diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 2517ead..01d07a2 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,14 +1,18 @@ -# V0.1 name: Pytest -on: [push, pull_request, workflow_dispatch] +on: + push: + branches: + - 'master' + pull_request: # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + jobs: generate_ctypes: runs-on: windows-latest timeout-minutes: 5 - steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 @@ -19,7 +23,6 @@ jobs: - name: Check generated code can execute run: py -c "import windows.generated_def" tests: - # Not a real dependency : but starting tests when ctypes generation is broken is not useful strategy: fail-fast: false matrix: @@ -32,7 +35,7 @@ jobs: python-architecture: x86 - python-bitness-to-test: 64 python-architecture: x64 - + # Not a real dependency : but starting tests when ctypes generation is broken is not useful needs: generate_ctypes timeout-minutes: 15 runs-on: ${{ matrix.runs-on }} @@ -76,11 +79,11 @@ jobs: py -${{ matrix.python-version}}-64 setup.py install - name: Installing pytest & capstone-windows - run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest capstone-windows + run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest pytest-timeout capstone-windows # Testing - name: Testing - run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -k "not known_to_fail" -v tests/ + run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -v tests/ - name: Publish PyTest Results uses: EnricoMi/publish-unit-test-result-action/windows@v2 @@ -90,4 +93,4 @@ jobs: check_name: PyTest Results for ${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} secondary_rate_limit_wait_seconds: 90 seconds_between_github_writes: 10 - seconds_between_github_reads: 1 \ No newline at end of file + seconds_between_github_reads: 1 diff --git a/.gitignore b/.gitignore index d379928..d7fcbae 100644 --- a/.gitignore +++ b/.gitignore @@ -3,7 +3,12 @@ doctrees *.inv *.pickle *.ignore +*.code-workspace .vscode/ .cache/ -dist/ \ No newline at end of file +dist/ +build/ +docs/BuildDocEnv/ +playground/ +*egg-info/ \ No newline at end of file diff --git a/ctypes_generation/definitions/functions/process.txt b/ctypes_generation/definitions/functions/process.txt index 96ea4ca..36f4c21 100644 --- a/ctypes_generation/definitions/functions/process.txt +++ b/ctypes_generation/definitions/functions/process.txt @@ -63,4 +63,10 @@ HMODULE LoadLibraryExW( BOOL FreeLibrary( HMODULE hLibModule -); \ No newline at end of file +); + + +/* Not documented by seems present since dawn of time (WRK) + I Prefere PVOID as a return value to allow simple cast to PEB subclass in process.py*/ + +PVOID RtlGetCurrentPeb (); \ No newline at end of file diff --git a/ctypes_generation/definitions/structures/simple_structs.txt b/ctypes_generation/definitions/structures/simple_structs.txt new file mode 100644 index 0000000..535b363 --- /dev/null +++ b/ctypes_generation/definitions/structures/simple_structs.txt @@ -0,0 +1,29 @@ +/* Structures that do not depends on anything other that basic type + Simplify structure dependancy file graph +*/ + +typedef struct _LIST_ENTRY { + struct _LIST_ENTRY *Flink; + struct _LIST_ENTRY *Blink; +} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; + +typedef struct _LSA_UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0 +} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; + +typedef struct _CLIENT_ID{ + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, *PCLIENT_ID; + +typedef struct _CLIENT_ID64{ + ULONG64 UniqueProcess; + ULONG64 UniqueThread; +} CLIENT_ID64, *PCLIENT_ID64; + +typedef struct _CLIENT_ID32{ + ULONG UniqueProcess; + ULONG UniqueThread; +} CLIENT_ID32, *PCLIENT_ID32; \ No newline at end of file diff --git a/ctypes_generation/definitions/structures/teb_peb.txt b/ctypes_generation/definitions/structures/teb_peb.txt new file mode 100644 index 0000000..3bde0b3 --- /dev/null +++ b/ctypes_generation/definitions/structures/teb_peb.txt @@ -0,0 +1,237 @@ +/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10 + http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html +*/ + +typedef struct _CURDIR +{ + UNICODE_STRING DosPath; + PVOID Handle; +} CURDIR, *PCURDIR; + +typedef struct _RTL_DRIVE_LETTER_CURDIR +{ + WORD Flags; + WORD Length; + ULONG TimeStamp; + UNICODE_STRING DosPath; +} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; + +typedef struct _RTL_USER_PROCESS_PARAMETERS +{ + ULONG MaximumLength; + ULONG Length; + ULONG Flags; + ULONG DebugFlags; + PVOID ConsoleHandle; + ULONG ConsoleFlags; + PVOID StandardInput; + PVOID StandardOutput; + PVOID StandardError; + CURDIR CurrentDirectory; + UNICODE_STRING DllPath; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; + PVOID Environment; + ULONG StartingX; + ULONG StartingY; + ULONG CountX; + ULONG CountY; + ULONG CountCharsX; + ULONG CountCharsY; + ULONG FillAttribute; + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING WindowTitle; + UNICODE_STRING DesktopInfo; + UNICODE_STRING ShellInfo; + UNICODE_STRING RuntimeData; + RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32]; +} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; + +// PEB: Thank to +// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx +// http://blog.rewolf.pl/blog/?p=573 +// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html + +typedef struct _LDR_DATA_TABLE_ENTRY { + PVOID Reserved1[2]; + LIST_ENTRY InMemoryOrderLinks; + PVOID Reserved2[2]; + PVOID DllBase; + PVOID EntryPoint; + PVOID SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + PVOID Reserved5[3]; + ULONG CheckSum; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +/* Definition of WinXP : Still same base in win11 with some extra field */ + +typedef struct _PEB_LDR_DATA { + ULONG Length; + BYTE Initialized; + PVOID SsHandle; + _LIST_ENTRY InLoadOrderModuleList; + _LIST_ENTRY InMemoryOrderModuleList; + _LIST_ENTRY InInitializationOrderModuleList; + PVOID EntryInProgress; + // BYTE ShutdownInProgress; // New field + // PVOID ShutdownThreadId; // New field +}PEB_LDR_DATA, *PPEB_LDR_DATA; + + + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 { + PVOID FastPebLockRoutine; + PVOID SparePtr1; + PVOID AtlThunkSListPtr; +}; + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 { + PVOID FastPebUnlockRoutine; + PVOID SparePtr2; + PVOID IFEOKey; +}; + + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 { + PVOID FreeList; + PVOID SparePebPtr0; + PVOID ApiSetMap; +}; + +typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 { + PVOID ReadOnlySharedMemoryHeap; + PVOID HotpatchInformation; + PVOID SparePvoid0; +}; + + +typedef union _ANON_PEB_UNION_1 { + PVOID KernelCallbackTable; + PVOID UserSharedInfoPtr; +}; + +typedef union _ANON_PEB_UNION_2 { + PVOID ImageProcessAffinityMask; + PVOID ActiveProcessAffinityMask; +}; + +typedef struct _PEB { + BYTE Reserved1[2]; + BYTE BeingDebugged; + BYTE Reserved2[1]; + PVOID Mutant; + PVOID ImageBaseAddress; + PPEB_LDR_DATA Ldr; + PRTL_USER_PROCESS_PARAMETERS ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID FastPebLock; + _ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02; + _ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03; + PVOID _SYSTEM_DEPENDENT_04; + union { + PVOID KernelCallbackTable; + PVOID UserSharedInfoPtr; + }; + DWORD SystemReserved; + DWORD _SYSTEM_DEPENDENT_05; + _ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06; + PVOID TlsExpansionCounter; + PVOID TlsBitmap; + DWORD TlsBitmapBits[2]; + PVOID ReadOnlySharedMemoryBase; + _ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07; + PVOID ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + DWORD NumberOfProcessors; + DWORD NtGlobalFlag; + LARGE_INTEGER CriticalSectionTimeout; + PVOID HeapSegmentReserve; + PVOID HeapSegmentCommit; + PVOID HeapDeCommitTotalFreeThreshold; + PVOID HeapDeCommitFreeBlockThreshold; + DWORD NumberOfHeaps; + DWORD MaximumNumberOfHeaps; + PVOID ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + PVOID GdiDCAttributeList; + PVOID LoaderLock; + DWORD OSMajorVersion; + DWORD OSMinorVersion; + WORD OSBuildNumber; + WORD OSCSDVersion; + DWORD OSPlatformId; + DWORD ImageSubsystem; + DWORD ImageSubsystemMajorVersion; + PVOID ImageSubsystemMinorVersion; + union { + PVOID ImageProcessAffinityMask; + PVOID ActiveProcessAffinityMask; + }; + PVOID GdiHandleBuffer[26]; + BYTE GdiHandleBuffer2[32]; + PVOID PostProcessInitRoutine; + PVOID TlsExpansionBitmap; + DWORD TlsExpansionBitmapBits[32]; + PVOID SessionId; + ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlagsUser; + PVOID pShimData; + PVOID AppCompatInfo; + UNICODE_STRING CSDVersion; + PVOID ActivationContextData; + PVOID ProcessAssemblyStorageMap; + PVOID SystemDefaultActivationContextData; + PVOID SystemAssemblyStorageMap; + PVOID MinimumStackCommit; +} PEB, *PPEB; + + +/* Partial TEB description + Based on: + - fields that did not move since XP + - https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb +*/ + +typedef struct _EXCEPTION_REGISTRATION_RECORD { + _EXCEPTION_REGISTRATION_RECORD *Next; + PVOID Handler; +}; + +typedef struct _NT_TIB { + struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList; + PVOID StackBase; + PVOID StackLimit; + PVOID SubSystemTib; + union { + PVOID FiberData; + ULONG Version; + }; + PVOID ArbitraryUserPointer; + struct _NT_TIB *Self; +} NT_TIB; + +typedef struct _TEB { + _NT_TIB NtTib; + PVOID EnvironmentPointer; + _CLIENT_ID ClientId; + PVOID ActiveRpcHandle; + PVOID ThreadLocalStoragePointer; + _PEB *ProcessEnvironmentBlock; + ULONG LastErrorValue; + ULONG CountOfOwnedCriticalSections; + PVOID CsrClientThread; + PVOID Win32ThreadInfo; + ULONG User32Reserved[26]; + ULONG UserReserved[5]; + PVOID WOW32Reserved; + ULONG CurrentLocale; + ULONG FpSoftwareStatusRegister; +} TEB; diff --git a/ctypes_generation/definitions/structures/winstruct.txt b/ctypes_generation/definitions/structures/winstruct.txt index 80ada30..713e17a 100644 --- a/ctypes_generation/definitions/structures/winstruct.txt +++ b/ctypes_generation/definitions/structures/winstruct.txt @@ -1,195 +1,3 @@ -typedef struct _LIST_ENTRY { - struct _LIST_ENTRY *Flink; - struct _LIST_ENTRY *Blink; -} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; - - -/* Definition of WinXP : Still same base in win11 with some extra field */ -typedef struct _PEB_LDR_DATA { - ULONG Length; - BYTE Initialized; - PVOID SsHandle; - _LIST_ENTRY InLoadOrderModuleList; - _LIST_ENTRY InMemoryOrderModuleList; - _LIST_ENTRY InInitializationOrderModuleList; - PVOID EntryInProgress; - // BYTE ShutdownInProgress; // New field - // PVOID ShutdownThreadId; // New field -}PEB_LDR_DATA, *PPEB_LDR_DATA; - - -typedef struct _LSA_UNICODE_STRING { - USHORT Length; - USHORT MaximumLength; - PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0 -} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING; - -typedef struct _CURDIR -{ - UNICODE_STRING DosPath; - PVOID Handle; -} CURDIR, *PCURDIR; - -typedef struct _RTL_DRIVE_LETTER_CURDIR -{ - WORD Flags; - WORD Length; - ULONG TimeStamp; - UNICODE_STRING DosPath; -} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; - -/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10 - http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html -*/ -typedef struct _RTL_USER_PROCESS_PARAMETERS -{ - ULONG MaximumLength; - ULONG Length; - ULONG Flags; - ULONG DebugFlags; - PVOID ConsoleHandle; - ULONG ConsoleFlags; - PVOID StandardInput; - PVOID StandardOutput; - PVOID StandardError; - CURDIR CurrentDirectory; - UNICODE_STRING DllPath; - UNICODE_STRING ImagePathName; - UNICODE_STRING CommandLine; - PVOID Environment; - ULONG StartingX; - ULONG StartingY; - ULONG CountX; - ULONG CountY; - ULONG CountCharsX; - ULONG CountCharsY; - ULONG FillAttribute; - ULONG WindowFlags; - ULONG ShowWindowFlags; - UNICODE_STRING WindowTitle; - UNICODE_STRING DesktopInfo; - UNICODE_STRING ShellInfo; - UNICODE_STRING RuntimeData; - RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32]; -} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; - - -// Thank to: -// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx -// http://blog.rewolf.pl/blog/?p=573 -// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 { - PVOID FastPebLockRoutine; - PVOID SparePtr1; - PVOID AtlThunkSListPtr; -}; - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 { - PVOID FastPebUnlockRoutine; - PVOID SparePtr2; - PVOID IFEOKey; -}; - - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 { - PVOID FreeList; - PVOID SparePebPtr0; - PVOID ApiSetMap; -}; - -typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 { - PVOID ReadOnlySharedMemoryHeap; - PVOID HotpatchInformation; - PVOID SparePvoid0; -}; - - -typedef union _ANON_PEB_UNION_1 { - PVOID KernelCallbackTable; - PVOID UserSharedInfoPtr; -}; - -typedef union _ANON_PEB_UNION_2 { - PVOID ImageProcessAffinityMask; - PVOID ActiveProcessAffinityMask; -}; - -typedef struct _PEB { - BYTE Reserved1[2]; - BYTE BeingDebugged; - BYTE Reserved2[1]; - PVOID Mutant; - PVOID ImageBaseAddress; - PPEB_LDR_DATA Ldr; - PRTL_USER_PROCESS_PARAMETERS ProcessParameters; - PVOID SubSystemData; - PVOID ProcessHeap; - PVOID FastPebLock; - _ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02; - _ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03; - PVOID _SYSTEM_DEPENDENT_04; - union { - PVOID KernelCallbackTable; - PVOID UserSharedInfoPtr; - }; - DWORD SystemReserved; - DWORD _SYSTEM_DEPENDENT_05; - _ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06; - PVOID TlsExpansionCounter; - PVOID TlsBitmap; - DWORD TlsBitmapBits[2]; - PVOID ReadOnlySharedMemoryBase; - _ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07; - PVOID ReadOnlyStaticServerData; - PVOID AnsiCodePageData; - PVOID OemCodePageData; - PVOID UnicodeCaseTableData; - DWORD NumberOfProcessors; - DWORD NtGlobalFlag; - LARGE_INTEGER CriticalSectionTimeout; - PVOID HeapSegmentReserve; - PVOID HeapSegmentCommit; - PVOID HeapDeCommitTotalFreeThreshold; - PVOID HeapDeCommitFreeBlockThreshold; - DWORD NumberOfHeaps; - DWORD MaximumNumberOfHeaps; - PVOID ProcessHeaps; - PVOID GdiSharedHandleTable; - PVOID ProcessStarterHelper; - PVOID GdiDCAttributeList; - PVOID LoaderLock; - DWORD OSMajorVersion; - DWORD OSMinorVersion; - WORD OSBuildNumber; - WORD OSCSDVersion; - DWORD OSPlatformId; - DWORD ImageSubsystem; - DWORD ImageSubsystemMajorVersion; - PVOID ImageSubsystemMinorVersion; - union { - PVOID ImageProcessAffinityMask; - PVOID ActiveProcessAffinityMask; - }; - PVOID GdiHandleBuffer[26]; - BYTE GdiHandleBuffer2[32]; - PVOID PostProcessInitRoutine; - PVOID TlsExpansionBitmap; - DWORD TlsExpansionBitmapBits[32]; - PVOID SessionId; - ULARGE_INTEGER AppCompatFlags; - ULARGE_INTEGER AppCompatFlagsUser; - PVOID pShimData; - PVOID AppCompatInfo; - UNICODE_STRING CSDVersion; - PVOID ActivationContextData; - PVOID ProcessAssemblyStorageMap; - PVOID SystemDefaultActivationContextData; - PVOID SystemAssemblyStorageMap; - PVOID MinimumStackCommit; -} PEB, *PPEB; - - typedef struct _SECURITY_ATTRIBUTES { DWORD nLength; LPVOID lpSecurityDescriptor; @@ -870,34 +678,7 @@ typedef enum _SE_OBJECT_TYPE { } SE_OBJECT_TYPE; -typedef struct _CLIENT_ID{ - HANDLE UniqueProcess; - HANDLE UniqueThread; -} CLIENT_ID, *PCLIENT_ID; -typedef struct _CLIENT_ID64{ - ULONG64 UniqueProcess; - ULONG64 UniqueThread; -} CLIENT_ID64, *PCLIENT_ID64; - -typedef struct _CLIENT_ID32{ - ULONG UniqueProcess; - ULONG UniqueThread; -} CLIENT_ID32, *PCLIENT_ID32; - -typedef struct _LDR_DATA_TABLE_ENTRY { - PVOID Reserved1[2]; - LIST_ENTRY InMemoryOrderLinks; - PVOID Reserved2[2]; - PVOID DllBase; - PVOID EntryPoint; - PVOID SizeOfImage; - UNICODE_STRING FullDllName; - UNICODE_STRING BaseDllName; - PVOID Reserved5[3]; - ULONG CheckSum; - ULONG TimeDateStamp; -} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; typedef struct _MEMORY_BASIC_INFORMATION { diff --git a/ctypes_generation/extended_structs/_LIST_ENTRY.py b/ctypes_generation/extended_structs/_LIST_ENTRY.py new file mode 100644 index 0000000..bb706a8 --- /dev/null +++ b/ctypes_generation/extended_structs/_LIST_ENTRY.py @@ -0,0 +1,18 @@ +# From: ctypes_generation\extended_structs\_LIST_ENTRY.py +# _LIST_ENTRY is a self referencing structure +# Currently ctypes generation does not support extending self referencing structures +# Ass the _fields_ assignement should happen after the extended structure definition +# So we just redefine fully _LIST_ENTRY without inheriting the real one + +class _LIST_ENTRY(Structure): + def get_real_struct(self, targetcls, target_field): + # >>> gdef.LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks + # + # This field object does not allow to retrieve the type.. + # So we need to basse the target class AND the target field.. + return targetcls.from_address(ctypes.addressof(self) - target_field.offset) + +_LIST_ENTRY._fields_ = [ + ("Flink", POINTER(_LIST_ENTRY)), + ("Blink", POINTER(_LIST_ENTRY)), +] \ No newline at end of file diff --git a/ctypes_generation/winstruct.py b/ctypes_generation/winstruct.py index 0645f16..c9179fa 100644 --- a/ctypes_generation/winstruct.py +++ b/ctypes_generation/winstruct.py @@ -123,8 +123,9 @@ class WinStruct(object): def generate_selfref_ctypes_class(self): res = ["# Self referencing struct tricks"] - res += ["""class {0}(Structure): pass""".format(self.name)] - # res += [self.generate_anonymous_union()] + res += ["""class {0}(Structure):""".format(self.name)] + # We need some code in the def of anon is empty -> insert path + res += [self.generate_anonymous_union() or " pass"] res += [self.generate_typedef_ctypes()] if self.pack: diff --git a/docs/source/winfuncs_generated.rst b/docs/source/winfuncs_generated.rst index 80cb453..bc279ee 100644 --- a/docs/source/winfuncs_generated.rst +++ b/docs/source/winfuncs_generated.rst @@ -696,6 +696,8 @@ Functions .. function:: FreeLibrary(hLibModule) +.. function:: RtlGetCurrentPeb() + .. function:: RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData) .. function:: RegQueryValueExW(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData) diff --git a/docs/source/winstructs_generated.rst b/docs/source/winstructs_generated.rst index dabdef8..9abcbe3 100644 --- a/docs/source/winstructs_generated.rst +++ b/docs/source/winstructs_generated.rst @@ -8509,6 +8509,128 @@ _SHFILEOPSTRUCTA :class:`PCSTR` +_LIST_ENTRY +''''''''''' +.. class:: LIST_ENTRY + + Alias for :class:`_LIST_ENTRY` + +.. class:: PLIST_ENTRY + + Pointer to :class:`_LIST_ENTRY` + +.. class:: PRLIST_ENTRY + + Pointer to :class:`_LIST_ENTRY` + +.. class:: _LIST_ENTRY + + .. attribute:: Flink + + :class:`_LIST_ENTRY` + + + .. attribute:: Blink + + :class:`_LIST_ENTRY` + +_LSA_UNICODE_STRING +''''''''''''''''''' +.. class:: LSA_UNICODE_STRING + + Alias for :class:`_LSA_UNICODE_STRING` + +.. class:: PLSA_UNICODE_STRING + + Pointer to :class:`_LSA_UNICODE_STRING` + +.. class:: PUNICODE_STRING + + Pointer to :class:`_LSA_UNICODE_STRING` + +.. class:: UNICODE_STRING + + Alias for :class:`_LSA_UNICODE_STRING` + +.. class:: _LSA_UNICODE_STRING + + .. attribute:: Length + + :class:`USHORT` + + + .. attribute:: MaximumLength + + :class:`USHORT` + + + .. attribute:: Buffer + + :class:`PVOID` + +_CLIENT_ID +'''''''''' +.. class:: CLIENT_ID + + Alias for :class:`_CLIENT_ID` + +.. class:: PCLIENT_ID + + Pointer to :class:`_CLIENT_ID` + +.. class:: _CLIENT_ID + + .. attribute:: UniqueProcess + + :class:`HANDLE` + + + .. attribute:: UniqueThread + + :class:`HANDLE` + +_CLIENT_ID64 +'''''''''''' +.. class:: CLIENT_ID64 + + Alias for :class:`_CLIENT_ID64` + +.. class:: PCLIENT_ID64 + + Pointer to :class:`_CLIENT_ID64` + +.. class:: _CLIENT_ID64 + + .. attribute:: UniqueProcess + + :class:`ULONG64` + + + .. attribute:: UniqueThread + + :class:`ULONG64` + +_CLIENT_ID32 +'''''''''''' +.. class:: CLIENT_ID32 + + Alias for :class:`_CLIENT_ID32` + +.. class:: PCLIENT_ID32 + + Pointer to :class:`_CLIENT_ID32` + +.. class:: _CLIENT_ID32 + + .. attribute:: UniqueProcess + + :class:`ULONG` + + + .. attribute:: UniqueThread + + :class:`ULONG` + _IMAGEHLP_MODULE64 '''''''''''''''''' .. class:: IMAGEHLP_MODULE64 @@ -9971,6 +10093,1121 @@ _tagSTACKFRAME_EX :class:`DWORD` +_SYSTEM_PROCESS_INFORMATION +''''''''''''''''''''''''''' +.. class:: PSYSTEM_PROCESS_INFORMATION + + Pointer to :class:`_SYSTEM_PROCESS_INFORMATION` + +.. class:: SYSTEM_PROCESS_INFORMATION + + Alias for :class:`_SYSTEM_PROCESS_INFORMATION` + +.. class:: _SYSTEM_PROCESS_INFORMATION + + .. attribute:: NextEntryOffset + + :class:`ULONG` + + + .. attribute:: NumberOfThreads + + :class:`ULONG` + + + .. attribute:: Reserved1 + + :class:`BYTE` ``[24]`` + + + .. attribute:: CreateTime + + :class:`LARGE_INTEGER` + + + .. attribute:: UserTime + + :class:`LARGE_INTEGER` + + + .. attribute:: KernelTime + + :class:`LARGE_INTEGER` + + + .. attribute:: ImageName + + :class:`UNICODE_STRING` + + + .. attribute:: BasePriority + + :class:`LONG` + + + .. attribute:: UniqueProcessId + + :class:`HANDLE` + + + .. attribute:: InheritedFromUniqueProcessId + + :class:`PVOID` + + + .. attribute:: HandleCount + + :class:`ULONG` + + + .. attribute:: Reserved4 + + :class:`BYTE` ``[4]`` + + + .. attribute:: Reserved5 + + :class:`PVOID` + + + .. attribute:: PeakVirtualSize + + :class:`PVOID` + + + .. attribute:: VirtualSize + + :class:`PVOID` + + + .. attribute:: PageFaultCount + + :class:`PVOID` + + + .. attribute:: PeakWorkingSetSize + + :class:`PVOID` + + + .. attribute:: WorkingSetSize + + :class:`PVOID` + + + .. attribute:: QuotaPeakPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaPeakNonPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaNonPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: PagefileUsage + + :class:`PVOID` + + + .. attribute:: PeakPagefileUsage + + :class:`SIZE_T` + + + .. attribute:: PrivatePageCount + + :class:`SIZE_T` + + + .. attribute:: Reserved6 + + :class:`LARGE_INTEGER` ``[6]`` + +_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION +''''''''''''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + Pointer to :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` + +.. class:: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + Alias for :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` + +.. class:: _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + .. attribute:: IdleTime + + :class:`LARGE_INTEGER` + + + .. attribute:: KernelTime + + :class:`LARGE_INTEGER` + + + .. attribute:: UserTime + + :class:`LARGE_INTEGER` + + + .. attribute:: Reserved1 + + :class:`LARGE_INTEGER` ``[2]`` + + + .. attribute:: Reserved2 + + :class:`ULONG` + +_SYSTEM_REGISTRY_QUOTA_INFORMATION +'''''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_REGISTRY_QUOTA_INFORMATION + + Pointer to :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` + +.. class:: SYSTEM_REGISTRY_QUOTA_INFORMATION + + Alias for :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` + +.. class:: _SYSTEM_REGISTRY_QUOTA_INFORMATION + + .. attribute:: RegistryQuotaAllowed + + :class:`ULONG` + + + .. attribute:: RegistryQuotaUsed + + :class:`ULONG` + + + .. attribute:: Reserved1 + + :class:`PVOID` + +_SYSTEM_BASIC_INFORMATION +''''''''''''''''''''''''' +.. class:: PSYSTEM_BASIC_INFORMATION + + Pointer to :class:`_SYSTEM_BASIC_INFORMATION` + +.. class:: SYSTEM_BASIC_INFORMATION + + Alias for :class:`_SYSTEM_BASIC_INFORMATION` + +.. class:: _SYSTEM_BASIC_INFORMATION + + .. attribute:: Reserved1 + + :class:`BYTE` ``[24]`` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[4]`` + + + .. attribute:: NumberOfProcessors + + :class:`CHAR` + +_CURDIR +''''''' +.. class:: CURDIR + + Alias for :class:`_CURDIR` + +.. class:: PCURDIR + + Pointer to :class:`_CURDIR` + +.. class:: _CURDIR + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + + + .. attribute:: Handle + + :class:`PVOID` + +_RTL_DRIVE_LETTER_CURDIR +'''''''''''''''''''''''' +.. class:: PRTL_DRIVE_LETTER_CURDIR + + Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: RTL_DRIVE_LETTER_CURDIR + + Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: _RTL_DRIVE_LETTER_CURDIR + + .. attribute:: Flags + + :class:`WORD` + + + .. attribute:: Length + + :class:`WORD` + + + .. attribute:: TimeStamp + + :class:`ULONG` + + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + +_RTL_USER_PROCESS_PARAMETERS +'''''''''''''''''''''''''''' +.. class:: PRTL_USER_PROCESS_PARAMETERS + + Pointer to :class:`_RTL_USER_PROCESS_PARAMETERS` + +.. class:: RTL_USER_PROCESS_PARAMETERS + + Alias for :class:`_RTL_USER_PROCESS_PARAMETERS` + +.. class:: _RTL_USER_PROCESS_PARAMETERS + + .. attribute:: MaximumLength + + :class:`ULONG` + + + .. attribute:: Length + + :class:`ULONG` + + + .. attribute:: Flags + + :class:`ULONG` + + + .. attribute:: DebugFlags + + :class:`ULONG` + + + .. attribute:: ConsoleHandle + + :class:`PVOID` + + + .. attribute:: ConsoleFlags + + :class:`ULONG` + + + .. attribute:: StandardInput + + :class:`PVOID` + + + .. attribute:: StandardOutput + + :class:`PVOID` + + + .. attribute:: StandardError + + :class:`PVOID` + + + .. attribute:: CurrentDirectory + + :class:`CURDIR` + + + .. attribute:: DllPath + + :class:`UNICODE_STRING` + + + .. attribute:: ImagePathName + + :class:`UNICODE_STRING` + + + .. attribute:: CommandLine + + :class:`UNICODE_STRING` + + + .. attribute:: Environment + + :class:`PVOID` + + + .. attribute:: StartingX + + :class:`ULONG` + + + .. attribute:: StartingY + + :class:`ULONG` + + + .. attribute:: CountX + + :class:`ULONG` + + + .. attribute:: CountY + + :class:`ULONG` + + + .. attribute:: CountCharsX + + :class:`ULONG` + + + .. attribute:: CountCharsY + + :class:`ULONG` + + + .. attribute:: FillAttribute + + :class:`ULONG` + + + .. attribute:: WindowFlags + + :class:`ULONG` + + + .. attribute:: ShowWindowFlags + + :class:`ULONG` + + + .. attribute:: WindowTitle + + :class:`UNICODE_STRING` + + + .. attribute:: DesktopInfo + + :class:`UNICODE_STRING` + + + .. attribute:: ShellInfo + + :class:`UNICODE_STRING` + + + .. attribute:: RuntimeData + + :class:`UNICODE_STRING` + + + .. attribute:: CurrentDirectores + + :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` + +_LDR_DATA_TABLE_ENTRY +''''''''''''''''''''' +.. class:: LDR_DATA_TABLE_ENTRY + + Alias for :class:`_LDR_DATA_TABLE_ENTRY` + +.. class:: PLDR_DATA_TABLE_ENTRY + + Pointer to :class:`_LDR_DATA_TABLE_ENTRY` + +.. class:: _LDR_DATA_TABLE_ENTRY + + .. attribute:: Reserved1 + + :class:`PVOID` ``[2]`` + + + .. attribute:: InMemoryOrderLinks + + :class:`LIST_ENTRY` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[2]`` + + + .. attribute:: DllBase + + :class:`PVOID` + + + .. attribute:: EntryPoint + + :class:`PVOID` + + + .. attribute:: SizeOfImage + + :class:`PVOID` + + + .. attribute:: FullDllName + + :class:`UNICODE_STRING` + + + .. attribute:: BaseDllName + + :class:`UNICODE_STRING` + + + .. attribute:: Reserved5 + + :class:`PVOID` ``[3]`` + + + .. attribute:: CheckSum + + :class:`ULONG` + + + .. attribute:: TimeDateStamp + + :class:`ULONG` + +_PEB_LDR_DATA +''''''''''''' +.. class:: PEB_LDR_DATA + + Alias for :class:`_PEB_LDR_DATA` + +.. class:: PPEB_LDR_DATA + + Pointer to :class:`_PEB_LDR_DATA` + +.. class:: _PEB_LDR_DATA + + .. attribute:: Length + + :class:`ULONG` + + + .. attribute:: Initialized + + :class:`BYTE` + + + .. attribute:: SsHandle + + :class:`PVOID` + + + .. attribute:: InLoadOrderModuleList + + :class:`_LIST_ENTRY` + + + .. attribute:: InMemoryOrderModuleList + + :class:`_LIST_ENTRY` + + + .. attribute:: InInitializationOrderModuleList + + :class:`_LIST_ENTRY` + + + .. attribute:: EntryInProgress + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_02 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_02 + + .. attribute:: FastPebLockRoutine + + :class:`PVOID` + + + .. attribute:: SparePtr1 + + :class:`PVOID` + + + .. attribute:: AtlThunkSListPtr + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_03 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_03 + + .. attribute:: FastPebUnlockRoutine + + :class:`PVOID` + + + .. attribute:: SparePtr2 + + :class:`PVOID` + + + .. attribute:: IFEOKey + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_06 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_06 + + .. attribute:: FreeList + + :class:`PVOID` + + + .. attribute:: SparePebPtr0 + + :class:`PVOID` + + + .. attribute:: ApiSetMap + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_07 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_07 + + .. attribute:: ReadOnlySharedMemoryHeap + + :class:`PVOID` + + + .. attribute:: HotpatchInformation + + :class:`PVOID` + + + .. attribute:: SparePvoid0 + + :class:`PVOID` + +_ANON_PEB_UNION_1 +''''''''''''''''' +.. class:: _ANON_PEB_UNION_1 + + .. attribute:: KernelCallbackTable + + :class:`PVOID` + + + .. attribute:: UserSharedInfoPtr + + :class:`PVOID` + +_ANON_PEB_UNION_2 +''''''''''''''''' +.. class:: _ANON_PEB_UNION_2 + + .. attribute:: ImageProcessAffinityMask + + :class:`PVOID` + + + .. attribute:: ActiveProcessAffinityMask + + :class:`PVOID` + +_PEB +'''' +.. class:: PEB + + Alias for :class:`_PEB` + +.. class:: PPEB + + Pointer to :class:`_PEB` + +.. class:: _PEB + + .. attribute:: Reserved1 + + :class:`BYTE` ``[2]`` + + + .. attribute:: BeingDebugged + + :class:`BYTE` + + + .. attribute:: Reserved2 + + :class:`BYTE` + + + .. attribute:: Mutant + + :class:`PVOID` + + + .. attribute:: ImageBaseAddress + + :class:`PVOID` + + + .. attribute:: Ldr + + :class:`PPEB_LDR_DATA` + + + .. attribute:: ProcessParameters + + :class:`PRTL_USER_PROCESS_PARAMETERS` + + + .. attribute:: SubSystemData + + :class:`PVOID` + + + .. attribute:: ProcessHeap + + :class:`PVOID` + + + .. attribute:: FastPebLock + + :class:`PVOID` + + + .. attribute:: _SYSTEM_DEPENDENT_02 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_02` + + + .. attribute:: _SYSTEM_DEPENDENT_03 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_03` + + + .. attribute:: _SYSTEM_DEPENDENT_04 + + :class:`PVOID` + + + .. attribute:: anon_01 + + :class:`_ANON__PEB_SUB_UNION_1` + + + .. attribute:: SystemReserved + + :class:`DWORD` + + + .. attribute:: _SYSTEM_DEPENDENT_05 + + :class:`DWORD` + + + .. attribute:: _SYSTEM_DEPENDENT_06 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_06` + + + .. attribute:: TlsExpansionCounter + + :class:`PVOID` + + + .. attribute:: TlsBitmap + + :class:`PVOID` + + + .. attribute:: TlsBitmapBits + + :class:`DWORD` ``[2]`` + + + .. attribute:: ReadOnlySharedMemoryBase + + :class:`PVOID` + + + .. attribute:: _SYSTEM_DEPENDENT_07 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_07` + + + .. attribute:: ReadOnlyStaticServerData + + :class:`PVOID` + + + .. attribute:: AnsiCodePageData + + :class:`PVOID` + + + .. attribute:: OemCodePageData + + :class:`PVOID` + + + .. attribute:: UnicodeCaseTableData + + :class:`PVOID` + + + .. attribute:: NumberOfProcessors + + :class:`DWORD` + + + .. attribute:: NtGlobalFlag + + :class:`DWORD` + + + .. attribute:: CriticalSectionTimeout + + :class:`LARGE_INTEGER` + + + .. attribute:: HeapSegmentReserve + + :class:`PVOID` + + + .. attribute:: HeapSegmentCommit + + :class:`PVOID` + + + .. attribute:: HeapDeCommitTotalFreeThreshold + + :class:`PVOID` + + + .. attribute:: HeapDeCommitFreeBlockThreshold + + :class:`PVOID` + + + .. attribute:: NumberOfHeaps + + :class:`DWORD` + + + .. attribute:: MaximumNumberOfHeaps + + :class:`DWORD` + + + .. attribute:: ProcessHeaps + + :class:`PVOID` + + + .. attribute:: GdiSharedHandleTable + + :class:`PVOID` + + + .. attribute:: ProcessStarterHelper + + :class:`PVOID` + + + .. attribute:: GdiDCAttributeList + + :class:`PVOID` + + + .. attribute:: LoaderLock + + :class:`PVOID` + + + .. attribute:: OSMajorVersion + + :class:`DWORD` + + + .. attribute:: OSMinorVersion + + :class:`DWORD` + + + .. attribute:: OSBuildNumber + + :class:`WORD` + + + .. attribute:: OSCSDVersion + + :class:`WORD` + + + .. attribute:: OSPlatformId + + :class:`DWORD` + + + .. attribute:: ImageSubsystem + + :class:`DWORD` + + + .. attribute:: ImageSubsystemMajorVersion + + :class:`DWORD` + + + .. attribute:: ImageSubsystemMinorVersion + + :class:`PVOID` + + + .. attribute:: anon_02 + + :class:`_ANON__PEB_SUB_UNION_2` + + + .. attribute:: GdiHandleBuffer + + :class:`PVOID` ``[26]`` + + + .. attribute:: GdiHandleBuffer2 + + :class:`BYTE` ``[32]`` + + + .. attribute:: PostProcessInitRoutine + + :class:`PVOID` + + + .. attribute:: TlsExpansionBitmap + + :class:`PVOID` + + + .. attribute:: TlsExpansionBitmapBits + + :class:`DWORD` ``[32]`` + + + .. attribute:: SessionId + + :class:`PVOID` + + + .. attribute:: AppCompatFlags + + :class:`ULARGE_INTEGER` + + + .. attribute:: AppCompatFlagsUser + + :class:`ULARGE_INTEGER` + + + .. attribute:: pShimData + + :class:`PVOID` + + + .. attribute:: AppCompatInfo + + :class:`PVOID` + + + .. attribute:: CSDVersion + + :class:`UNICODE_STRING` + + + .. attribute:: ActivationContextData + + :class:`PVOID` + + + .. attribute:: ProcessAssemblyStorageMap + + :class:`PVOID` + + + .. attribute:: SystemDefaultActivationContextData + + :class:`PVOID` + + + .. attribute:: SystemAssemblyStorageMap + + :class:`PVOID` + + + .. attribute:: MinimumStackCommit + + :class:`PVOID` + +_EXCEPTION_REGISTRATION_RECORD +'''''''''''''''''''''''''''''' +.. class:: _EXCEPTION_REGISTRATION_RECORD + + .. attribute:: Next + + :class:`_EXCEPTION_REGISTRATION_RECORD` + + + .. attribute:: Handler + + :class:`PVOID` + +_NT_TIB +''''''' +.. class:: NT_TIB + + Alias for :class:`_NT_TIB` + +.. class:: _NT_TIB + + .. attribute:: ExceptionList + + :class:`_EXCEPTION_REGISTRATION_RECORD` + + + .. attribute:: StackBase + + :class:`PVOID` + + + .. attribute:: StackLimit + + :class:`PVOID` + + + .. attribute:: SubSystemTib + + :class:`PVOID` + + + .. attribute:: anon_01 + + :class:`_ANON__NT_TIB_SUB_UNION_1` + + + .. attribute:: ArbitraryUserPointer + + :class:`PVOID` + + + .. attribute:: Self + + :class:`_NT_TIB` + +_TEB +'''' +.. class:: TEB + + Alias for :class:`_TEB` + +.. class:: _TEB + + .. attribute:: NtTib + + :class:`_NT_TIB` + + + .. attribute:: EnvironmentPointer + + :class:`PVOID` + + + .. attribute:: ClientId + + :class:`_CLIENT_ID` + + + .. attribute:: ActiveRpcHandle + + :class:`PVOID` + + + .. attribute:: ThreadLocalStoragePointer + + :class:`PVOID` + + + .. attribute:: ProcessEnvironmentBlock + + :class:`_PEB` + + + .. attribute:: LastErrorValue + + :class:`ULONG` + + + .. attribute:: CountOfOwnedCriticalSections + + :class:`ULONG` + + + .. attribute:: CsrClientThread + + :class:`PVOID` + + + .. attribute:: Win32ThreadInfo + + :class:`PVOID` + + + .. attribute:: User32Reserved + + :class:`ULONG` ``[26]`` + + + .. attribute:: UserReserved + + :class:`ULONG` ``[5]`` + + + .. attribute:: WOW32Reserved + + :class:`PVOID` + + + .. attribute:: CurrentLocale + + :class:`ULONG` + + + .. attribute:: FpSoftwareStatusRegister + + :class:`ULONG` + _TRACE_PROVIDER_INFO '''''''''''''''''''' .. class:: TRACE_PROVIDER_INFO @@ -10484,748 +11721,6 @@ tagWNDCLASSEXW :class:`HICON` -_LIST_ENTRY -''''''''''' -.. class:: LIST_ENTRY - - Alias for :class:`_LIST_ENTRY` - -.. class:: PLIST_ENTRY - - Pointer to :class:`_LIST_ENTRY` - -.. class:: PRLIST_ENTRY - - Pointer to :class:`_LIST_ENTRY` - -.. class:: _LIST_ENTRY - - .. attribute:: Flink - - :class:`_LIST_ENTRY` - - - .. attribute:: Blink - - :class:`_LIST_ENTRY` - -_PEB_LDR_DATA -''''''''''''' -.. class:: PEB_LDR_DATA - - Alias for :class:`_PEB_LDR_DATA` - -.. class:: PPEB_LDR_DATA - - Pointer to :class:`_PEB_LDR_DATA` - -.. class:: _PEB_LDR_DATA - - .. attribute:: Length - - :class:`ULONG` - - - .. attribute:: Initialized - - :class:`BYTE` - - - .. attribute:: SsHandle - - :class:`PVOID` - - - .. attribute:: InLoadOrderModuleList - - :class:`_LIST_ENTRY` - - - .. attribute:: InMemoryOrderModuleList - - :class:`_LIST_ENTRY` - - - .. attribute:: InInitializationOrderModuleList - - :class:`_LIST_ENTRY` - - - .. attribute:: EntryInProgress - - :class:`PVOID` - -_LSA_UNICODE_STRING -''''''''''''''''''' -.. class:: LSA_UNICODE_STRING - - Alias for :class:`_LSA_UNICODE_STRING` - -.. class:: PLSA_UNICODE_STRING - - Pointer to :class:`_LSA_UNICODE_STRING` - -.. class:: PUNICODE_STRING - - Pointer to :class:`_LSA_UNICODE_STRING` - -.. class:: UNICODE_STRING - - Alias for :class:`_LSA_UNICODE_STRING` - -.. class:: _LSA_UNICODE_STRING - - .. attribute:: Length - - :class:`USHORT` - - - .. attribute:: MaximumLength - - :class:`USHORT` - - - .. attribute:: Buffer - - :class:`PVOID` - -_CURDIR -''''''' -.. class:: CURDIR - - Alias for :class:`_CURDIR` - -.. class:: PCURDIR - - Pointer to :class:`_CURDIR` - -.. class:: _CURDIR - - .. attribute:: DosPath - - :class:`UNICODE_STRING` - - - .. attribute:: Handle - - :class:`PVOID` - -_RTL_DRIVE_LETTER_CURDIR -'''''''''''''''''''''''' -.. class:: PRTL_DRIVE_LETTER_CURDIR - - Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` - -.. class:: RTL_DRIVE_LETTER_CURDIR - - Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` - -.. class:: _RTL_DRIVE_LETTER_CURDIR - - .. attribute:: Flags - - :class:`WORD` - - - .. attribute:: Length - - :class:`WORD` - - - .. attribute:: TimeStamp - - :class:`ULONG` - - - .. attribute:: DosPath - - :class:`UNICODE_STRING` - -_RTL_USER_PROCESS_PARAMETERS -'''''''''''''''''''''''''''' -.. class:: PRTL_USER_PROCESS_PARAMETERS - - Pointer to :class:`_RTL_USER_PROCESS_PARAMETERS` - -.. class:: RTL_USER_PROCESS_PARAMETERS - - Alias for :class:`_RTL_USER_PROCESS_PARAMETERS` - -.. class:: _RTL_USER_PROCESS_PARAMETERS - - .. attribute:: MaximumLength - - :class:`ULONG` - - - .. attribute:: Length - - :class:`ULONG` - - - .. attribute:: Flags - - :class:`ULONG` - - - .. attribute:: DebugFlags - - :class:`ULONG` - - - .. attribute:: ConsoleHandle - - :class:`PVOID` - - - .. attribute:: ConsoleFlags - - :class:`ULONG` - - - .. attribute:: StandardInput - - :class:`PVOID` - - - .. attribute:: StandardOutput - - :class:`PVOID` - - - .. attribute:: StandardError - - :class:`PVOID` - - - .. attribute:: CurrentDirectory - - :class:`CURDIR` - - - .. attribute:: DllPath - - :class:`UNICODE_STRING` - - - .. attribute:: ImagePathName - - :class:`UNICODE_STRING` - - - .. attribute:: CommandLine - - :class:`UNICODE_STRING` - - - .. attribute:: Environment - - :class:`PVOID` - - - .. attribute:: StartingX - - :class:`ULONG` - - - .. attribute:: StartingY - - :class:`ULONG` - - - .. attribute:: CountX - - :class:`ULONG` - - - .. attribute:: CountY - - :class:`ULONG` - - - .. attribute:: CountCharsX - - :class:`ULONG` - - - .. attribute:: CountCharsY - - :class:`ULONG` - - - .. attribute:: FillAttribute - - :class:`ULONG` - - - .. attribute:: WindowFlags - - :class:`ULONG` - - - .. attribute:: ShowWindowFlags - - :class:`ULONG` - - - .. attribute:: WindowTitle - - :class:`UNICODE_STRING` - - - .. attribute:: DesktopInfo - - :class:`UNICODE_STRING` - - - .. attribute:: ShellInfo - - :class:`UNICODE_STRING` - - - .. attribute:: RuntimeData - - :class:`UNICODE_STRING` - - - .. attribute:: CurrentDirectores - - :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` - -_ANON_PEB_SYSTEM_DEPENDENT_02 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_02 - - .. attribute:: FastPebLockRoutine - - :class:`PVOID` - - - .. attribute:: SparePtr1 - - :class:`PVOID` - - - .. attribute:: AtlThunkSListPtr - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_03 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_03 - - .. attribute:: FastPebUnlockRoutine - - :class:`PVOID` - - - .. attribute:: SparePtr2 - - :class:`PVOID` - - - .. attribute:: IFEOKey - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_06 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_06 - - .. attribute:: FreeList - - :class:`PVOID` - - - .. attribute:: SparePebPtr0 - - :class:`PVOID` - - - .. attribute:: ApiSetMap - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_07 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_07 - - .. attribute:: ReadOnlySharedMemoryHeap - - :class:`PVOID` - - - .. attribute:: HotpatchInformation - - :class:`PVOID` - - - .. attribute:: SparePvoid0 - - :class:`PVOID` - -_ANON_PEB_UNION_1 -''''''''''''''''' -.. class:: _ANON_PEB_UNION_1 - - .. attribute:: KernelCallbackTable - - :class:`PVOID` - - - .. attribute:: UserSharedInfoPtr - - :class:`PVOID` - -_ANON_PEB_UNION_2 -''''''''''''''''' -.. class:: _ANON_PEB_UNION_2 - - .. attribute:: ImageProcessAffinityMask - - :class:`PVOID` - - - .. attribute:: ActiveProcessAffinityMask - - :class:`PVOID` - -_PEB -'''' -.. class:: PEB - - Alias for :class:`_PEB` - -.. class:: PPEB - - Pointer to :class:`_PEB` - -.. class:: _PEB - - .. attribute:: Reserved1 - - :class:`BYTE` ``[2]`` - - - .. attribute:: BeingDebugged - - :class:`BYTE` - - - .. attribute:: Reserved2 - - :class:`BYTE` - - - .. attribute:: Mutant - - :class:`PVOID` - - - .. attribute:: ImageBaseAddress - - :class:`PVOID` - - - .. attribute:: Ldr - - :class:`PPEB_LDR_DATA` - - - .. attribute:: ProcessParameters - - :class:`PRTL_USER_PROCESS_PARAMETERS` - - - .. attribute:: SubSystemData - - :class:`PVOID` - - - .. attribute:: ProcessHeap - - :class:`PVOID` - - - .. attribute:: FastPebLock - - :class:`PVOID` - - - .. attribute:: _SYSTEM_DEPENDENT_02 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_02` - - - .. attribute:: _SYSTEM_DEPENDENT_03 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_03` - - - .. attribute:: _SYSTEM_DEPENDENT_04 - - :class:`PVOID` - - - .. attribute:: anon_01 - - :class:`_ANON__PEB_SUB_UNION_1` - - - .. attribute:: SystemReserved - - :class:`DWORD` - - - .. attribute:: _SYSTEM_DEPENDENT_05 - - :class:`DWORD` - - - .. attribute:: _SYSTEM_DEPENDENT_06 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_06` - - - .. attribute:: TlsExpansionCounter - - :class:`PVOID` - - - .. attribute:: TlsBitmap - - :class:`PVOID` - - - .. attribute:: TlsBitmapBits - - :class:`DWORD` ``[2]`` - - - .. attribute:: ReadOnlySharedMemoryBase - - :class:`PVOID` - - - .. attribute:: _SYSTEM_DEPENDENT_07 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_07` - - - .. attribute:: ReadOnlyStaticServerData - - :class:`PVOID` - - - .. attribute:: AnsiCodePageData - - :class:`PVOID` - - - .. attribute:: OemCodePageData - - :class:`PVOID` - - - .. attribute:: UnicodeCaseTableData - - :class:`PVOID` - - - .. attribute:: NumberOfProcessors - - :class:`DWORD` - - - .. attribute:: NtGlobalFlag - - :class:`DWORD` - - - .. attribute:: CriticalSectionTimeout - - :class:`LARGE_INTEGER` - - - .. attribute:: HeapSegmentReserve - - :class:`PVOID` - - - .. attribute:: HeapSegmentCommit - - :class:`PVOID` - - - .. attribute:: HeapDeCommitTotalFreeThreshold - - :class:`PVOID` - - - .. attribute:: HeapDeCommitFreeBlockThreshold - - :class:`PVOID` - - - .. attribute:: NumberOfHeaps - - :class:`DWORD` - - - .. attribute:: MaximumNumberOfHeaps - - :class:`DWORD` - - - .. attribute:: ProcessHeaps - - :class:`PVOID` - - - .. attribute:: GdiSharedHandleTable - - :class:`PVOID` - - - .. attribute:: ProcessStarterHelper - - :class:`PVOID` - - - .. attribute:: GdiDCAttributeList - - :class:`PVOID` - - - .. attribute:: LoaderLock - - :class:`PVOID` - - - .. attribute:: OSMajorVersion - - :class:`DWORD` - - - .. attribute:: OSMinorVersion - - :class:`DWORD` - - - .. attribute:: OSBuildNumber - - :class:`WORD` - - - .. attribute:: OSCSDVersion - - :class:`WORD` - - - .. attribute:: OSPlatformId - - :class:`DWORD` - - - .. attribute:: ImageSubsystem - - :class:`DWORD` - - - .. attribute:: ImageSubsystemMajorVersion - - :class:`DWORD` - - - .. attribute:: ImageSubsystemMinorVersion - - :class:`PVOID` - - - .. attribute:: anon_02 - - :class:`_ANON__PEB_SUB_UNION_2` - - - .. attribute:: GdiHandleBuffer - - :class:`PVOID` ``[26]`` - - - .. attribute:: GdiHandleBuffer2 - - :class:`BYTE` ``[32]`` - - - .. attribute:: PostProcessInitRoutine - - :class:`PVOID` - - - .. attribute:: TlsExpansionBitmap - - :class:`PVOID` - - - .. attribute:: TlsExpansionBitmapBits - - :class:`DWORD` ``[32]`` - - - .. attribute:: SessionId - - :class:`PVOID` - - - .. attribute:: AppCompatFlags - - :class:`ULARGE_INTEGER` - - - .. attribute:: AppCompatFlagsUser - - :class:`ULARGE_INTEGER` - - - .. attribute:: pShimData - - :class:`PVOID` - - - .. attribute:: AppCompatInfo - - :class:`PVOID` - - - .. attribute:: CSDVersion - - :class:`UNICODE_STRING` - - - .. attribute:: ActivationContextData - - :class:`PVOID` - - - .. attribute:: ProcessAssemblyStorageMap - - :class:`PVOID` - - - .. attribute:: SystemDefaultActivationContextData - - :class:`PVOID` - - - .. attribute:: SystemAssemblyStorageMap - - :class:`PVOID` - - - .. attribute:: MinimumStackCommit - - :class:`PVOID` - _SECURITY_ATTRIBUTES '''''''''''''''''''' .. class:: LPSECURITY_ATTRIBUTES @@ -11413,135 +11908,6 @@ _SYSTEM_PROCESS_ID_INFORMATION :class:`UNICODE_STRING` -_CLIENT_ID -'''''''''' -.. class:: CLIENT_ID - - Alias for :class:`_CLIENT_ID` - -.. class:: PCLIENT_ID - - Pointer to :class:`_CLIENT_ID` - -.. class:: _CLIENT_ID - - .. attribute:: UniqueProcess - - :class:`HANDLE` - - - .. attribute:: UniqueThread - - :class:`HANDLE` - -_CLIENT_ID64 -'''''''''''' -.. class:: CLIENT_ID64 - - Alias for :class:`_CLIENT_ID64` - -.. class:: PCLIENT_ID64 - - Pointer to :class:`_CLIENT_ID64` - -.. class:: _CLIENT_ID64 - - .. attribute:: UniqueProcess - - :class:`ULONG64` - - - .. attribute:: UniqueThread - - :class:`ULONG64` - -_CLIENT_ID32 -'''''''''''' -.. class:: CLIENT_ID32 - - Alias for :class:`_CLIENT_ID32` - -.. class:: PCLIENT_ID32 - - Pointer to :class:`_CLIENT_ID32` - -.. class:: _CLIENT_ID32 - - .. attribute:: UniqueProcess - - :class:`ULONG` - - - .. attribute:: UniqueThread - - :class:`ULONG` - -_LDR_DATA_TABLE_ENTRY -''''''''''''''''''''' -.. class:: LDR_DATA_TABLE_ENTRY - - Alias for :class:`_LDR_DATA_TABLE_ENTRY` - -.. class:: PLDR_DATA_TABLE_ENTRY - - Pointer to :class:`_LDR_DATA_TABLE_ENTRY` - -.. class:: _LDR_DATA_TABLE_ENTRY - - .. attribute:: Reserved1 - - :class:`PVOID` ``[2]`` - - - .. attribute:: InMemoryOrderLinks - - :class:`LIST_ENTRY` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[2]`` - - - .. attribute:: DllBase - - :class:`PVOID` - - - .. attribute:: EntryPoint - - :class:`PVOID` - - - .. attribute:: SizeOfImage - - :class:`PVOID` - - - .. attribute:: FullDllName - - :class:`UNICODE_STRING` - - - .. attribute:: BaseDllName - - :class:`UNICODE_STRING` - - - .. attribute:: Reserved5 - - :class:`PVOID` ``[3]`` - - - .. attribute:: CheckSum - - :class:`ULONG` - - - .. attribute:: TimeDateStamp - - :class:`ULONG` - _MEMORY_BASIC_INFORMATION ''''''''''''''''''''''''' .. class:: MEMORY_BASIC_INFORMATION @@ -25403,235 +25769,6 @@ _EXPLICIT_ACCESS_W :class:`TRUSTEE_W` -_SYSTEM_PROCESS_INFORMATION -''''''''''''''''''''''''''' -.. class:: PSYSTEM_PROCESS_INFORMATION - - Pointer to :class:`_SYSTEM_PROCESS_INFORMATION` - -.. class:: SYSTEM_PROCESS_INFORMATION - - Alias for :class:`_SYSTEM_PROCESS_INFORMATION` - -.. class:: _SYSTEM_PROCESS_INFORMATION - - .. attribute:: NextEntryOffset - - :class:`ULONG` - - - .. attribute:: NumberOfThreads - - :class:`ULONG` - - - .. attribute:: Reserved1 - - :class:`BYTE` ``[24]`` - - - .. attribute:: CreateTime - - :class:`LARGE_INTEGER` - - - .. attribute:: UserTime - - :class:`LARGE_INTEGER` - - - .. attribute:: KernelTime - - :class:`LARGE_INTEGER` - - - .. attribute:: ImageName - - :class:`UNICODE_STRING` - - - .. attribute:: BasePriority - - :class:`LONG` - - - .. attribute:: UniqueProcessId - - :class:`HANDLE` - - - .. attribute:: InheritedFromUniqueProcessId - - :class:`PVOID` - - - .. attribute:: HandleCount - - :class:`ULONG` - - - .. attribute:: Reserved4 - - :class:`BYTE` ``[4]`` - - - .. attribute:: Reserved5 - - :class:`PVOID` - - - .. attribute:: PeakVirtualSize - - :class:`PVOID` - - - .. attribute:: VirtualSize - - :class:`PVOID` - - - .. attribute:: PageFaultCount - - :class:`PVOID` - - - .. attribute:: PeakWorkingSetSize - - :class:`PVOID` - - - .. attribute:: WorkingSetSize - - :class:`PVOID` - - - .. attribute:: QuotaPeakPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaPeakNonPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaNonPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: PagefileUsage - - :class:`PVOID` - - - .. attribute:: PeakPagefileUsage - - :class:`SIZE_T` - - - .. attribute:: PrivatePageCount - - :class:`SIZE_T` - - - .. attribute:: Reserved6 - - :class:`LARGE_INTEGER` ``[6]`` - -_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION -''''''''''''''''''''''''''''''''''''''''' -.. class:: PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - Pointer to :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` - -.. class:: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - Alias for :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` - -.. class:: _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - .. attribute:: IdleTime - - :class:`LARGE_INTEGER` - - - .. attribute:: KernelTime - - :class:`LARGE_INTEGER` - - - .. attribute:: UserTime - - :class:`LARGE_INTEGER` - - - .. attribute:: Reserved1 - - :class:`LARGE_INTEGER` ``[2]`` - - - .. attribute:: Reserved2 - - :class:`ULONG` - -_SYSTEM_REGISTRY_QUOTA_INFORMATION -'''''''''''''''''''''''''''''''''' -.. class:: PSYSTEM_REGISTRY_QUOTA_INFORMATION - - Pointer to :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` - -.. class:: SYSTEM_REGISTRY_QUOTA_INFORMATION - - Alias for :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` - -.. class:: _SYSTEM_REGISTRY_QUOTA_INFORMATION - - .. attribute:: RegistryQuotaAllowed - - :class:`ULONG` - - - .. attribute:: RegistryQuotaUsed - - :class:`ULONG` - - - .. attribute:: Reserved1 - - :class:`PVOID` - -_SYSTEM_BASIC_INFORMATION -''''''''''''''''''''''''' -.. class:: PSYSTEM_BASIC_INFORMATION - - Pointer to :class:`_SYSTEM_BASIC_INFORMATION` - -.. class:: SYSTEM_BASIC_INFORMATION - - Alias for :class:`_SYSTEM_BASIC_INFORMATION` - -.. class:: _SYSTEM_BASIC_INFORMATION - - .. attribute:: Reserved1 - - :class:`BYTE` ``[24]`` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[4]`` - - - .. attribute:: NumberOfProcessors - - :class:`CHAR` - _TIME_ZONE_INFORMATION '''''''''''''''''''''' .. class:: LPTIME_ZONE_INFORMATION @@ -29723,6 +29860,42 @@ ADDRESS_MODE .. attribute:: AddrModeFlat(3) +_COMPUTER_NAME_FORMAT +''''''''''''''''''''' +.. class:: COMPUTER_NAME_FORMAT + + Alias for :class:`_COMPUTER_NAME_FORMAT` + + +.. class:: _COMPUTER_NAME_FORMAT + + + .. attribute:: ComputerNameNetBIOS(0) + + + .. attribute:: ComputerNameDnsHostname(1) + + + .. attribute:: ComputerNameDnsDomain(2) + + + .. attribute:: ComputerNameDnsFullyQualified(3) + + + .. attribute:: ComputerNamePhysicalNetBIOS(4) + + + .. attribute:: ComputerNamePhysicalDnsHostname(5) + + + .. attribute:: ComputerNamePhysicalDnsDomain(6) + + + .. attribute:: ComputerNamePhysicalDnsFullyQualified(7) + + + .. attribute:: ComputerNameMax(8) + _TASK_ACTION_TYPE ''''''''''''''''' .. class:: TASK_ACTION_TYPE @@ -33523,42 +33696,6 @@ _ACCESS_MODE .. attribute:: SET_AUDIT_FAILURE(6) -_COMPUTER_NAME_FORMAT -''''''''''''''''''''' -.. class:: COMPUTER_NAME_FORMAT - - Alias for :class:`_COMPUTER_NAME_FORMAT` - - -.. class:: _COMPUTER_NAME_FORMAT - - - .. attribute:: ComputerNameNetBIOS(0) - - - .. attribute:: ComputerNameDnsHostname(1) - - - .. attribute:: ComputerNameDnsDomain(2) - - - .. attribute:: ComputerNameDnsFullyQualified(3) - - - .. attribute:: ComputerNamePhysicalNetBIOS(4) - - - .. attribute:: ComputerNamePhysicalDnsHostname(5) - - - .. attribute:: ComputerNamePhysicalDnsDomain(6) - - - .. attribute:: ComputerNamePhysicalDnsFullyQualified(7) - - - .. attribute:: ComputerNameMax(8) - TRACE_INFO_CLASS '''''''''''''''' .. class:: TRACE_QUERY_INFO_CLASS diff --git a/tests/test_debugger.py b/tests/test_debugger.py index 0710b61..9035ffc 100644 --- a/tests/test_debugger.py +++ b/tests/test_debugger.py @@ -27,7 +27,7 @@ else: yolo = generate_pop_and_exit_fixtures([pop_proc_32, pop_proc_64], ids=["proc32dbg", "proc64dbg"], dwCreationFlags=gdef.CREATE_SUSPENDED) -DEFAULT_DEBUGGER_TIMEOUT = 10 +DEFAULT_DEBUGGER_TIMEOUT = 60 @pytest.mark.timeout(DEFAULT_DEBUGGER_TIMEOUT) def test_init_breakpoint_callback(proc32_64_debug): diff --git a/tests/test_generated_def.py b/tests/test_generated_def.py index d950490..b061912 100644 --- a/tests/test_generated_def.py +++ b/tests/test_generated_def.py @@ -12,11 +12,25 @@ def assert_struct_offset(struct, field, offset): if windows.current_process.bitness == 32: PEB32 = windows.generated_def.PEB PEB64 = rctypes.transform_type_to_remote64bits(windows.generated_def.PEB) + + TEB32 = windows.generated_def.TEB + TEB64 = rctypes.transform_type_to_remote64bits(windows.generated_def.TEB) + + NT_TIB32 = windows.generated_def.NT_TIB + NT_TIB64 = rctypes.transform_type_to_remote64bits(windows.generated_def.NT_TIB) + SYSTEM_PROCESS_INFORMATION32 = windows.generated_def.SYSTEM_PROCESS_INFORMATION SYSTEM_PROCESS_INFORMATION64 = rctypes.transform_type_to_remote64bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION) else: PEB32 = rctypes.transform_type_to_remote32bits(windows.generated_def.PEB) PEB64 = windows.generated_def.PEB + + TEB32 = rctypes.transform_type_to_remote32bits(windows.generated_def.TEB) + TEB64 = windows.generated_def.TEB + + NT_TIB32 = rctypes.transform_type_to_remote32bits(windows.generated_def.NT_TIB) + NT_TIB64 = windows.generated_def.NT_TIB + SYSTEM_PROCESS_INFORMATION32 = rctypes.transform_type_to_remote32bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION) SYSTEM_PROCESS_INFORMATION64 = windows.generated_def.SYSTEM_PROCESS_INFORMATION @@ -53,6 +67,29 @@ def test_peb64_fields(): assert_peb_offset("CSDVersion", 0x02E8) assert_peb_offset("MinimumStackCommit", 0x0318) +# Important to the the current TEB via Self +def test_nt_tib32_fields(): + assert_nt_tib_offset = lambda field, offset: assert_struct_offset(NT_TIB32, field, offset) + assert_nt_tib_offset("ExceptionList", 0) + assert_nt_tib_offset("StackBase", 4) + assert_nt_tib_offset("StackLimit", 8) + assert_nt_tib_offset("SubSystemTib", 0xc) + assert_nt_tib_offset("FiberData", 0x10) + assert_nt_tib_offset("Version", 0x10) + assert_nt_tib_offset("ArbitraryUserPointer", 0x14) + assert_nt_tib_offset("Self", 0x18) # Important ! + +def test_nt_tib64_fields(): + assert_nt_tib_offset = lambda field, offset: assert_struct_offset(NT_TIB64, field, offset) + assert_nt_tib_offset("ExceptionList", 0) + assert_nt_tib_offset("StackBase", 8) + assert_nt_tib_offset("StackLimit", 0x10) + assert_nt_tib_offset("SubSystemTib", 0x18) + assert_nt_tib_offset("FiberData", 0x20) + assert_nt_tib_offset("Version", 0x20) + assert_nt_tib_offset("ArbitraryUserPointer", 0x28) + assert_nt_tib_offset("Self", 0x30) # Important ! + def test_system_process_information32_fields(): assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION32, field, offset) # Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm diff --git a/tests/test_handle.py b/tests/test_handle.py index 0004aeb..8008d7c 100644 --- a/tests/test_handle.py +++ b/tests/test_handle.py @@ -31,6 +31,6 @@ def test_remote_handle_type_and_name(proc32_64): remote_handle = [x for x in proc32_64.handles if x.value == file_handle_vlue][0] assert remote_handle.pid == proc32_64.pid assert remote_handle.type == "File" - assert remote_handle.name.startswith("\Device\HarddiskVolume") + assert remote_handle.name.startswith(r"\Device\HarddiskVolume") assert remote_handle.name.endswith(TEST_FILE_FOR_HANDLE[2:]) # Remove volume letter assert remote_handle.infos \ No newline at end of file diff --git a/tests/test_object_manager.py b/tests/test_object_manager.py index 4fbc392..05a74d6 100644 --- a/tests/test_object_manager.py +++ b/tests/test_object_manager.py @@ -32,7 +32,7 @@ def test_multiple_access_type(objname): def test_complex_object_path(): - obj = objmanager["\\KnownDLLs\\kernel32.dll"] + obj = objmanager[r"\KnownDLLs\kernel32.dll"] assert obj.name == "kernel32.dll" assert obj.fullname == "\\KnownDLLs\\kernel32.dll" assert obj.path == "\\KnownDLLs" @@ -41,9 +41,9 @@ def test_complex_object_path(): def test_link_object(): - obj = objmanager["\\KnownDLLs\\KnownDLLPath"] + obj = objmanager[r"\KnownDLLs\KnownDLLPath"] assert obj.type == "SymbolicLink" - assert obj.target.lower() == "c:\windows\system32" + assert obj.target.lower() == r"c:\windows\system32" # Test unicode string in Kernel object using an ALPC port diff --git a/tests/test_orpc.py b/tests/test_orpc.py index d2e36fd..f9fff60 100644 --- a/tests/test_orpc.py +++ b/tests/test_orpc.py @@ -16,7 +16,14 @@ from .pfwtest import * # A second check about in parameters can be done with put_Left / get_Left or put_Visible def test_orpc_iexplore(): iid = gdef.IWebBrowser2.IID - client, ipid = windows.rpc.stubborn.stubborn_create_instance("0002DF01-0000-0000-C000-000000000046", iid) + try: + client, ipid = windows.rpc.stubborn.stubborn_create_instance("0002DF01-0000-0000-C000-000000000046", iid) + except Exception as e: + dbginfo = getattr(e, "stubborn_info", None) + if dbginfo: + for x in dbginfo.items(): + print(x) + raise # get_FullName addrep = client.call(iid, 38, b"", ipid=ipid) @@ -45,7 +52,14 @@ def test_orpc_iexplore(): def test_orpc_network_manager(): """ORPC: Testing ORPCTHAT size using a method that takes no arguments and returns a single bytes""" iid = gdef.GUID.from_string("D0074FFD-570F-4A9B-8D69-199FDBA5723B") - client, ipid = windows.rpc.stubborn.stubborn_create_instance("A47979D2-C419-11D9-A5B4-001185AD2B89", iid) + try: + client, ipid = windows.rpc.stubborn.stubborn_create_instance("A47979D2-C419-11D9-A5B4-001185AD2B89", iid) + except Exception as e: + dbginfo = getattr(e, "stubborn_info", None) + if dbginfo: + for x in dbginfo.items(): + print(x) + raise response = client.call(iid, 17, b"", ipid=ipid) assert response[0] not in (b"\x00", 0) diff --git a/tests/test_process.py b/tests/test_process.py index 76996be..aea71d4 100644 --- a/tests/test_process.py +++ b/tests/test_process.py @@ -28,7 +28,7 @@ class TestCurrentProcessWithCheckGarbage(object): return windows.current_process.peb def test_get_current_process_modules(self): - # Use module filename because this executable can be: + # Use module filename because this executable can be: # 1. A PyInstaller exe # 2. A Windows App execution alias (Microsoft Store builds) assert os.path.basename(windows.current_process.peb.ProcessParameters[0].ImagePathName.str) in windows.current_process.peb.modules[0].name @@ -474,11 +474,28 @@ class TestProcessWithCheckGarbage(object): with proc32_64.allocated_memory(0x1000) as addr: assert proc32_64.get_mapped_filename(addr) is None + def test_current_thread_teb(self): + teb = windows.current_thread.teb + assert ctypes.addressof(teb) == ctypes.addressof(windows.current_thread.teb.NtTib.Self[0]) + assert ctypes.addressof(windows.current_process.peb) == ctypes.addressof(teb.ProcessEnvironmentBlock[0]) + # Check type of teb.peb is the correct subclass (with modules & co) + assert teb.peb.modules def test_thread_teb_base(self, proc32_64): t = proc32_64.threads[0] assert t.teb_base != 0 + def test_teb(self, proc32_64): + teb = proc32_64.threads[0].teb + if proc32_64.bitness == 32: + assert type(teb) == windows.winobject.process.RemoteTEB32 + else: + assert type(teb) == windows.winobject.process.RemoteTEB64 + assert teb.NtTib.Self.value == teb._base_addr + assert teb.ProcessEnvironmentBlock.value == teb.peb._base_addr + # Check type of teb.peb is the correct subclass (with modules & co) + assert teb.peb.modules + @windows_64bit_only def test_thread_teb_syswow_base(self, proc32): t = proc32.threads[0] @@ -486,7 +503,15 @@ class TestProcessWithCheckGarbage(object): assert t.teb_syswow_base != 0 assert t.teb_base == t.teb_syswow_base + 0x2000 - + @windows_64bit_only + def test_thread_teb_syswow(self, proc32): + teb_syswow = proc32.threads[0].teb_syswow + assert type(teb_syswow) == windows.winobject.process.RemoteTEB64 + assert type(teb_syswow.peb) == windows.winobject.process.RemotePEB64 + assert teb_syswow.NtTib.Self.value == teb_syswow._base_addr + assert teb_syswow.ProcessEnvironmentBlock.value == teb_syswow.peb._base_addr + # Check type of teb.peb is the correct subclass (with modules & co) + assert teb_syswow.peb.modules def test_thread_owner_from_tid(self, proc32_64): thread = proc32_64.threads[0] diff --git a/tests/test_remotectypes.py b/tests/test_remotectypes.py index 12d198c..d703100 100644 --- a/tests/test_remotectypes.py +++ b/tests/test_remotectypes.py @@ -29,7 +29,7 @@ def test_remote_struct_same_bitness(): # This test fails for now. (0.6) # Should I improve remote ctypes to handel this ? -@pytest.mark.known_to_fail +@pytest.mark.xfail def test_remote_long_ptr(): # Bug thatwas in retrieving of NtCreateFile arguments target = windows.current_process diff --git a/tests/test_scheduled_tasks.py b/tests/test_scheduled_tasks.py index 8b02046..4e24dd0 100644 --- a/tests/test_scheduled_tasks.py +++ b/tests/test_scheduled_tasks.py @@ -5,7 +5,7 @@ import os.path import windows import windows.generated_def as gdef -SCHTASKS = "c:\Windows\System32\schtasks.exe" +SCHTASKS = r"c:\Windows\System32\schtasks.exe" task_scheduler = windows.system.task_scheduler @@ -28,9 +28,9 @@ def schtasks_task_exists(taskname): raise SCHEDULED_TASK_PARAMS = [ - {"DIR": "", "NAME": "PFW_TEST1", "PATH": '"c:\windows\system32\notepad.exe"', "ARGS": "PFW_TEST_PARAM.txt"}, + {"DIR": "", "NAME": "PFW_TEST1", "PATH": r'"c:\windows\system32\notepad.exe"', "ARGS": "PFW_TEST_PARAM.txt"}, # Test in subdir - {"DIR": "PFW_TEST_DIR", "NAME": "PFW_TEST1", "PATH": '"c:\windows\system32\notepad.exe"', "ARGS": "PFW_TEST_PARAM.txt"} + {"DIR": "PFW_TEST_DIR", "NAME": "PFW_TEST1", "PATH": r'"c:\windows\system32\notepad.exe"', "ARGS": "PFW_TEST_PARAM.txt"} ] diff --git a/windows/debug/symbols.py b/windows/debug/symbols.py index d14fb7f..d0599b6 100644 --- a/windows/debug/symbols.py +++ b/windows/debug/symbols.py @@ -13,7 +13,7 @@ DEFAULT_DBG_OPTION = gdef.SYMOPT_DEFERRED_LOADS + gdef.SYMOPT_UNDNAME def set_dbghelp_path(path): - """Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading. + r"""Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading. If ``path`` is a directory, the final ``dbghelp.dll`` will be computed as ``path\\dbghelp.dll``. @@ -124,7 +124,7 @@ class SymbolInfoA(gdef.SYMBOL_INFO, SymbolInfoBase): CHAR_TYPE = gdef.CHAR class SymbolInfoW(gdef.SYMBOL_INFOW, SymbolInfoBase): - """Represent a Symbol. + r"""Represent a Symbol. This class in based on the class `SYMBOL_INFO `_ with the handling on displacement embeded into it.s @@ -326,7 +326,7 @@ class SymbolModule(gdef.IMAGEHLP_MODULEW64): @property def pdb(self): - """The local path of the loaded PDB if present + r"""The local path of the loaded PDB if present Exemple: >>> sh = windows.debug.symbols.VirtualSymbolHandler() @@ -455,7 +455,7 @@ class SymbolHandler(object): return sym def resolve(self, name_or_addr): - """Resolve ``name_or_addr``. + r"""Resolve ``name_or_addr``. If its an int -> Return the :class:`SymbolInfo` at the address. If its a string -> Return the :class:`SymbolInfo` corresponding to the symbol name @@ -504,7 +504,7 @@ class SymbolHandler(object): return True def search(self, mask, mod=0, tag=0, options=gdef.SYMSEARCH_ALLITEMS, callback=None): - """Search the symbols matching ``mask`` (``Windbg`` like). + r"""Search the symbols matching ``mask`` (``Windbg`` like). :return: [:class:`SymbolInfo`] -- A list of :class:`SymbolInfo` diff --git a/windows/generated_def/meta.py b/windows/generated_def/meta.py index 1a57ebb..7a50a52 100644 --- a/windows/generated_def/meta.py +++ b/windows/generated_def/meta.py @@ -12730,6 +12730,7 @@ structs = {'ACCESS_ALLOWED_ACE', 'NET_DISPLAY_USER', 'NPBITMAP', 'NPRGBTRIPLE', +'NT_TIB', 'OBJECTS_AND_NAME_A', 'OBJECTS_AND_NAME_W', 'OBJECTS_AND_SID', @@ -13471,6 +13472,7 @@ structs = {'ACCESS_ALLOWED_ACE', 'SYSTEM_RESOURCE_ATTRIBUTE_ACE', 'SYSTEM_SCOPED_POLICY_ID_ACE', 'SYSTEM_VERIFIER_INFORMATION', +'TEB', 'THREADENTRY32', 'THREAD_BASIC_INFORMATION', 'TIME_ZONE_INFORMATION', @@ -13772,6 +13774,7 @@ structs = {'ACCESS_ALLOWED_ACE', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', +'_EXCEPTION_REGISTRATION_RECORD', '_EXIT_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXPLICIT_ACCESS_W', @@ -13917,6 +13920,7 @@ structs = {'ACCESS_ALLOWED_ACE', '_NET_DISPLAY_GROUP', '_NET_DISPLAY_MACHINE', '_NET_DISPLAY_USER', +'_NT_TIB', '_OBJECTS_AND_NAME_A', '_OBJECTS_AND_NAME_W', '_OBJECTS_AND_SID', @@ -14047,6 +14051,7 @@ structs = {'ACCESS_ALLOWED_ACE', '_SYSTEM_RESOURCE_ATTRIBUTE_ACE', '_SYSTEM_SCOPED_POLICY_ID_ACE', '_SYSTEM_VERIFIER_INFORMATION', +'_TEB', '_THREAD_BASIC_INFORMATION', '_TIME_ZONE_INFORMATION', '_TMPUNION_CERT_ID', @@ -15113,6 +15118,7 @@ functions = {'AccessCheck', 'RtlDosPathNameToNtPathName_U', 'RtlEqualUnicodeString', 'RtlGetCompressionWorkSpaceSize', +'RtlGetCurrentPeb', 'RtlGetUnloadEventTraceEx', 'RtlInitString', 'RtlInitUnicodeString', diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 5aa0b6e..2e9a353 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -1735,6 +1735,11 @@ LoadLibraryExWParams = ((1, 'lpLibFileName'), (1, 'hFile'), (1, 'dwFlags')) FreeLibraryPrototype = WINFUNCTYPE(BOOL, HMODULE) FreeLibraryParams = ((1, 'hLibModule'),) +#def RtlGetCurrentPeb(): +# return RtlGetCurrentPeb.ctypes_function() +RtlGetCurrentPebPrototype = WINFUNCTYPE(PVOID) +RtlGetCurrentPebParams = () + #def RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData): # return RegQueryValueExA.ctypes_function(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData) RegQueryValueExAPrototype = WINFUNCTYPE(LSTATUS, HKEY, LPCSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD) diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index ef09ba6..90a373a 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -1902,7 +1902,8 @@ ATTACH_VIRTUAL_DISK_PARAMETERS = _ATTACH_VIRTUAL_DISK_PARAMETERS PATTACH_VIRTUAL_DISK_PARAMETERS = POINTER(_ATTACH_VIRTUAL_DISK_PARAMETERS) # Self referencing struct tricks -class _INTERNET_BUFFERSA(Structure): pass +class _INTERNET_BUFFERSA(Structure): + pass INTERNET_BUFFERSA = _INTERNET_BUFFERSA LPINTERNET_BUFFERSA = POINTER(_INTERNET_BUFFERSA) _INTERNET_BUFFERSA._fields_ = [ @@ -1919,7 +1920,8 @@ _INTERNET_BUFFERSA._fields_ = [ ] # Self referencing struct tricks -class _INTERNET_BUFFERSW(Structure): pass +class _INTERNET_BUFFERSW(Structure): + pass INTERNET_BUFFERSW = _INTERNET_BUFFERSW LPINTERNET_BUFFERSW = POINTER(_INTERNET_BUFFERSW) _INTERNET_BUFFERSW._fields_ = [ @@ -2453,7 +2455,8 @@ IP_INTERFACE_INFO = _IP_INTERFACE_INFO PIP_INTERFACE_INFO = POINTER(_IP_INTERFACE_INFO) # Self referencing struct tricks -class _DNS_CACHE_ENTRY(Structure): pass +class _DNS_CACHE_ENTRY(Structure): + pass DNS_CACHE_ENTRY = _DNS_CACHE_ENTRY PDNS_CACHE_ENTRY = POINTER(_DNS_CACHE_ENTRY) _DNS_CACHE_ENTRY._fields_ = [ @@ -2982,7 +2985,9 @@ class _ANON__DNSRECORDA_SUB_UNION_2(Union): ] # Self referencing struct tricks -class _DnsRecordA(Structure): pass +class _DnsRecordA(Structure): + _anonymous_ = ("Flags","Data") + DNS_RECORDA = _DnsRecordA PDNS_RECORDA = POINTER(_DnsRecordA) _DnsRecordA._fields_ = [ @@ -3092,7 +3097,9 @@ class _ANON__DNSRECORDW_SUB_UNION_2(Union): ] # Self referencing struct tricks -class _DnsRecordW(Structure): pass +class _DnsRecordW(Structure): + _anonymous_ = ("Flags","Data") + DNS_RECORDW = _DnsRecordW PDNS_RECORDW = POINTER(_DnsRecordW) _DnsRecordW._fields_ = [ @@ -3171,7 +3178,8 @@ PIP_ADDRESS_STRING = POINTER(IP_ADDRESS_STRING) PIP_MASK_STRING = POINTER(IP_ADDRESS_STRING) # Self referencing struct tricks -class _IP_ADDR_STRING(Structure): pass +class _IP_ADDR_STRING(Structure): + pass IP_ADDR_STRING = _IP_ADDR_STRING PIP_ADDR_STRING = POINTER(_IP_ADDR_STRING) _IP_ADDR_STRING._fields_ = [ @@ -3182,7 +3190,8 @@ _IP_ADDR_STRING._fields_ = [ ] # Self referencing struct tricks -class _IP_ADAPTER_INFO(Structure): pass +class _IP_ADAPTER_INFO(Structure): + pass IP_ADAPTER_INFO = _IP_ADAPTER_INFO PIP_ADAPTER_INFO = POINTER(_IP_ADAPTER_INFO) _IP_ADAPTER_INFO._fields_ = [ @@ -3876,6 +3885,114 @@ class _SHFILEOPSTRUCTA(Structure): LPSHFILEOPSTRUCTA = POINTER(_SHFILEOPSTRUCTA) SHFILEOPSTRUCTA = _SHFILEOPSTRUCTA +# Self referencing struct tricks +class _LIST_ENTRY(Structure): + pass +LIST_ENTRY = _LIST_ENTRY +PLIST_ENTRY = POINTER(_LIST_ENTRY) +PRLIST_ENTRY = POINTER(_LIST_ENTRY) +_LIST_ENTRY._fields_ = [ + ("Flink", POINTER(_LIST_ENTRY)), + ("Blink", POINTER(_LIST_ENTRY)), +] + +# From: ctypes_generation\extended_structs\_LIST_ENTRY.py +# _LIST_ENTRY is a self referencing structure +# Currently ctypes generation does not support extending self referencing structures +# Ass the _fields_ assignement should happen after the extended structure definition +# So we just redefine fully _LIST_ENTRY without inheriting the real one + +class _LIST_ENTRY(Structure): + def get_real_struct(self, targetcls, target_field): + # >>> gdef.LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks + # + # This field object does not allow to retrieve the type.. + # So we need to basse the target class AND the target field.. + return targetcls.from_address(ctypes.addressof(self) - target_field.offset) + +_LIST_ENTRY._fields_ = [ + ("Flink", POINTER(_LIST_ENTRY)), + ("Blink", POINTER(_LIST_ENTRY)), +] +LIST_ENTRY = _LIST_ENTRY +PLIST_ENTRY = POINTER(_LIST_ENTRY) +PRLIST_ENTRY = POINTER(_LIST_ENTRY) +class _LSA_UNICODE_STRING(Structure): + _fields_ = [ + ("Length", USHORT), + ("MaximumLength", USHORT), + ("Buffer", PVOID), + ] +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING + +INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING + +class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): + @property + def str(self): + """The python string of the LSA_UNICODE_STRING object + + :type: :class:`unicode` + """ + if not self.Length: + return "" + if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR + raw_data = self._target.read_memory(self.Buffer, self.Length) + return raw_data.decode("utf16") + size = int(self.Length / 2) + return (ctypes.c_wchar * size).from_address(self.Buffer)[:] + + @classmethod + def from_string(cls, s): + utf16_len = len(s) * 2 + return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID)) + + @classmethod + def from_size(cls, size): + buffer = ctypes.create_string_buffer(size) + return cls(size, size, ctypes.cast(buffer, PVOID)) + + def __repr__(self): + return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))) + + def __sprint__(self): + try: + return self.__repr__() + except TypeError as e: + # Bad buffer: print raw infos + return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer) + +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING +class _CLIENT_ID(Structure): + _fields_ = [ + ("UniqueProcess", HANDLE), + ("UniqueThread", HANDLE), + ] +CLIENT_ID = _CLIENT_ID +PCLIENT_ID = POINTER(_CLIENT_ID) + +class _CLIENT_ID64(Structure): + _fields_ = [ + ("UniqueProcess", ULONG64), + ("UniqueThread", ULONG64), + ] +CLIENT_ID64 = _CLIENT_ID64 +PCLIENT_ID64 = POINTER(_CLIENT_ID64) + +class _CLIENT_ID32(Structure): + _fields_ = [ + ("UniqueProcess", ULONG), + ("UniqueThread", ULONG), + ] +CLIENT_ID32 = _CLIENT_ID32 +PCLIENT_ID32 = POINTER(_CLIENT_ID32) + SymNone = EnumValue("SYM_TYPE", "SymNone", 0x0) SymCoff = EnumValue("SYM_TYPE", "SymCoff", 0x1) SymCv = EnumValue("SYM_TYPE", "SymCv", 0x2) @@ -4437,6 +4554,82 @@ class _tagSTACKFRAME_EX(Structure): LPSTACKFRAME_EX = POINTER(_tagSTACKFRAME_EX) STACKFRAME_EX = _tagSTACKFRAME_EX +ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0) +ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1) +ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2) +ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3) +ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4) +ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5) +ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6) +ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7) +ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8) +class _COMPUTER_NAME_FORMAT(EnumType): + values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax] + mapper = FlagMapper(*values) +COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT + + +class _SYSTEM_PROCESS_INFORMATION(Structure): + _fields_ = [ + ("NextEntryOffset", ULONG), + ("NumberOfThreads", ULONG), + ("Reserved1", BYTE * (24)), + ("CreateTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("ImageName", UNICODE_STRING), + ("BasePriority", LONG), + ("UniqueProcessId", HANDLE), + ("InheritedFromUniqueProcessId", PVOID), + ("HandleCount", ULONG), + ("Reserved4", BYTE * (4)), + ("Reserved5", PVOID * (1)), + ("PeakVirtualSize", PVOID), + ("VirtualSize", PVOID), + ("PageFaultCount", PVOID), + ("PeakWorkingSetSize", PVOID), + ("WorkingSetSize", PVOID), + ("QuotaPeakPagedPoolUsage", PVOID), + ("QuotaPagedPoolUsage", PVOID), + ("QuotaPeakNonPagedPoolUsage", PVOID), + ("QuotaNonPagedPoolUsage", PVOID), + ("PagefileUsage", PVOID), + ("PeakPagefileUsage", SIZE_T), + ("PrivatePageCount", SIZE_T), + ("Reserved6", LARGE_INTEGER * (6)), + ] +PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) +SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION + +class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): + _fields_ = [ + ("IdleTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("Reserved1", LARGE_INTEGER * (2)), + ("Reserved2", ULONG), + ] +PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) +SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + +class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): + _fields_ = [ + ("RegistryQuotaAllowed", ULONG), + ("RegistryQuotaUsed", ULONG), + ("Reserved1", PVOID), + ] +PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) +SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION + +class _SYSTEM_BASIC_INFORMATION(Structure): + _fields_ = [ + ("Reserved1", BYTE * (24)), + ("Reserved2", PVOID * (4)), + ("NumberOfProcessors", CHAR), + ] +PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) +SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION + TASK_ACTION_EXEC = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_EXEC", 0x0) TASK_ACTION_COM_HANDLER = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_COM_HANDLER", 0x5) TASK_ACTION_SEND_EMAIL = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_SEND_EMAIL", 0x6) @@ -4545,6 +4738,269 @@ class TASK_RUN_FLAGS(EnumType): mapper = FlagMapper(*values) +class _CURDIR(Structure): + _fields_ = [ + ("DosPath", UNICODE_STRING), + ("Handle", PVOID), + ] +CURDIR = _CURDIR +PCURDIR = POINTER(_CURDIR) + +class _RTL_DRIVE_LETTER_CURDIR(Structure): + _fields_ = [ + ("Flags", WORD), + ("Length", WORD), + ("TimeStamp", ULONG), + ("DosPath", UNICODE_STRING), + ] +PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) +RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR + +class _RTL_USER_PROCESS_PARAMETERS(Structure): + _fields_ = [ + ("MaximumLength", ULONG), + ("Length", ULONG), + ("Flags", ULONG), + ("DebugFlags", ULONG), + ("ConsoleHandle", PVOID), + ("ConsoleFlags", ULONG), + ("StandardInput", PVOID), + ("StandardOutput", PVOID), + ("StandardError", PVOID), + ("CurrentDirectory", CURDIR), + ("DllPath", UNICODE_STRING), + ("ImagePathName", UNICODE_STRING), + ("CommandLine", UNICODE_STRING), + ("Environment", PVOID), + ("StartingX", ULONG), + ("StartingY", ULONG), + ("CountX", ULONG), + ("CountY", ULONG), + ("CountCharsX", ULONG), + ("CountCharsY", ULONG), + ("FillAttribute", ULONG), + ("WindowFlags", ULONG), + ("ShowWindowFlags", ULONG), + ("WindowTitle", UNICODE_STRING), + ("DesktopInfo", UNICODE_STRING), + ("ShellInfo", UNICODE_STRING), + ("RuntimeData", UNICODE_STRING), + ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)), + ] +PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) +RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS + +class _LDR_DATA_TABLE_ENTRY(Structure): + _fields_ = [ + ("Reserved1", PVOID * (2)), + ("InMemoryOrderLinks", LIST_ENTRY), + ("Reserved2", PVOID * (2)), + ("DllBase", PVOID), + ("EntryPoint", PVOID), + ("SizeOfImage", PVOID), + ("FullDllName", UNICODE_STRING), + ("BaseDllName", UNICODE_STRING), + ("Reserved5", PVOID * (3)), + ("CheckSum", ULONG), + ("TimeDateStamp", ULONG), + ] +LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY +PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY) + +class _PEB_LDR_DATA(Structure): + _fields_ = [ + ("Length", ULONG), + ("Initialized", BYTE), + ("SsHandle", PVOID), + ("InLoadOrderModuleList", _LIST_ENTRY), + ("InMemoryOrderModuleList", _LIST_ENTRY), + ("InInitializationOrderModuleList", _LIST_ENTRY), + ("EntryInProgress", PVOID), + ] +PEB_LDR_DATA = _PEB_LDR_DATA +PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA) + +class _ANON_PEB_SYSTEM_DEPENDENT_02(Union): + _fields_ = [ + ("FastPebLockRoutine", PVOID), + ("SparePtr1", PVOID), + ("AtlThunkSListPtr", PVOID), + ] + + +class _ANON_PEB_SYSTEM_DEPENDENT_03(Union): + _fields_ = [ + ("FastPebUnlockRoutine", PVOID), + ("SparePtr2", PVOID), + ("IFEOKey", PVOID), + ] + + +class _ANON_PEB_SYSTEM_DEPENDENT_06(Union): + _fields_ = [ + ("FreeList", PVOID), + ("SparePebPtr0", PVOID), + ("ApiSetMap", PVOID), + ] + + +class _ANON_PEB_SYSTEM_DEPENDENT_07(Union): + _fields_ = [ + ("ReadOnlySharedMemoryHeap", PVOID), + ("HotpatchInformation", PVOID), + ("SparePvoid0", PVOID), + ] + + +class _ANON_PEB_UNION_1(Union): + _fields_ = [ + ("KernelCallbackTable", PVOID), + ("UserSharedInfoPtr", PVOID), + ] + + +class _ANON_PEB_UNION_2(Union): + _fields_ = [ + ("ImageProcessAffinityMask", PVOID), + ("ActiveProcessAffinityMask", PVOID), + ] + + +class _ANON__PEB_SUB_UNION_1(Union): + _fields_ = [ + ("KernelCallbackTable", PVOID), + ("UserSharedInfoPtr", PVOID), + ] + + +class _ANON__PEB_SUB_UNION_2(Union): + _fields_ = [ + ("ImageProcessAffinityMask", PVOID), + ("ActiveProcessAffinityMask", PVOID), + ] + +class _PEB(Structure): + _anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02") + _fields_ = [ + ("Reserved1", BYTE * (2)), + ("BeingDebugged", BYTE), + ("Reserved2", BYTE * (1)), + ("Mutant", PVOID), + ("ImageBaseAddress", PVOID), + ("Ldr", PPEB_LDR_DATA), + ("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS), + ("SubSystemData", PVOID), + ("ProcessHeap", PVOID), + ("FastPebLock", PVOID), + ("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02), + ("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03), + ("_SYSTEM_DEPENDENT_04", PVOID), + ("anon_01", _ANON__PEB_SUB_UNION_1), + ("SystemReserved", DWORD), + ("_SYSTEM_DEPENDENT_05", DWORD), + ("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06), + ("TlsExpansionCounter", PVOID), + ("TlsBitmap", PVOID), + ("TlsBitmapBits", DWORD * (2)), + ("ReadOnlySharedMemoryBase", PVOID), + ("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07), + ("ReadOnlyStaticServerData", PVOID), + ("AnsiCodePageData", PVOID), + ("OemCodePageData", PVOID), + ("UnicodeCaseTableData", PVOID), + ("NumberOfProcessors", DWORD), + ("NtGlobalFlag", DWORD), + ("CriticalSectionTimeout", LARGE_INTEGER), + ("HeapSegmentReserve", PVOID), + ("HeapSegmentCommit", PVOID), + ("HeapDeCommitTotalFreeThreshold", PVOID), + ("HeapDeCommitFreeBlockThreshold", PVOID), + ("NumberOfHeaps", DWORD), + ("MaximumNumberOfHeaps", DWORD), + ("ProcessHeaps", PVOID), + ("GdiSharedHandleTable", PVOID), + ("ProcessStarterHelper", PVOID), + ("GdiDCAttributeList", PVOID), + ("LoaderLock", PVOID), + ("OSMajorVersion", DWORD), + ("OSMinorVersion", DWORD), + ("OSBuildNumber", WORD), + ("OSCSDVersion", WORD), + ("OSPlatformId", DWORD), + ("ImageSubsystem", DWORD), + ("ImageSubsystemMajorVersion", DWORD), + ("ImageSubsystemMinorVersion", PVOID), + ("anon_02", _ANON__PEB_SUB_UNION_2), + ("GdiHandleBuffer", PVOID * (26)), + ("GdiHandleBuffer2", BYTE * (32)), + ("PostProcessInitRoutine", PVOID), + ("TlsExpansionBitmap", PVOID), + ("TlsExpansionBitmapBits", DWORD * (32)), + ("SessionId", PVOID), + ("AppCompatFlags", ULARGE_INTEGER), + ("AppCompatFlagsUser", ULARGE_INTEGER), + ("pShimData", PVOID), + ("AppCompatInfo", PVOID), + ("CSDVersion", UNICODE_STRING), + ("ActivationContextData", PVOID), + ("ProcessAssemblyStorageMap", PVOID), + ("SystemDefaultActivationContextData", PVOID), + ("SystemAssemblyStorageMap", PVOID), + ("MinimumStackCommit", PVOID), + ] +PEB = _PEB +PPEB = POINTER(_PEB) + +# Self referencing struct tricks +class _EXCEPTION_REGISTRATION_RECORD(Structure): + pass + +_EXCEPTION_REGISTRATION_RECORD._fields_ = [ + ("Next", POINTER(_EXCEPTION_REGISTRATION_RECORD)), + ("Handler", PVOID), +] + +class _ANON__NT_TIB_SUB_UNION_1(Union): + _fields_ = [ + ("FiberData", PVOID), + ("Version", ULONG), + ] + +# Self referencing struct tricks +class _NT_TIB(Structure): + _anonymous_ = ("anon_01",) + +NT_TIB = _NT_TIB +_NT_TIB._fields_ = [ + ("ExceptionList", POINTER(_EXCEPTION_REGISTRATION_RECORD)), + ("StackBase", PVOID), + ("StackLimit", PVOID), + ("SubSystemTib", PVOID), + ("anon_01", _ANON__NT_TIB_SUB_UNION_1), + ("ArbitraryUserPointer", PVOID), + ("Self", POINTER(_NT_TIB)), +] + +class _TEB(Structure): + _fields_ = [ + ("NtTib", _NT_TIB), + ("EnvironmentPointer", PVOID), + ("ClientId", _CLIENT_ID), + ("ActiveRpcHandle", PVOID), + ("ThreadLocalStoragePointer", PVOID), + ("ProcessEnvironmentBlock", POINTER(_PEB)), + ("LastErrorValue", ULONG), + ("CountOfOwnedCriticalSections", ULONG), + ("CsrClientThread", PVOID), + ("Win32ThreadInfo", PVOID), + ("User32Reserved", ULONG * (26)), + ("UserReserved", ULONG * (5)), + ("WOW32Reserved", PVOID), + ("CurrentLocale", ULONG), + ("FpSoftwareStatusRegister", ULONG), + ] +TEB = _TEB + class _TRACE_PROVIDER_INFO(Structure): _fields_ = [ ("ProviderGuid", GUID), @@ -5426,264 +5882,6 @@ NT_PRODUCT_TYPE = _NT_PRODUCT_TYPE PNT_PRODUCT_TYPE = POINTER(_NT_PRODUCT_TYPE) -# Self referencing struct tricks -class _LIST_ENTRY(Structure): pass -LIST_ENTRY = _LIST_ENTRY -PLIST_ENTRY = POINTER(_LIST_ENTRY) -PRLIST_ENTRY = POINTER(_LIST_ENTRY) -_LIST_ENTRY._fields_ = [ - ("Flink", POINTER(_LIST_ENTRY)), - ("Blink", POINTER(_LIST_ENTRY)), -] - -class _PEB_LDR_DATA(Structure): - _fields_ = [ - ("Length", ULONG), - ("Initialized", BYTE), - ("SsHandle", PVOID), - ("InLoadOrderModuleList", _LIST_ENTRY), - ("InMemoryOrderModuleList", _LIST_ENTRY), - ("InInitializationOrderModuleList", _LIST_ENTRY), - ("EntryInProgress", PVOID), - ] -PEB_LDR_DATA = _PEB_LDR_DATA -PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA) - -class _LSA_UNICODE_STRING(Structure): - _fields_ = [ - ("Length", USHORT), - ("MaximumLength", USHORT), - ("Buffer", PVOID), - ] -LSA_UNICODE_STRING = _LSA_UNICODE_STRING -PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -UNICODE_STRING = _LSA_UNICODE_STRING - -INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING - -class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): - @property - def str(self): - """The python string of the LSA_UNICODE_STRING object - - :type: :class:`unicode` - """ - if not self.Length: - return "" - if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR - raw_data = self._target.read_memory(self.Buffer, self.Length) - return raw_data.decode("utf16") - size = int(self.Length / 2) - return (ctypes.c_wchar * size).from_address(self.Buffer)[:] - - @classmethod - def from_string(cls, s): - utf16_len = len(s) * 2 - return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID)) - - @classmethod - def from_size(cls, size): - buffer = ctypes.create_string_buffer(size) - return cls(size, size, ctypes.cast(buffer, PVOID)) - - def __repr__(self): - return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))) - - def __sprint__(self): - try: - return self.__repr__() - except TypeError as e: - # Bad buffer: print raw infos - return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer) - -LSA_UNICODE_STRING = _LSA_UNICODE_STRING -PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -UNICODE_STRING = _LSA_UNICODE_STRING -class _CURDIR(Structure): - _fields_ = [ - ("DosPath", UNICODE_STRING), - ("Handle", PVOID), - ] -CURDIR = _CURDIR -PCURDIR = POINTER(_CURDIR) - -class _RTL_DRIVE_LETTER_CURDIR(Structure): - _fields_ = [ - ("Flags", WORD), - ("Length", WORD), - ("TimeStamp", ULONG), - ("DosPath", UNICODE_STRING), - ] -PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) -RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR - -class _RTL_USER_PROCESS_PARAMETERS(Structure): - _fields_ = [ - ("MaximumLength", ULONG), - ("Length", ULONG), - ("Flags", ULONG), - ("DebugFlags", ULONG), - ("ConsoleHandle", PVOID), - ("ConsoleFlags", ULONG), - ("StandardInput", PVOID), - ("StandardOutput", PVOID), - ("StandardError", PVOID), - ("CurrentDirectory", CURDIR), - ("DllPath", UNICODE_STRING), - ("ImagePathName", UNICODE_STRING), - ("CommandLine", UNICODE_STRING), - ("Environment", PVOID), - ("StartingX", ULONG), - ("StartingY", ULONG), - ("CountX", ULONG), - ("CountY", ULONG), - ("CountCharsX", ULONG), - ("CountCharsY", ULONG), - ("FillAttribute", ULONG), - ("WindowFlags", ULONG), - ("ShowWindowFlags", ULONG), - ("WindowTitle", UNICODE_STRING), - ("DesktopInfo", UNICODE_STRING), - ("ShellInfo", UNICODE_STRING), - ("RuntimeData", UNICODE_STRING), - ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)), - ] -PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) -RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS - -class _ANON_PEB_SYSTEM_DEPENDENT_02(Union): - _fields_ = [ - ("FastPebLockRoutine", PVOID), - ("SparePtr1", PVOID), - ("AtlThunkSListPtr", PVOID), - ] - - -class _ANON_PEB_SYSTEM_DEPENDENT_03(Union): - _fields_ = [ - ("FastPebUnlockRoutine", PVOID), - ("SparePtr2", PVOID), - ("IFEOKey", PVOID), - ] - - -class _ANON_PEB_SYSTEM_DEPENDENT_06(Union): - _fields_ = [ - ("FreeList", PVOID), - ("SparePebPtr0", PVOID), - ("ApiSetMap", PVOID), - ] - - -class _ANON_PEB_SYSTEM_DEPENDENT_07(Union): - _fields_ = [ - ("ReadOnlySharedMemoryHeap", PVOID), - ("HotpatchInformation", PVOID), - ("SparePvoid0", PVOID), - ] - - -class _ANON_PEB_UNION_1(Union): - _fields_ = [ - ("KernelCallbackTable", PVOID), - ("UserSharedInfoPtr", PVOID), - ] - - -class _ANON_PEB_UNION_2(Union): - _fields_ = [ - ("ImageProcessAffinityMask", PVOID), - ("ActiveProcessAffinityMask", PVOID), - ] - - -class _ANON__PEB_SUB_UNION_1(Union): - _fields_ = [ - ("KernelCallbackTable", PVOID), - ("UserSharedInfoPtr", PVOID), - ] - - -class _ANON__PEB_SUB_UNION_2(Union): - _fields_ = [ - ("ImageProcessAffinityMask", PVOID), - ("ActiveProcessAffinityMask", PVOID), - ] - -class _PEB(Structure): - _anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02") - _fields_ = [ - ("Reserved1", BYTE * (2)), - ("BeingDebugged", BYTE), - ("Reserved2", BYTE * (1)), - ("Mutant", PVOID), - ("ImageBaseAddress", PVOID), - ("Ldr", PPEB_LDR_DATA), - ("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS), - ("SubSystemData", PVOID), - ("ProcessHeap", PVOID), - ("FastPebLock", PVOID), - ("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02), - ("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03), - ("_SYSTEM_DEPENDENT_04", PVOID), - ("anon_01", _ANON__PEB_SUB_UNION_1), - ("SystemReserved", DWORD), - ("_SYSTEM_DEPENDENT_05", DWORD), - ("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06), - ("TlsExpansionCounter", PVOID), - ("TlsBitmap", PVOID), - ("TlsBitmapBits", DWORD * (2)), - ("ReadOnlySharedMemoryBase", PVOID), - ("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07), - ("ReadOnlyStaticServerData", PVOID), - ("AnsiCodePageData", PVOID), - ("OemCodePageData", PVOID), - ("UnicodeCaseTableData", PVOID), - ("NumberOfProcessors", DWORD), - ("NtGlobalFlag", DWORD), - ("CriticalSectionTimeout", LARGE_INTEGER), - ("HeapSegmentReserve", PVOID), - ("HeapSegmentCommit", PVOID), - ("HeapDeCommitTotalFreeThreshold", PVOID), - ("HeapDeCommitFreeBlockThreshold", PVOID), - ("NumberOfHeaps", DWORD), - ("MaximumNumberOfHeaps", DWORD), - ("ProcessHeaps", PVOID), - ("GdiSharedHandleTable", PVOID), - ("ProcessStarterHelper", PVOID), - ("GdiDCAttributeList", PVOID), - ("LoaderLock", PVOID), - ("OSMajorVersion", DWORD), - ("OSMinorVersion", DWORD), - ("OSBuildNumber", WORD), - ("OSCSDVersion", WORD), - ("OSPlatformId", DWORD), - ("ImageSubsystem", DWORD), - ("ImageSubsystemMajorVersion", DWORD), - ("ImageSubsystemMinorVersion", PVOID), - ("anon_02", _ANON__PEB_SUB_UNION_2), - ("GdiHandleBuffer", PVOID * (26)), - ("GdiHandleBuffer2", BYTE * (32)), - ("PostProcessInitRoutine", PVOID), - ("TlsExpansionBitmap", PVOID), - ("TlsExpansionBitmapBits", DWORD * (32)), - ("SessionId", PVOID), - ("AppCompatFlags", ULARGE_INTEGER), - ("AppCompatFlagsUser", ULARGE_INTEGER), - ("pShimData", PVOID), - ("AppCompatInfo", PVOID), - ("CSDVersion", UNICODE_STRING), - ("ActivationContextData", PVOID), - ("ProcessAssemblyStorageMap", PVOID), - ("SystemDefaultActivationContextData", PVOID), - ("SystemAssemblyStorageMap", PVOID), - ("MinimumStackCommit", PVOID), - ] -PEB = _PEB -PPEB = POINTER(_PEB) - class _SECURITY_ATTRIBUTES(Structure): _fields_ = [ ("nLength", DWORD), @@ -5733,47 +5931,6 @@ class _SYSTEM_PROCESS_ID_INFORMATION(Structure): PSYSTEM_PROCESS_ID_INFORMATION = POINTER(_SYSTEM_PROCESS_ID_INFORMATION) SYSTEM_PROCESS_ID_INFORMATION = _SYSTEM_PROCESS_ID_INFORMATION -class _CLIENT_ID(Structure): - _fields_ = [ - ("UniqueProcess", HANDLE), - ("UniqueThread", HANDLE), - ] -CLIENT_ID = _CLIENT_ID -PCLIENT_ID = POINTER(_CLIENT_ID) - -class _CLIENT_ID64(Structure): - _fields_ = [ - ("UniqueProcess", ULONG64), - ("UniqueThread", ULONG64), - ] -CLIENT_ID64 = _CLIENT_ID64 -PCLIENT_ID64 = POINTER(_CLIENT_ID64) - -class _CLIENT_ID32(Structure): - _fields_ = [ - ("UniqueProcess", ULONG), - ("UniqueThread", ULONG), - ] -CLIENT_ID32 = _CLIENT_ID32 -PCLIENT_ID32 = POINTER(_CLIENT_ID32) - -class _LDR_DATA_TABLE_ENTRY(Structure): - _fields_ = [ - ("Reserved1", PVOID * (2)), - ("InMemoryOrderLinks", LIST_ENTRY), - ("Reserved2", PVOID * (2)), - ("DllBase", PVOID), - ("EntryPoint", PVOID), - ("SizeOfImage", PVOID), - ("FullDllName", UNICODE_STRING), - ("BaseDllName", UNICODE_STRING), - ("Reserved5", PVOID * (3)), - ("CheckSum", ULONG), - ("TimeDateStamp", ULONG), - ] -LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY -PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY) - class _MEMORY_BASIC_INFORMATION(Structure): _fields_ = [ ("BaseAddress", PVOID), @@ -6441,7 +6598,8 @@ PRTL_OSVERSIONINFOEXW = POINTER(_OSVERSIONINFOEXW) RTL_OSVERSIONINFOEXW = _OSVERSIONINFOEXW # Self referencing struct tricks -class _EXCEPTION_RECORD(Structure): pass +class _EXCEPTION_RECORD(Structure): + pass EXCEPTION_RECORD = _EXCEPTION_RECORD PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD) _EXCEPTION_RECORD._fields_ = [ @@ -8639,7 +8797,8 @@ PCCERT_SIMPLE_CHAIN = POINTER(_CERT_SIMPLE_CHAIN) PCERT_SIMPLE_CHAIN = POINTER(_CERT_SIMPLE_CHAIN) # Self referencing struct tricks -class _CERT_CHAIN_CONTEXT(Structure): pass +class _CERT_CHAIN_CONTEXT(Structure): + pass CERT_CHAIN_CONTEXT = _CERT_CHAIN_CONTEXT PCCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT) PCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT) @@ -11004,7 +11163,9 @@ class _ANON__TRUSTEE_A_SUB_UNION_1(Union): ] # Self referencing struct tricks -class _TRUSTEE_A(Structure): pass +class _TRUSTEE_A(Structure): + _anonymous_ = ("anon_01",) + PTRUSTEEA = POINTER(_TRUSTEE_A) PTRUSTEE_A = POINTER(_TRUSTEE_A) TRUSTEEA = _TRUSTEE_A @@ -11038,7 +11199,9 @@ class _ANON__TRUSTEE_W_SUB_UNION_1(Union): ] # Self referencing struct tricks -class _TRUSTEE_W(Structure): pass +class _TRUSTEE_W(Structure): + _anonymous_ = ("anon_01",) + PTRUSTEEW = POINTER(_TRUSTEE_W) PTRUSTEE_W = POINTER(_TRUSTEE_W) TRUSTEEW = _TRUSTEE_W @@ -11064,82 +11227,6 @@ EXPLICIT_ACCESS_W = _EXPLICIT_ACCESS_W PEXPLICIT_ACCESSW = POINTER(_EXPLICIT_ACCESS_W) PEXPLICIT_ACCESS_W = POINTER(_EXPLICIT_ACCESS_W) -ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0) -ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1) -ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2) -ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3) -ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4) -ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5) -ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6) -ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7) -ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8) -class _COMPUTER_NAME_FORMAT(EnumType): - values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax] - mapper = FlagMapper(*values) -COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT - - -class _SYSTEM_PROCESS_INFORMATION(Structure): - _fields_ = [ - ("NextEntryOffset", ULONG), - ("NumberOfThreads", ULONG), - ("Reserved1", BYTE * (24)), - ("CreateTime", LARGE_INTEGER), - ("UserTime", LARGE_INTEGER), - ("KernelTime", LARGE_INTEGER), - ("ImageName", UNICODE_STRING), - ("BasePriority", LONG), - ("UniqueProcessId", HANDLE), - ("InheritedFromUniqueProcessId", PVOID), - ("HandleCount", ULONG), - ("Reserved4", BYTE * (4)), - ("Reserved5", PVOID * (1)), - ("PeakVirtualSize", PVOID), - ("VirtualSize", PVOID), - ("PageFaultCount", PVOID), - ("PeakWorkingSetSize", PVOID), - ("WorkingSetSize", PVOID), - ("QuotaPeakPagedPoolUsage", PVOID), - ("QuotaPagedPoolUsage", PVOID), - ("QuotaPeakNonPagedPoolUsage", PVOID), - ("QuotaNonPagedPoolUsage", PVOID), - ("PagefileUsage", PVOID), - ("PeakPagefileUsage", SIZE_T), - ("PrivatePageCount", SIZE_T), - ("Reserved6", LARGE_INTEGER * (6)), - ] -PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) -SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION - -class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): - _fields_ = [ - ("IdleTime", LARGE_INTEGER), - ("KernelTime", LARGE_INTEGER), - ("UserTime", LARGE_INTEGER), - ("Reserved1", LARGE_INTEGER * (2)), - ("Reserved2", ULONG), - ] -PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) -SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - -class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): - _fields_ = [ - ("RegistryQuotaAllowed", ULONG), - ("RegistryQuotaUsed", ULONG), - ("Reserved1", PVOID), - ] -PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) -SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION - -class _SYSTEM_BASIC_INFORMATION(Structure): - _fields_ = [ - ("Reserved1", BYTE * (24)), - ("Reserved2", PVOID * (4)), - ("NumberOfProcessors", CHAR), - ] -PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) -SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION - class _TIME_ZONE_INFORMATION(Structure): _fields_ = [ ("Bias", LONG), @@ -12526,7 +12613,8 @@ class sockaddr_in(Structure): # Self referencing struct tricks -class addrinfoW(Structure): pass +class addrinfoW(Structure): + pass ADDRINFOW = addrinfoW PADDRINFOW = POINTER(addrinfoW) addrinfoW._fields_ = [ @@ -12601,7 +12689,8 @@ LPWSAPROTOCOL_INFOW = POINTER(_WSAPROTOCOL_INFOW) WSAPROTOCOL_INFOW = _WSAPROTOCOL_INFOW # Self referencing struct tricks -class addrinfo(Structure): pass +class addrinfo(Structure): + pass ADDRINFOA = addrinfo PADDRINFOA = POINTER(addrinfo) addrinfo._fields_ = [ diff --git a/windows/rpc/stubborn.py b/windows/rpc/stubborn.py index ea377a0..30f7ffe 100644 --- a/windows/rpc/stubborn.py +++ b/windows/rpc/stubborn.py @@ -73,7 +73,18 @@ def stubborn_create_instance(clsid, iid): # Bad alignement for everythin -> Legacy resolver_info = ctypes.cast(rpiv_infoptr, gdef.PPRIV_RESOLVER_INFO_LEGACY)[0] - psa = resolver_info.OxidInfo.psa[0] # Retrieve the bidings to our COM server + try: + psa = resolver_info.OxidInfo.psa[0] # Retrieve the bidings to our COM server + except ValueError as e: + # Seen case of NULL DEREF + # Embed more value to the except for better debugging + e.stubborn_info = { + "resolver_info.OxidInfo.containerVersion.version": resolver_info.OxidInfo.containerVersion.version, + "dcomversion": (dcomversionstruct.MajorVersion, dcomversionstruct.MinorVersion), + "resolver_info": resolver_info, + } + raise + # print("psa.bidings: {0}".format(psa.bidings)) # ipidRemUnknown = resolver_info.OxidInfo.ipidRemUnknown # Useful for IRemQueryInterface diff --git a/windows/syswow64.py b/windows/syswow64.py index 28b1b0a..2f2558c 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -164,19 +164,18 @@ def get_current_process_syswow_peb_addr(): def get_current_process_syswow_peb(): current_process = windows.current_process - - class CurrentProcessReadSyswow(process.Process): - bitness = 64 - def _get_handle(self): - return winproxy.OpenProcess(dwProcessId=current_process.pid) - - def read_memory(self, addr, size): - buffer_addr = ctypes.create_string_buffer(size) - winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) - return buffer_addr[:] peb_addr = get_current_process_syswow_peb_addr() return windows.winobject.process.RemotePEB64(peb_addr, CurrentProcessReadSyswow()) +class CurrentProcessReadSyswow(process.Process): + bitness = 64 + def _get_handle(self): + return winproxy.OpenProcess(dwProcessId=windows.current_process.pid) + + def read_memory(self, addr, size): + buffer_addr = ctypes.create_string_buffer(size) + winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) + return buffer_addr[:] class ReadSyswow64Process(process.Process): def __init__(self, target): diff --git a/windows/utils/winutils.py b/windows/utils/winutils.py index 2706b8d..1f803f1 100644 --- a/windows/utils/winutils.py +++ b/windows/utils/winutils.py @@ -626,7 +626,7 @@ class VirtualProtected(object): class DisableWow64FsRedirection(object): - """ + r""" A context manager that disable the SysWow64 Filesystem Redirection :: if is_process_32_bits: diff --git a/windows/winobject/object_manager.py b/windows/winobject/object_manager.py index f0de7f3..a0590d7 100644 --- a/windows/winobject/object_manager.py +++ b/windows/winobject/object_manager.py @@ -166,13 +166,13 @@ class KernelObject(object): raise KeyError("Could not find WinObject <{0}> under <{1}>".format(name, self.fullname)) def __getitem__(self, name): - """Query object ``name`` from the directory, split and subquery on ``\\``:: + r"""Query object ``name`` from the directory, split and subquery on ``\``:: >>> obj >>> obj["WindowStations"]["WinSta0"] - >>> obj["WindowStations\\WinSta0"] + >>> obj[r"WindowStations\\WinSta0"] :rtype: :class:`KernelObject` diff --git a/windows/winobject/process.py b/windows/winobject/process.py index db9829d..3ea231f 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -64,7 +64,7 @@ class DeadThread(utils.AutoHandle): class Process(utils.AutoHandle): - @utils.fixedpropety + @utils.fixedproperty def is_wow_64(self): """``True`` if the process is a SysWow64 process (32bit process on 64bits system). @@ -73,7 +73,7 @@ class Process(utils.AutoHandle): # return utils.is_wow_64(self.handle) return utils.is_wow_64(self.limited_handle) - @utils.fixedpropety + @utils.fixedproperty def bitness(self): """The bitness of the process @@ -85,15 +85,25 @@ class Process(utils.AutoHandle): return 32 return 64 - @utils.fixedpropety + @utils.fixedproperty def limited_handle(self): if windows.system.version[0] <= 5: # Windows XP | Serveur 2003 return winproxy.OpenProcess(PROCESS_QUERY_INFORMATION, dwProcessId=self.pid) return winproxy.OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, dwProcessId=self.pid) + @utils.fixedproperty + def name(self): + """Name of the process - @utils.fixedpropety + :type: :class:`str` + """ + buffer = ctypes.create_unicode_buffer(0x1024) + rsize = winproxy.GetProcessImageFileNameW(self.limited_handle, buffer) + # GetProcessImageFileNameW returns the fullpath + return buffer[:rsize].split("\\")[-1] + + @utils.fixedproperty def ppid(self): """Parent Process ID @@ -559,7 +569,14 @@ class Thread(utils.AutoHandle): class CurrentThread(Thread): """The current thread""" - @property #It's not a fixedpropety because executing thread might change + + get_teb_code_by_bitness = { + 32: x86.assemble("mov eax, fs:[0x18]; ret"), + 64: x64.assemble("mov rax, gs:[0x30]; ret") + + } + + @property #It's not a fixedproperty because executing thread might change def tid(self): """Thread ID @@ -567,6 +584,15 @@ class CurrentThread(Thread): """ return winproxy.GetCurrentThreadId() + @property #It's not a fixedproperty because executing thread might change + def teb_base(self): + get_teb_base_code = self.get_teb_code_by_bitness[self.owner.bitness] + return self.owner.execute(get_teb_base_code) + + @property + def teb(self): + return TEB.from_address(self.teb_base) + @property def owner(self): """The current process @@ -585,8 +611,6 @@ class CurrentThread(Thread): """Exit the thread""" return winproxy.ExitThread(code) - - def wait(self, timeout=INFINITE): """Raise :class:`ValueError` to prevent deadlock :D""" raise ValueError("wait() on current thread") @@ -594,37 +618,12 @@ class CurrentThread(Thread): class CurrentProcess(Process): """The current process""" - get_peb = None - - get_peb_32_code = x86.MultipleInstr() - get_peb_32_code += x86.Mov('EAX', x86.mem('fs:[0x30]')) - get_peb_32_code += x86.Ret() - get_peb_32_code = get_peb_32_code.get_code() - - get_peb_64_code = x64.MultipleInstr() - get_peb_64_code += x64.Mov('RAX', x64.mem('gs:[0x60]')) - get_peb_64_code += x64.Ret() - get_peb_64_code = get_peb_64_code.get_code() - allocator = native_exec.native_function.allocator - name = "CurrentProcess" # Used by Winthread for __repr__ - - # Use RtlGetCurrentPeb ? - def get_peb_builtin(self): - if self.get_peb is not None: - return self.get_peb - if self.bitness == 32: - get_peb = native_exec.create_function(self.get_peb_32_code, [PVOID]) - else: - get_peb = native_exec.create_function(self.get_peb_64_code, [PVOID]) - self.get_peb = get_peb - return get_peb - def _get_handle(self): return winproxy.GetCurrentProcess() - @utils.fixedpropety + @utils.fixedproperty def limited_handle(self): return winproxy.GetCurrentProcess() @@ -640,23 +639,21 @@ class CurrentProcess(Process): """ return os.getpid() - @utils.fixedpropety # leave it has fixed property as we don't care if CurrentProcess is never collected + @utils.fixedproperty # leave it has fixed property as we don't care if CurrentProcess is never collected def peb(self): """The Process Environment Block of the current process :type: :class:`PEB` """ - return PEB.from_address(self.get_peb_builtin()()) + return PEB.from_address(windows.winproxy.RtlGetCurrentPeb()) - @utils.fixedpropety + @utils.fixedproperty def bitness(self): """The bitness of the process :type: :class:`int` -- 32 or 64 """ - import platform - bits = platform.architecture()[0] - return int(bits[:2]) + return ctypes.sizeof(gdef.PVOID) * 8 # byte to bits def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE): """Allocate memory in the process @@ -718,7 +715,7 @@ class CurrentProcess(Process): """Raise :class:`ValueError` to prevent deadlock :D""" raise ValueError("wait() on current thread") - @utils.fixedpropety + @utils.fixedproperty def peb_syswow(self): """The 64bits PEB of a SysWow64 process @@ -761,21 +758,21 @@ class WinThread(Thread): # Create a DeadThread if thread is already dead ? return WinThread(handle=handle) - @utils.fixedpropety + @utils.fixedproperty def tid(self): """Thread ID :type: :class:`int`""" return self._get_thread_id(self.handle) - @utils.fixedpropety + @utils.fixedproperty def owner_pid(self): res = THREAD_BASIC_INFORMATION() windows.winproxy.NtQueryInformationThread(self.handle, ThreadBasicInformation, byref(res), ctypes.sizeof(res)) owner_id = res.ClientId.UniqueProcess return owner_id - @utils.fixedpropety + @utils.fixedproperty def owner(self): """The Process owning the thread @@ -900,7 +897,11 @@ class WinThread(Thread): # TebBase->NtTib.ExceptionList = (PVOID)Teb32Base; return self.owner.read_dword(main_teb_addr) - + @property + def teb(self): + if self.owner.bitness == 32: + return RemoteTEB32(self.teb_base, target=self.owner) + return RemoteTEB64(self.teb_base, target=self.owner) @property def teb_syswow_base(self): @@ -913,6 +914,12 @@ class WinThread(Thread): # just return the main TEB return self._get_principal_teb_addr() + @property + def teb_syswow(self): + if windows.current_process.bitness == 64: + return RemoteTEB64(self.teb_syswow_base, self.owner) + else: #current is 32bits + return RemoteTEB64(self.teb_syswow_base, windows.syswow64.ReadSyswow64Process(self.owner)) def exit(self, code=0): """Exit the thread""" @@ -1006,18 +1013,7 @@ class WinProcess(Process): return cls(pid=pid, name=name, ppid=ppid) - @utils.fixedpropety - def name(self): - """Name of the process - - :type: :class:`str` - """ - buffer = ctypes.create_unicode_buffer(0x1024) - rsize = winproxy.GetProcessImageFileNameW(self.limited_handle, buffer) - # GetProcessImageFileNameW returns the fullpath - return buffer[:rsize].split("\\")[-1] - - @utils.fixedpropety + @utils.fixedproperty def pid(self): """Process ID @@ -1150,9 +1146,7 @@ class WinProcess(Process): return injection.execute_python_code(self, pycode) - - - @utils.fixedpropety + @utils.fixedproperty def peb_addr(self): """The address of the PEB @@ -1179,7 +1173,7 @@ class WinProcess(Process): raise ValueError("Could not get peb addr of process {0}".format(self.name)) return peb_addr - # Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess + # Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess # Try with a weakref ? @property def peb(self): @@ -1193,7 +1187,7 @@ class WinProcess(Process): return RemotePEB32(self.peb_addr, self) return RemotePEB(self.peb_addr, self) - @utils.fixedpropety + @utils.fixedproperty def peb_syswow_addr(self): if not self.is_wow_64: raise ValueError("Not a syswow process") @@ -1212,7 +1206,7 @@ class WinProcess(Process): peb_addr = struct.unpack("""".format(type(self).__name__, self.name, null) class WmiManager(dict): - """The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access + r"""The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access :class:`WmiNamespace` by name Example: - >>> windows.system.wmi["root\\SecurityCenter2"] + >>> windows.system.wmi[r"root\SecurityCenter2"] """ DEFAULT_NAMESPACE = "root\\cimv2" #: The default namespace for :func:`select` & :func:`query` diff --git a/windows/winproxy/apis/ntdll.py b/windows/winproxy/apis/ntdll.py index 0b14f73..d09bef5 100644 --- a/windows/winproxy/apis/ntdll.py +++ b/windows/winproxy/apis/ntdll.py @@ -10,6 +10,9 @@ class NtdllProxy(ApiProxy): # Process +@NtdllProxy(error_check=fail_on_zero) +def RtlGetCurrentPeb(): + return RtlGetCurrentPeb.ctypes_function() @NtdllProxy() def NtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId):