diff --git a/dbgprint.py b/dbgprint.py index abef5f9..1b75584 100644 --- a/dbgprint.py +++ b/dbgprint.py @@ -40,4 +40,6 @@ try: else: dbgprint = do_nothing except Exception as e: - print("dbgprint Error: {0}({1})".format(type(e), e)) \ No newline at end of file + dbgprint = do_nothing + print("dbgprint Error: {0}({1})".format(type(e), e)) + x = type(e), e \ No newline at end of file diff --git a/generated_def/winfuncs.py b/generated_def/winfuncs.py index e6477af..61bde23 100644 --- a/generated_def/winfuncs.py +++ b/generated_def/winfuncs.py @@ -3,12 +3,16 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) ExitProcessParams = ((1, 'uExitCode'),) +# TerminateProcess(hProcess, uExitCode): +TerminateProcessPrototype = WINFUNCTYPE(BOOL, HANDLE, UINT) +TerminateProcessParams = ((1, 'hProcess'), (1, 'uExitCode')) + # GetLastError(): GetLastErrorPrototype = WINFUNCTYPE(DWORD) GetLastErrorParams = () @@ -217,6 +221,10 @@ GetCurrentProcessorNumberParams = () AllocConsolePrototype = WINFUNCTYPE(BOOL) AllocConsoleParams = () +# FreeConsole(): +FreeConsolePrototype = WINFUNCTYPE(BOOL) +FreeConsoleParams = () + # GetStdHandle(nStdHandle): GetStdHandlePrototype = WINFUNCTYPE(HANDLE, DWORD) GetStdHandleParams = ((1, 'nStdHandle'),) @@ -337,3 +345,15 @@ RegGetValueWParams = ((1, 'hkey'), (1, 'lpSubKey'), (1, 'lpValue'), (1, 'dwFlags RegCloseKeyPrototype = WINFUNCTYPE(LONG, HKEY) RegCloseKeyParams = ((1, 'hKey'),) +# Wow64DisableWow64FsRedirection(OldValue): +Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID)) +Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),) + +# Wow64RevertWow64FsRedirection(OldValue): +Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID) +Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),) + +# Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection): +Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN) +Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),) + diff --git a/k32testing.py b/k32testing.py index 97988fc..9470985 100644 --- a/k32testing.py +++ b/k32testing.py @@ -160,7 +160,10 @@ def TransparentApiProxy(APIDLL, func_name, error_check): prototype = getattr(winfuncs, func_name + "Prototype") args = getattr(winfuncs, func_name + "Params") - c_prototyped = prototype((func_name, APIDLL), args) + try: + c_prototyped = prototype((func_name, APIDLL), args) + except AttributeError: + raise ExportNotFound(func_name, APIDLL._name) c_prototyped.errcheck = functools.wraps(error_check)(functools.partial(error_check, func_name)) return c_prototyped @@ -183,6 +186,7 @@ class NeededParameterType(object): NeededParameter = NeededParameterType() ExitProcess = TransparentKernel32Proxy("ExitProcess") +TerminateProcess = TransparentKernel32Proxy("TerminateProcess") CloseHandle = TransparentKernel32Proxy("CloseHandle") GetProcAddress = TransparentKernel32Proxy("GetProcAddress") LoadLibraryA = TransparentKernel32Proxy("LoadLibraryA") @@ -192,6 +196,7 @@ GetCurrentProcess = TransparentKernel32Proxy("GetCurrentProcess") GetCurrentProcessorNumber = TransparentKernel32Proxy("GetCurrentProcessorNumber", no_error_check) GetCurrentThread = TransparentKernel32Proxy("GetCurrentThread") AllocConsole = TransparentKernel32Proxy("AllocConsole") +FreeConsole = TransparentKernel32Proxy("FreeConsole") GetStdHandle = TransparentKernel32Proxy("GetStdHandle") SetStdHandle = TransparentKernel32Proxy("SetStdHandle") GetCurrentThreadId = TransparentKernel32Proxy("GetCurrentThreadId") @@ -202,6 +207,9 @@ SuspendThread = TransparentKernel32Proxy("SuspendThread", minus_one_error_check) ResumeThread = TransparentKernel32Proxy("ResumeThread", minus_one_error_check) GetThreadId = TransparentKernel32Proxy("GetThreadId") +Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection") +Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection") +Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection") @Kernel32Proxy("CreateFileA") def CreateFileA(lpFileName, dwDesiredAccess, dwShareMode=0, lpSecurityAttributes=None, dwCreationDisposition=OPEN_EXISTING, dwFlagsAndAttributes=FILE_ATTRIBUTE_NORMAL, hTemplateFile=None): @@ -371,6 +379,7 @@ def DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize=None, lp # Some windows check 0 / others does not lpBytesReturned = ctypes.byref(DWORD()) return DeviceIoControl.ctypes_function(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped) + #### NTDLL ##### diff --git a/utils.py b/utils.py index 2a4f929..54b55ee 100644 --- a/utils.py +++ b/utils.py @@ -85,6 +85,20 @@ def create_console(): #os.dup2(console_stderr.fileno(), 2) sys.stderr = console_stderr +def create_process(path, show_windows=False): + proc_info = PROCESS_INFORMATION() + lpStartupInfo = None + if show_windows: + StartupInfo = STARTUPINFOA() + StartupInfo.cb = ctypes.sizeof(StartupInfo) + StartupInfo.dwFlags = 0 + #StartupInfo.wShowWindow = SW_HIDE + lpStartupInfo = ctypes.byref(StartupInfo) + windows.k32testing.CreateProcessA(path, lpProcessInformation=ctypes.byref(proc_info), lpStartupInfo=lpStartupInfo) + proc = [p for p in windows.system.processes if p.pid == proc_info.dwProcessId][0] + return proc + + class FixedInteractiveConsole(code.InteractiveConsole): def raw_input(self, prompt=">>>"): sys.stdout.write(prompt) @@ -125,4 +139,14 @@ class VirtualProtected(object): def __exit__(self, exc_type, exc_value, traceback): kernel32proxy.VirtualProtect(self.addr, self.size, self.old_protect.value, ctypes.byref(self.old_protect)) - return False \ No newline at end of file + return False + +class DisableWow64FsRedirection(object): + def __enter__(self): + self.OldValue = PVOID() + kernel32proxy.Wow64DisableWow64FsRedirection(ctypes.byref(self.OldValue)) + return self + + def __exit__(self, exc_type, exc_value, traceback): + kernel32proxy.Wow64RevertWow64FsRedirection(self.OldValue) + return False diff --git a/winobject.py b/winobject.py index 6fb68bd..bc97aac 100644 --- a/winobject.py +++ b/winobject.py @@ -464,6 +464,10 @@ class WinProcess(PROCESSENTRY32, Process): return RemotePEB64(self.get_peb_addr(), self) return RemotePEB(self.get_peb_addr(), self) + def exit(self, code=0): + """Exit the process""" + return kernel32proxy.TerminateProcess(self.handle, code) + class LoadedModule(LDR_DATA_TABLE_ENTRY): """An entry in the PEB Ldr list"""