admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated doc

Browse Source
This commit is contained in:
hakril
2018-03-07 10:24:46 +01:00
parent 03e252b53a
commit 8840b9fdb9
133 changed files with 48749 additions and 36558 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/source/crypto.rst
+12 -6
View File
@@ -36,7 +36,7 @@ Certificate
.. warning::
The classes described here are under heavy test and try.
The classes described here are still under test and possible rewrite/refactor.
The classes, methods and properties described here will problably change as I haven't yet had the time
to try it out in real cases and figure out the final look of the API I want to do.
@@ -45,16 +45,17 @@ Certificate
See sample :ref:`sample_crypto_certificate`
CertificateContext
Certificate
''''''''''''''''''
.. autoclass:: CertificateContext
.. autoclass:: Certificate
:show-inheritance:
EHCERTSTORE
'''''''''''
CertificateStore
''''''''''''''''
.. autoclass:: EHCERTSTORE
.. autoclass:: CertificateStore
CryptObject
@@ -63,6 +64,11 @@ CryptObject
.. autoclass:: CryptObject
CryptMessage
''''''''''''
.. autoclass:: CryptMessage
CryptContext
''''''''''''
docs/source/generated.rst
+1 -1
View File
@@ -3,7 +3,7 @@
.. module:: windows.generated_def
:mod:`windows.generated_def` contains ``Python`` files generated by ``ctypes_generation``.
:mod:`windows.generated_def` contains ``Python`` files generated by ``ctypes_generation/``.
Those generated files includes:
docs/source/index.rst
+1
View File
@@ -34,6 +34,7 @@ Documentation
various.rst
native_exec.rst
winproxy.rst
pipe.rst
utils.rst
wintrust.rst
debug.rst
docs/source/native_exec.rst
+2 -2
View File
@@ -4,7 +4,7 @@
************************************************
:mod:`windows.native_exec` allows to create `Python` functions calling native code.
:mod:`windows.native_exec` allows to create ``Python`` functions calling native code.
it also provides a simple assembler for x86 and x64.
:mod:`windows.native_exec` provides those functions:
@@ -55,7 +55,7 @@ Its features are:
The assembler DOES NOT handle every instruction at all.
The assembler instructions are `Python` object that may accept arguments representing
The assembler instructions are ``Python`` object that may accept arguments representing
the mnemonic operands.
These parameters can be of type:
docs/source/pipe.rst
+31
View File
@@ -0,0 +1,31 @@
``windows.pipe`` -- Inter-Process Communication
***********************************************
.. module:: windows.pipe
:mod:`windows.pipe` is wrapper around :class:`_multiprocessing.PipeConnection` simplifiying its use.
The main improvement are:
- send/recv object from a pipe name in one line
- Context manager around pipe connection
.. note::
see sample :ref:`sample_pipe`
Helper functions
""""""""""""""""
.. autofunction:: create
.. autofunction:: connect
.. autofunction:: recv_object
.. autofunction:: send_object
.. autofunction:: full_pipe_address
PipeConnection
""""""""""""""
.. autoclass:: PipeConnection
docs/source/process.rst
+24 -2
View File
@@ -75,14 +75,36 @@ PEB
:members:
:inherited-members:
.. autoclass:: WinUnicodeString
LoadedModule
''''''''''''
.. autoclass:: LoadedModule
ApiSetMap
'''''''''
.. note::
see sample :ref:`sample_apisetmap`
.. autoclass:: windows.winobject.apisetmap.ApiSetMap
.. note::
Currently supported version for the ApiSetMap are 2/4/6
.. autoclass:: windows.winobject.apisetmap.ApiSetMapVersion2
:no-inherited-members:
:members: version
.. autoclass:: windows.winobject.apisetmap.ApiSetMapVersion4
:no-inherited-members:
