From 8628ff559504a3df9b0836302611bfee700837a8 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Fri, 18 Mar 2016 18:04:50 +0100 Subject: [PATCH] new funcs + struct + fix winobject --- ctypes_generation/generate.py | 1 + ctypes_generation/windef.txt | 40 ++++++++++++- ctypes_generation/winfunc.txt | 88 +++++++++++++++++++++++++++++ ctypes_generation/winstruct.txt | 40 ++++++++++++- windows/generated_def/windef.py | 26 ++++++++- windows/generated_def/winfuncs.py | 10 +++- windows/generated_def/winstructs.py | 55 +++++++++++++++++- windows/winobject.py | 71 ++++++++++++++++++++--- windows/wmi.py | 2 +- 9 files changed, 317 insertions(+), 16 deletions(-) diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py index b1d0c6b..55df1af 100644 --- a/ctypes_generation/generate.py +++ b/ctypes_generation/generate.py @@ -48,6 +48,7 @@ TYPE_EQUIVALENCE = [ ('HCATADMIN', 'HANDLE'), ('HCATINFO', 'HANDLE'), ('SC_HANDLE', 'HANDLE'), + ('LPHANDLE', 'POINTER(HANDLE)'), ('PHKEY', 'POINTER(HKEY)'), ('ACCESS_MASK', 'DWORD'), ('REGSAM', 'ACCESS_MASK'), diff --git a/ctypes_generation/windef.txt b/ctypes_generation/windef.txt index 494384c..517cf09 100644 --- a/ctypes_generation/windef.txt +++ b/ctypes_generation/windef.txt @@ -12,6 +12,32 @@ #define STD_ERROR_HANDLE -12 #define WARMING_NOT_SAME_FLAG_FOR_WINXP 0 + +#define PROCESS_TERMINATE (0x0001) +#define PROCESS_CREATE_THREAD (0x0002) +#define PROCESS_SET_SESSIONID (0x0004) +#define PROCESS_VM_OPERATION (0x0008) +#define PROCESS_VM_READ (0x0010) +#define PROCESS_VM_WRITE (0x0020) +#define PROCESS_DUP_HANDLE (0x0040) +#define PROCESS_CREATE_PROCESS (0x0080) +#define PROCESS_SET_QUOTA (0x0100) +#define PROCESS_SET_INFORMATION (0x0200) +#define PROCESS_QUERY_INFORMATION (0x0400) +#define PROCESS_SUSPEND_RESUME (0x0800) +#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000) + +#define THREAD_TERMINATE (0x0001) +#define THREAD_SUSPEND_RESUME (0x0002) +#define THREAD_GET_CONTEXT (0x0008) +#define THREAD_SET_CONTEXT (0x0010) +#define THREAD_QUERY_INFORMATION (0x0040) +#define THREAD_SET_INFORMATION (0x0020) +#define THREAD_SET_THREAD_TOKEN (0x0080) +#define THREAD_IMPERSONATE (0x0100) +#define THREAD_DIRECT_IMPERSONATION (0x0200) + + #define PROCESS_ALL_ACCESS 0x001F0FFF #define THREAD_ALL_ACCESS 0x001F03FF @@ -726,4 +752,16 @@ #define SERVICE_ACCEPT_SESSIONCHANGE 0x00000080 #define SERVICE_ACCEPT_PRESHUTDOWN 0x00000100 #define SERVICE_ACCEPT_TIMECHANGE 0x00000200 -#define SERVICE_ACCEPT_TRIGGEREVENT 0x00000400 \ No newline at end of file +#define SERVICE_ACCEPT_TRIGGEREVENT 0x00000400 + + +#define DRIVE_UNKNOWN 0 +#define DRIVE_NO_ROOT_DIR 1 +#define DRIVE_REMOVABLE 2 +#define DRIVE_FIXED 3 +#define DRIVE_REMOTE 4 +#define DRIVE_CDROM 5 +#define DRIVE_RAMDISK 6 + +#define DUPLICATE_CLOSE_SOURCE 0x00000001 +#define DUPLICATE_SAME_ACCESS 0x00000002 diff --git a/ctypes_generation/winfunc.txt b/ctypes_generation/winfunc.txt