diff --git a/ctypes_generation/definitions/defines/kuser_shared_data.txt b/ctypes_generation/definitions/defines/kuser_shared_data.txt new file mode 100644 index 0000000..eb8241e --- /dev/null +++ b/ctypes_generation/definitions/defines/kuser_shared_data.txt @@ -0,0 +1,14 @@ +#define MM_SHARED_USER_DATA_VA 0x7FFE0000 + +#define XSTATE_LEGACY_FLOATING_POINT (0) +#define XSTATE_LEGACY_SSE (1) +#define XSTATE_GSSE (2) +#define XSTATE_AVX (XSTATE_GSSE) +#define XSTATE_MPX_BNDREGS (3) +#define XSTATE_MPX_BNDCSR (4) +#define XSTATE_AVX512_KMASK (5) +#define XSTATE_AVX512_ZMM_H (6) +#define XSTATE_AVX512_ZMM (7) +#define XSTATE_IPT (8) +#define XSTATE_LWP (62) +#define MAXIMUM_XSTATE_FEATURES (64) \ No newline at end of file diff --git a/ctypes_generation/definitions/defines/services.txt b/ctypes_generation/definitions/defines/services.txt index 21a2960..5a738e6 100644 --- a/ctypes_generation/definitions/defines/services.txt +++ b/ctypes_generation/definitions/defines/services.txt @@ -38,13 +38,36 @@ #define SERVICE_USER_OWN_PROCESS 0x00000050 #define SERVICE_USER_SHARE_PROCESS 0x00000060 + + #define SERVICE_WIN32 (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS) #define SERVICE_INTERACTIVE_PROCESS 0x00000100 +/* +Legacy value changed with Win10 build 14942 +https://github.com/processhacker/processhacker/issues/120 +*/ #define SERVICE_TYPE_ALL (SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS) +/* New service Type from Win10 build 14942 */ + +#define SERVICE_USER_SERVICE 0x00000040 +#define SERVICE_USERSERVICE_INSTANCE 0x00000080 +#define SERVICE_USER_SHARE_PROCESS (SERVICE_USER_SERVICE | +SERVICE_WIN32_SHARE_PROCESS) +#define SERVICE_USER_OWN_PROCESS (SERVICE_USER_SERVICE | +SERVICE_WIN32_OWN_PROCESS) +#define SERVICE_PKG_SERVICE 0x00000200 + + +/* Make a value for the new SERVICE_TYPE_ALL ? */ + + + + + #define SERVICE_BOOT_START 0x00000000 #define SERVICE_SYSTEM_START 0x00000001 #define SERVICE_AUTO_START 0x00000002 diff --git a/ctypes_generation/definitions/defines/windef.txt b/ctypes_generation/definitions/defines/windef.txt index 37252c1..dba8efc 100644 --- a/ctypes_generation/definitions/defines/windef.txt +++ b/ctypes_generation/definitions/defines/windef.txt @@ -668,4 +668,7 @@ #define TXFS_MINIVERSION_COMMITTED_VIEW (0x0000) #define TXFS_MINIVERSION_DIRTY_VIEW (0xFFFF) -#define TXFS_MINIVERSION_DEFAULT_VIEW (0xFFFE) \ No newline at end of file +#define TXFS_MINIVERSION_DEFAULT_VIEW (0xFFFE) + + +#define PROCESSOR_FEATURE_MAX 64 \ No newline at end of file diff --git a/ctypes_generation/definitions/functions/syscall.txt b/ctypes_generation/definitions/functions/syscall.txt index 23b01dd..0141265 100644 --- a/ctypes_generation/definitions/functions/syscall.txt +++ b/ctypes_generation/definitions/functions/syscall.txt @@ -182,6 +182,16 @@ NTSTATUS WINAPI NtQuerySystemInformation( ); +NTSTATUS WINAPI NtQuerySystemInformationEx( + _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, + _In_reads_bytes_(InputBufferLength) PVOID InputBuffer, + _In_ ULONG InputBufferLength, + _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation, + _In_ ULONG SystemInformationLength, + _Out_opt_ PULONG ReturnLength +); + + NTSTATUS WINAPI NtQueryInformationProcess( _In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, diff --git a/ctypes_generation/definitions/functions/winfunc.txt b/ctypes_generation/definitions/functions/winfunc.txt index a7bc93c..d77d7c6 100644 --- a/ctypes_generation/definitions/functions/winfunc.txt +++ b/ctypes_generation/definitions/functions/winfunc.txt @@ -450,6 +450,9 @@ BOOL AllocConsole(); BOOL FreeConsole(); +UINT WINAPI GetConsoleOutputCP(); +UINT WINAPI GetConsoleCP(); + HANDLE WINAPI GetStdHandle( _In_ DWORD nStdHandle ); diff --git a/ctypes_generation/definitions/structures/kuser_shared_data.txt b/ctypes_generation/definitions/structures/kuser_shared_data.txt new file mode 100644 index 0000000..1dfd1a0 --- /dev/null +++ b/ctypes_generation/definitions/structures/kuser_shared_data.txt @@ -0,0 +1,270 @@ +/* From: https://www.codemachine.com/downloads/win10.1703/winnt.h*/ + + +typedef struct _XSTATE_FEATURE { + DWORD Offset; + DWORD Size; +} XSTATE_FEATURE, *PXSTATE_FEATURE; + +typedef struct _XSTATE_CONFIGURATION { + // Mask of all enabled features + DWORD64 EnabledFeatures; + + // Mask of volatile enabled features + DWORD64 EnabledVolatileFeatures; + + // Total size of the save area for user states + DWORD Size; + + // Control Flags + union { + DWORD ControlFlags; + struct + { + DWORD OptimizedSave : 1; + DWORD CompactionEnabled : 1; + }; + }; + + // List of features + XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES]; + + // Mask of all supervisor features + DWORD64 EnabledSupervisorFeatures; + + // Mask of features that require start address to be 64 byte aligned + DWORD64 AlignedFeatures; + + // Total size of the save area for user and supervisor states + DWORD AllFeatureSize; + + // List which holds size of each user and supervisor state supported by CPU + DWORD AllFeatures[MAXIMUM_XSTATE_FEATURES]; + +} XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION; + + +/* From ntexapi.h */ + +typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE { + StandardDesign, // None == 0 == standard design + NEC98x86, // NEC PC98xx series on X86 + EndAlternatives // past end of known alternatives +} ALTERNATIVE_ARCHITECTURE_TYPE; + +/* ntkeapi.h */ +typedef struct _KSYSTEM_TIME { + ULONG LowPart; + LONG High1Time; + LONG High2Time; +} KSYSTEM_TIME, *PKSYSTEM_TIME; + + +/* + An extract from https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data. + With only the fields up to <0x02f8 unsigned __int64 TestRetInstruction> + These are the fields that have not moved (but may have been renamed) since XP. +*/ + + +typedef struct _PFW_MINIMAL_KUSER_SHARED_DATA { + ULONG TickCountLowDeprecated; + ULONG TickCountMultiplier; + KSYSTEM_TIME InterruptTime; + KSYSTEM_TIME SystemTime; + KSYSTEM_TIME TimeZoneBias; + USHORT ImageNumberLow; + USHORT ImageNumberHigh; + WCHAR NtSystemRoot[260]; + ULONG MaxStackTraceDepth; + ULONG CryptoExponent; + ULONG TimeZoneId; + ULONG LargePageMinimum; + ULONG AitSamplingValue; + ULONG AppCompatFlag; + ULONGLONG RNGSeedVersion; + ULONG GlobalValidationRunlevel; + LONG TimeZoneBiasStamp; + ULONG