mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Add some defs + wintrust catalog functions
This commit is contained in:
Clement Rouault
@@ -28,6 +28,10 @@ TODO:
|
||||
|
||||
- Debugger ? Veh ?
|
||||
|
||||
- TransparentApiProxy
|
||||
|
||||
double name (params and args) for same info..
|
||||
|
||||
|
||||
FIXME:
|
||||
- WMI
|
||||
|
||||
@@ -21,12 +21,16 @@ TYPE_EQUIVALENCE = [
|
||||
('PDWORD', 'POINTER(DWORD)'),
|
||||
('LPDWORD', 'POINTER(DWORD)'),
|
||||
('LPTHREAD_START_ROUTINE', 'PVOID'),
|
||||
('WNDENUMPROC', 'PVOID'),
|
||||
('PHANDLER_ROUTINE', 'PVOID'),
|
||||
('LPBYTE', 'POINTER(BYTE)'),
|
||||
('ULONG_PTR','PULONG'),
|
||||
('CHAR', 'c_char'),
|
||||
('INT', 'c_int'),
|
||||
('UCHAR', 'c_char'),
|
||||
('CSHORT', 'c_short'),
|
||||
('PUCHAR', 'POINTER(UCHAR)'),
|
||||
('double', 'c_double'),
|
||||
('FARPROC', 'PVOID'),
|
||||
('HGLOBAL', 'PVOID'),
|
||||
('PSID', 'PVOID'),
|
||||
@@ -35,17 +39,24 @@ TYPE_EQUIVALENCE = [
|
||||
('ULONGLONG', 'c_ulonglong'),
|
||||
('LONGLONG', 'c_longlong'),
|
||||
('ULONG64', 'c_ulonglong'),
|
||||
('LARGE_INTEGER', 'LONGLONG'),
|
||||
('PLARGE_INTEGER', 'POINTER(LARGE_INTEGER)'),
|
||||
('DWORD64', 'ULONG64'),
|
||||
('PULONG64', 'POINTER(ULONG64)'),
|
||||
('PHANDLE', 'POINTER(HANDLE)'),
|
||||
('HKEY', 'HANDLE'),
|
||||
('HCATADMIN', 'HANDLE'),
|
||||
('HCATINFO', 'HANDLE'),
|
||||
('SC_HANDLE', 'HANDLE'),
|
||||
('PHKEY', 'POINTER(HKEY)'),
|
||||
('ACCESS_MASK', 'DWORD'),
|
||||
('REGSAM', 'ACCESS_MASK'),
|
||||
('SECURITY_CONTEXT_TRACKING_MODE', 'BOOLEAN'),
|
||||
# Will be changed at import time
|
||||
('LPCONTEXT', 'PVOID'),
|
||||
('HCERTSTORE', 'PVOID'),
|
||||
('HCRYPTMSG', 'PVOID'),
|
||||
('PALPC_PORT_ATTRIBUTES', 'PVOID'),
|
||||
]
|
||||
|
||||
# For functions returning void
|
||||
@@ -86,7 +97,6 @@ def verif_funcs_type(funcs, structs, enums):
|
||||
for f in funcs:
|
||||
ret_type = f.return_type
|
||||
if ret_type not in known_type and ret_type not in all_struct_name:
|
||||
import pdb; pdb.set_trace()
|
||||
raise ValueError("UNKNOW RET TYPE {0}".format(ret_type))
|
||||
|
||||
for param_type, _ in f.params:
|
||||
@@ -94,7 +104,6 @@ def verif_funcs_type(funcs, structs, enums):
|
||||
if param_type.startswith("POINTER(") and param_type.endswith(")"):
|
||||
param_type = param_type[len("POINTER("): -1]
|
||||
if param_type not in known_type and param_type not in all_struct_name:
|
||||
import pdb; pdb.set_trace()
|
||||
raise ValueError("UNKNOW PARAM TYPE {0}".format(param_type))
|
||||
|
||||
def check_in_define(name, defs):
|
||||
@@ -105,7 +114,6 @@ def validate_structs(structs, enums, defs):
|
||||
for struct in structs:
|
||||
for field_type, field_name, nb_rep in struct.fields:
|
||||
if field_type.name not in known_type + all_struct_name:
|
||||
import pdb; pdb.set_trace()
|
||||
raise ValueError("UNKNOW TYPE {0}".format(field_type))
|
||||
try:
|
||||
int(nb_rep)
|
||||
|
||||
@@ -605,3 +605,125 @@
|
||||
#define IMAGE_FILE_MACHINE_AMD64 0x8664
|
||||
#define IMAGE_FILE_MACHINE_M32R 0x9041
|
||||
