mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
new funcs + struct + fix winobject
This commit is contained in:
Clement Rouault
@@ -48,6 +48,7 @@ TYPE_EQUIVALENCE = [
|
||||
('HCATADMIN', 'HANDLE'),
|
||||
('HCATINFO', 'HANDLE'),
|
||||
('SC_HANDLE', 'HANDLE'),
|
||||
('LPHANDLE', 'POINTER(HANDLE)'),
|
||||
('PHKEY', 'POINTER(HKEY)'),
|
||||
('ACCESS_MASK', 'DWORD'),
|
||||
('REGSAM', 'ACCESS_MASK'),
|
||||
|
||||
@@ -12,6 +12,32 @@
|
||||
#define STD_ERROR_HANDLE -12
|
||||
|
||||
#define WARMING_NOT_SAME_FLAG_FOR_WINXP 0
|
||||
|
||||
#define PROCESS_TERMINATE (0x0001)
|
||||
#define PROCESS_CREATE_THREAD (0x0002)
|
||||
#define PROCESS_SET_SESSIONID (0x0004)
|
||||
#define PROCESS_VM_OPERATION (0x0008)
|
||||
#define PROCESS_VM_READ (0x0010)
|
||||
#define PROCESS_VM_WRITE (0x0020)
|
||||
#define PROCESS_DUP_HANDLE (0x0040)
|
||||
#define PROCESS_CREATE_PROCESS (0x0080)
|
||||
#define PROCESS_SET_QUOTA (0x0100)
|
||||
#define PROCESS_SET_INFORMATION (0x0200)
|
||||
#define PROCESS_QUERY_INFORMATION (0x0400)
|
||||
#define PROCESS_SUSPEND_RESUME (0x0800)
|
||||
#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000)
|
||||
|
||||
#define THREAD_TERMINATE (0x0001)
|
||||
#define THREAD_SUSPEND_RESUME (0x0002)
|
||||
#define THREAD_GET_CONTEXT (0x0008)
|
||||
#define THREAD_SET_CONTEXT (0x0010)
|
||||
#define THREAD_QUERY_INFORMATION (0x0040)
|
||||
#define THREAD_SET_INFORMATION (0x0020)
|
||||
#define THREAD_SET_THREAD_TOKEN (0x0080)
|
||||
#define THREAD_IMPERSONATE (0x0100)
|
||||
#define THREAD_DIRECT_IMPERSONATION (0x0200)
|
||||
|
||||
|
||||
#define PROCESS_ALL_ACCESS 0x001F0FFF
|
||||
#define THREAD_ALL_ACCESS 0x001F03FF
|
||||
|
||||
@@ -726,4 +752,16 @@
|
||||
#define SERVICE_ACCEPT_SESSIONCHANGE 0x00000080
|
||||
#define SERVICE_ACCEPT_PRESHUTDOWN 0x00000100
|
||||
#define SERVICE_ACCEPT_TIMECHANGE 0x00000200
|
||||
#define SERVICE_ACCEPT_TRIGGEREVENT 0x00000400
|
||||
#define SERVICE_ACCEPT_TRIGGEREVENT 0x00000400
|
||||
|
||||
|
||||
#define DRIVE_UNKNOWN 0
|
||||
#define DRIVE_NO_ROOT_DIR 1
|
||||
#define DRIVE_REMOVABLE 2
|
||||
#define DRIVE_FIXED 3
|
||||
#define DRIVE_REMOTE 4
|
||||
#define DRIVE_CDROM 5
|
||||
#define DRIVE_RAMDISK 6
|
||||
|
||||
#define DUPLICATE_CLOSE_SOURCE 0x00000001
|
||||
#define DUPLICATE_SAME_ACCESS 0x00000002
|
||||
|
||||
@@ -969,4 +969,92 @@ BOOL WINAPI CryptCATAdminReleaseCatalogContext(
|
||||
BOOL WINAPI CryptCATAdminReleaseContext(
|
||||
_In_ HCATADMIN hCatAdmin,
|
||||
_In_ DWORD dwFlags
|
||||
);
|
||||
|
||||
DWORD WINAPI GetLogicalDriveStringsA(
|
||||
_In_ DWORD nBufferLength,
|
||||
_Out_ LPCSTR lpBuffer
|
||||
);
|
||||
|
||||
|
||||
DWORD WINAPI GetLogicalDriveStringsW(
|
||||
_In_ DWORD nBufferLength,