NtBuildNumber; + NT_PRODUCT_TYPE NtProductType; + BOOLEAN ProductTypeIsValid; + BOOLEAN Reserved0[1]; + USHORT NativeProcessorArchitecture; + ULONG NtMajorVersion; + ULONG NtMinorVersion; + BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; + ULONG Reserved1; + ULONG Reserved3; + ULONG TimeSlip; + ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; + ULONG BootId; + LARGE_INTEGER SystemExpirationDate; + ULONG SuiteMask; + BOOLEAN KdDebuggerEnabled; + union { + BYTE MitigationPolicies; /* Modified UCHAR to BYTE for ctype compat */ + struct { + BYTE NXSupportPolicy : 2; + BYTE SEHValidationPolicy : 2; + BYTE CurDirDevicesSkippedForDlls : 2; + BYTE Reserved : 2; + }; + }; + USHORT CyclesPerYield; + ULONG ActiveConsoleId; + ULONG DismountCount; + ULONG ComPlusPackage; + ULONG LastSystemRITEventTickCount; + ULONG NumberOfPhysicalPages; + BOOLEAN SafeBootMode; + UCHAR VirtualizationFlags; + UCHAR Reserved12[2]; + union { + ULONG SharedDataFlags; + struct { + ULONG DbgErrorPortPresent : 1; + ULONG DbgElevationEnabled : 1; + ULONG DbgVirtEnabled : 1; + ULONG DbgInstallerDetectEnabled : 1; + ULONG DbgLkgEnabled : 1; + ULONG DbgDynProcessorEnabled : 1; + ULONG DbgConsoleBrokerEnabled : 1; + ULONG DbgSecureBootEnabled : 1; + ULONG DbgMultiSessionSku : 1; + ULONG DbgMultiUsersInSessionSku : 1; + ULONG DbgStateSeparationEnabled : 1; + ULONG SpareBits : 21; + }; + }; + ULONG DataFlagsPad[1]; + ULONGLONG TestRetInstruction; +} PFW_MINIMAL_KUSER_SHARED_DATA; + + +/* From: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/ns-ntddk-kuser_shared_data */ +typedef struct _KUSER_SHARED_DATA { + ULONG TickCountLowDeprecated; + ULONG TickCountMultiplier; + KSYSTEM_TIME InterruptTime; + KSYSTEM_TIME SystemTime; + KSYSTEM_TIME TimeZoneBias; + USHORT ImageNumberLow; + USHORT ImageNumberHigh; + WCHAR NtSystemRoot[260]; + ULONG MaxStackTraceDepth; + ULONG CryptoExponent; + ULONG TimeZoneId; + ULONG LargePageMinimum; + ULONG AitSamplingValue; + ULONG AppCompatFlag; + ULONGLONG RNGSeedVersion; + ULONG GlobalValidationRunlevel; + LONG TimeZoneBiasStamp; + ULONG NtBuildNumber; + NT_PRODUCT_TYPE NtProductType; + BOOLEAN ProductTypeIsValid; + BOOLEAN Reserved0[1]; + USHORT NativeProcessorArchitecture; + ULONG NtMajorVersion; + ULONG NtMinorVersion; + BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; + ULONG Reserved1; + ULONG Reserved3; + ULONG TimeSlip; + ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; + ULONG BootId; + LARGE_INTEGER SystemExpirationDate; + ULONG SuiteMask; + BOOLEAN KdDebuggerEnabled; + union { + BYTE MitigationPolicies; /* Modified UCHAR to BYTE for ctype compat */ + struct { + BYTE NXSupportPolicy : 2; + BYTE SEHValidationPolicy : 2; + BYTE CurDirDevicesSkippedForDlls : 2; + BYTE Reserved : 2; + }; + }; + USHORT CyclesPerYield; + ULONG ActiveConsoleId; + ULONG DismountCount; + ULONG ComPlusPackage; + ULONG LastSystemRITEventTickCount; + ULONG NumberOfPhysicalPages; + BOOLEAN SafeBootMode; + UCHAR VirtualizationFlags; + UCHAR Reserved12[2]; + union { + ULONG SharedDataFlags; + struct { + ULONG DbgErrorPortPresent : 1; + ULONG DbgElevationEnabled : 1; + ULONG DbgVirtEnabled : 