#define IMAGE_FILE_MACHINE_CEE 0xC0EE
|
||||
|
||||
|
||||
|
||||
#define SECURITY_MANDATORY_UNTRUSTED_RID (0x00000000L)
|
||||
#define SECURITY_MANDATORY_LOW_RID (0x00001000L)
|
||||
#define SECURITY_MANDATORY_MEDIUM_RID (0x00002000L)
|
||||
#define SECURITY_MANDATORY_MEDIUM_PLUS_RID (SECURITY_MANDATORY_MEDIUM_RID + 0x100)
|
||||
#define SECURITY_MANDATORY_HIGH_RID (0x00003000L)
|
||||
#define SECURITY_MANDATORY_SYSTEM_RID (0x00004000L)
|
||||
#define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L)
|
||||
|
||||
#define SECTION_QUERY 0x0001
|
||||
#define SECTION_MAP_WRITE 0x0002
|
||||
#define SECTION_MAP_READ 0x0004
|
||||
#define SECTION_MAP_EXECUTE 0x0008
|
||||
#define SECTION_EXTEND_SIZE 0x0010
|
||||
#define SECTION_MAP_EXECUTE_EXPLICIT 0x0020
|
||||
|
||||
|
||||
#define SECTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SECTION_QUERY| SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE | SECTION_EXTEND_SIZE)
|
||||
|
||||
#define FILE_MAP_COPY SECTION_QUERY
|
||||
#define FILE_MAP_WRITE SECTION_MAP_WRITE
|
||||
#define FILE_MAP_READ SECTION_MAP_READ
|
||||
#define FILE_MAP_ALL_ACCESS SECTION_ALL_ACCESS
|
||||
#define FILE_MAP_EXECUTE SECTION_MAP_EXECUTE_EXPLICIT
|
||||
|
||||
|
||||
#define SC_MANAGER_CONNECT 0x0001
|
||||
#define SC_MANAGER_CREATE_SERVICE 0x0002
|
||||
#define SC_MANAGER_ENUMERATE_SERVICE 0x0004
|
||||
#define SC_MANAGER_LOCK 0x0008
|
||||
#define SC_MANAGER_QUERY_LOCK_STATUS 0x0010
|
||||
#define SC_MANAGER_MODIFY_BOOT_CONFIG 0x0020
|
||||
|
||||
#define SC_MANAGER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE | SC_MANAGER_ENUMERATE_SERVICE | SC_MANAGER_LOCK | SC_MANAGER_QUERY_LOCK_STATUS | SC_MANAGER_MODIFY_BOOT_CONFIG)
|
||||
|
||||
#define SERVICE_QUERY_CONFIG 0x0001
|
||||
#define SERVICE_CHANGE_CONFIG 0x0002
|
||||
#define SERVICE_QUERY_STATUS 0x0004
|
||||
#define SERVICE_ENUMERATE_DEPENDENTS 0x0008
|
||||
#define SERVICE_START 0x0010
|
||||
#define SERVICE_STOP 0x0020
|
||||
#define SERVICE_PAUSE_CONTINUE 0x0040
|
||||
#define SERVICE_INTERROGATE 0x0080
|
||||
#define SERVICE_USER_DEFINED_CONTROL 0x0100
|
||||
|
||||
#define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_START | SERVICE_STOP | SERVICE_PAUSE_CONTINUE | SERVICE_INTERROGATE | SERVICE_USER_DEFINED_CONTROL)
|
||||
|
||||
|
||||
#define SERVICE_RUNS_IN_SYSTEM_PROCESS 0x00000001
|
||||
|
||||
|
||||
#define SERVICE_KERNEL_DRIVER 0x00000001
|
||||
#define SERVICE_FILE_SYSTEM_DRIVER 0x00000002
|
||||
#define SERVICE_ADAPTER 0x00000004
|
||||
#define SERVICE_RECOGNIZER_DRIVER 0x00000008
|
||||
|
||||
#define SERVICE_DRIVER (SERVICE_KERNEL_DRIVER | SERVICE_FILE_SYSTEM_DRIVER | SERVICE_RECOGNIZER_DRIVER)
|
||||
|
||||
#define SERVICE_WIN32_OWN_PROCESS 0x00000010
|
||||
#define SERVICE_WIN32_SHARE_PROCESS 0x00000020
|
||||
#define SERVICE_WIN32 (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS)
|
||||
|
||||
#define SERVICE_INTERACTIVE_PROCESS 0x00000100
|
||||
|
||||
#define SERVICE_TYPE_ALL (SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS)
|
||||
|
||||
|
||||
