Added some ntdll function to winproxy

ctypes_generation/definitions/functions/syscall.txt

@@ -351,3 +351,16 @@ NTSTATUS NtUnmapViewOfSection(
     PVOID  BaseAddress
 );
 
+
+NTSTATUS NtOpenProcess(
+  PHANDLE            ProcessHandle,
+  ACCESS_MASK        DesiredAccess,
+  POBJECT_ATTRIBUTES ObjectAttributes,
+  PCLIENT_ID         ClientId
+);
+
+
+NTSTATUS WINAPI NtDelayExecution(
+    _In_ BOOLEAN Alertable,
+    _In_opt_ PLARGE_INTEGER DelayInterval
+);

ctypes_generation/definitions/structures/winstruct.txt

@@ -870,17 +870,17 @@ typedef enum _SECTION_INHERIT {
 typedef struct _CLIENT_ID{
    HANDLE UniqueProcess;
    HANDLE UniqueThread;
-} CLIENT_ID;
+} CLIENT_ID, *PCLIENT_ID;
 
 typedef struct _CLIENT_ID64{
    ULONG64 UniqueProcess;
    ULONG64 UniqueThread;
-} CLIENT_ID64;
+} CLIENT_ID64, *PCLIENT_ID64;
 
 typedef struct _CLIENT_ID32{
    ULONG UniqueProcess;
    ULONG UniqueThread;
-} CLIENT_ID32;
+} CLIENT_ID32, *PCLIENT_ID32;
 
 typedef struct _LDR_DATA_TABLE_ENTRY {
     PVOID Reserved1[2];

windows/generated_def/meta.py

@@ -12031,6 +12031,9 @@ structs = set(['ACCESS_ALLOWED_ACE',
      'PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE',
      'PCLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1',
      'PCLAIM_SECURITY_ATTRIBUTE_V1',
+     'PCLIENT_ID',
+     'PCLIENT_ID32',
+     'PCLIENT_ID64',
      'PCMSG_CTRL_DECRYPT_PARA',
      'PCMSG_ENVELOPED_ENCODE_INFO',
      'PCMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO',
@@ -13887,6 +13890,7 @@ functions = set(['AccessCheck',
      'NtCreateSection',
      'NtCreateSymbolicLinkObject',
      'NtCreateThreadEx',
+     'NtDelayExecution',
      'NtDeleteValueKey',
      'NtEnumerateSystemEnvironmentValuesEx',
      'NtEnumerateValueKey',
@@ -13897,6 +13901,7 @@ functions = set(['AccessCheck',
      'NtOpenEvent',
      'NtOpenFile',
      'NtOpenKey',
+     'NtOpenProcess',
      'NtOpenSection',
      'NtOpenSymbolicLinkObject',
      'NtProtectVirtualMemory',

windows/generated_def/winfuncs.py

@@ -2490,6 +2490,16 @@ NtMapViewOfSectionParams = ((1, 'SectionHandle'), (1, 'ProcessHandle'), (1, 'Bas
 NtUnmapViewOfSectionPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PVOID)
 NtUnmapViewOfSectionParams = ((1, 'ProcessHandle'), (1, 'BaseAddress'))
 
+#def NtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId):
+#    return NtOpenProcess.ctypes_function(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId)
+NtOpenProcessPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)
+NtOpenProcessParams = ((1, 'ProcessHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes'), (1, 'ClientId'))
+
+#def NtDelayExecution(Alertable, DelayInterval):
+#    return NtDelayExecution.ctypes_function(Alertable, DelayInterval)
+NtDelayExecutionPrototype = WINFUNCTYPE(NTSTATUS, BOOLEAN, PLARGE_INTEGER)
+NtDelayExecutionParams = ((1, 'Alertable'), (1, 'DelayInterval'))
+
 #def FileTimeToSystemTime(lpFileTime, lpSystemTime):
 #    return FileTimeToSystemTime.ctypes_function(lpFileTime, lpSystemTime)
 FileTimeToSystemTimePrototype = WINFUNCTYPE(BOOL, POINTER(FILETIME), LPSYSTEMTIME)

windows/generated_def/winstructs.py

@@ -4496,6 +4496,7 @@ class _CLIENT_ID(Structure):
         ("UniqueProcess", HANDLE),
         ("UniqueThread", HANDLE),
     ]
+PCLIENT_ID = POINTER(_CLIENT_ID)
 CLIENT_ID = _CLIENT_ID
 
 class _CLIENT_ID64(Structure):
@@ -4503,6 +4504,7 @@ class _CLIENT_ID64(Structure):
         ("UniqueProcess", ULONG64),
         ("UniqueThread", ULONG64),
     ]
+PCLIENT_ID64 = POINTER(_CLIENT_ID64)
 CLIENT_ID64 = _CLIENT_ID64
 
 class _CLIENT_ID32(Structure):
@@ -4511,6 +4513,7 @@ class _CLIENT_ID32(Structure):
         ("UniqueThread", ULONG),
     ]
 CLIENT_ID32 = _CLIENT_ID32
+PCLIENT_ID32 = POINTER(_CLIENT_ID32)
 
 class _LDR_DATA_TABLE_ENTRY(Structure):
     _fields_ = [

windows/winproxy/apis/ntdll.py

@@ -9,6 +9,12 @@ class NtdllProxy(ApiProxy):
     default_error_check = staticmethod(result_is_ntstatus)
 
 
+# Process
+
+@NtdllProxy()
+def NtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId):
+    return NtOpenProcess.ctypes_function(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId)
+
 # Memory
 
 @NtdllProxy()
@@ -129,6 +135,10 @@ def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes
 def NtSetContextThread(hThread, lpContext):
     return NtSetContextThread.ctypes_function(hThread, lpContext)
 
+@NtdllProxy()
+def NtDelayExecution(Alertable, DelayInterval):
+    return NtDelayExecution.ctypes_function(Alertable, DelayInterval)
+
 
 # Memory