diff --git a/samples/com/com_inetfwpolicy2.py b/samples/com/com_inetfwpolicy2.py index 62425da..8df3107 100644 --- a/samples/com/com_inetfwpolicy2.py +++ b/samples/com/com_inetfwpolicy2.py @@ -17,7 +17,7 @@ print("") print("Generating CLSID") NetFwPolicy2CLSID = windows.com.IID.from_string("E2B3C97F-6AE1-41AC-817A-F6F92166D7DD") -print(NetFwPolicy2CLSID) +print(repr(NetFwPolicy2CLSID)) print("") print("Creating COM instance") diff --git a/samples/crypto/certificate.py b/samples/crypto/certificate.py index ad5724a..d3512c5 100644 --- a/samples/crypto/certificate.py +++ b/samples/crypto/certificate.py @@ -33,7 +33,7 @@ l2ec6CyjDQc6HcQBNCsbJVq6qGtQbYNE+ih+KhIU4tO5jf25xthf2g== -----END CERTIFICATE-----""" -raw_cert = base64.decodestring(b"".join(windowscert.split(b"\n")[1:-1])) +raw_cert = base64.decodebytes(b"".join(windowscert.split(b"\n")[1:-1])) cert = windows.crypto.Certificate.from_buffer(raw_cert) print("Analysing certificate: {0}".format(cert)) diff --git a/samples/debug/symbol_debugger.py b/samples/debug/symbol_debugger.py index 2b9718d..6440fdb 100644 --- a/samples/debug/symbol_debugger.py +++ b/samples/debug/symbol_debugger.py @@ -30,7 +30,7 @@ class MyInfoBP(windows.debug.Breakpoint): dbg.current_process.exit() print("") -dbg = windows.debug.SymbolDebugger.debug(b"c:\\windows\\system32\\notepad.exe") -dbg.add_bp(MyInfoBP("kernelbase!CreateFileInternal+2")) +dbg = windows.debug.SymbolDebugger.debug("C:\\windows\\system32\\notepad.exe") +dbg.add_bp(MyInfoBP("kernelbase!CreateFileInternal")) dbg.add_bp(MyInfoBP("ntdll!LdrpInitializeProcess")) dbg.loop() \ No newline at end of file diff --git a/samples/device_manager/device_manager.py b/samples/device_manager/device_manager.py index 7831f07..dc97420 100644 --- a/samples/device_manager/device_manager.py +++ b/samples/device_manager/device_manager.py @@ -3,6 +3,7 @@ import os.path sys.path.append(os.path.abspath(__file__ + "\..\..")) import windows +import windows.pipe import windows.generated_def as gdef devmgr = windows.system.device_manager @@ -14,7 +15,7 @@ for cls in devmgr.classes[:3]: print("Finding device class 'System'") # Allow devmgr.classes["name"] ? -system_cls = [cls for cls in devmgr.classes if cls.name == b"System"][0] +system_cls = [cls for cls in devmgr.classes if cls.name == "System"][0] print(" * {0}".format(system_cls)) print(" Enumerating some devices of 'System'") devices = system_cls.devices.all() diff --git a/samples/etw/etw_enumeration.py b/samples/etw/etw_enumeration.py index b69afc6..00b334d 100644 --- a/samples/etw/etw_enumeration.py +++ b/samples/etw/etw_enumeration.py @@ -13,6 +13,7 @@ for sess in etwmgr.sessions[:2]: print(" * id: {0}".format(sess.id)) print(" * logfile: {0}".format(sess.logfile)) +sess = etwmgr.sessions[1] target_id = sess.id NB_MATCH = 0 print("") diff --git a/samples/pipe/child_send_object.py b/samples/pipe/child_send_object.py index e0a2b79..8049a4a 100644 --- a/samples/pipe/child_send_object.py +++ b/samples/pipe/child_send_object.py @@ -1,5 +1,6 @@ import windows import windows.test +import windows.pipe p = windows.test.pop_proc_32() print("Child is {0}".format(p)) @@ -8,6 +9,7 @@ PIPE_NAME = "PFW_Pipe" rcode = """ import windows +import windows.pipe f = open('tst.txt', "w+") fh = windows.utils.get_handle_from_file(f) diff --git a/samples/pipe/pipe_custom_acl.py b/samples/pipe/pipe_custom_acl.py index 90e4e8d..3772c6a 100644 --- a/samples/pipe/pipe_custom_acl.py +++ b/samples/pipe/pipe_custom_acl.py @@ -1,4 +1,5 @@ import windows.test +import windows.pipe p = windows.test.pop_proc_32() print("Child is {0}".format(p)) @@ -7,6 +8,7 @@ PIPE_NAME = "PFW_Pipe" lower_integrity = """ import windows +import windows.pipe windows.current_process.token.integrity = 0x1000 """ diff --git a/samples/process/apisetmap.py b/samples/process/apisetmap.py index 897a515..b0c65b0 100644 --- a/samples/process/apisetmap.py +++ b/samples/process/apisetmap.py @@ -7,7 +7,8 @@ apism = cp.peb.apisetmap print("ApiSetMap: {0} (version = {1})".format(apism, apism.version)) -dll_demos_fullname = 