1; + ULONG DbgInstallerDetectEnabled : 1; + ULONG DbgLkgEnabled : 1; + ULONG DbgDynProcessorEnabled : 1; + ULONG DbgConsoleBrokerEnabled : 1; + ULONG DbgSecureBootEnabled : 1; + ULONG DbgMultiSessionSku : 1; + ULONG DbgMultiUsersInSessionSku : 1; + ULONG DbgStateSeparationEnabled : 1; + ULONG SpareBits : 21; + }; + }; + ULONG DataFlagsPad[1]; + ULONGLONG TestRetInstruction; + LONGLONG QpcFrequency; + ULONG SystemCall; + union { + ULONG AllFlags; + struct { + ULONG Win32Process : 1; + ULONG Sgx2Enclave : 1; + ULONG VbsBasicEnclave : 1; + ULONG SpareBits : 29; + }; + } UserCetAvailableEnvironments; + ULONGLONG SystemCallPad[2]; + union { + KSYSTEM_TIME TickCount; + ULONG64 TickCountQuad; + struct { + ULONG ReservedTickCountOverlay[3]; + ULONG TickCountPad[1]; + }; + }; + ULONG Cookie; + ULONG CookiePad[1]; + LONGLONG ConsoleSessionForegroundProcessId; + ULONGLONG TimeUpdateLock; + ULONGLONG BaselineSystemTimeQpc; + ULONGLONG BaselineInterruptTimeQpc; + ULONGLONG QpcSystemTimeIncrement; + ULONGLONG QpcInterruptTimeIncrement; + UCHAR QpcSystemTimeIncrementShift; + UCHAR QpcInterruptTimeIncrementShift; + USHORT UnparkedProcessorCount; + ULONG EnclaveFeatureMask[4]; + ULONG TelemetryCoverageRound; + USHORT UserModeGlobalLogger[16]; + ULONG ImageFileExecutionOptions; + ULONG LangGenerationCount; + ULONGLONG Reserved4; + ULONGLONG InterruptTimeBias; + ULONGLONG QpcBias; + ULONG ActiveProcessorCount; + UCHAR ActiveGroupCount; + UCHAR Reserved9; + union { + USHORT QpcData; + struct { + UCHAR QpcBypassEnabled; + UCHAR QpcShift; + }; + }; + LARGE_INTEGER TimeZoneBiasEffectiveStart; + LARGE_INTEGER TimeZoneBiasEffectiveEnd; + XSTATE_CONFIGURATION XState; + KSYSTEM_TIME FeatureConfigurationChangeStamp; + ULONG Spare; +} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; \ No newline at end of file diff --git a/ctypes_generation/definitions/structures/template.py b/ctypes_generation/definitions/structures/template.py index 43236c2..79e5dd9 100644 --- a/ctypes_generation/definitions/structures/template.py +++ b/ctypes_generation/definitions/structures/template.py @@ -1,4 +1,6 @@ import windows # Allow extended-struct to use windows/winproxy/... +import windows.pycompat + from ctypes import * from ctypes.wintypes import * diff --git a/ctypes_generation/definitions/structures/winstruct.txt b/ctypes_generation/definitions/structures/winstruct.txt index bb7836e..6415d29 100644 --- a/ctypes_generation/definitions/structures/winstruct.txt +++ b/ctypes_generation/definitions/structures/winstruct.txt @@ -2132,3 +2132,8 @@ typedef struct _FILETIME { } FILETIME, *PFILETIME, *LPFILETIME; +typedef enum _NT_PRODUCT_TYPE { + NtProductWinNt = 1, + NtProductLanManNt, + NtProductServer +} NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE; \ No newline at end of file diff --git a/windows/pycompat.py b/windows/pycompat.py index c86e294..38ea8aa 100644 --- a/windows/pycompat.py +++ b/windows/pycompat.py @@ -2,6 +2,11 @@ import sys is_py3 = (sys.version_info.major >= 3) +# retrieve info about current encoding output +# Provite a warning if sys.stdout.encoding do not match GetConsoleOutputCP() ? + + + if is_py3: def