#define SERVICE_BOOT_START 0x00000000
|
||||
#define SERVICE_SYSTEM_START 0x00000001
|
||||
#define SERVICE_AUTO_START 0x00000002
|
||||
#define SERVICE_DEMAND_START 0x00000003
|
||||
#define SERVICE_DISABLED 0x00000004
|
||||
|
||||
#define SERVICE_ERROR_IGNORE 0x00000000
|
||||
#define SERVICE_ERROR_NORMAL 0x00000001
|
||||
#define SERVICE_ERROR_SEVERE 0x00000002
|
||||
#define SERVICE_ERROR_CRITICAL 0x00000003
|
||||
|
||||
#define SERVICE_ACTIVE 0x00000001
|
||||
#define SERVICE_INACTIVE 0x00000002
|
||||
#define SERVICE_STATE_ALL (SERVICE_ACTIVE | SERVICE_INACTIVE)
|
||||
|
||||
#define SERVICE_CONTROL_STOP 0x00000001
|
||||
#define SERVICE_CONTROL_PAUSE 0x00000002
|
||||
#define SERVICE_CONTROL_CONTINUE 0x00000003
|
||||
#define SERVICE_CONTROL_INTERROGATE 0x00000004
|
||||
#define SERVICE_CONTROL_SHUTDOWN 0x00000005
|
||||
#define SERVICE_CONTROL_PARAMCHANGE 0x00000006
|
||||
#define SERVICE_CONTROL_NETBINDADD 0x00000007
|
||||
#define SERVICE_CONTROL_NETBINDREMOVE 0x00000008
|
||||
#define SERVICE_CONTROL_NETBINDENABLE 0x00000009
|
||||
#define SERVICE_CONTROL_NETBINDDISABLE 0x0000000A
|
||||
#define SERVICE_CONTROL_DEVICEEVENT 0x0000000B
|
||||
#define SERVICE_CONTROL_HARDWAREPROFILECHANGE 0x0000000C
|
||||
#define SERVICE_CONTROL_POWEREVENT 0x0000000D
|
||||
#define SERVICE_CONTROL_SESSIONCHANGE 0x0000000E
|
||||
#define SERVICE_CONTROL_PRESHUTDOWN 0x0000000F
|
||||
#define SERVICE_CONTROL_TIMECHANGE 0x00000010
|
||||
#define SERVICE_CONTROL_TRIGGEREVENT 0x00000020
|
||||
|
||||
#define SERVICE_STOPPED 0x00000001
|
||||
#define SERVICE_START_PENDING 0x00000002
|
||||
#define SERVICE_STOP_PENDING 0x00000003
|
||||
#define SERVICE_RUNNING 0x00000004
|
||||
#define SERVICE_CONTINUE_PENDING 0x00000005
|
||||
#define SERVICE_PAUSE_PENDING 0x00000006
|
||||
#define SERVICE_PAUSED 0x00000007
|
||||
|
||||
|
||||
#define SERVICE_ACCEPT_STOP 0x00000001
|
||||
#define SERVICE_ACCEPT_PAUSE_CONTINUE 0x00000002
|
||||
#define SERVICE_ACCEPT_SHUTDOWN 0x00000004
|
||||
#define SERVICE_ACCEPT_PARAMCHANGE 0x00000008
|
||||
#define SERVICE_ACCEPT_NETBINDCHANGE 0x00000010
|
||||
#define SERVICE_ACCEPT_HARDWAREPROFILECHANGE 0x00000020
|
||||
#define SERVICE_ACCEPT_POWEREVENT 0x00000040
|
||||
#define SERVICE_ACCEPT_SESSIONCHANGE 0x00000080
|
||||
#define SERVICE_ACCEPT_PRESHUTDOWN 0x00000100
|
||||
#define SERVICE_ACCEPT_TIMECHANGE 0x00000200
|
||||
#define SERVICE_ACCEPT_TRIGGEREVENT 0x00000400
|
||||
@@ -761,4 +761,212 @@ DWORD WINAPI GetMappedFileNameA (
|
||||
__in LPVOID lpv,
|
||||
__out PVOID lpFilename,
|
||||
__in DWORD nSize
|
||||
);
|
||||
|
||||
VOID RtlInitString (
|
||||
PSTRING DestinationString,
|
||||
LPCSTR SourceString
|
||||
);
|
||||
|
||||
|
||||
VOID RtlInitUnicodeString (
|
||||
PUNICODE_STRING DestinationString,
|
||||
LPCWSTR SourceString
|
||||
);
|
||||
|
||||
NTSTATUS RtlAnsiStringToUnicodeString (
|
||||
PUNICODE_STRING DestinationString,
|
||||
PCANSI_STRING SourceString,
|
||||
BOOLEAN AllocateDestinationString
|
||||
);
|
||||
|
||||
|
||||
HANDLE WINAPI OpenEventA(
|
||||