|
||||
_Out_ LPWSTR lpBuffer
|
||||
);
|
||||
|
||||
|
||||
|
||||
BOOL WINAPI GetVolumeInformationA(
|
||||
_In_opt_ LPCSTR lpRootPathName,
|
||||
_Out_opt_ LPSTR lpVolumeNameBuffer,
|
||||
_In_ DWORD nVolumeNameSize,
|
||||
_Out_opt_ LPDWORD lpVolumeSerialNumber,
|
||||
_Out_opt_ LPDWORD lpMaximumComponentLength,
|
||||
_Out_opt_ LPDWORD lpFileSystemFlags,
|
||||
_Out_opt_ LPSTR lpFileSystemNameBuffer,
|
||||
_In_ DWORD nFileSystemNameSize
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI GetVolumeInformationW(
|
||||
_In_opt_ LPWSTR lpRootPathName,
|
||||
_Out_opt_ LPWSTR lpVolumeNameBuffer,
|
||||
_In_ DWORD nVolumeNameSize,
|
||||
_Out_opt_ LPDWORD lpVolumeSerialNumber,
|
||||
_Out_opt_ LPDWORD lpMaximumComponentLength,
|
||||
_Out_opt_ LPDWORD lpFileSystemFlags,
|
||||
_Out_opt_ LPWSTR lpFileSystemNameBuffer,
|
||||
_In_ DWORD nFileSystemNameSize
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI GetVolumeNameForVolumeMountPointA(
|
||||
_In_ LPCSTR lpszVolumeMountPoint,
|
||||
_Out_ LPCSTR lpszVolumeName,
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI GetVolumeNameForVolumeMountPointW(
|
||||
_In_ LPWSTR lpszVolumeMountPoint,
|
||||
_Out_ LPWSTR lpszVolumeName,
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
UINT WINAPI GetDriveTypeA(
|
||||
_In_opt_ LPCSTR lpRootPathName
|
||||
);
|
||||
|
||||
UINT WINAPI GetDriveTypeW(
|
||||
_In_opt_ LPWSTR lpRootPathName
|
||||
);
|
||||
|
||||
DWORD WINAPI QueryDosDeviceA(
|
||||
_In_opt_ LPCSTR lpDeviceName,
|
||||
_Out_ LPCSTR lpTargetPath,
|
||||
_In_ DWORD ucchMax
|
||||
);
|
||||
|
||||
DWORD WINAPI QueryDosDeviceW(
|
||||
_In_opt_ LPWSTR lpDeviceName,
|
||||
_Out_ LPWSTR lpTargetPath,
|
||||
_In_ DWORD ucchMax
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryObject(
|
||||
_In_opt_ HANDLE Handle,
|
||||
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
_Out_opt_ PVOID ObjectInformation,
|
||||
_In_ ULONG ObjectInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
BOOL WINAPI DuplicateHandle(
|
||||
_In_ HANDLE hSourceProcessHandle,
|
||||
_In_ HANDLE hSourceHandle,
|
||||
_In_ HANDLE hTargetProcessHandle,
|
||||
_Out_ LPHANDLE lpTargetHandle,
|
||||
_In_ DWORD dwDesiredAccess,
|
||||
_In_ BOOL bInheritHandle,
|
||||
_In_ DWORD dwOptions
|
||||
);
|
||||
@@ -344,6 +344,13 @@ typedef enum _SC_STATUS_TYPE {
|
||||
SC_STATUS_PROCESS_INFO = 0
|
||||
} SC_STATUS_TYPE;
|
||||
|
||||
typedef enum _OBJECT_INFORMATION_CLASS {
|
||||
ObjectBasicInformation = 0,
|
||||
ObjectNameInformation = 1,
|
||||
ObjectTypeInformation = 2
|
||||
} OBJECT_INFORMATION_CLASS;
|
||||
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
PVOID Reserved1[2];
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