:members: version
.. autoclass:: windows.winobject.apisetmap.ApiSetMapVersion6
:no-inherited-members:
:members: version
PEFile - Parsing loaded PE
""""""""""""""""""""""""""
docs/source/sample.rst
+25
View File
@@ -43,6 +43,17 @@ Output
.. literalinclude:: samples_output\process_peb.txt
.. _sample_apisetmap:
ApiSetMap
'''''''''
.. literalinclude:: ..\..\samples\process\apisetmap.py
Output
.. literalinclude:: samples_output\process_apisetmap.txt
.. _sample_iat_hook:
@@ -423,3 +434,17 @@ Output
.. literalinclude:: samples_output\rpc_lsass.txt
.. _sample_pipe:
:mod:`windows.pipe`
"""""""""""""""""""
Communication with an injected process
''''''''''''''''''''''''''''''''''''''
.. literalinclude:: ..\..\samples\pipe\child_send_object.py
Output
.. literalinclude:: samples_output\pipe_child_send_object.txt
docs/source/samples_output/pipe_child_send_object.txt
+9
View File
@@ -0,0 +1,9 @@
(cmd) python pipe\child_send_object.py
Child is <WinProcess "notepad.exe" pid 4316 at 0x672fcf0>
Created pipe is <PipeConnection name="\\.\pipe\PFW_Pipe" server=True>
Receiving object from injected process
Remote Address = 0x97a0000
Querying memory in target at <0x97a0000>
* <MEMORY_BASIC_INFORMATION32 BaseAddress=0x97a0000 RegionSize=0x001000 State=MEM_COMMIT(0x1000L) Type=MEM_MAPPED(0x40000L) Protect=PAGE_READWRITE(0x4L)>
Querying mapped file in target at <0x97a0000>
* \Device\HarddiskVolume2\Users\hakril\Documents\projets\PythonForWindows\samples\tst.txt
docs/source/samples_output/process_apisetmap.txt
+12
View File
@@ -0,0 +1,12 @@
(cmd) python process\apisetmap.py
Computer is a <Windows 10>
ApiSetMap: <windows.winobject.apisetmap.ApiSetMapVersion6 object at 0x0645ECB0> (version = 6)
Entries in 'apisetmap_dict' are the full api-dll path extracted
* apisetmap.apisetmap_dict['api-ms-win-core-processthreads-l1-1-3'] -> kernelbase.dll
Entries in 'resolution_dict' are the contains the util-part check by windows
* apisetmap.resolution_dict['api-ms-win-core-processthreads-l1-1-'] -> kernelbase.dll
ApiSetMap.resolve resolve a api-dll based on the util part
* apisetmap.resolve('api-ms-win-core-processthreads-l1-1-1') -> kernelbase.dll
* apisetmap.resolve('api-ms-win-core-processthreads-l1-1-2') -> kernelbase.dll
* apisetmap.resolve('api-ms-win-core-processthreads-l1-1-PART_IS_IGNORED') -> kernelbase.dll
* apisetmap.resolve('BAD_DLL-3.dll') -> raised: KeyError('BAD_DLL-',)
docs/source/samples_output/wmi_wmi_request.txt
+19 -6
View File
@@ -1,15 +1,28 @@
(cmd) python wmi\wmi_request.py
WMI requester is <windows.winobject.wmi.WmiManager object at 0x052D7CA8>
WMI requester is <windows.winobject.wmi.WmiManager object at 0x05C70CA8>
Selecting * from 'Win32_Process'
They are <224> processes
They are <188> processes
Looking for ourself via pid
Some info about our process:
* Name -> python.exe
* ProcessId -> 10136
* ProcessId -> 8144
* OSName -> Microsoft Windows 10 Home|C:\WINDOWS|\Device\Harddisk0\Partition2
* UserModeTime -> 1718750
* UserModeTime -> 1875000
* WindowsVersion -> 10.0.16299
* CommandLine -> C:\Python27\python.exe wmi\wmi_request.py
<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:
* {'Caption': u'C:', 'FreeSpace': u'15900839936', 'FileSystem': u'NTFS'}
* {'Caption': u'D:', 'FreeSpace': u'301635821568', 'FileSystem': u'NTFS'}
* {'Caption': u'C:', 'FreeSpace': u'4704194560', 'FileSystem': u'NTFS'}
* {'Caption': u'D:', 'FreeSpace': u'269887504384', 'FileSystem': u'NTFS'}
==== Advanced use ====
Listing some namespaces:
* CIMV2
* SecurityCenter2
* StandardCimv2