index 54efdac..f67e17e 100644 --- a/ctypes_generation/winfunc.txt +++ b/ctypes_generation/winfunc.txt @@ -969,4 +969,92 @@ BOOL WINAPI CryptCATAdminReleaseCatalogContext( BOOL WINAPI CryptCATAdminReleaseContext( _In_ HCATADMIN hCatAdmin, _In_ DWORD dwFlags +); + +DWORD WINAPI GetLogicalDriveStringsA( + _In_ DWORD nBufferLength, + _Out_ LPCSTR lpBuffer +); + + +DWORD WINAPI GetLogicalDriveStringsW( + _In_ DWORD nBufferLength, + _Out_ LPWSTR lpBuffer +); + + + +BOOL WINAPI GetVolumeInformationA( + _In_opt_ LPCSTR lpRootPathName, + _Out_opt_ LPSTR lpVolumeNameBuffer, + _In_ DWORD nVolumeNameSize, + _Out_opt_ LPDWORD lpVolumeSerialNumber, + _Out_opt_ LPDWORD lpMaximumComponentLength, + _Out_opt_ LPDWORD lpFileSystemFlags, + _Out_opt_ LPSTR lpFileSystemNameBuffer, + _In_ DWORD nFileSystemNameSize +); + + +BOOL WINAPI GetVolumeInformationW( + _In_opt_ LPWSTR lpRootPathName, + _Out_opt_ LPWSTR lpVolumeNameBuffer, + _In_ DWORD nVolumeNameSize, + _Out_opt_ LPDWORD lpVolumeSerialNumber, + _Out_opt_ LPDWORD lpMaximumComponentLength, + _Out_opt_ LPDWORD lpFileSystemFlags, + _Out_opt_ LPWSTR lpFileSystemNameBuffer, + _In_ DWORD nFileSystemNameSize +); + + +BOOL WINAPI GetVolumeNameForVolumeMountPointA( + _In_ LPCSTR lpszVolumeMountPoint, + _Out_ LPCSTR lpszVolumeName, + _In_ DWORD cchBufferLength +); + + +BOOL WINAPI GetVolumeNameForVolumeMountPointW( + _In_ LPWSTR lpszVolumeMountPoint, + _Out_ LPWSTR lpszVolumeName, + _In_ DWORD cchBufferLength +); + +UINT WINAPI GetDriveTypeA( + _In_opt_ LPCSTR lpRootPathName +); + +UINT WINAPI GetDriveTypeW( + _In_opt_ LPWSTR lpRootPathName +); + +DWORD WINAPI QueryDosDeviceA( + _In_opt_ LPCSTR lpDeviceName, + _Out_ LPCSTR lpTargetPath, + _In_ DWORD ucchMax +); + +DWORD WINAPI QueryDosDeviceW( + _In_opt_ LPWSTR lpDeviceName, + _Out_ LPWSTR lpTargetPath, + _In_ DWORD ucchMax +); + +NTSTATUS WINAPI NtQueryObject( + _In_opt_ HANDLE Handle, + _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, + _Out_opt_ PVOID ObjectInformation, + _In_ ULONG ObjectInformationLength, + _Out_opt_ PULONG ReturnLength +); + +BOOL WINAPI DuplicateHandle( + _In_ HANDLE hSourceProcessHandle, + _In_ HANDLE hSourceHandle, + _In_ HANDLE hTargetProcessHandle, + _Out_ LPHANDLE lpTargetHandle, + _In_ DWORD dwDesiredAccess, + _In_ BOOL bInheritHandle, + _In_ DWORD dwOptions ); \ No newline at end of file diff --git a/ctypes_generation/winstruct.txt b/ctypes_generation/winstruct.txt index 40c44e9..1ca2205 100644 --- a/ctypes_generation/winstruct.txt +++ b/ctypes_generation/winstruct.txt @@ -344,6 +344,13 @@ typedef enum _SC_STATUS_TYPE { SC_STATUS_PROCESS_INFO = 0 } SC_STATUS_TYPE; +typedef enum _OBJECT_INFORMATION_CLASS { + ObjectBasicInformation = 0, + ObjectNameInformation = 1, + ObjectTypeInformation = 2 +} OBJECT_INFORMATION_CLASS; + + typedef struct _LDR_DATA_TABLE_ENTRY { PVOID Reserved1[2]; LIST_ENTRY InMemoryOrderLinks; @@ -1722,4 +1729,35 @@ typedef struct CATALOG_INFO_ { DWORD cbStruct; WCHAR wszCatalogFile[MAX_PATH]; -} CATALOG_INFO; \ No newline at end of file +} CATALOG_INFO; + +typedef struct _SYSTEM_HANDLE +{ + DWORD dwProcessId; + BYTE bObjectType; + BYTE bFlags; + WORD wValue; + PVOID pAddress; + DWORD GrantedAccess; +} +SYSTEM_HANDLE; + + +typedef struct _SYSTEM_HANDLE_INFORMATION +{ + ULONG HandleCount; + SYSTEM_HANDLE Handles[1]; +} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; + +typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION { + UNICODE_STRING TypeName; + ULONG Reserved [22]; +} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION; + +typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION { + ULONG Attributes; + ACCESS_MASK GrantedAccess; + ULONG HandleCount; + ULONG PointerCount; + ULONG Reserved[10]; + } PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION; \ No newline at end of file diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index 9697f9c..ff8ec02 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -1828,6 +1828,28 @@ STD_INPUT_HANDLE = Flag("STD_INPUT_HANDLE", -10) STD_OUTPUT_HANDLE = Flag("STD_OUTPUT_HANDLE", -11) STD_ERROR_HANDLE = Flag("STD_ERROR_HANDLE", -12) WARMING_NOT_SAME_FLAG_FOR_WINXP = Flag("WARMING_NOT_SAME_FLAG_FOR_WINXP", 0) +PROCESS_TERMINATE = Flag("PROCESS_TERMINATE", ( 0x0001 )) +PROCESS_CREATE_THREAD = Flag("PROCESS_CREATE_THREAD", ( 0x0002 )) +PROCESS_SET_SESSIONID = Flag("PROCESS_SET_SESSIONID", ( 0x0004 )) +PROCESS_VM_OPERATION = Flag("PROCESS_VM_OPERATION", ( 0x0008 )) +PROCESS_VM_READ = Flag("PROCESS_VM_READ", ( 0x0010 )) +PROCESS_VM_WRITE = Flag("PROCESS_VM_WRITE", ( 0x0020 )) +PROCESS_DUP_HANDLE = Flag("PROCESS_DUP_HANDLE", ( 0x0040 )) +PROCESS_CREATE_PROCESS = Flag("PROCESS_CREATE_PROCESS", ( 0x0080 )) +PROCESS_SET_QUOTA = Flag("PROCESS_SET_QUOTA", ( 0x0100 )) +PROCESS_SET_INFORMATION = Flag("PROCESS_SET_INFORMATION", ( 0x0200 )) +PROCESS_QUERY_INFORMATION = Flag("PROCESS_QUERY_INFORMATION", ( 0x0400 )) +PROCESS_SUSPEND_RESUME = Flag("PROCESS_SUSPEND_RESUME", ( 0x0800 )) +PROCESS_QUERY_LIMITED_INFORMATION = Flag("PROCESS_QUERY_LIMITED_INFORMATION", ( 0x1000 )) +THREAD_TERMINATE = Flag("THREAD_TERMINATE", ( 0x0001 )) +THREAD_SUSPEND_RESUME = Flag("THREAD_SUSPEND_RESUME", ( 0x0002 )) +THREAD_GET_CONTEXT = Flag("THREAD_GET_CONTEXT", ( 0x0008 )) +THREAD_SET_CONTEXT = Flag("THREAD_SET_CONTEXT", ( 0x0010 )) +THREAD_QUERY_INFORMATION = Flag("THREAD_QUERY_INFORMATION", ( 0x0040 )) +THREAD_SET_INFORMATION = Flag("THREAD_SET_INFORMATION", ( 0x0020 )) +THREAD_SET_THREAD_TOKEN = Flag("THREAD_SET_THREAD_TOKEN", ( 0x0080 )) +THREAD_IMPERSONATE = Flag("THREAD_IMPERSONATE", ( 0x0100 )) +THREAD_DIRECT_IMPERSONATION = Flag("THREAD_DIRECT_IMPERSONATION", ( 0x0200 )) PROCESS_ALL_ACCESS = Flag("PROCESS_ALL_ACCESS", 0x001F0FFF) THREAD_ALL_ACCESS = Flag("THREAD_ALL_ACCESS", 0x001F03FF) STARTF_USESHOWWINDOW = Flag("STARTF_USESHOWWINDOW", 