diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 5566617..3202c30 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -570,6 +570,12 @@ class Thread(utils.AutoHandle): class CurrentThread(Thread): """The current thread""" + get_teb_code_by_bitness = { + 32: x86.assemble("mov eax, fs:[0x18]; ret"), + 64: x64.assemble("mov rax, gs:[0x30]; ret") + + } + @property #It's not a fixedproperty because executing thread might change def tid(self): """Thread ID @@ -578,7 +584,14 @@ class CurrentThread(Thread): """ return winproxy.GetCurrentThreadId() + @utils.fixedproperty + def teb_base(self): + get_teb_base_code = self.get_teb_code_by_bitness[self.owner.bitness] + return self.owner.execute(get_teb_base_code) + @property + def teb(self): + return TEB.from_address(self.teb_base) @property def owner(self): @@ -884,6 +897,10 @@ class WinThread(Thread): # TebBase->NtTib.ExceptionList = (PVOID)Teb32Base; return self.owner.read_dword(main_teb_addr) + @property + def teb(self): + return RemoteTEB(self.teb_base, target=self.owner) + @property def teb_syswow_base(self): """The address of the thread's TEB64 for a SysWow64 process @@ -895,6 +912,9 @@ class WinThread(Thread): # just return the main TEB return self._get_principal_teb_addr() + @property + def teb_syswow(self): + return TEB64.from_address(self.teb_syswow_base) def exit(self, code=0): @@ -1321,6 +1341,14 @@ class PEB(gdef.PEB): raise NotImplementedError("ApiSetMap does not exist prior to Windows 7") return apisetmap.get_api_set_map_for_current_process(self.ApiSetMap) +# TEB enhanced, same bitness as PEB (current process) +class TEB(gdef.TEB): + def peb(self): + return ctypes.cast(self.ProcessEnvironmentBlock, ctypes.POINTER(PEB))[0] + +class RemoteTEB(rctypes.RemoteStructure.from_structure(TEB)): + def peb(self): + return ctypes.cast(self.ProcessEnvironmentBlock, ctypes.POINTER(PEB))[0] # Memory stuff @@ -1435,6 +1463,7 @@ class RemotePEB(rctypes.RemoteStructure.from_structure(PEB)): + if CurrentProcess().bitness == 32: class RemoteLoadedModule64(rctypes.transform_type_to_remote64bits(LoadedModule)): @property