@@ -1722,4 +1729,35 @@ typedef struct CATALOG_INFO_
|
||||
{
|
||||
DWORD cbStruct;
|
||||
WCHAR wszCatalogFile[MAX_PATH];
|
||||
} CATALOG_INFO;
|
||||
} CATALOG_INFO;
|
||||
|
||||
typedef struct _SYSTEM_HANDLE
|
||||
{
|
||||
DWORD dwProcessId;
|
||||
BYTE bObjectType;
|
||||
BYTE bFlags;
|
||||
WORD wValue;
|
||||
PVOID pAddress;
|
||||
DWORD GrantedAccess;
|
||||
}
|
||||
SYSTEM_HANDLE;
|
||||
|
||||
|
||||
typedef struct _SYSTEM_HANDLE_INFORMATION
|
||||
{
|
||||
ULONG HandleCount;
|
||||
SYSTEM_HANDLE Handles[1];
|
||||
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
|
||||
|
||||
typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
|
||||
UNICODE_STRING TypeName;
|
||||
ULONG Reserved [22];
|
||||
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;
|
||||
|
||||
typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
|
||||
ULONG Attributes;
|
||||
ACCESS_MASK GrantedAccess;
|
||||
ULONG HandleCount;
|
||||
ULONG PointerCount;
|
||||
ULONG Reserved[10];
|
||||
} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;
|
||||
@@ -1828,6 +1828,28 @@ STD_INPUT_HANDLE = Flag("STD_INPUT_HANDLE", -10)
|
||||
STD_OUTPUT_HANDLE = Flag("STD_OUTPUT_HANDLE", -11)
|
||||
STD_ERROR_HANDLE = Flag("STD_ERROR_HANDLE", -12)
|
||||
WARMING_NOT_SAME_FLAG_FOR_WINXP = Flag("WARMING_NOT_SAME_FLAG_FOR_WINXP", 0)
|
||||
PROCESS_TERMINATE = Flag("PROCESS_TERMINATE", ( 0x0001 ))
|
||||
PROCESS_CREATE_THREAD = Flag("PROCESS_CREATE_THREAD", ( 0x0002 ))
|
||||
PROCESS_SET_SESSIONID = Flag("PROCESS_SET_SESSIONID", ( 0x0004 ))
|
||||
PROCESS_VM_OPERATION = Flag("PROCESS_VM_OPERATION", ( 0x0008 ))
|
||||
PROCESS_VM_READ = Flag("PROCESS_VM_READ", ( 0x0010 ))
|
||||
PROCESS_VM_WRITE = Flag("PROCESS_VM_WRITE", ( 0x0020 ))
|
||||
PROCESS_DUP_HANDLE = Flag("PROCESS_DUP_HANDLE", ( 0x0040 ))
|
||||
PROCESS_CREATE_PROCESS = Flag("PROCESS_CREATE_PROCESS", ( 0x0080 ))
|
||||
PROCESS_SET_QUOTA = Flag("PROCESS_SET_QUOTA", ( 0x0100 ))
|
||||
PROCESS_SET_INFORMATION = Flag("PROCESS_SET_INFORMATION", ( 0x0200 ))
|
||||
PROCESS_QUERY_INFORMATION = Flag("PROCESS_QUERY_INFORMATION", ( 0x0400 ))
|
||||
PROCESS_SUSPEND_RESUME = Flag("PROCESS_SUSPEND_RESUME", ( 0x0800 ))
|
||||
PROCESS_QUERY_LIMITED_INFORMATION = Flag("PROCESS_QUERY_LIMITED_INFORMATION", ( 0x1000 ))
|
||||
THREAD_TERMINATE = Flag("THREAD_TERMINATE", ( 0x0001 ))
|
||||
THREAD_SUSPEND_RESUME = Flag("THREAD_SUSPEND_RESUME", ( 0x0002 ))
|
||||
THREAD_GET_CONTEXT = Flag("THREAD_GET_CONTEXT", ( 0x0008 ))
|
||||
THREAD_SET_CONTEXT = Flag("THREAD_SET_CONTEXT", ( 0x0010 ))
|
||||
THREAD_QUERY_INFORMATION = Flag("THREAD_QUERY_INFORMATION", ( 0x0040 ))
|
||||
THREAD_SET_INFORMATION = Flag("THREAD_SET_INFORMATION", ( 0x0020 ))
|
||||