__in DWORD dwDesiredAccess,
|
||||
__in BOOL bInheritHandle,
|
||||
__in LPCSTR lpName
|
||||
);
|
||||
|
||||
|
||||
HANDLE WINAPI OpenEventW(
|
||||
__in DWORD dwDesiredAccess,
|
||||
__in BOOL bInheritHandle,
|
||||
__in LPCWSTR lpName
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtOpenEvent(
|
||||
__out PHANDLE EventHandle,
|
||||
__in ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_ATTRIBUTES ObjectAttributes
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtAlpcConnectPort(
|
||||
_Out_ PHANDLE PortHandle,
|
||||
_In_ PUNICODE_STRING PortName,
|
||||
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
|
||||
_In_ ULONG Flags,
|
||||
_In_opt_ PSID RequiredServerSid,
|
||||
_Inout_opt_ PPORT_MESSAGE ConnectionMessage,
|
||||
_Inout_opt_ PULONG BufferLength,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
|
||||
_In_opt_ PLARGE_INTEGER Timeout);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtAlpcSendWaitReceivePort(
|
||||
_In_ HANDLE PortHandle,
|
||||
_In_ ULONG Flags,
|
||||
_In_opt_ PPORT_MESSAGE SendMessage,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
|
||||
_Out_opt_ PPORT_MESSAGE ReceiveMessage,
|
||||
_Inout_opt_ PSIZE_T BufferLength,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
|
||||
INT WINAPI lstrcmpA(
|
||||
__in LPCSTR lpString1,
|
||||
__in LPCSTR lpString2
|
||||
);
|
||||
|
||||
INT WINAPI lstrcmpW(
|
||||
__in LPCWSTR lpString1,
|
||||
__in LPCWSTR lpString2
|
||||
);
|
||||
|
||||
|
||||
HANDLE WINAPI CreateFileMappingA(
|
||||
__in HANDLE hFile,
|
||||
__in_opt LPSECURITY_ATTRIBUTES lpFileMappingAttributes,
|
||||
__in DWORD flProtect,
|
||||
__in DWORD dwMaximumSizeHigh,
|
||||
__in DWORD dwMaximumSizeLow,
|
||||
__in_opt LPCSTR lpName
|
||||
);
|
||||
|
||||
HANDLE WINAPI CreateFileMappingW(
|
||||
__in HANDLE hFile,
|
||||
__in_opt LPSECURITY_ATTRIBUTES lpFileMappingAttributes,
|
||||
__in DWORD flProtect,
|
||||
__in DWORD dwMaximumSizeHigh,
|
||||
__in DWORD dwMaximumSizeLow,
|
||||
__in_opt LPCWSTR lpName
|
||||
);
|
||||
|
||||
|
||||
LPVOID WINAPI MapViewOfFile(
|
||||
__in HANDLE hFileMappingObject,
|
||||
__in DWORD dwDesiredAccess,
|
||||
__in DWORD dwFileOffsetHigh,
|
||||
__in DWORD dwFileOffsetLow,
|
||||
__in SIZE_T dwNumberOfBytesToMap
|
||||
);
|
||||
|
||||
|
||||
SC_HANDLE WINAPI OpenSCManagerA(
|
||||
__in_opt LPCSTR lpMachineName,
|
||||
__in_opt LPCSTR lpDatabaseName,
|
||||
__in DWORD dwDesiredAccess
|
||||
);
|
||||
|
||||
SC_HANDLE WINAPI OpenSCManagerW(
|
||||
__in_opt LPCWSTR lpMachineName,
|
||||
__in_opt LPCWSTR lpDatabaseName,
|
||||
__in DWORD dwDesiredAccess
|
||||
);
|
||||
|
||||
BOOL WINAPI EnumServicesStatusExA(
|
||||
__in SC_HANDLE hSCManager,
|
||||
__in SC_ENUM_TYPE InfoLevel,
|
||||
__in DWORD dwServiceType,
|
||||
__in DWORD dwServiceState,
|
||||
_Out_opt_ LPBYTE lpServices,
|
||||
__in DWORD cbBufSize,
|
||||
__out LPDWORD pcbBytesNeeded,
|
||||
__out LPDWORD lpServicesReturned,
|
||||
__inout_opt LPDWORD lpResumeHandle,
|
||||
__in_opt LPCSTR pszGroupName
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI EnumServicesStatusExW(
