diff --git a/samples/com/icallinterceptor.py b/samples/com/icallinterceptor.py index c773e03..d8e33dd 100644 --- a/samples/com/icallinterceptor.py +++ b/samples/com/icallinterceptor.py @@ -10,49 +10,62 @@ from windows import winproxy windows.com.init() -target = gdef.INetFwPolicy2 - -fakefirewall = gdef.INetFwPolicy2() - +# Create an interceptor for the firewall (INetFwPolicy2) interceptor = gdef.ICallInterceptor() +winproxy.CoGetInterceptor(gdef.INetFwPolicy2.IID, None, interceptor.IID, interceptor) -winproxy.CoGetInterceptor(target.IID, None, interceptor.IID, interceptor) - +# The PythonForWindows firewall object is a real/valid INetFwPolicy2 +# used for demos of ICallFrameEvents.Invoke real_firewall = windows.system.network.firewall +# Custom Python ICallFrameEvents implementation class MySink(windows.com.COMImplementation): IMPLEMENT = gdef.ICallFrameEvents def OnCall(self, this, frame): this = gdef.ICallFrameEvents(this) # TODO: auto-translate this ? frame = gdef.ICallFrame(frame) - print(this) - print(frame) - name = gdef.PWSTR() - name2 = gdef.PWSTR() - frame.GetNames(name, name2) - stack = frame.GetStackLocation() - print(name) - print(name2) - x = gdef.CALLFRAMEPARAMINFO() - ci = gdef.CALLFRAMEINFO() - y = windows.com.ImprovedVariant() - frame.GetParamInfo(1, x) - frame.GetParam(1, y) - frame.GetInfo(ci) - windows.utils.sprint(x) - # vbool = windows.current_process.read_dword(stack + 8) - # You can use this to call the real function :) + ifname = gdef.PWSTR() + methodname = gdef.PWSTR() + print("Hello from python sink !") + frame.GetNames(ifname, methodname) + print("Catching call to <{0}.{1}>".format(ifname.value, methodname.value)) + param0info = gdef.CALLFRAMEPARAMINFO() + param0 = windows.com.ImprovedVariant() + frame.GetParamInfo(0, param0info) + frame.GetParam(0, param0) + print("Info about parameters 0:") + windows.utils.sprint(param0info, name=" * param0info") + print("param0 value = {0}".format(param0.aslong)) frame.Invoke(real_firewall) frame.SetReturnValue(1234) - print("COM COM MON PYTHON :D") + print("Leaving the sink !") return 0 +# Create and register our ICallFrameEvents sink xsink = MySink() interceptor.RegisterSink(xsink) +# Create the INetFwPolicy2 interceptor interface +fakefirewall = gdef.INetFwPolicy2() interceptor.QueryInterface(fakefirewall.IID, fakefirewall) +# Calling one of the INetFwPolicy2 function for testing +# Testing on https://msdn.microsoft.com/en-us/library/windows/desktop/aa365316(v=vs.85).aspx enabled = gdef.VARIANT_BOOL() res = fakefirewall.get_FirewallEnabled(2, enabled) print("return value = {0}".format(res)) -print("enabled = {0}".format(enabled)) \ No newline at end of file +print("firewall enabled = {0}".format(enabled)) + + +# (cmd) python samples\com\icallinterceptor.py +# Hello from python sink ! +# Catching call to +# Info about parameters 0: +# * param0info.fIn -> 0x1 +# * param0info.fOut -> 0x0 +# * param0info.stackOffset -> 0x4L +# * param0info.cbParam -> 0x4L +# param0 value = 2 +# Leaving the sink ! +# return value = 1234 +# firewall enabled = VARIANT_BOOL(True) \ No newline at end of file