THREAD_SET_THREAD_TOKEN = Flag("THREAD_SET_THREAD_TOKEN", ( 0x0080 ))
|
||||
THREAD_IMPERSONATE = Flag("THREAD_IMPERSONATE", ( 0x0100 ))
|
||||
THREAD_DIRECT_IMPERSONATION = Flag("THREAD_DIRECT_IMPERSONATION", ( 0x0200 ))
|
||||
PROCESS_ALL_ACCESS = Flag("PROCESS_ALL_ACCESS", 0x001F0FFF)
|
||||
THREAD_ALL_ACCESS = Flag("THREAD_ALL_ACCESS", 0x001F03FF)
|
||||
STARTF_USESHOWWINDOW = Flag("STARTF_USESHOWWINDOW", 0x00000001)
|
||||
@@ -2451,4 +2473,6 @@ DRIVE_REMOVABLE = Flag("DRIVE_REMOVABLE", 2)
|
||||
DRIVE_FIXED = Flag("DRIVE_FIXED", 3)
|
||||
DRIVE_REMOTE = Flag("DRIVE_REMOTE", 4)
|
||||
DRIVE_CDROM = Flag("DRIVE_CDROM", 5)
|
||||
DRIVE_RAMDISK = Flag("DRIVE_RAMDISK", 6)
|
||||
DRIVE_RAMDISK = Flag("DRIVE_RAMDISK", 6)
|
||||
DUPLICATE_CLOSE_SOURCE = Flag("DUPLICATE_CLOSE_SOURCE", 0x00000001)
|
||||
DUPLICATE_SAME_ACCESS = Flag("DUPLICATE_SAME_ACCESS", 0x00000002)
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle']
|
||||
|
||||
# ExitProcess(uExitCode):
|
||||
ExitProcessPrototype = WINFUNCTYPE(VOID, UINT)
|
||||
@@ -685,3 +685,11 @@ QueryDosDeviceAParams = ((1, 'lpDeviceName'), (1, 'lpTargetPath'), (1, 'ucchMax'
|
||||
QueryDosDeviceWPrototype = WINFUNCTYPE(DWORD, LPWSTR, LPWSTR, DWORD)
|
||||
QueryDosDeviceWParams = ((1, 'lpDeviceName'), (1, 'lpTargetPath'), (1, 'ucchMax'))
|
||||
|
||||
# NtQueryObject(Handle, ObjectInformationClass, ObjectInformation, ObjectInformationLength, ReturnLength):
|
||||
NtQueryObjectPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG)
|
||||
NtQueryObjectParams = ((1, 'Handle'), (1, 'ObjectInformationClass'), (1, 'ObjectInformation'), (1, 'ObjectInformationLength'), (1, 'ReturnLength'))
|
||||
|
||||
# DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, lpTargetHandle, dwDesiredAccess, bInheritHandle, dwOptions):
|
||||
DuplicateHandlePrototype = WINFUNCTYPE(BOOL, HANDLE, HANDLE, HANDLE, LPHANDLE, DWORD, BOOL, DWORD)
|
||||
DuplicateHandleParams = ((1, 'hSourceProcessHandle'), (1, 'hSourceHandle'), (1, 'hTargetProcessHandle'), (1, 'lpTargetHandle'), (1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'dwOptions'))
|
||||
|
||||
|
||||
@@ -39,6 +39,7 @@ HKEY = HANDLE
|
||||
HCATADMIN = HANDLE
|
||||
HCATINFO = HANDLE
|
||||
SC_HANDLE = HANDLE
|
||||
LPHANDLE = POINTER(HANDLE)
|
||||
PHKEY = POINTER(HKEY)
|
||||
ACCESS_MASK = DWORD
|
||||
REGSAM = ACCESS_MASK
|
||||
@@ -49,9 +50,9 @@ HCRYPTMSG = PVOID
|
||||
PALPC_PORT_ATTRIBUTES = PVOID
|
||||
VOID = DWORD
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_OBJECT_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
|
||||
# Enum _SYSTEM_INFORMATION_CLASS definitions
|
||||
_SYSTEM_INFORMATION_CLASS = DWORD
|
||||
@@ -337,6 +338,14 @@ SC_STATUS_TYPE = _SC_STATUS_TYPE
|
||||
|
||||
