block a user