From 6b75fe3185944478590b4c270ae77d23f0aa820a Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Wed, 20 Jan 2016 19:07:18 +0100 Subject: [PATCH] Playing with Token and Debugger API --- ctypes_generation/func_parser.py | 34 +++---- ctypes_generation/generate.py | 2 + ctypes_generation/winfunc.txt | 74 +++++++++++++- ctypes_generation/winstruct.txt | 93 +++++++++++++++++- windows/debug.py | 63 ++++++++++++ windows/generated_def/winfuncs.py | 58 ++++++++++- windows/generated_def/winstructs.py | 147 +++++++++++++++++++++++++++- windows/winobject.py | 46 ++++++++- windows/winproxy.py | 22 ++++- 9 files changed, 516 insertions(+), 23 deletions(-) create mode 100644 windows/debug.py diff --git a/ctypes_generation/func_parser.py b/ctypes_generation/func_parser.py index 4444b0e..8949073 100644 --- a/ctypes_generation/func_parser.py +++ b/ctypes_generation/func_parser.py @@ -16,19 +16,19 @@ class WinFunc(object): def generate_ctypes(self): return self.generate_comment_ctypes() + "\n" + self.generate_prototype_ctypes() + "\n" + self.generate_paramflags_ctypes() + "\n" - + def generate_comment_ctypes(self): model = "# {0}({1}):" ctypes_param = [name for type, name in self.params] ctypes_param_str = ", ".join(ctypes_param) return model.format(self.name, ctypes_param_str) - + def generate_prototype_ctypes(self): model = "{0} = WINFUNCTYPE({1})" ctypes_param = [self.return_type] + [type for type, name in self.params] ctypes_param_str = ", ".join(ctypes_param) return model.format(self.name + "Prototype", ctypes_param_str) - + def generate_paramflags_ctypes(self): model = "{0} = {1}" ctypes_paramflags = tuple([(1, name) for type, name in self.params]) @@ -37,14 +37,14 @@ class WinFunc(object): class WinFuncParser(Parser): - known_io_info_type = ["__in", "__in_opt", "_In_", "_In_opt_", "_Inout_", "_Out_opt_", "_Out_", "_Reserved_", "_Inout_opt_", "__inout_opt", "__out", "__inout"] + known_io_info_type = ["__in", "__in_opt", "_In_", "_In_opt_", "_Inout_", "_Out_opt_", "_Out_", "_Reserved_", "_Inout_opt_", "__inout_opt", "__out", "__inout", "__deref_out"] def assert_argument_io_info(self): io_info = self.assert_token_type(NameToken) if io_info.value not in self.known_io_info_type: raise ParsingError("Was expection IO_INFO got {0} instead".format(io_info)) return io_info - + def parse_func_arg(self, has_winapi): type_ptr = False if has_winapi: @@ -52,23 +52,23 @@ class WinFuncParser(Parser): arg_type = self.assert_token_type(NameToken) if arg_type.value.upper() == "CONST": arg_type = self.assert_token_type(NameToken) - + if type(self.peek()) == StarToken: type_ptr = True - self.assert_token_type(StarToken) + self.assert_token_type(StarToken) arg_name = self.assert_token_type(NameToken) if not type(self.peek()) == CloseParenthesisToken: self.assert_token_type(CommaToken) if not type_ptr: return (arg_type.value, arg_name.value) return ("POINTER({0})".format(arg_type.value), arg_name.value) - + def assert_winapi_token(self): winapi = self.assert_token_type(NameToken) if