SC_STATUS_PROCESS_INFO = 0x0
|
||||
|
||||
# Enum _OBJECT_INFORMATION_CLASS definitions
|
||||
_OBJECT_INFORMATION_CLASS = DWORD
|
||||
OBJECT_INFORMATION_CLASS = _OBJECT_INFORMATION_CLASS
|
||||
|
||||
ObjectBasicInformation = 0x0
|
||||
ObjectNameInformation = 0x1
|
||||
ObjectTypeInformation = 0x2
|
||||
|
||||
# Enum _IMAGEHLP_SYMBOL_TYPE_INFO definitions
|
||||
_IMAGEHLP_SYMBOL_TYPE_INFO = DWORD
|
||||
IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO
|
||||
@@ -2261,3 +2270,45 @@ class CATALOG_INFO_(Structure):
|
||||
]
|
||||
CATALOG_INFO = CATALOG_INFO_
|
||||
|
||||
# Struct _SYSTEM_HANDLE definitions
|
||||
class _SYSTEM_HANDLE(Structure):
|
||||
_fields_ = [
|
||||
("dwProcessId", DWORD),
|
||||
("bObjectType", BYTE),
|
||||
("bFlags", BYTE),
|
||||
("wValue", WORD),
|
||||
("pAddress", PVOID),
|
||||
("GrantedAccess", DWORD),
|
||||
]
|
||||
SYSTEM_HANDLE = _SYSTEM_HANDLE
|
||||
|
||||
# Struct _SYSTEM_HANDLE_INFORMATION definitions
|
||||
class _SYSTEM_HANDLE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("HandleCount", ULONG),
|
||||
("Handles", SYSTEM_HANDLE * 1),
|
||||
]
|
||||
PSYSTEM_HANDLE_INFORMATION = POINTER(_SYSTEM_HANDLE_INFORMATION)
|
||||
SYSTEM_HANDLE_INFORMATION = _SYSTEM_HANDLE_INFORMATION
|
||||
|
||||
# Struct __PUBLIC_OBJECT_TYPE_INFORMATION definitions
|
||||
class __PUBLIC_OBJECT_TYPE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("TypeName", UNICODE_STRING),
|
||||
("Reserved", ULONG * 22),
|
||||
]
|
||||
PPUBLIC_OBJECT_TYPE_INFORMATION = POINTER(__PUBLIC_OBJECT_TYPE_INFORMATION)
|
||||
PUBLIC_OBJECT_TYPE_INFORMATION = __PUBLIC_OBJECT_TYPE_INFORMATION
|
||||
|
||||
# Struct _PUBLIC_OBJECT_BASIC_INFORMATION definitions
|
||||
class _PUBLIC_OBJECT_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Attributes", ULONG),
|
||||
("GrantedAccess", ACCESS_MASK),
|
||||
("HandleCount", ULONG),
|
||||
("PointerCount", ULONG),
|
||||
("Reserved", ULONG * 10),
|
||||
]
|
||||
PUBLIC_OBJECT_BASIC_INFORMATION = _PUBLIC_OBJECT_BASIC_INFORMATION
|
||||
PPUBLIC_OBJECT_BASIC_INFORMATION = POINTER(_PUBLIC_OBJECT_BASIC_INFORMATION)
|
||||
|
||||
|
||||
+62
-9
@@ -12,6 +12,9 @@ import windows.network
|
||||
import windows.registry
|
||||
import windows.syswow64
|
||||
import windows.exception
|
||||
import windows.service
|
||||
import windows.volumes
|
||||
import windows.wmi
|
||||
import windows.winproxy as winproxy
|
||||
import windows.injection as injection
|
||||
import windows.native_exec as native_exec
|
||||
@@ -27,8 +30,6 @@ from .generated_def import windef
|
||||
import windows.pe_parse as pe_parse
|
||||
|
||||
|
||||
|
||||
|
||||
class AutoHandle(object):
|
||||
"""An abstract class that allow easy handle creation/destruction/wait"""
