From 8a718c6e065f0335e0249f2537b05c57d05bbd48 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Wed, 16 Sep 2015 14:47:23 +0200 Subject: [PATCH] Fix bug + remove debug print --- native_exec/simple_x64.py | 6 +++--- native_exec/simple_x86.py | 4 ++-- pe_parse.py | 2 -- winobject.py | 45 +++++++++++++++++++-------------------- 4 files changed, 27 insertions(+), 30 deletions(-) diff --git a/native_exec/simple_x64.py b/native_exec/simple_x64.py index 67ec4a6..a5f95af 100644 --- a/native_exec/simple_x64.py +++ b/native_exec/simple_x64.py @@ -617,7 +617,7 @@ class In(Instruction): (RawBits.from_int(8, 0xed), FixedRegister('EAX'), FixedRegister('DX'))] class JmpImm(object): - accept_as_Ximmediat = None + accept_as_Ximmediat = (None) def __init__(self, sub): self.sub = sub @@ -634,10 +634,10 @@ class JmpImm(object): return (1, BitArray.from_string(jmp_imm), None) class JmpImm8(JmpImm): - accept_as_Ximmediat = accept_as_8immediat + accept_as_Ximmediat = staticmethod(accept_as_8immediat) class JmpImm32(JmpImm): - accept_as_Ximmediat = accept_as_32immediat + accept_as_Ximmediat = staticmethod(accept_as_32immediat) class Jmp(JmpType): encoding = [(RawBits.from_int(8, 0xeb), JmpImm8(2)), diff --git a/native_exec/simple_x86.py b/native_exec/simple_x86.py index ac3d26f..3cb9ba6 100644 --- a/native_exec/simple_x86.py +++ b/native_exec/simple_x86.py @@ -484,10 +484,10 @@ class JmpImm(object): return (1, BitArray.from_string(jmp_imm)) class JmpImm8(JmpImm): - accept_as_Ximmediat = accept_as_8immediat + accept_as_Ximmediat = staticmethod(accept_as_8immediat) class JmpImm32(JmpImm): - accept_as_Ximmediat = accept_as_32immediat + accept_as_Ximmediat = staticmethod(accept_as_32immediat) class Jmp(JmpType): diff --git a/pe_parse.py b/pe_parse.py index b224e57..2cc622d 100644 --- a/pe_parse.py +++ b/pe_parse.py @@ -167,8 +167,6 @@ def PEFile(baseaddr, target=None): @utils.fixedpropety def exports(self): - print("ASK FOR EXPORTS {0}".format(target)) - res = {} exp_dir = self.get_EXPORT_DIRECTORY() if exp_dir is None: diff --git a/winobject.py b/winobject.py index 95ba323..01190ff 100644 --- a/winobject.py +++ b/winobject.py @@ -14,7 +14,7 @@ import windows.native_exec.simple_x86 as x86 import windows.native_exec.simple_x64 as x64 from . import utils -from .dbgprint import dbgprint +from windows.dbgprint import dbgprint from windows.generated_def.winstructs import * from .generated_def import windef @@ -289,7 +289,6 @@ class CurrentProcess(Process): """The bitness of the process :returns: int -- 32 or 64""" - print("FAIL") import platform bits = platform.architecture()[0] return int(bits[:2]) @@ -374,10 +373,10 @@ class WinProcess(PROCESSENTRY32, Process): def low_read_memory(self, addr, buffer_addr, size): if windows.current_process.bitness == 32 and self.bitness == 64: - if not hasattr(self, "NtWow64ReadVirtualMemory64"): # TODO: better stuff : (in k32testing?) - NtWow64ReadVirtualMemory64Addr = windows.utils.get_func_addr("ntdll.dll", "NtWow64ReadVirtualMemory64") - self.NtWow64ReadVirtualMemory64 = WINFUNCTYPE(HRESULT, HANDLE, ULONG64, PVOID, ULONG64, PULONG64)(NtWow64ReadVirtualMemory64Addr) - return self.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size, None) + #OptionalExport can be None (see k32testing.py) + if kernel32proxy.NtWow64ReadVirtualMemory64 is None: + raise ValueError("NtWow64ReadVirtualMemory64 non available in ntdll: cannot write into 64bits processus") + return kernel32proxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) return kernel32proxy.ReadProcessMemory(self.handle, addr, lpBuffer=buffer_addr, nSize=size) def read_memory(self, addr, size): @@ -386,23 +385,23 @@ class WinProcess(PROCESSENTRY32, Process): self.low_read_memory(addr, ctypes.byref(buffer), size) return buffer[:] - #Simple cache test - real_read = read_memory - - def read_memory(self, addr, size): - """Cached version for test""" - dbgprint('Read remote Memory of {0}'.format(self), 'READMEM') - if not hasattr(self, "_cache_cache"): - self._cache_cache = {} - page_addr = addr & 0xfffffffffffff000 - if page_addr in self._cache_cache: - #print("CACHED Read on page {0}".format(hex(page_addr))) - page_data = self._cache_cache[page_addr] - return page_data[addr & 0xfff: (addr & 0xfff) + size] - else: - page_data = self.real_read(page_addr, 0x1000) - self._cache_cache[page_addr] = page_data - return page_data[addr & 0xfff: (addr & 0xfff) + size] + ##Simple cache test + #real_read = read_memory + # + #def read_memory(self, addr, size): + # """Cached version for test""" + # dbgprint('Read remote Memory of {0}'.format(self), 'READMEM') + # if not hasattr(self, "_cache_cache"): + # self._cache_cache = {} + # page_addr = addr & 0xfffffffffffff000 + # if page_addr in self._cache_cache: + # #print("CACHED Read on page {0}".format(hex(page_addr))) + # page_data = self._cache_cache[page_addr] + # return page_data[addr & 0xfff: (addr & 0xfff) + size] + # else: + # page_data = self.real_read(page_addr, 0x1000) + # self._cache_cache[page_addr] = page_data + # return page_data[addr & 0xfff: (addr & 0xfff) + size] def read_memory_into(self, addr, struct): """Read a :mod:`ctypes` struct from `addr`"""