Added pycompat urepr_unicode for unicode repr in python2 + fix / kuser_shared_data in ctypes generation

This commit is contained in:
hakril
2020-07-30 14:15:22 +02:00
parent 93540ddbe5
commit 7883e5f189
12 changed files with 374 additions and 1 deletions
@@ -0,0 +1,14 @@
#define MM_SHARED_USER_DATA_VA 0x7FFE0000
#define XSTATE_LEGACY_FLOATING_POINT (0)
#define XSTATE_LEGACY_SSE (1)
#define XSTATE_GSSE (2)
#define XSTATE_AVX (XSTATE_GSSE)
#define XSTATE_MPX_BNDREGS (3)
#define XSTATE_MPX_BNDCSR (4)
#define XSTATE_AVX512_KMASK (5)
#define XSTATE_AVX512_ZMM_H (6)
#define XSTATE_AVX512_ZMM (7)
#define XSTATE_IPT (8)
#define XSTATE_LWP (62)
#define MAXIMUM_XSTATE_FEATURES (64)
@@ -38,13 +38,36 @@
#define SERVICE_USER_OWN_PROCESS 0x00000050
#define SERVICE_USER_SHARE_PROCESS 0x00000060
#define SERVICE_WIN32 (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS)
#define SERVICE_INTERACTIVE_PROCESS 0x00000100
/*
Legacy value changed with Win10 build 14942
https://github.com/processhacker/processhacker/issues/120
*/
#define SERVICE_TYPE_ALL (SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS)
/* New service Type from Win10 build 14942 */
#define SERVICE_USER_SERVICE 0x00000040
#define SERVICE_USERSERVICE_INSTANCE 0x00000080
#define SERVICE_USER_SHARE_PROCESS (SERVICE_USER_SERVICE |
SERVICE_WIN32_SHARE_PROCESS)
#define SERVICE_USER_OWN_PROCESS (SERVICE_USER_SERVICE |
SERVICE_WIN32_OWN_PROCESS)
#define SERVICE_PKG_SERVICE 0x00000200
/* Make a value for the new SERVICE_TYPE_ALL ? */
#define SERVICE_BOOT_START 0x00000000
#define SERVICE_SYSTEM_START 0x00000001
#define SERVICE_AUTO_START 0x00000002
@@ -668,4 +668,7 @@
#define TXFS_MINIVERSION_COMMITTED_VIEW (0x0000)
#define TXFS_MINIVERSION_DIRTY_VIEW (0xFFFF)
#define TXFS_MINIVERSION_DEFAULT_VIEW (0xFFFE)
#define TXFS_MINIVERSION_DEFAULT_VIEW (0xFFFE)
#define PROCESSOR_FEATURE_MAX 64
@@ -182,6 +182,16 @@ NTSTATUS WINAPI NtQuerySystemInformation(
);
NTSTATUS WINAPI NtQuerySystemInformationEx(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_In_reads_bytes_(InputBufferLength) PVOID InputBuffer,
_In_ ULONG InputBufferLength,
_Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSTATUS WINAPI NtQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
@@ -450,6 +450,9 @@ BOOL AllocConsole();
BOOL FreeConsole();
UINT WINAPI GetConsoleOutputCP();
UINT WINAPI GetConsoleCP();
HANDLE WINAPI GetStdHandle(
_In_ DWORD nStdHandle
);
@@ -0,0 +1,270 @@
/* From: https://www.codemachine.com/downloads/win10.1703/winnt.h*/
typedef struct _XSTATE_FEATURE {
DWORD Offset;
DWORD Size;
} XSTATE_FEATURE, *PXSTATE_FEATURE;
typedef struct _XSTATE_CONFIGURATION {
// Mask of all enabled features
DWORD64 EnabledFeatures;
// Mask of volatile enabled features
DWORD64 EnabledVolatileFeatures;
// Total size of the save area for user states
DWORD Size;
// Control Flags
union {
DWORD ControlFlags;
struct
{
DWORD OptimizedSave : 1;
DWORD CompactionEnabled : 1;
};
};
// List of features
XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES];
// Mask of all supervisor features
DWORD64 EnabledSupervisorFeatures;
// Mask of features that require start address to be 64 byte aligned
DWORD64 AlignedFeatures;
// Total size of the save area for user and supervisor states
DWORD AllFeatureSize;
// List which holds size of each user and supervisor state supported by CPU
DWORD AllFeatures[MAXIMUM_XSTATE_FEATURES];
} XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION;
/* From ntexapi.h */
typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE {
StandardDesign, // None == 0 == standard design
NEC98x86, // NEC PC98xx series on X86
EndAlternatives // past end of known alternatives
} ALTERNATIVE_ARCHITECTURE_TYPE;
/* ntkeapi.h */
typedef struct _KSYSTEM_TIME {
ULONG LowPart;
LONG High1Time;
LONG High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;
/*
An extract from https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data.
