From 735b18b3693bd1afca2d7f0ecfc8babd74a3a40f Mon Sep 17 00:00:00 2001 From: clement rouault Date: Tue, 7 Sep 2021 18:08:59 +0200 Subject: [PATCH] Added some ntdll function to winproxy --- ctypes_generation/definitions/functions/syscall.txt | 13 +++++++++++++ .../definitions/structures/winstruct.txt | 6 +++--- windows/generated_def/meta.py | 5 +++++ windows/generated_def/winfuncs.py | 10 ++++++++++ windows/generated_def/winstructs.py | 3 +++ windows/winproxy/apis/ntdll.py | 10 ++++++++++ 6 files changed, 44 insertions(+), 3 deletions(-) diff --git a/ctypes_generation/definitions/functions/syscall.txt b/ctypes_generation/definitions/functions/syscall.txt index 116668e..1eaa530 100644 --- a/ctypes_generation/definitions/functions/syscall.txt +++ b/ctypes_generation/definitions/functions/syscall.txt @@ -351,3 +351,16 @@ NTSTATUS NtUnmapViewOfSection( PVOID BaseAddress ); + +NTSTATUS NtOpenProcess( + PHANDLE ProcessHandle, + ACCESS_MASK DesiredAccess, + POBJECT_ATTRIBUTES ObjectAttributes, + PCLIENT_ID ClientId +); + + +NTSTATUS WINAPI NtDelayExecution( + _In_ BOOLEAN Alertable, + _In_opt_ PLARGE_INTEGER DelayInterval +); diff --git a/ctypes_generation/definitions/structures/winstruct.txt b/ctypes_generation/definitions/structures/winstruct.txt index 112a563..dda5ea8 100644 --- a/ctypes_generation/definitions/structures/winstruct.txt +++ b/ctypes_generation/definitions/structures/winstruct.txt @@ -870,17 +870,17 @@ typedef enum _SECTION_INHERIT { typedef struct _CLIENT_ID{ HANDLE UniqueProcess; HANDLE UniqueThread; -} CLIENT_ID; +} CLIENT_ID, *PCLIENT_ID; typedef struct _CLIENT_ID64{ ULONG64 UniqueProcess; ULONG64 UniqueThread; -} CLIENT_ID64; +} CLIENT_ID64, *PCLIENT_ID64; typedef struct _CLIENT_ID32{ ULONG UniqueProcess; ULONG UniqueThread; -} CLIENT_ID32; +} CLIENT_ID32, *PCLIENT_ID32; typedef struct _LDR_DATA_TABLE_ENTRY { PVOID Reserved1[2]; diff --git a/windows/generated_def/meta.py b/windows/generated_def/meta.py index 2689442..c11c770 100644 --- a/windows/generated_def/meta.py +++ b/windows/generated_def/meta.py @@ -12031,6 +12031,9 @@ structs = set(['ACCESS_ALLOWED_ACE', 'PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE', 'PCLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1', 'PCLAIM_SECURITY_ATTRIBUTE_V1', + 'PCLIENT_ID', + 'PCLIENT_ID32', + 'PCLIENT_ID64', 'PCMSG_CTRL_DECRYPT_PARA', 'PCMSG_ENVELOPED_ENCODE_INFO', 'PCMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO', @@ -13887,6 +13890,7 @@ functions = set(['AccessCheck', 'NtCreateSection', 'NtCreateSymbolicLinkObject', 'NtCreateThreadEx', + 'NtDelayExecution', 'NtDeleteValueKey', 'NtEnumerateSystemEnvironmentValuesEx', 'NtEnumerateValueKey', @@ -13897,6 +13901,7 @@ functions = set(['AccessCheck', 'NtOpenEvent', 'NtOpenFile', 'NtOpenKey', + 'NtOpenProcess', 'NtOpenSection', 'NtOpenSymbolicLinkObject', 'NtProtectVirtualMemory', diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 5ab6bd5..dae5a14 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -2490,6 +2490,16 @@ NtMapViewOfSectionParams = ((1, 'SectionHandle'), (1, 'ProcessHandle'), (1, 'Bas NtUnmapViewOfSectionPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, PVOID) NtUnmapViewOfSectionParams = ((1, 'ProcessHandle'), (1, 'BaseAddress')) +#def NtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId): +# return NtOpenProcess.ctypes_function(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId) +NtOpenProcessPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID) +NtOpenProcessParams = ((1, 'ProcessHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes'), (1, 'ClientId')) + +#def NtDelayExecution(Alertable, DelayInterval): +# return NtDelayExecution.ctypes_function(Alertable, DelayInterval) +NtDelayExecutionPrototype = WINFUNCTYPE(NTSTATUS, BOOLEAN, PLARGE_INTEGER) +NtDelayExecutionParams = ((1, 'Alertable'), (1, 'DelayInterval')) + #def FileTimeToSystemTime(lpFileTime, lpSystemTime): # return FileTimeToSystemTime.ctypes_function(lpFileTime, lpSystemTime) FileTimeToSystemTimePrototype = WINFUNCTYPE(BOOL, POINTER(FILETIME), LPSYSTEMTIME) diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 74851af..55117a7 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -4496,6 +4496,7 @@ class _CLIENT_ID(Structure): ("UniqueProcess", HANDLE), ("UniqueThread", HANDLE), ] +PCLIENT_ID = POINTER(_CLIENT_ID) CLIENT_ID = _CLIENT_ID class _CLIENT_ID64(Structure): @@ -4503,6 +4504,7 @@ class _CLIENT_ID64(Structure): ("UniqueProcess", ULONG64), ("UniqueThread", ULONG64), ] +PCLIENT_ID64 = POINTER(_CLIENT_ID64) CLIENT_ID64 = _CLIENT_ID64 class _CLIENT_ID32(Structure): @@ -4511,6 +4513,7 @@ class _CLIENT_ID32(Structure): ("UniqueThread", ULONG), ] CLIENT_ID32 = _CLIENT_ID32 +PCLIENT_ID32 = POINTER(_CLIENT_ID32) class _LDR_DATA_TABLE_ENTRY(Structure): _fields_ = [ diff --git a/windows/winproxy/apis/ntdll.py b/windows/winproxy/apis/ntdll.py index 012f670..efa6a98 100644 --- a/windows/winproxy/apis/ntdll.py +++ b/windows/winproxy/apis/ntdll.py @@ -9,6 +9,12 @@ class NtdllProxy(ApiProxy): default_error_check = staticmethod(result_is_ntstatus) +# Process + +@NtdllProxy() +def NtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId): + return NtOpenProcess.ctypes_function(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId) + # Memory @NtdllProxy() @@ -129,6 +135,10 @@ def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes def NtSetContextThread(hThread, lpContext): return NtSetContextThread.ctypes_function(hThread, lpContext) +@NtdllProxy() +def NtDelayExecution(Alertable, DelayInterval): + return NtDelayExecution.ctypes_function(Alertable, DelayInterval) + # Memory