Clean ICallInterceptor POC

samples/com/icallinterceptor.py

@@ -10,49 +10,62 @@ from windows import winproxy
 
 windows.com.init()
 
-target = gdef.INetFwPolicy2
-
-fakefirewall = gdef.INetFwPolicy2()
-
+# Create an interceptor for the firewall (INetFwPolicy2)
 interceptor = gdef.ICallInterceptor()
+winproxy.CoGetInterceptor(gdef.INetFwPolicy2.IID, None, interceptor.IID, interceptor)
 
-winproxy.CoGetInterceptor(target.IID, None, interceptor.IID, interceptor)
-
+# The PythonForWindows firewall object is a real/valid INetFwPolicy2
+# used for demos of ICallFrameEvents.Invoke
 real_firewall = windows.system.network.firewall
 
+# Custom Python ICallFrameEvents implementation
 class MySink(windows.com.COMImplementation):
     IMPLEMENT = gdef.ICallFrameEvents
 
     def OnCall(self, this, frame):
         this = gdef.ICallFrameEvents(this) # TODO: auto-translate this ?
         frame = gdef.ICallFrame(frame)
-        print(this)
-        print(frame)
-        name = gdef.PWSTR()
-        name2 = gdef.PWSTR()
-        frame.GetNames(name, name2)
-        stack = frame.GetStackLocation()
-        print(name)
-        print(name2)
-        x = gdef.CALLFRAMEPARAMINFO()
-        ci = gdef.CALLFRAMEINFO()
-        y = windows.com.ImprovedVariant()
-        frame.GetParamInfo(1, x)
-        frame.GetParam(1, y)
-        frame.GetInfo(ci)
-        windows.utils.sprint(x)
-        # vbool = windows.current_process.read_dword(stack + 8)
-        # You can use this to call the real function :)
+        ifname = gdef.PWSTR()
+        methodname = gdef.PWSTR()
+        print("Hello from python sink !")
+        frame.GetNames(ifname, methodname)
+        print("Catching call to <{0}.{1}>".format(ifname.value, methodname.value))
+        param0info = gdef.CALLFRAMEPARAMINFO()
+        param0 = windows.com.ImprovedVariant()
+        frame.GetParamInfo(0, param0info)
+        frame.GetParam(0, param0)
+        print("Info about parameters 0:")
+        windows.utils.sprint(param0info, name=" * param0info")
+        print("param0 value = {0}".format(param0.aslong))
         frame.Invoke(real_firewall)
         frame.SetReturnValue(1234)
-        print("COM COM MON PYTHON :D")
+        print("Leaving the sink !")
         return 0
 
+# Create and register our ICallFrameEvents sink
 xsink = MySink()
 interceptor.RegisterSink(xsink)
+# Create the INetFwPolicy2 interceptor interface
+fakefirewall = gdef.INetFwPolicy2()
 interceptor.QueryInterface(fakefirewall.IID, fakefirewall)
 
+# Calling one of the INetFwPolicy2 function for testing
+# Testing on https://msdn.microsoft.com/en-us/library/windows/desktop/aa365316(v=vs.85).aspx
 enabled = gdef.VARIANT_BOOL()
 res = fakefirewall.get_FirewallEnabled(2, enabled)
 print("return value = {0}".format(res))
-print("enabled = {0}".format(enabled))
+print("firewall enabled = {0}".format(enabled))
+
+
+# (cmd) python samples\com\icallinterceptor.py
+# Hello from python sink !
+# Catching call to <INetFwPolicy2.FirewallEnabled>
+# Info about parameters 0:
+#  * param0info.fIn -> 0x1
+#  * param0info.fOut -> 0x0
+#  * param0info.stackOffset -> 0x4L
+#  * param0info.cbParam -> 0x4L
+# param0 value = 2
+# Leaving the sink !
+# return value = 1234
+# firewall enabled = VARIANT_BOOL(True)