str_from_ascii_function(s): return s.decode("ascii") @@ -20,6 +25,11 @@ if is_py3: return s.decode("latin1") return s + # No encoding of unicode repr + # Python3 handle unicode natively in string and console output + def urepr_encode(s): + return s + else: # py2.7 def str_from_ascii_function(s): return s @@ -36,3 +46,9 @@ else: # py2.7 def raw_decode(s): # No unicode for now on py2 return s + + repr_encoding = sys.stdout.encoding + + def urepr_encode(ustr): + # assert isinstance(s, unicode) # Make the check explicitly ? + return ustr.encode(repr_encoding, "backslashreplace") \ No newline at end of file diff --git a/windows/winproxy/apis/advapi32.py b/windows/winproxy/apis/advapi32.py index 4517abd..2b75b68 100644 --- a/windows/winproxy/apis/advapi32.py +++ b/windows/winproxy/apis/advapi32.py @@ -481,6 +481,18 @@ def GetServiceDisplayNameA(hSCManager, lpServiceName, lpDisplayName, lpcchBuffer def GetServiceDisplayNameW(hSCManager, lpServiceName, lpDisplayName, lpcchBuffer): return GetServiceDisplayNameW.ctypes_function(hSCManager, lpServiceName, lpDisplayName, lpcchBuffer) +@Advapi32Proxy() +def CreateServiceA(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword): + return CreateServiceA.ctypes_function(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword) + +@Advapi32Proxy() +def CreateServiceW(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword): + return CreateServiceW.ctypes_function(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword) + +@Advapi32Proxy() +def DeleteService(hService): + return DeleteService.ctypes_function(hService) + # Event log @Advapi32Proxy() diff --git a/windows/winproxy/apis/kernel32.py b/windows/winproxy/apis/kernel32.py index f8d5544..7d8adf0 100644 --- a/windows/winproxy/apis/kernel32.py +++ b/windows/winproxy/apis/kernel32.py @@ -365,6 +365,14 @@ def GetStdHandle(nStdHandle): def SetStdHandle(nStdHandle, hHandle): return SetStdHandle.ctypes_function(nStdHandle, hHandle) +@Kernel32Proxy() +def GetConsoleOutputCP(): + return GetConsoleOutputCP.ctypes_function() + +@Kernel32Proxy() +def GetConsoleCP(): + return GetConsoleCP.ctypes_function() + ## System @Kernel32Proxy() diff --git a/windows/winproxy/apis/ntdll.py b/windows/winproxy/apis/ntdll.py index 7140005..d0a0b34 100644 --- a/windows/winproxy/apis/ntdll.py +++ b/windows/winproxy/apis/ntdll.py @@ -189,6 +189,13 @@ def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, Sys SystemInformationLength = ctypes.sizeof(SystemInformation) return NtQuerySystemInformation.ctypes_function(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength) + +@NtdllProxy(error_check=ntquerysysteminformation_error_check) +def NtQuerySystemInformationEx(SystemInformationClass, InputBuffer, InputBufferLength, SystemInformation, SystemInformationLength, ReturnLength): + if SystemInformation is not None and SystemInformationLength == 0: + SystemInformationLength = ctypes.sizeof(SystemInformation) + return NtQuerySystemInformationEx.ctypes_function(SystemInformationClass, InputBuffer, InputBufferLength, SystemInformation, SystemInformationLength, ReturnLength) + # path @NtdllProxy(error_check=fail_on_zero)