winapi.value != "WINAPI": raise ParsingError("Was expection NameToken(WINAPI) got {0} instead".format(winapi)) - return winapi - + return winapi + def parse_winfunc(self): has_winapi = False try: @@ -80,7 +80,7 @@ class WinFuncParser(Parser): if func_name.upper() == "WINAPI": has_winapi = True func_name = self.assert_token_type(NameToken).value - + self.assert_token_type(OpenParenthesisToken) params = [] @@ -96,9 +96,9 @@ class WinFuncParser(Parser): while self.peek() is not None: res.append(self.parse_winfunc()) return res - - - + + + def dbg_lexer(data): for i in Lexer(data).token_generation(): @@ -109,11 +109,11 @@ def dbg_parser(data): def dbg_validate(data): return validate_structs(Parser(data).parse()) - - + + if __name__ == "__main__": import sys data = open(sys.argv[1], 'r').read() funcs = generate_ctypes(data) - print(funcs) + print(funcs) diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py index 388bd59..eead896 100644 --- a/ctypes_generation/generate.py +++ b/ctypes_generation/generate.py @@ -24,8 +24,10 @@ TYPE_EQUIVALENCE = [ ('ULONG_PTR','PULONG'), ('CHAR', 'c_char'), ('UCHAR', 'c_char'), + ('PUCHAR', 'POINTER(UCHAR)'), ('FARPROC', 'PVOID'), ('HGLOBAL', 'PVOID'), + ('PSID', 'PVOID'), ('PVECTORED_EXCEPTION_HANDLER', 'PVOID'), #('HRESULT', 'c_long'), # VERY BAD : real HRESULT raise by itself -> way better ('ULONGLONG', 'c_ulonglong'), diff --git a/ctypes_generation/winfunc.txt b/ctypes_generation/winfunc.txt index 61a2157..2bb118f 100644 --- a/ctypes_generation/winfunc.txt +++ b/ctypes_generation/winfunc.txt @@ -653,4 +653,76 @@ LONG WINAPI WinVerifyTrust( _In_ HWND hWnd, _In_ GUID *pgActionID, _In_ LPVOID pWVTData -); \ No newline at end of file +); + +BOOL WINAPI OpenProcessToken ( + __in HANDLE ProcessHandle, + __in DWORD DesiredAccess, + __deref_out PHANDLE TokenHandle +); + +BOOL WINAPI OpenThreadToken ( + __in HANDLE ThreadHandle, + __in DWORD DesiredAccess, + __in BOOL OpenAsSelf, + __deref_out PHANDLE TokenHandle +); + + +BOOL WINAPI GetTokenInformation ( + __in HANDLE TokenHandle, + __in TOKEN_INFORMATION_CLASS TokenInformationClass, + __out LPVOID TokenInformation, + __in DWORD TokenInformationLength, + __out PDWORD ReturnLength +); + +BOOL WINAPI SetTokenInformation ( + __in HANDLE TokenHandle, + __in TOKEN_INFORMATION_CLASS TokenInformationClass, + __in LPVOID TokenInformation, + __in DWORD TokenInformationLength +); + +PSID_IDENTIFIER_AUTHORITY WINAPI GetSidIdentifierAuthority ( + __in PSID pSid + ); + +PDWORD WINAPI GetSidSubAuthority ( + __in PSID pSid, + __in DWORD nSubAuthority + ); + +PUCHAR WINAPI GetSidSubAuthorityCount ( + __in PSID pSid + ); + + +VOID DebugBreak(); + +BOOL WINAPI WaitForDebugEvent( + __in LPDEBUG_EVENT lpDebugEvent, + __in DWORD dwMilliseconds + ); + +BOOL WINAPI ContinueDebugEvent( + __in DWORD dwProcessId, + __in DWORD dwThreadId, + __in DWORD dwContinueStatus + ); + +BOOL WINAPI DebugActiveProcess( + __in DWORD dwProcessId + ); + +BOOL WINAPI DebugActiveProcessStop( + __in DWORD