|
||||
__in SC_HANDLE hSCManager,
|
||||
__in SC_ENUM_TYPE InfoLevel,
|
||||
__in DWORD dwServiceType,
|
||||
__in DWORD dwServiceState,
|
||||
_Out_opt_ LPBYTE lpServices,
|
||||
__in DWORD cbBufSize,
|
||||
__out LPDWORD pcbBytesNeeded,
|
||||
__out LPDWORD lpServicesReturned,
|
||||
__inout_opt LPDWORD lpResumeHandle,
|
||||
__in_opt LPCWSTR pszGroupName
|
||||
);
|
||||
|
||||
BOOL WINAPI EnumWindows(
|
||||
__in WNDENUMPROC lpEnumFunc,
|
||||
__in LPARAM lParam
|
||||
);
|
||||
|
||||
|
||||
INT WINAPI GetWindowTextA(
|
||||
__in HWND hWnd,
|
||||
__out LPSTR lpString,
|
||||
__in INT nMaxCount
|
||||
);
|
||||
|
||||
INT WINAPI GetWindowTextW(
|
||||
__in HWND hWnd,
|
||||
__out LPWSTR lpString,
|
||||
__in INT nMaxCount
|
||||
);
|
||||
|
||||
UINT WINAPI GetWindowModuleFileNameA(
|
||||
__in HWND hwnd,
|
||||
__out LPSTR pszFileName,
|
||||
__in UINT cchFileNameMax);
|
||||
|
||||
UINT WINAPI GetWindowModuleFileNameW(
|
||||
__in HWND hwnd,
|
||||
__out LPWSTR pszFileName,
|
||||
__in UINT cchFileNameMax);
|
||||
|
||||
|
||||
BOOL WINAPI CryptCATAdminCalcHashFromFileHandle(
|
||||
__in HANDLE hFile,
|
||||
__inout DWORD *pcbHash,
|
||||
_Out_opt_ BYTE *pbHash,
|
||||
__in DWORD dwFlags);
|
||||
|
||||
HCATINFO WINAPI CryptCATAdminEnumCatalogFromHash(
|
||||
__in HCATADMIN hCatAdmin,
|
||||
__in BYTE *pbHash,
|
||||
__in DWORD cbHash,
|
||||
__in DWORD dwFlags,
|
||||
__inout HCATINFO *phPrevCatInfo);
|
||||
|
||||
BOOL WINAPI CryptCATAdminAcquireContext(
|
||||
_Out_ HCATADMIN *phCatAdmin,
|
||||
_In_ GUID *pgSubsystem,
|
||||
_In_ DWORD dwFlags
|
||||
);
|
||||
|
||||
BOOL WINAPI CryptCATCatalogInfoFromContext(
|
||||
_In_ HCATINFO hCatInfo,
|
||||
_Inout_ CATALOG_INFO *psCatInfo,
|
||||
_In_ DWORD dwFlags
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI CryptCATAdminReleaseCatalogContext(
|
||||
_In_ HCATADMIN hCatAdmin,
|
||||
_In_ HCATINFO hCatInfo,
|
||||
_In_ DWORD dwFlags
|
||||
);
|
||||
|
||||
BOOL WINAPI CryptCATAdminReleaseContext(
|
||||
_In_ HCATADMIN hCatAdmin,
|
||||
_In_ DWORD dwFlags
|
||||
);
|
||||
@@ -328,6 +328,22 @@ typedef enum _TOKEN_INFORMATION_CLASS {
|
||||
MaxTokenInfoClass,
|
||||
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
|
||||
|
||||
|
||||
typedef enum _SECURITY_IMPERSONATION_LEVEL {
|
||||
SecurityAnonymous,
|
||||
SecurityIdentification,
|
||||
SecurityImpersonation,
|
||||
SecurityDelegation
|
||||
} SECURITY_IMPERSONATION_LEVEL, * PSECURITY_IMPERSONATION_LEVEL;
|
||||
|
||||
typedef enum _SC_ENUM_TYPE {
|
||||
SC_ENUM_PROCESS_INFO = 0
|
||||
} SC_ENUM_TYPE;
|
||||
|
||||
typedef enum _SC_STATUS_TYPE {
|
||||
SC_STATUS_PROCESS_INFO = 0
|
||||
} SC_STATUS_TYPE;
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
PVOID Reserved1[2];
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
@@ -1560,4 +1576,150 @@ typedef struct _DEBUG_EVENT {
|
||||
DWORD dwProcessId;
|
||||
DWORD dwThreadId;
|
||||
_TMP_UNION_DEBUG_INFO u;
|
||||
} DEBUG_EVENT, *LPDEBUG_EVENT;
|
||||
} DEBUG_EVENT, *LPDEBUG_EVENT;