'api-ms-win-core-processthreads-l1-1-3' +# Find the current version of "api-ms-win-core-processthreads" used by windows +dll_demos_fullname = [x for x in windows.current_process.peb.apisetmap.apisetmap_dict if "api-ms-win-core-processthreads" in x][0] dll_demos_utilname = 'api-ms-win-core-processthreads-l1-1-' print("Entries in 'apisetmap_dict' are the full api-dll path extracted") diff --git a/samples/process/iat_hook.py b/samples/process/iat_hook.py index 7cd8bea..9eaaabe 100644 --- a/samples/process/iat_hook.py +++ b/samples/process/iat_hook.py @@ -2,7 +2,10 @@ import sys import os.path sys.path.append(os.path.abspath(__file__ + "\..\..")) -import _winreg +try: + import winreg +except ImportError: + import _winreg as winreg import windows # Here is a demo of IAT hooking in python @@ -25,6 +28,22 @@ def open_reg_hook(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_functio print(" Non-secret key : calling normal function") return real_function() +## Wide version of the Hook for python3 ! +@windows.hooks.RegOpenKeyExWCallback +def open_reg_hookw(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_function): + print(" Hook called | hKey = {0} | lpSubKey = <{1}>".format(hex(hKey), lpSubKey.value)) + # Our hook can choose to call the real_function or not + if "SECRET" in lpSubKey.value: + print(" Secret key asked, returning magic handle 0x12345678") + # We must respect the hooked method return-value interface + phkResult[0] = 0x12345678 + return 0 + if "FAIL" in lpSubKey.value: + print(" Asked for a failing key: returning 0x2a") + return 42 + print(" Non-secret key : calling normal function") + return real_function() + # Get the peb of our process peb = windows.current_process.peb @@ -36,23 +55,27 @@ pythondll_module = [m for m in peb.modules if m.name.startswith("python") and m. adv_imports = pythondll_module.pe.imports['advapi32.dll'] # Get RegOpenKeyExA iat entry -RegOpenKeyExA_iat = [n for n in adv_imports if n.name == "RegOpenKeyExA"][0] +RegOpenKeyEx_iat = [n for n in adv_imports if n.name == "RegOpenKeyExA"] +if not RegOpenKeyEx_iat: # Py3 + RegOpenKeyEx_iat = [n for n in adv_imports if n.name == "RegOpenKeyExW"] + open_reg_hook = open_reg_hookw +RegOpenKeyEx_iat = RegOpenKeyEx_iat[0] # Setup our hook -RegOpenKeyExA_iat.set_hook(open_reg_hook) +RegOpenKeyEx_iat.set_hook(open_reg_hook) ### !!!! You must keep the iat_entry alive !!!! ### If the hook is garbage collected while active -> python will crash # Use python native module _winreg that call 'RegOpenKeyExA' print("Asking for ") -v = _winreg.OpenKey(1234567, "MY_SECRET_KEY") +v = winreg.OpenKey(1234567, "MY_SECRET_KEY") print("Result = " + hex(v.handle)) print("") print("Asking for ") try: - v = _winreg.OpenKey(1234567, "MY_FAIL_KEY") + v = winreg.OpenKey(1234567, "MY_FAIL_KEY") print("Result = " + hex(v.handle)) except WindowsError as e: print(repr(e)) @@ -60,7 +83,7 @@ except WindowsError as e: print("") print("Asking for ") try: - v = _winreg.OpenKey(_winreg.HKEY_CURRENT_USER, "Software") + v = winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Software") print("Result = " + hex(v.handle)) except WindowsError as e: print(repr(e)) \ No newline at end of file diff --git a/samples/rpc/lsass.py b/samples/rpc/lsass.py index c8c340d..cdca9eb 100644 --- a/samples/rpc/lsass.py +++ b/samples/rpc/lsass.py @@ -100,4 +100,4 @@ print("Privileges:") ## Unpack the resulting 'LSAPR_PRIVILEGE_ENUM_BUFFER' priviledges = LSAPR_PRIVILEGE_ENUM_BUFFER.unpack(ndr.NdrStream(res)) for priv in priviledges: - print priv \ No newline at end of file + print(priv) \ No newline at end of file diff --git a/samples/service/service_demo.py b/samples/service/service_demo.py index 3b46784..4a1b582 100644 --- a/samples/service/service_demo.py +++ b/samples/service/service_demo.py @@ -6,7 +6,7 @@ for service in windows.system.services[:3]: print(" * {0}".format(service)) print("") -TARGET_SERVICE = b"TapiSrv" +TARGET_SERVICE = "TapiSrv" print("Retriving service <{0}>".format(TARGET_SERVICE)) service = windows.system.services[TARGET_SERVICE] print("{0}".format(service))