dwProcessId + ); + +BOOL WINAPI DebugSetProcessKillOnExit( + __in BOOL KillOnExit + ); + +BOOL WINAPI DebugBreakProcess ( + __in HANDLE Process + ); \ No newline at end of file diff --git a/ctypes_generation/winstruct.txt b/ctypes_generation/winstruct.txt index 2daa6af..acbb521 100644 --- a/ctypes_generation/winstruct.txt +++ b/ctypes_generation/winstruct.txt @@ -798,6 +798,17 @@ typedef struct _TOKEN_ELEVATION { DWORD TokenIsElevated; } TOKEN_ELEVATION, *PTOKEN_ELEVATION; +typedef struct _SID_AND_ATTRIBUTES { + PSID Sid; + DWORD Attributes; +} SID_AND_ATTRIBUTES, * PSID_AND_ATTRIBUTES; + +typedef struct _TOKEN_MANDATORY_LABEL { + SID_AND_ATTRIBUTES Label; +} TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL; + + + typedef struct _OSVERSIONINFOA { DWORD dwOSVersionInfoSize; DWORD dwMajorVersion; @@ -1469,4 +1480,84 @@ typedef struct _JIT_DEBUG_INFO { ULONG64 lpExceptionAddress; ULONG64 lpExceptionRecord; ULONG64 lpContextRecord; -} JIT_DEBUG_INFO, *LPJIT_DEBUG_INFO; \ No newline at end of file +} JIT_DEBUG_INFO, *LPJIT_DEBUG_INFO; + +typedef struct _SID_IDENTIFIER_AUTHORITY { + BYTE Value[6]; +} SID_IDENTIFIER_AUTHORITY, *PSID_IDENTIFIER_AUTHORITY; + +typedef struct _EXCEPTION_DEBUG_INFO { + EXCEPTION_RECORD ExceptionRecord; + DWORD dwFirstChance; +} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO; + +typedef struct _CREATE_THREAD_DEBUG_INFO { + HANDLE hThread; + LPVOID lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; +} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO; + +typedef struct _CREATE_PROCESS_DEBUG_INFO { + HANDLE hFile; + HANDLE hProcess; + HANDLE hThread; + LPVOID lpBaseOfImage; + DWORD dwDebugInfoFileOffset; + DWORD nDebugInfoSize; + LPVOID lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; + LPVOID lpImageName; + WORD fUnicode; +} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO; + + +typedef struct _EXIT_THREAD_DEBUG_INFO { + DWORD dwExitCode; +} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO; + +typedef struct _EXIT_PROCESS_DEBUG_INFO { + DWORD dwExitCode; +} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO; + +typedef struct _LOAD_DLL_DEBUG_INFO { + HANDLE hFile; + LPVOID lpBaseOfDll; + DWORD dwDebugInfoFileOffset; + DWORD nDebugInfoSize; + LPVOID lpImageName; + WORD fUnicode; +} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO; + +typedef struct _UNLOAD_DLL_DEBUG_INFO { + LPVOID lpBaseOfDll; +} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO; + +typedef struct _OUTPUT_DEBUG_STRING_INFO { + LPSTR lpDebugStringData; + WORD fUnicode; + WORD nDebugStringLength; +} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO; + +typedef struct _RIP_INFO { + DWORD dwError; + DWORD dwType; +} RIP_INFO, *LPRIP_INFO; + +typedef union _TMP_UNION_DEBUG_INFO { + EXCEPTION_DEBUG_INFO Exception; + CREATE_THREAD_DEBUG_INFO CreateThread; + CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; + EXIT_THREAD_DEBUG_INFO ExitThread; + EXIT_PROCESS_DEBUG_INFO ExitProcess; + LOAD_DLL_DEBUG_INFO