With only the fields up to <0x02f8 unsigned __int64 TestRetInstruction>
These are the fields that have not moved (but may have been renamed) since XP.
*/
typedef struct _PFW_MINIMAL_KUSER_SHARED_DATA {
ULONG TickCountLowDeprecated;
ULONG TickCountMultiplier;
KSYSTEM_TIME InterruptTime;
KSYSTEM_TIME SystemTime;
KSYSTEM_TIME TimeZoneBias;
USHORT ImageNumberLow;
USHORT ImageNumberHigh;
WCHAR NtSystemRoot[260];
ULONG MaxStackTraceDepth;
ULONG CryptoExponent;
ULONG TimeZoneId;
ULONG LargePageMinimum;
ULONG AitSamplingValue;
ULONG AppCompatFlag;
ULONGLONG RNGSeedVersion;
ULONG GlobalValidationRunlevel;
LONG TimeZoneBiasStamp;
ULONG NtBuildNumber;
NT_PRODUCT_TYPE NtProductType;
BOOLEAN ProductTypeIsValid;
BOOLEAN Reserved0[1];
USHORT NativeProcessorArchitecture;
ULONG NtMajorVersion;
ULONG NtMinorVersion;
BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
ULONG Reserved1;
ULONG Reserved3;
ULONG TimeSlip;
ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
ULONG BootId;
LARGE_INTEGER SystemExpirationDate;
ULONG SuiteMask;
BOOLEAN KdDebuggerEnabled;
union {
BYTE MitigationPolicies; /* Modified UCHAR to BYTE for ctype compat */
struct {
BYTE NXSupportPolicy : 2;
BYTE SEHValidationPolicy : 2;
BYTE CurDirDevicesSkippedForDlls : 2;
BYTE Reserved : 2;
};
};
USHORT CyclesPerYield;
ULONG ActiveConsoleId;
ULONG DismountCount;
ULONG ComPlusPackage;
ULONG LastSystemRITEventTickCount;
ULONG NumberOfPhysicalPages;
BOOLEAN SafeBootMode;
UCHAR VirtualizationFlags;
UCHAR Reserved12[2];
union {
ULONG SharedDataFlags;
struct {
ULONG DbgErrorPortPresent : 1;
ULONG DbgElevationEnabled : 1;
ULONG DbgVirtEnabled : 1;
ULONG DbgInstallerDetectEnabled : 1;
ULONG DbgLkgEnabled : 1;
ULONG DbgDynProcessorEnabled : 1;
ULONG DbgConsoleBrokerEnabled : 1;
ULONG DbgSecureBootEnabled : 1;
ULONG DbgMultiSessionSku : 1;
ULONG DbgMultiUsersInSessionSku : 1;
ULONG DbgStateSeparationEnabled : 1;
ULONG SpareBits : 21;
};
};
ULONG DataFlagsPad[1];
ULONGLONG TestRetInstruction;
} PFW_MINIMAL_KUSER_SHARED_DATA;
/* From: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data */
typedef struct _KUSER_SHARED_DATA {
ULONG TickCountLowDeprecated;
ULONG TickCountMultiplier;
KSYSTEM_TIME InterruptTime;
KSYSTEM_TIME SystemTime;
KSYSTEM_TIME TimeZoneBias;
USHORT ImageNumberLow;
USHORT ImageNumberHigh;
WCHAR NtSystemRoot[260];
ULONG MaxStackTraceDepth;
ULONG CryptoExponent;
ULONG TimeZoneId;
ULONG LargePageMinimum;
ULONG AitSamplingValue;
ULONG AppCompatFlag;
ULONGLONG RNGSeedVersion;
ULONG GlobalValidationRunlevel;
LONG TimeZoneBiasStamp;
ULONG NtBuildNumber;
NT_PRODUCT_TYPE NtProductType;
BOOLEAN ProductTypeIsValid;
BOOLEAN Reserved0[1];