|
||||
# Big bypass to prevent missing reference at programm close..
|
||||
@@ -83,6 +84,39 @@ class System(object):
|
||||
"""
|
||||
return self.enumerate_threads()
|
||||
|
||||
@property
|
||||
def logicaldrives(self):
|
||||
return windows.volumes.enum_logical_drive()
|
||||
|
||||
@property
|
||||
def services(self):
|
||||
"""The list of services (TODO: BETTER DOC)"""
|
||||
return windows.service.enumerate_services()
|
||||
|
||||
#@property
|
||||
#def handles(self):
|
||||
# size_needed = ULONG()
|
||||
# size = 0x1000
|
||||
# buffer = ctypes.c_buffer(size)
|
||||
#
|
||||
# try:
|
||||
# winproxy.NtQuerySystemInformation(16, buffer, size, ReturnLength=ctypes.byref(size_needed))
|
||||
# except WindowsError as e:
|
||||
# pass
|
||||
#
|
||||
# size = size_needed.value + 0x1000
|
||||
# buffer = ctypes.c_buffer(size)
|
||||
# winproxy.NtQuerySystemInformation(16, buffer, size, ReturnLength=ctypes.byref(size_needed))
|
||||
#
|
||||
# x = SYSTEM_HANDLE_INFORMATION.from_buffer(buffer)
|
||||
#
|
||||
# class _GENERATED_SYSTEM_HANDLE_INFORMATION(ctypes.Structure):
|
||||
# _fields_ = [
|
||||
# ("HandleCount", ULONG),
|
||||
# ("Handles", SYSTEM_HANDLE * x.HandleCount),
|
||||
# ]
|
||||
# return _GENERATED_SYSTEM_HANDLE_INFORMATION.from_buffer_copy(buffer[:size_needed.value]).Handles[:]
|
||||
|
||||
@utils.fixedpropety
|
||||
def bitness(self):
|
||||
"""The bitness of the system
|
||||
@@ -95,6 +129,10 @@ class System(object):
|
||||
return 64
|
||||
return 32
|
||||
|
||||
@utils.fixedpropety
|
||||
def wmi(self):
|
||||
return windows.wmi.WmiRequester()
|
||||
|
||||
@staticmethod
|
||||
def enumerate_processes():
|
||||
process_entry = WinProcess()
|
||||
@@ -120,6 +158,10 @@ class System(object):
|
||||
return threads
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
class WinThread(THREADENTRY32, AutoHandle):
|
||||
"""Represent a thread """
|
||||
@utils.fixedpropety
|
||||
@@ -342,7 +384,7 @@ class Process(AutoHandle):
|
||||
try:
|
||||
yield addr
|
||||
finally:
|
||||
windows.winproxy.VirtualFreeEx(self.handle, addr)
|
||||
winproxy.VirtualFreeEx(self.handle, addr)
|
||||
|
||||
def execute(self, code, parameter=0):
|
||||
"""Execute some native code in the context of the process
|
||||
@@ -397,8 +439,8 @@ class Process(AutoHandle):
|
||||
"""
|
||||
buffer = ctypes.c_buffer(0x1024)
|
||||
try:
|
||||
size = windows.winproxy.GetMappedFileNameA(self.handle, addr, buffer)
|
||||
except windows.winproxy.Kernel32Error:
|
||||
size = winproxy.GetMappedFileNameA(self.handle, addr, buffer)
|
||||
except winproxy.Kernel32Error:
|
||||
return None
|
||||
return buffer[:size]
|
||||
|
||||
@@ -407,6 +449,11 @@ class Process(AutoHandle):
|
||||
sizeof_char = sizeof(CHAR)
|
||||
return struct.unpack("<B", self.read_memory(addr, sizeof_char))[0]
|
||||
|
||||
def read_short(self, addr):
|
||||
"""Read a ``SHORT`` at ``addr``"""
|
||||
sizeof_short = sizeof(ctypes.c_short)