|
||||
|
||||
|
||||
typedef struct _STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
LPCSTR Buffer;
|
||||
} STRING, *PSTRING, *PANSI_STRING, *PCANSI_STRING;
|
||||
|
||||
typedef struct _OBJECT_ATTRIBUTES {
|
||||
ULONG Length;
|
||||
HANDLE RootDirectory;
|
||||
PUNICODE_STRING ObjectName;
|
||||
ULONG Attributes;
|
||||
PVOID SecurityDescriptor;
|
||||
PVOID SecurityQualityOfService;
|
||||
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
|
||||
|
||||
|
||||
typedef struct _SECURITY_QUALITY_OF_SERVICE {
|
||||
DWORD Length;
|
||||
SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
|
||||
SECURITY_CONTEXT_TRACKING_MODE ContextTrackingMode;
|
||||
BOOLEAN EffectiveOnly;
|
||||
} SECURITY_QUALITY_OF_SERVICE, * PSECURITY_QUALITY_OF_SERVICE;
|
||||
|
||||
typedef struct _ALPC_PORT_ATTRIBUTES32
|
||||
{
|
||||
ULONG Flags;
|
||||
SECURITY_QUALITY_OF_SERVICE SecurityQos;
|
||||
SIZE_T MaxMessageLength;
|
||||
SIZE_T MemoryBandwidth;
|
||||
SIZE_T MaxPoolUsage;
|
||||
SIZE_T MaxSectionSize;
|
||||
SIZE_T MaxViewSize;
|
||||
SIZE_T MaxTotalSectionSize;
|
||||
ULONG DupObjectTypes;
|
||||
} ALPC_PORT_ATTRIBUTES32, *PALPC_PORT_ATTRIBUTES32;
|
||||
|
||||
|
||||
typedef struct _ALPC_PORT_ATTRIBUTES64
|
||||
{
|
||||
ULONG Flags;
|
||||
SECURITY_QUALITY_OF_SERVICE SecurityQos;
|
||||
SIZE_T MaxMessageLength;
|
||||
SIZE_T MemoryBandwidth;
|
||||
SIZE_T MaxPoolUsage;
|
||||
SIZE_T MaxSectionSize;
|
||||
SIZE_T MaxViewSize;
|
||||
SIZE_T MaxTotalSectionSize;
|
||||
ULONG DupObjectTypes;
|
||||
ULONG Reserved;
|
||||
} ALPC_PORT_ATTRIBUTES64, *PALPC_PORT_ATTRIBUTES64;
|
||||
|
||||
typedef struct _ALPC_MESSAGE_ATTRIBUTES
|
||||
{
|
||||
ULONG AllocatedAttributes;
|
||||
ULONG ValidAttributes;
|
||||
} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;
|
||||
|
||||
|
||||
typedef union _PORT_MESSAGE_TMP_UNION
|
||||
{
|
||||
SIZE_T ClientViewSize;
|
||||
ULONG CallbackId;
|
||||
} PORT_MESSAGE_TMP_UNION;
|
||||
|
||||
|
||||
typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1
|
||||
{
|
||||
CSHORT DataLength;
|
||||
CSHORT TotalLength;
|
||||
} _PORT_MESSAGE_TMP_SUBSTRUCT_S1;
|
||||
|
||||
|
||||
typedef union _PORT_MESSAGE_TMP_UNION_U1
|
||||
{
|
||||
ULONG Length;
|
||||
_PORT_MESSAGE_TMP_SUBSTRUCT_S1 s1;
|
||||
} _PORT_MESSAGE_TMP_UNION_U1;
|
||||
|
||||
|
||||
typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2
|
||||
{
|
||||
CSHORT Type;
|
||||
CSHORT DataInfoOffset;
|
||||
} _PORT_MESSAGE_TMP_SUBSTRUCT_S2;
|
||||
|
||||
|
||||
typedef union _PORT_MESSAGE_TMP_UNION_U2
|
||||
{
|
||||
ULONG ZeroInit;
|
||||
_PORT_MESSAGE_TMP_SUBSTRUCT_S2 s2;
|
||||
} _PORT_MESSAGE_TMP_UNION_U2;
|
||||
|
||||
|
||||
typedef struct _PORT_MESSAGE
|
||||
{
|
||||
_PORT_MESSAGE_TMP_UNION_U1 u1;
|
||||
_PORT_MESSAGE_TMP_UNION_U2 u2;
|
||||
double DoNotUseThisField;
|
||||
ULONG MessageId;
|
||||
_PORT_MESSAGE_TMP_UNION tmp_union;
|
||||
} PORT_MESSAGE, *PPORT_MESSAGE;
|
||||
|
||||
|
||||
typedef struct _SERVICE_STATUS {
|
||||
DWORD dwServiceType;
|
||||
DWORD dwCurrentState;
|