0x00000001) @@ -2451,4 +2473,6 @@ DRIVE_REMOVABLE = Flag("DRIVE_REMOVABLE", 2) DRIVE_FIXED = Flag("DRIVE_FIXED", 3) DRIVE_REMOTE = Flag("DRIVE_REMOTE", 4) DRIVE_CDROM = Flag("DRIVE_CDROM", 5) -DRIVE_RAMDISK = Flag("DRIVE_RAMDISK", 6) \ No newline at end of file +DRIVE_RAMDISK = Flag("DRIVE_RAMDISK", 6) +DUPLICATE_CLOSE_SOURCE = Flag("DUPLICATE_CLOSE_SOURCE", 0x00000001) +DUPLICATE_SAME_ACCESS = Flag("DUPLICATE_SAME_ACCESS", 0x00000002) \ No newline at end of file diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 880aca4..80e99d3 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -685,3 +685,11 @@ QueryDosDeviceAParams = ((1, 'lpDeviceName'), (1, 'lpTargetPath'), (1, 'ucchMax' QueryDosDeviceWPrototype = WINFUNCTYPE(DWORD, LPWSTR, LPWSTR, DWORD) QueryDosDeviceWParams = ((1, 'lpDeviceName'), (1, 'lpTargetPath'), (1, 'ucchMax')) +# NtQueryObject(Handle, ObjectInformationClass, ObjectInformation, ObjectInformationLength, ReturnLength): +NtQueryObjectPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG) +NtQueryObjectParams = ((1, 'Handle'), (1, 'ObjectInformationClass'), (1, 'ObjectInformation'), (1, 'ObjectInformationLength'), (1, 'ReturnLength')) + +# DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, lpTargetHandle, dwDesiredAccess, bInheritHandle, dwOptions): +DuplicateHandlePrototype = WINFUNCTYPE(BOOL, HANDLE, HANDLE, HANDLE, LPHANDLE, DWORD, BOOL, DWORD) +DuplicateHandleParams = ((1, 'hSourceProcessHandle'), (1, 'hSourceHandle'), (1, 'hTargetProcessHandle'), (1, 'lpTargetHandle'), (1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'dwOptions')) + diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 775da91..4cea56c 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -39,6 +39,7 @@ HKEY = HANDLE HCATADMIN = HANDLE HCATINFO = HANDLE SC_HANDLE = HANDLE +LPHANDLE = POINTER(HANDLE) PHKEY = POINTER(HKEY) ACCESS_MASK = DWORD REGSAM = ACCESS_MASK @@ -49,9 +50,9 @@ HCRYPTMSG = PVOID PALPC_PORT_ATTRIBUTES = PVOID VOID = DWORD -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION'] -enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] +enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_OBJECT_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] # Enum _SYSTEM_INFORMATION_CLASS definitions _SYSTEM_INFORMATION_CLASS = DWORD @@ -337,6 +338,14 @@ SC_STATUS_TYPE = _SC_STATUS_TYPE SC_STATUS_PROCESS_INFO = 0x0 +# Enum _OBJECT_INFORMATION_CLASS definitions +_OBJECT_INFORMATION_CLASS = DWORD +OBJECT_INFORMATION_CLASS = _OBJECT_INFORMATION_CLASS + +ObjectBasicInformation = 0x0 +ObjectNameInformation = 0x1 +ObjectTypeInformation = 0x2 + # Enum _IMAGEHLP_SYMBOL_TYPE_INFO definitions _IMAGEHLP_SYMBOL_TYPE_INFO = DWORD IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO @@ -2261,3 +2270,45 @@ class CATALOG_INFO_(Structure): ] CATALOG_INFO = CATALOG_INFO_ +# Struct _SYSTEM_HANDLE definitions +class _SYSTEM_HANDLE(Structure): + _fields_ = [ + ("dwProcessId", DWORD), + ("bObjectType", BYTE), + ("bFlags", BYTE), + ("wValue", WORD), + ("pAddress", PVOID), + ("GrantedAccess", DWORD), + ] +SYSTEM_HANDLE = _SYSTEM_HANDLE + +# Struct _SYSTEM_HANDLE_INFORMATION definitions +class _SYSTEM_HANDLE_INFORMATION(Structure): + _fields_ = [ + ("HandleCount", ULONG), + ("Handles", SYSTEM_HANDLE * 1), + ] +PSYSTEM_HANDLE_INFORMATION = POINTER(_SYSTEM_HANDLE_INFORMATION) +SYSTEM_HANDLE_INFORMATION = _SYSTEM_HANDLE_INFORMATION + +# Struct __PUBLIC_OBJECT_TYPE_INFORMATION definitions +class __PUBLIC_OBJECT_TYPE_INFORMATION(Structure): + _fields_ = [ + ("TypeName", UNICODE_STRING), + ("Reserved", ULONG * 22), + ] +PPUBLIC_OBJECT_TYPE_INFORMATION = POINTER(__PUBLIC_OBJECT_TYPE_INFORMATION) +PUBLIC_OBJECT_TYPE_INFORMATION = __PUBLIC_OBJECT_TYPE_INFORMATION + +# Struct _PUBLIC_OBJECT_BASIC_INFORMATION definitions +class _PUBLIC_OBJECT_BASIC_INFORMATION(Structure): + _fields_ = [ + ("Attributes", ULONG), + ("GrantedAccess", ACCESS_MASK), + ("HandleCount", ULONG), + ("PointerCount", ULONG), + ("Reserved", ULONG * 10), + ] +PUBLIC_OBJECT_BASIC_INFORMATION = _PUBLIC_OBJECT_BASIC_INFORMATION +PPUBLIC_OBJECT_BASIC_INFORMATION = POINTER(_PUBLIC_OBJECT_BASIC_INFORMATION) + diff --git a/windows/winobject.py b/windows/winobject.py index b6b369f..e63eabe 100644 --- a/windows/winobject.py +++ b/windows/winobject.py @@ -12,6 +12,9 @@ import windows.network import windows.registry import windows.syswow64 import windows.exception +import windows.service +import windows.volumes +import windows.wmi import windows.winproxy as winproxy import windows.injection as injection import windows.native_exec as native_exec @@ -27,8 +30,6 @@ from .generated_def import windef import windows.pe_parse as pe_parse - - class AutoHandle(object): """An abstract class that allow easy handle creation/destruction/wait""" # Big bypass to prevent missing reference at programm close.. @@ -83,6 +84,39 @@ class System(object): """ return self.enumerate_threads() + @property + def logicaldrives(self): + return windows.volumes.enum_logical_drive() + + @property + def services(self): + """The list of services (TODO: BETTER DOC)""" + return windows.service.enumerate_services() + + #@property + #def handles(self): + # size_needed = ULONG() + # size = 0x1000 + # buffer = ctypes.c_buffer(size) + # + # try: + # winproxy.NtQuerySystemInformation(16, buffer, size, ReturnLength=ctypes.byref(size_needed)) + # except WindowsError as e: + # pass + # + # size = size_needed.value + 0x1000 + # buffer = ctypes.c_buffer(size) + # winproxy.NtQuerySystemInformation(16, buffer, size, ReturnLength=ctypes.byref(size_needed)) + # + # x = SYSTEM_HANDLE_INFORMATION.from_buffer(buffer) + # + # class _GENERATED_SYSTEM_HANDLE_INFORMATION(ctypes.Structure): + # _fields_ = [ + # ("HandleCount", ULONG), + # ("Handles", SYSTEM_HANDLE * x.HandleCount), + # ] + # return _GENERATED_SYSTEM_HANDLE_INFORMATION.from_buffer_copy(buffer[:size_needed.value]).Handles[:] + @utils.fixedpropety def bitness(self): """The bitness of the system @@ -95,6 +129,10 @@ class System(object): return 64 return 32 + @utils.fixedpropety + def wmi(self): + return windows.wmi.WmiRequester() + @staticmethod def enumerate_processes(): process_entry = WinProcess() @@ -120,6 +158,10 @@ class System(object): return threads + + + + class WinThread(THREADENTRY32, AutoHandle): """Represent a thread """ @utils.fixedpropety @@ -342,7 +384,7 @@ class Process(AutoHandle): try: yield addr finally: - windows.winproxy.VirtualFreeEx(self.handle, addr) + winproxy.VirtualFreeEx(self.handle, addr) def execute(self, code, parameter=0): """Execute some native code in the context of the process @@ -397,8 +439,8 @@ class Process(AutoHandle): """ buffer = ctypes.c_buffer(0x1024) try: - size = windows.winproxy.GetMappedFileNameA(self.handle, addr, buffer) - except windows.winproxy.Kernel32Error: + size = winproxy.GetMappedFileNameA(self.handle, addr, buffer) + except winproxy.Kernel32Error: return None return buffer[:size] @@ -407,6 +449,11 @@ class Process(AutoHandle): sizeof_char = sizeof(CHAR) return struct.unpack("'.format(self.__class__.__name__, self.name, self.pid, hex(id(self))) + except WindowsError: # Cannot open process + pass return '<{0} "{1}" pid {2} at {3}>'.format(self.__class__.__name__, self.name, self.pid, hex(id(self))) def virtual_alloc(self, size): @@ -780,12 +833,12 @@ class WinProcess(PROCESSENTRY32, Process): elif windows.current_process.bitness == 64 and self.bitness == 32: information_type = 26 y = ULONGLONG() - windows.winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y)) + winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y)) peb_addr = y.value else: information_type = 0 x = PROCESS_BASIC_INFORMATION() - windows.winproxy.NtQueryInformationProcess(self.handle, information_type, x) + winproxy.NtQueryInformationProcess(self.handle, information_type, x) peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value if peb_addr is None: raise ValueError("Could not get peb addr of process {0}".format(self.name)) @@ -814,7 +867,7 @@ class WinProcess(PROCESSENTRY32, Process): if windows.current_process.bitness == 64: information_type = 0 x = PROCESS_BASIC_INFORMATION() - windows.winproxy.NtQueryInformationProcess(self.handle, information_type, x) + winproxy.NtQueryInformationProcess(self.handle, information_type, x) peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value return RemotePEB(peb_addr, self) else: #current is 32bits diff --git a/windows/wmi.py b/windows/wmi.py index e5e9692..7e3d33e 100644 --- a/windows/wmi.py +++ b/windows/wmi.py @@ -136,7 +136,7 @@ class WmiRequester(object): self.initializiated = True - def select(self, frm, attrs): + def select(self, frm, attrs="*"): """Select `attrs` from ``frm`` :rtype: list of dict