|
||||
return struct.unpack("<H", self.read_memory(addr, sizeof_short))[0]
|
||||
|
||||
def read_dword(self, addr):
|
||||
"""Read a ``DWORD`` at ``addr``"""
|
||||
sizeof_dword = sizeof(DWORD)
|
||||
@@ -450,7 +497,7 @@ class Process(AutoHandle):
|
||||
"""write a byte at ``addr``"""
|
||||
return self.write_memory(addr, struct.pack("<B", byte))
|
||||
|
||||
def write_word(self, addr, word):
|
||||
def write_short(self, addr, word):
|
||||
"""write a word at ``addr``"""
|
||||
return self.write_memory(addr, struct.pack("<H", word))
|
||||
|
||||
@@ -522,6 +569,7 @@ class CurrentProcess(Process):
|
||||
|
||||
allocator = native_exec.native_function.allocator
|
||||
|
||||
# Use RtlGetCurrentPeb ?
|
||||
def get_peb_builtin(self):
|
||||
if self.get_peb is not None:
|
||||
return self.get_peb
|
||||
@@ -669,6 +717,11 @@ class WinProcess(PROCESSENTRY32, Process):
|
||||
return winproxy.OpenProcess(dwProcessId=self.pid)
|
||||
|
||||
def __repr__(self):
|
||||
try:
|
||||
if self.is_exit:
|
||||
return '<{0} "{1}" pid {2} (DEAD) at {3}>'.format(self.__class__.__name__, self.name, self.pid, hex(id(self)))
|
||||
except WindowsError: # Cannot open process
|
||||
pass
|
||||
return '<{0} "{1}" pid {2} at {3}>'.format(self.__class__.__name__, self.name, self.pid, hex(id(self)))
|
||||
|
||||
def virtual_alloc(self, size):
|
||||
@@ -780,12 +833,12 @@ class WinProcess(PROCESSENTRY32, Process):
|
||||
elif windows.current_process.bitness == 64 and self.bitness == 32:
|
||||
information_type = 26
|
||||
y = ULONGLONG()
|
||||
windows.winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y))
|
||||
winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y))
|
||||
peb_addr = y.value
|
||||
else:
|
||||
information_type = 0
|
||||
x = PROCESS_BASIC_INFORMATION()
|
||||
windows.winproxy.NtQueryInformationProcess(self.handle, information_type, x)
|
||||
winproxy.NtQueryInformationProcess(self.handle, information_type, x)
|
||||
peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value
|
||||
if peb_addr is None:
|
||||
raise ValueError("Could not get peb addr of process {0}".format(self.name))
|
||||
@@ -814,7 +867,7 @@ class WinProcess(PROCESSENTRY32, Process):
|
||||
if windows.current_process.bitness == 64:
|
||||
information_type = 0
|
||||
x = PROCESS_BASIC_INFORMATION()
|
||||
windows.winproxy.NtQueryInformationProcess(self.handle, information_type, x)
|
||||
winproxy.NtQueryInformationProcess(self.handle, information_type, x)
|
||||
peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value
|
||||
return RemotePEB(peb_addr, self)
|
||||
else: #current is 32bits
|
||||
|
||||
+1
-1
@@ -136,7 +136,7 @@ class WmiRequester(object):
|
||||
self.initializiated = True
|
||||
|
||||
|
||||
def select(self, frm, attrs):
|
||||
def select(self, frm, attrs="*"):
|
||||
"""Select `attrs` from ``frm``
|
||||
|
||||
:rtype: list of dict
|
||||
|
||||
Reference in New Issue
Block a user