||||
DWORD dwControlsAccepted;
|
||||
DWORD dwWin32ExitCode;
|
||||
DWORD dwServiceSpecificExitCode;
|
||||
DWORD dwCheckPoint;
|
||||
DWORD dwWaitHint;
|
||||
} SERVICE_STATUS, *LPSERVICE_STATUS;
|
||||
|
||||
typedef struct _SERVICE_STATUS_PROCESS {
|
||||
DWORD dwServiceType;
|
||||
DWORD dwCurrentState;
|
||||
DWORD dwControlsAccepted;
|
||||
DWORD dwWin32ExitCode;
|
||||
DWORD dwServiceSpecificExitCode;
|
||||
DWORD dwCheckPoint;
|
||||
DWORD dwWaitHint;
|
||||
DWORD dwProcessId;
|
||||
DWORD dwServiceFlags;
|
||||
} SERVICE_STATUS_PROCESS, *LPSERVICE_STATUS_PROCESS;
|
||||
|
||||
typedef struct _ENUM_SERVICE_STATUS_PROCESSA {
|
||||
LPSTR lpServiceName;
|
||||
LPSTR lpDisplayName;
|
||||
SERVICE_STATUS_PROCESS ServiceStatusProcess;
|
||||
} ENUM_SERVICE_STATUS_PROCESSA, *LPENUM_SERVICE_STATUS_PROCESSA;
|
||||
|
||||
|
||||
typedef struct _ENUM_SERVICE_STATUS_PROCESSW {
|
||||
LPWSTR lpServiceName;
|
||||
LPWSTR lpDisplayName;
|
||||
SERVICE_STATUS_PROCESS ServiceStatusProcess;
|
||||
} ENUM_SERVICE_STATUS_PROCESSW, *LPENUM_SERVICE_STATUS_PROCESSW;
|
||||
|
||||
|
||||
typedef struct CATALOG_INFO_
|
||||
{
|
||||
DWORD cbStruct;
|
||||
WCHAR wszCatalogFile[MAX_PATH];
|
||||
} CATALOG_INFO;
|
||||
+7
-1
@@ -19,6 +19,10 @@ system = System()
|
||||
current_process = CurrentProcess()
|
||||
current_thread = CurrentThread()
|
||||
|
||||
del System
|
||||
del CurrentProcess
|
||||
del CurrentThread
|
||||
|
||||
# Late import: other imports should go here
|
||||
# Do not move it: risk of circular import
|
||||
|
||||
@@ -26,8 +30,10 @@ import windows.exception
|
||||
import windows.wmi
|
||||
import windows.utils
|
||||
import windows.debug
|
||||
import windows.service
|
||||
import windows.wintrust
|
||||
|
||||
__all__ = ["system", "VirtualProtected", 'current_process', 'current_thread', 'winproxy']
|
||||
__all__ = ["system", 'current_process', 'current_thread']
|
||||
|
||||
import os
|
||||
|
||||
|
||||
@@ -18,6 +18,9 @@ if bitness() == 32:
|
||||
|
||||
winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE32
|
||||
winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION32
|
||||
|
||||
winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES32
|
||||
|
||||
else:
|
||||
winstructs.CONTEXT = winstructs.CONTEXT64
|
||||
winstructs.PCONTEXT = winstructs.PCONTEXT64
|
||||
@@ -29,8 +32,15 @@ else:
|
||||
winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE64
|
||||
winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION64
|
||||
|
||||
winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES64
|
||||
|
||||
from . import winfuncs
|
||||
from . import windef
|
||||
|
||||
# Fuck it
|
||||
from winstructs import *
|
||||
from winfuncs import *
|
||||
from windef import *
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -2350,4 +2350,98 @@ IMAGE_FILE_MACHINE_CEF = Flag("IMAGE_FILE_MACHINE_CEF", 0x0CEF)
|
||||
IMAGE_FILE_MACHINE_EBC = Flag("IMAGE_FILE_MACHINE_EBC", 0x0EBC)
|
||||
IMAGE_FILE_MACHINE_AMD64 = Flag("IMAGE_FILE_MACHINE_AMD64", 0x8664)
|
||||