USHORT NativeProcessorArchitecture;
ULONG NtMajorVersion;
ULONG NtMinorVersion;
BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX];
ULONG Reserved1;
ULONG Reserved3;
ULONG TimeSlip;
ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
ULONG BootId;
LARGE_INTEGER SystemExpirationDate;
ULONG SuiteMask;
BOOLEAN KdDebuggerEnabled;
union {
BYTE MitigationPolicies; /* Modified UCHAR to BYTE for ctype compat */
struct {
BYTE NXSupportPolicy : 2;
BYTE SEHValidationPolicy : 2;
BYTE CurDirDevicesSkippedForDlls : 2;
BYTE Reserved : 2;
};
};
USHORT CyclesPerYield;
ULONG ActiveConsoleId;
ULONG DismountCount;
ULONG ComPlusPackage;
ULONG LastSystemRITEventTickCount;
ULONG NumberOfPhysicalPages;
BOOLEAN SafeBootMode;
UCHAR VirtualizationFlags;
UCHAR Reserved12[2];
union {
ULONG SharedDataFlags;
struct {
ULONG DbgErrorPortPresent : 1;
ULONG DbgElevationEnabled : 1;
ULONG DbgVirtEnabled : 1;
ULONG DbgInstallerDetectEnabled : 1;
ULONG DbgLkgEnabled : 1;
ULONG DbgDynProcessorEnabled : 1;
ULONG DbgConsoleBrokerEnabled : 1;
ULONG DbgSecureBootEnabled : 1;
ULONG DbgMultiSessionSku : 1;
ULONG DbgMultiUsersInSessionSku : 1;
ULONG DbgStateSeparationEnabled : 1;
ULONG SpareBits : 21;
};
};
ULONG DataFlagsPad[1];
ULONGLONG TestRetInstruction;
LONGLONG QpcFrequency;
ULONG SystemCall;
union {
ULONG AllFlags;
struct {
ULONG Win32Process : 1;
ULONG Sgx2Enclave : 1;
ULONG VbsBasicEnclave : 1;
ULONG SpareBits : 29;
};
} UserCetAvailableEnvironments;
ULONGLONG SystemCallPad[2];
union {
KSYSTEM_TIME TickCount;
ULONG64 TickCountQuad;
struct {
ULONG ReservedTickCountOverlay[3];
ULONG TickCountPad[1];
};
};
ULONG Cookie;
ULONG CookiePad[1];
LONGLONG ConsoleSessionForegroundProcessId;
ULONGLONG TimeUpdateLock;
ULONGLONG BaselineSystemTimeQpc;
ULONGLONG BaselineInterruptTimeQpc;
ULONGLONG QpcSystemTimeIncrement;
ULONGLONG QpcInterruptTimeIncrement;
UCHAR QpcSystemTimeIncrementShift;
UCHAR QpcInterruptTimeIncrementShift;
USHORT UnparkedProcessorCount;
ULONG EnclaveFeatureMask[4];
ULONG TelemetryCoverageRound;
USHORT UserModeGlobalLogger[16];
ULONG ImageFileExecutionOptions;
ULONG LangGenerationCount;
ULONGLONG Reserved4;
ULONGLONG InterruptTimeBias;
ULONGLONG QpcBias;
ULONG ActiveProcessorCount;
UCHAR ActiveGroupCount;
UCHAR Reserved9;
union {
USHORT QpcData;
struct {
UCHAR QpcBypassEnabled;
UCHAR QpcShift;
};
};
LARGE_INTEGER TimeZoneBiasEffectiveStart;
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
XSTATE_CONFIGURATION XState;
KSYSTEM_TIME FeatureConfigurationChangeStamp;
ULONG Spare;
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;
@@ -1,4 +1,6 @@
import windows # Allow extended-struct to use windows/winproxy/...