Querying non-default namespace: <WmiRequester namespace="root\SecurityCenter2">
Listing some available classes:
* FirewallProduct
* AntiVirusProduct
* AntiSpywareProduct
Listing <AntiVirusProduct>:
* Windows Defender
docs/source/utils.rst
+26 -1
View File
@@ -24,6 +24,29 @@ DisableWow64FsRedirection
Helper functions
""""""""""""""""
.. autofunction:: windows.utils.sprint
Example:
>>> cert
<Certificate "YOLO2" serial="6f 1d 3e 7d d9 77 59 a9 4c 1c 53 dc 80 db 0c fe">
>>> windows.utils.sprint(cert)
struct.dwCertEncodingType -> 0x1L
struct.pbCertEncoded<deref> -> 0x30
struct.cbCertEncoded -> 0x1a7L
struct.pCertInfo<deref>.dwVersion -> 0x2L
struct.pCertInfo<deref>.SerialNumber.cbData -> 0x10L
struct.pCertInfo<deref>.SerialNumber.pbData<deref> -> 0xfe
struct.pCertInfo<deref>.SignatureAlgorithm.pszObjId -> '1.2.840.113549.1.1.5'
struct.pCertInfo<deref>.SignatureAlgorithm.Parameters.cbData -> 0x2L
struct.pCertInfo<deref>.SignatureAlgorithm.Parameters.pbData<deref> -> 0x5
struct.pCertInfo<deref>.Issuer.cbData -> 0x12L
struct.pCertInfo<deref>.Issuer.pbData<deref> -> 0x30
struct.pCertInfo<deref>.NotBefore.dwLowDateTime -> 0x718ddc00L
struct.pCertInfo<deref>.NotBefore.dwHighDateTime -> 0x1d249bbL
struct.pCertInfo<deref>.NotAfter.dwLowDateTime -> 0x34ef0c00L
struct.pCertInfo<deref>.NotAfter.dwHighDateTime -> 0x1d368bfL
...
.. autofunction:: windows.utils.enable_privilege
.. autofunction:: windows.utils.check_is_elevated
.. autofunction:: windows.utils.check_debug
@@ -31,4 +54,6 @@ Helper functions
.. autofunction:: windows.utils.create_console
.. autofunction:: windows.utils.pop_shell
.. autofunction:: windows.utils.create_file_from_handle
.. autofunction:: windows.utils.get_handle_from_file
.. autofunction:: windows.utils.get_handle_from_file
.. autofunction:: windows.utils.get_short_path
.. autofunction:: windows.utils.get_long_path
docs/source/windef_generated.rst
+600 -600
View File
File diff suppressed because it is too large Load Diff
docs/source/windows.rst
+2
View File
@@ -12,6 +12,7 @@ The defaults objects accessible in ``windows`` are:
* ``current_thread`` of type :class:`windows.winobject.process.CurrentThread`
The submodules that you might use by themself are:
* :mod:`windows.generated_def`
* :mod:`windows.native_exec`
* :mod:`windows.winproxy`
* :mod:`windows.wintrust`
@@ -19,6 +20,7 @@ The submodules that you might use by themself are:
* :mod:`windows.utils`
* :mod:`windows.debug`
* :mod:`windows.alpc`
* :mod:`windows.pipe`
* :mod:`windows.rpc`
* :mod:`windows.com`
docs/source/winproxy.rst
+18
View File
@@ -74,6 +74,24 @@ Calling it
windows.winproxy.Kernel32Error: VirtualAlloc: [Error 8] Not enough storage is available to process this command.
"""
Helper functions
""""""""""""""""
.. autofunction:: is_implemented
Example:
>>> windows.winproxy.is_implemented(windows.winproxy.NtWow64WriteVirtualMemory64)
True
.. autofunction:: resolve
Example:
>>> hex(windows.winproxy.resolve(windows.winproxy.NtWow64WriteVirtualMemory64))
'0x77340520'
Kernel32Error
"""""""""""""
docs/source/winstructs_generated.rst
+1 -1
View File
@@ -1,4 +1,4 @@
.. currentmodule:: windows.generated_def
.. currentmodule:: windows.generated_def.winstructs
Winstructs
----------
docs/source/wmi.rst
+9 -2
View File
@@ -7,8 +7,15 @@ WMI -- Make request to WMI
See sample :ref:`wmi_request`
.. autoclass:: WmiRequester
WmiManager
""""""""""
.. autoclass:: WmiManager
:no-inherited-members:
:members: select, query, namespaces
:members: DEFAULT_NAMESPACE, select, query, namespaces
WmiRequester
""""""""""""
.. autoclass:: WmiRequester