Working on rewriting of tests with pytest

2026-06-08 14:31:45 +00:00 · 2017-09-06 18:42:54 +02:00
parent fccd2a49e6
commit 89e486cd95
14 changed files with 1690 additions and 0 deletions
@@ -0,0 +1,73 @@
+import pytest
+import textwrap
+
+import windows
+import windows.generated_def as gdef
+import windows.native_exec.simple_x86 as x86
+import windows.native_exec.simple_x64 as x64
+
+from pfwtest import *
+
+pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
+
+
+
+@process_syswow_only
+class TestSyswowCurrentProcess(object):
+    def test_exec_syswow(self):
+        x64_code = x64.assemble("mov rax, 0x4040404040404040; mov r11, 0x0202020202020202; add rax, r11; ret")
+        res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
+        assert res == 0x4242424242424242
+
+    def test_self_pebsyswow(self):
+        peb64 = windows.current_process.peb_syswow
+        modules_names = [m.name for m in peb64.modules]
+        assert "wow64.dll" in modules_names
+        # Parsing
+        wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0]
+        assert "Wow64LdrpInitialize" in wow64.pe.exports
+
+
+@windows_64bit_only
+class TestSyswowRemoteProcess(object):
+    def test_remote_pebsyswow(self, proc32):
+        peb64 = proc32.peb_syswow
+        modules_names = [m.name for m in peb64.modules]
+        assert "wow64.dll" in modules_names
+        # Parsing
+        wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0]
+        assert "Wow64LdrpInitialize" in wow64.pe.exports
+
+
+    def test_getset_syswow_context(self, proc32):
+        addr = proc32.virtual_alloc(0x1000)
+        remote_python_code = """
+        import windows
+        import windows.native_exec.simple_x64 as x64
+        windows.utils.create_console()
+        x64_code = x64.assemble("mov r11, 0x1122334455667788; mov rax, 0x8877665544332211; mov [{0}], rax ;label :loop; jmp :loop; nop; nop; ret")
+        res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
+        print("res = {{0}}".format(hex(res)))
+        windows.current_process.write_qword({0},  res)
+        """.format(addr)
+
+        t = proc32.execute_python_unsafe(textwrap.dedent(remote_python_code))
+        # Wait for python execution
+        while proc32.read_qword(addr) != 0x8877665544332211:
+            pass
+        ctx = t.context_syswow
+        # Check the get context
+        assert ctx.R11 == 0x1122334455667788
+        assert proc32.read_memory(ctx.Rip, 2) == x64.assemble("label :loop; jmp :loop")
+        t.suspend()
+        proc32.write_memory(ctx.Rip, "\x90\x90")
+        # Check the set context
+        RETURN_VALUE = 0x4041424344454647
+        ctx.Rax = RETURN_VALUE
+        ctx.Rip += 2
+        t.set_syswow_context(ctx)
+        t.resume()
+        t.wait()
+        assert RETURN_VALUE == proc32.read_qword(addr)
+
+