import windows.pycompat
from ctypes import *
from ctypes.wintypes import *
@@ -2132,3 +2132,8 @@ typedef struct _FILETIME {
} FILETIME, *PFILETIME, *LPFILETIME;
typedef enum _NT_PRODUCT_TYPE {
NtProductWinNt = 1,
NtProductLanManNt,
NtProductServer
} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE;
+16
View File
@@ -2,6 +2,11 @@ import sys
is_py3 = (sys.version_info.major >= 3)
# retrieve info about current encoding output
# Provite a warning if sys.stdout.encoding do not match GetConsoleOutputCP() ?
if is_py3:
def str_from_ascii_function(s):
return s.decode("ascii")
@@ -20,6 +25,11 @@ if is_py3:
return s.decode("latin1")
return s
# No encoding of unicode repr
# Python3 handle unicode natively in string and console output
def urepr_encode(s):
return s
else: # py2.7
def str_from_ascii_function(s):
return s
@@ -36,3 +46,9 @@ else: # py2.7
def raw_decode(s):
# No unicode for now on py2
return s
repr_encoding = sys.stdout.encoding
def urepr_encode(ustr):
# assert isinstance(s, unicode) # Make the check explicitly ?
return ustr.encode(repr_encoding, "backslashreplace")
+12
View File
@@ -481,6 +481,18 @@ def GetServiceDisplayNameA(hSCManager, lpServiceName, lpDisplayName, lpcchBuffer
def GetServiceDisplayNameW(hSCManager, lpServiceName, lpDisplayName, lpcchBuffer):
return GetServiceDisplayNameW.ctypes_function(hSCManager, lpServiceName, lpDisplayName, lpcchBuffer)
@Advapi32Proxy()
def CreateServiceA(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword):
return CreateServiceA.ctypes_function(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword)
@Advapi32Proxy()
def CreateServiceW(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword):
return CreateServiceW.ctypes_function(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword)
@Advapi32Proxy()
def DeleteService(hService):
return DeleteService.ctypes_function(hService)
# Event log
@Advapi32Proxy()
+8
View File
@@ -365,6 +365,14 @@ def GetStdHandle(nStdHandle):
def SetStdHandle(nStdHandle, hHandle):
return SetStdHandle.ctypes_function(nStdHandle, hHandle)
@Kernel32Proxy()
def GetConsoleOutputCP():
return GetConsoleOutputCP.ctypes_function()
@Kernel32Proxy()
def GetConsoleCP():
return GetConsoleCP.ctypes_function()
## System
@Kernel32Proxy()
+7
View File
@@ -189,6 +189,13 @@ def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, Sys
SystemInformationLength = ctypes.sizeof(SystemInformation)
return NtQuerySystemInformation.ctypes_function(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength)
@NtdllProxy(error_check=ntquerysysteminformation_error_check)
def NtQuerySystemInformationEx(SystemInformationClass, InputBuffer, InputBufferLength, SystemInformation, SystemInformationLength, ReturnLength):
if SystemInformation is not None and SystemInformationLength == 0:
SystemInformationLength = ctypes.sizeof(SystemInformation)
return NtQuerySystemInformationEx.ctypes_function(SystemInformationClass, InputBuffer, InputBufferLength, SystemInformation, SystemInformationLength, ReturnLength)
# path
@NtdllProxy(error_check=fail_on_zero)