LoadDll; + UNLOAD_DLL_DEBUG_INFO UnloadDll; + OUTPUT_DEBUG_STRING_INFO DebugString; + RIP_INFO RipInfo; +} TMP_UNION_DEBUG_INFO; + +typedef struct _DEBUG_EVENT { + DWORD dwDebugEventCode; + DWORD dwProcessId; + DWORD dwThreadId; + _TMP_UNION_DEBUG_INFO u; +} DEBUG_EVENT, *LPDEBUG_EVENT; \ No newline at end of file diff --git a/windows/debug.py b/windows/debug.py new file mode 100644 index 0000000..b8dc170 --- /dev/null +++ b/windows/debug.py @@ -0,0 +1,63 @@ +import windows +import windows.winproxy as winproxy + +import windows.native_exec.simple_x86 as x86 +import windows.native_exec.simple_x64 as x64 + +from windows.generated_def.winstructs import * +from .generated_def import windef + + + + +class DEBUG_EVENT(DEBUG_EVENT): + KNOWN_EVENT_CODE = dict((x,x) for x in [EXCEPTION_DEBUG_EVENT, + CREATE_THREAD_DEBUG_EVENT, CREATE_PROCESS_DEBUG_EVENT, + EXIT_THREAD_DEBUG_EVENT, EXIT_PROCESS_DEBUG_EVENT, LOAD_DLL_DEBUG_EVENT, + UNLOAD_DLL_DEBUG_EVENT, OUTPUT_DEBUG_STRING_EVENT, RIP_EVENT]) + + @property + def code(self): + return self.KNOWN_EVENT_CODE.get(self.dwDebugEventCode, self.dwDebugEventCode) + +class Debugger(object): + +#define EXCEPTION_DEBUG_EVENT 1 +#define CREATE_THREAD_DEBUG_EVENT 2 +#define CREATE_PROCESS_DEBUG_EVENT 3 +#define EXIT_THREAD_DEBUG_EVENT 4 +#define EXIT_PROCESS_DEBUG_EVENT 5 +#define LOAD_DLL_DEBUG_EVENT 6 +#define UNLOAD_DLL_DEBUG_EVENT 7 +#define OUTPUT_DEBUG_STRING_EVENT 8 +#define RIP_EVENT 9 + + + + def __init__(self, target): + # Todo: accept PID / String / WinProcess + self.target = target + winproxy.DebugActiveProcess(target.pid) + self._handle_initial_debug_event() + + def _handle_initial_debug_event(self): + pass + + def _debug_event_generator(self): + while True: + debug_event = DEBUG_EVENT() + winproxy.WaitForDebugEvent(debug_event) + yield debug_event + + def _finish_debug_event(self, event, action): + if action not in [windef.DBG_CONTINUE, windef.DBG_EXCEPTION_NOT_HANDLED]: + raise ValueError('Unknow action : <0>'.format(action)) + winproxy.ContinueDebugEvent(event.dwProcessId, event.dwThreadId, action) + + def loop(self): + for x, i in enumerate(self._debug_event_generator()): + print(i, i.code) + self._finish_debug_event(i, windef.DBG_CONTINUE) + # TODO: exit on process exit + if x == 100: + break diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 3f051cf..cdbda73 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -453,3 +453,59 @@ GetClipboardFormatNameWParams = ((1, 'format'), (1, 'lpszFormatName'), (1, 'cchM WinVerifyTrustPrototype = WINFUNCTYPE(LONG, HWND, POINTER(GUID), LPVOID) WinVerifyTrustParams = ((1, 'hWnd'), (1, 'pgActionID'), (1, 'pWVTData')) +# OpenProcessToken(ProcessHandle, DesiredAccess, TokenHandle): +OpenProcessTokenPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, PHANDLE) +OpenProcessTokenParams = ((1, 'ProcessHandle'), (1, 'DesiredAccess'), (1, 'TokenHandle')) + +# OpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle): +OpenThreadTokenPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, BOOL, PHANDLE) +OpenThreadTokenParams = ((1, 'ThreadHandle'), (1, 'DesiredAccess'), (1, 'OpenAsSelf'), (1, 'TokenHandle')) + +# GetTokenInformation(TokenHandle, TokenInformationClass, TokenInformation, TokenInformationLength, ReturnLength): +GetTokenInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD, PDWORD) +GetTokenInformationParams = ((1, 'TokenHandle'), (1, 'TokenInformationClass'), (1, 'TokenInformation'), (1, 'TokenInformationLength'), (1, 'ReturnLength')) + +# SetTokenInformation(TokenHandle, TokenInformationClass, TokenInformation, TokenInformationLength): +SetTokenInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, TOKEN_INFORMATION_CLASS, LPVOID, DWORD) +SetTokenInformationParams = ((1, 'TokenHandle'), (1, 'TokenInformationClass'), (1, 'TokenInformation'), (1, 'TokenInformationLength')) + +# GetSidIdentifierAuthority(pSid): +GetSidIdentifierAuthorityPrototype = WINFUNCTYPE(PSID_IDENTIFIER_AUTHORITY, PSID) +GetSidIdentifierAuthorityParams = ((1, 'pSid'),) + +# GetSidSubAuthority(pSid, nSubAuthority): +GetSidSubAuthorityPrototype = WINFUNCTYPE(PDWORD, PSID, DWORD) +GetSidSubAuthorityParams = ((1, 'pSid'), (1, 'nSubAuthority')) + +# GetSidSubAuthorityCount(pSid): +GetSidSubAuthorityCountPrototype = WINFUNCTYPE(PUCHAR, PSID) +GetSidSubAuthorityCountParams = ((1, 'pSid'),) + +# DebugBreak(): +DebugBreakPrototype = WINFUNCTYPE(VOID) +DebugBreakParams = () + +# WaitForDebugEvent(lpDebugEvent, dwMilliseconds): +WaitForDebugEventPrototype = WINFUNCTYPE(BOOL, LPDEBUG_EVENT, DWORD) +WaitForDebugEventParams = ((1, 'lpDebugEvent'), (1, 'dwMilliseconds')) + +# ContinueDebugEvent(dwProcessId, dwThreadId, dwContinueStatus): +ContinueDebugEventPrototype = WINFUNCTYPE(BOOL, DWORD, DWORD, DWORD) +ContinueDebugEventParams = ((1, 'dwProcessId'), (1, 'dwThreadId'), (1, 'dwContinueStatus')) + +# DebugActiveProcess(dwProcessId): +DebugActiveProcessPrototype = WINFUNCTYPE(BOOL, DWORD) +DebugActiveProcessParams = ((1, 'dwProcessId'),) + +# DebugActiveProcessStop(dwProcessId): +DebugActiveProcessStopPrototype = WINFUNCTYPE(BOOL, DWORD) +DebugActiveProcessStopParams = ((1, 'dwProcessId'),) + +# DebugSetProcessKillOnExit(KillOnExit): +DebugSetProcessKillOnExitPrototype = WINFUNCTYPE(BOOL, BOOL) +DebugSetProcessKillOnExitParams = ((1, 'KillOnExit'),) + +# DebugBreakProcess(Process): +DebugBreakProcessPrototype = WINFUNCTYPE(BOOL, HANDLE) +DebugBreakProcessParams = ((1, 'Process'),) + diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index f1f6726..00278df 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -18,8 +18,10 @@ LPBYTE = POINTER(BYTE) ULONG_PTR = PULONG CHAR = c_char UCHAR = c_char +PUCHAR = POINTER(UCHAR) FARPROC = PVOID HGLOBAL = PVOID +PSID = PVOID PVECTORED_EXCEPTION_HANDLER = PVOID ULONGLONG = c_ulonglong LONGLONG = c_longlong @@ -36,7 +38,7 @@ HCERTSTORE = PVOID HCRYPTMSG = PVOID VOID = DWORD -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT'] enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] @@ -1013,6 +1015,23 @@ class _TOKEN_ELEVATION(Structure): TOKEN_ELEVATION = _TOKEN_ELEVATION PTOKEN_ELEVATION = POINTER(_TOKEN_ELEVATION) +# Struct _SID_AND_ATTRIBUTES definitions +class _SID_AND_ATTRIBUTES(Structure): + _fields_ = [ + ("Sid", PSID), + ("Attributes", DWORD), + ] +SID_AND_ATTRIBUTES = _SID_AND_ATTRIBUTES +PSID_AND_ATTRIBUTES = POINTER(_SID_AND_ATTRIBUTES) + +# Struct _TOKEN_MANDATORY_LABEL definitions +class _TOKEN_MANDATORY_LABEL(Structure): + _fields_ = [ + ("Label", SID_AND_ATTRIBUTES), + ] +TOKEN_MANDATORY_LABEL = _TOKEN_MANDATORY_LABEL +PTOKEN_MANDATORY_LABEL = POINTER(_TOKEN_MANDATORY_LABEL) + # Struct _OSVERSIONINFOA definitions class _OSVERSIONINFOA(Structure): _fields_ = [ @@ -1895,3 +1914,129 @@ class _JIT_DEBUG_INFO(Structure): LPJIT_DEBUG_INFO = POINTER(_JIT_DEBUG_INFO) JIT_DEBUG_INFO = _JIT_DEBUG_INFO +# Struct _SID_IDENTIFIER_AUTHORITY definitions +class _SID_IDENTIFIER_AUTHORITY(Structure): + _fields_ = [ + ("Value", BYTE * 6), + ] +SID_IDENTIFIER_AUTHORITY = _SID_IDENTIFIER_AUTHORITY +PSID_IDENTIFIER_AUTHORITY = POINTER(_SID_IDENTIFIER_AUTHORITY) + +# Struct _EXCEPTION_DEBUG_INFO definitions +class _EXCEPTION_DEBUG_INFO(Structure): + _fields_ = [ + ("ExceptionRecord", EXCEPTION_RECORD), + ("dwFirstChance", DWORD), + ] +LPEXCEPTION_DEBUG_INFO = POINTER(_EXCEPTION_DEBUG_INFO) +EXCEPTION_DEBUG_INFO = _EXCEPTION_DEBUG_INFO + +# Struct _CREATE_THREAD_DEBUG_INFO definitions +class _CREATE_THREAD_DEBUG_INFO(Structure): + _fields_ = [ + ("hThread", HANDLE), + ("lpThreadLocalBase", LPVOID), + ("lpStartAddress", LPTHREAD_START_ROUTINE), + ] +LPCREATE_THREAD_DEBUG_INFO = POINTER(_CREATE_THREAD_DEBUG_INFO) +CREATE_THREAD_DEBUG_INFO = _CREATE_THREAD_DEBUG_INFO + +# Struct _CREATE_PROCESS_DEBUG_INFO definitions +class _CREATE_PROCESS_DEBUG_INFO(Structure): + _fields_ = [ + ("hFile", HANDLE), + ("hProcess", HANDLE), + ("hThread", HANDLE), + ("lpBaseOfImage", LPVOID), + ("dwDebugInfoFileOffset", DWORD), + ("nDebugInfoSize", DWORD), + ("lpThreadLocalBase", LPVOID), + ("lpStartAddress", LPTHREAD_START_ROUTINE), + ("lpImageName", LPVOID), + ("fUnicode", WORD), + ] +CREATE_PROCESS_DEBUG_INFO = _CREATE_PROCESS_DEBUG_INFO +LPCREATE_PROCESS_DEBUG_INFO = POINTER(_CREATE_PROCESS_DEBUG_INFO) + +# Struct _EXIT_THREAD_DEBUG_INFO definitions +class _EXIT_THREAD_DEBUG_INFO(Structure): + _fields_ = [ + ("dwExitCode", DWORD), + ] +EXIT_THREAD_DEBUG_INFO = _EXIT_THREAD_DEBUG_INFO +LPEXIT_THREAD_DEBUG_INFO = POINTER(_EXIT_THREAD_DEBUG_INFO) + +# Struct _EXIT_PROCESS_DEBUG_INFO definitions +class _EXIT_PROCESS_DEBUG_INFO(Structure): + _fields_ = [ + ("dwExitCode", DWORD), + ] +LPEXIT_PROCESS_DEBUG_INFO = POINTER(_EXIT_PROCESS_DEBUG_INFO) +EXIT_PROCESS_DEBUG_INFO = _EXIT_PROCESS_DEBUG_INFO + +# Struct _LOAD_DLL_DEBUG_INFO definitions +class _LOAD_DLL_DEBUG_INFO(Structure): + _fields_ = [ + ("hFile", HANDLE), + ("lpBaseOfDll", LPVOID), + ("dwDebugInfoFileOffset", DWORD), + ("nDebugInfoSize", DWORD), + ("lpImageName", LPVOID), + ("fUnicode", WORD), + ] +LPLOAD_DLL_DEBUG_INFO = POINTER(_LOAD_DLL_DEBUG_INFO) +LOAD_DLL_DEBUG_INFO = _LOAD_DLL_DEBUG_INFO + +# Struct _UNLOAD_DLL_DEBUG_INFO definitions +class _UNLOAD_DLL_DEBUG_INFO(Structure): + _fields_ = [ + ("lpBaseOfDll", LPVOID), + ] +UNLOAD_DLL_DEBUG_INFO = _UNLOAD_DLL_DEBUG_INFO +LPUNLOAD_DLL_DEBUG_INFO = POINTER(_UNLOAD_DLL_DEBUG_INFO) + +# Struct _OUTPUT_DEBUG_STRING_INFO definitions +class _OUTPUT_DEBUG_STRING_INFO(Structure): + _fields_ = [ + ("lpDebugStringData", LPSTR), + ("fUnicode", WORD), + ("nDebugStringLength", WORD), + ] +OUTPUT_DEBUG_STRING_INFO = _OUTPUT_DEBUG_STRING_INFO +LPOUTPUT_DEBUG_STRING_INFO = POINTER(_OUTPUT_DEBUG_STRING_INFO) + +# Struct _RIP_INFO definitions +class _RIP_INFO(Structure): + _fields_ = [ + ("dwError", DWORD), + ("dwType", DWORD), + ] +LPRIP_INFO = POINTER(_RIP_INFO) +RIP_INFO = _RIP_INFO + +# Struct _TMP_UNION_DEBUG_INFO definitions +class _TMP_UNION_DEBUG_INFO(Union): + _fields_ = [ + ("Exception", EXCEPTION_DEBUG_INFO), + ("CreateThread", CREATE_THREAD_DEBUG_INFO), + ("CreateProcessInfo", CREATE_PROCESS_DEBUG_INFO), + ("ExitThread", EXIT_THREAD_DEBUG_INFO), + ("ExitProcess", EXIT_PROCESS_DEBUG_INFO), + ("LoadDll", LOAD_DLL_DEBUG_INFO), + ("UnloadDll", UNLOAD_DLL_DEBUG_INFO), + ("DebugString", OUTPUT_DEBUG_STRING_INFO), + ("RipInfo", RIP_INFO), + ] +TMP_UNION_DEBUG_INFO = _TMP_UNION_DEBUG_INFO + +# Struct _DEBUG_EVENT definitions +class _DEBUG_EVENT(Structure): + _fields_ = [ + ("dwDebugEventCode", DWORD), + ("dwProcessId", DWORD), + ("dwThreadId", DWORD), + ("u", _TMP_UNION_DEBUG_INFO), + ] +LPDEBUG_EVENT = POINTER(_DEBUG_EVENT) +DEBUG_EVENT = _DEBUG_EVENT + diff --git a/windows/winobject.py b/windows/winobject.py index 92752d9..d17447f 100644 --- a/windows/winobject.py +++ b/windows/winobject.py @@ -27,6 +27,8 @@ import windows.pe_parse as pe_parse class AutoHandle(object): """An abstract class that allow easy handle creation/destruction/wait""" + # Big bypass to prevent missing reference at programm close.. + CLOSE_FUNCTION = ctypes.WinDLL("kernel32").CloseHandle def _get_handle(self): raise NotImplementedError("{0} is abstract".format(type(self).__name__)) @@ -50,7 +52,7 @@ class AutoHandle(object): def __del__(self): if hasattr(self, "_handle") and self._handle: - winproxy.CloseHandle(self._handle) + self.CLOSE_FUNCTION(self._handle) class System(object): @@ -358,6 +360,13 @@ class Process(AutoHandle): return addr += x.RegionSize + @utils.fixedpropety + def token(self): + """TODO: DOC""" + token_handle = HANDLE() + winproxy.OpenProcessToken(self.handle, TOKEN_ALL_ACCESS, byref(token_handle)) + return Token(token_handle.value) + class CurrentThread(AutoHandle): """The current thread""" @@ -663,6 +672,41 @@ class WinProcess(PROCESSENTRY32, Process): """Exit the process""" return winproxy.TerminateProcess(self.handle, code) +# Create ProcessToken and Thread Token objects ? +class Token(AutoHandle): + def __init__(self, handle): + self._handle = handle + + @property + def integrity(self): + buffer_size = self.get_required_information_size(TokenIntegrityLevel) + buffer = ctypes.c_buffer(buffer_size) + self.get_informations(TokenIntegrityLevel, buffer) + + sid = ctypes.cast(buffer, POINTER(TOKEN_MANDATORY_LABEL))[0].Label.Sid + count = winproxy.GetSidSubAuthorityCount(sid) + integrity = winproxy.GetSidSubAuthority(sid, ord(count[0]) - 1)[0] + return integrity + + @property + def is_elevated(self): + """``True`` if process is Admin""" + elevation = TOKEN_ELEVATION() + self.get_informations(TokenElevation, elevation) + return bool(elevation.TokenIsElevated) + + def get_informations(self, info_type, data): + cbsize = DWORD() + winproxy.GetTokenInformation(self.handle, info_type, ctypes.byref(data), ctypes.sizeof(data), ctypes.byref(cbsize)) + return cbsize.value + + def get_required_information_size(self, info_type): + cbsize = DWORD() + try: + winproxy.GetTokenInformation(self.handle, info_type, None, 0, ctypes.byref(cbsize)) + except WindowsError: + pass + return cbsize.value class LoadedModule(LDR_DATA_TABLE_ENTRY): """An entry in the PEB Ldr list""" diff --git a/windows/winproxy.py b/windows/winproxy.py index a1d1672..ca1adfe 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -461,6 +461,22 @@ def DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lp return DeviceIoControl.ctypes_function(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped) +# Debug API + +DebugBreak = TransparentKernel32Proxy("DebugBreak") +ContinueDebugEvent = TransparentKernel32Proxy("ContinueDebugEvent") +DebugActiveProcess = TransparentKernel32Proxy("DebugActiveProcess") +DebugActiveProcessStop = TransparentKernel32Proxy("DebugActiveProcessStop") +DebugSetProcessKillOnExit = TransparentKernel32Proxy("DebugSetProcessKillOnExit") +DebugBreakProcess = TransparentKernel32Proxy("DebugBreakProcess") + +@Kernel32Proxy("WaitForDebugEvent") +def WaitForDebugEvent(lpDebugEvent, dwMilliseconds=INFINITE): + return WaitForDebugEvent.ctypes_function(lpDebugEvent, dwMilliseconds) + + + + # ### NTDLL #### # @OptionalExport(NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus)) @@ -553,7 +569,10 @@ def AdjustTokenPrivileges(TokenHandle, DisableAllPrivileges=False, NewState=Need return AdjustTokenPrivileges.ctypes_function(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength) -# Registry stuff +# Token stuff + +GetSidSubAuthorityCount = TransparentAdvapi32Proxy("GetSidSubAuthorityCount") +GetSidSubAuthority = TransparentAdvapi32Proxy("GetSidSubAuthority") @Advapi32Proxy('GetTokenInformation') def GetTokenInformation(TokenHandle=NeededParameter, TokenInformationClass=NeededParameter, TokenInformation=None, TokenInformationLength=0, ReturnLength=None): @@ -566,6 +585,7 @@ def GetTokenInformation(TokenHandle=NeededParameter, TokenInformationClass=Neede def RegOpenKeyExA(hKey, lpSubKey, ulOptions, samDesired, phkResult): return RegOpenKeyExA.ctypes_function(hKey, lpSubKey, ulOptions, samDesired, phkResult) + # Registry stuff # TODO: default values? which ones ?