IMAGE_FILE_MACHINE_M32R = Flag("IMAGE_FILE_MACHINE_M32R", 0x9041)
|
||||
IMAGE_FILE_MACHINE_CEE = Flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE)
|
||||
IMAGE_FILE_MACHINE_CEE = Flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE)
|
||||
SECURITY_MANDATORY_UNTRUSTED_RID = Flag("SECURITY_MANDATORY_UNTRUSTED_RID", ( 0x00000000 ))
|
||||
SECURITY_MANDATORY_LOW_RID = Flag("SECURITY_MANDATORY_LOW_RID", ( 0x00001000 ))
|
||||
SECURITY_MANDATORY_MEDIUM_RID = Flag("SECURITY_MANDATORY_MEDIUM_RID", ( 0x00002000 ))
|
||||
SECURITY_MANDATORY_MEDIUM_PLUS_RID = Flag("SECURITY_MANDATORY_MEDIUM_PLUS_RID", ( SECURITY_MANDATORY_MEDIUM_RID + 0x100 ))
|
||||
SECURITY_MANDATORY_HIGH_RID = Flag("SECURITY_MANDATORY_HIGH_RID", ( 0x00003000 ))
|
||||
SECURITY_MANDATORY_SYSTEM_RID = Flag("SECURITY_MANDATORY_SYSTEM_RID", ( 0x00004000 ))
|
||||
SECURITY_MANDATORY_PROTECTED_PROCESS_RID = Flag("SECURITY_MANDATORY_PROTECTED_PROCESS_RID", ( 0x00005000 ))
|
||||
SECTION_QUERY = Flag("SECTION_QUERY", 0x0001)
|
||||
SECTION_MAP_WRITE = Flag("SECTION_MAP_WRITE", 0x0002)
|
||||
SECTION_MAP_READ = Flag("SECTION_MAP_READ", 0x0004)
|
||||
SECTION_MAP_EXECUTE = Flag("SECTION_MAP_EXECUTE", 0x0008)
|
||||
SECTION_EXTEND_SIZE = Flag("SECTION_EXTEND_SIZE", 0x0010)
|
||||
SECTION_MAP_EXECUTE_EXPLICIT = Flag("SECTION_MAP_EXECUTE_EXPLICIT", 0x0020)
|
||||
SECTION_ALL_ACCESS = Flag("SECTION_ALL_ACCESS", ( STANDARD_RIGHTS_REQUIRED|SECTION_QUERY| SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE | SECTION_EXTEND_SIZE ))
|
||||
FILE_MAP_COPY = Flag("FILE_MAP_COPY", SECTION_QUERY)
|
||||
FILE_MAP_WRITE = Flag("FILE_MAP_WRITE", SECTION_MAP_WRITE)
|
||||
FILE_MAP_READ = Flag("FILE_MAP_READ", SECTION_MAP_READ)
|
||||
FILE_MAP_ALL_ACCESS = Flag("FILE_MAP_ALL_ACCESS", SECTION_ALL_ACCESS)
|
||||
FILE_MAP_EXECUTE = Flag("FILE_MAP_EXECUTE", SECTION_MAP_EXECUTE_EXPLICIT)
|
||||
SC_MANAGER_CONNECT = Flag("SC_MANAGER_CONNECT", 0x0001)
|
||||
SC_MANAGER_CREATE_SERVICE = Flag("SC_MANAGER_CREATE_SERVICE", 0x0002)
|
||||
SC_MANAGER_ENUMERATE_SERVICE = Flag("SC_MANAGER_ENUMERATE_SERVICE", 0x0004)
|
||||
SC_MANAGER_LOCK = Flag("SC_MANAGER_LOCK", 0x0008)
|
||||
SC_MANAGER_QUERY_LOCK_STATUS = Flag("SC_MANAGER_QUERY_LOCK_STATUS", 0x0010)
|
||||
SC_MANAGER_MODIFY_BOOT_CONFIG = Flag("SC_MANAGER_MODIFY_BOOT_CONFIG", 0x0020)
|
||||
SC_MANAGER_ALL_ACCESS = Flag("SC_MANAGER_ALL_ACCESS", ( STANDARD_RIGHTS_REQUIRED | SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE | SC_MANAGER_ENUMERATE_SERVICE | SC_MANAGER_LOCK | SC_MANAGER_QUERY_LOCK_STATUS | SC_MANAGER_MODIFY_BOOT_CONFIG ))
|
||||
SERVICE_QUERY_CONFIG = Flag("SERVICE_QUERY_CONFIG", 0x0001)
|
||||
SERVICE_CHANGE_CONFIG = Flag("SERVICE_CHANGE_CONFIG", 0x0002)
|
||||
SERVICE_QUERY_STATUS = Flag("SERVICE_QUERY_STATUS", 0x0004)
|
||||
SERVICE_ENUMERATE_DEPENDENTS = Flag("SERVICE_ENUMERATE_DEPENDENTS", 0x0008)
|
||||
SERVICE_START = Flag("SERVICE_START", 0x0010)
|
||||
SERVICE_STOP = Flag("SERVICE_STOP", 0x0020)
|
||||
SERVICE_PAUSE_CONTINUE = Flag("SERVICE_PAUSE_CONTINUE", 0x0040)
|
||||
SERVICE_INTERROGATE = Flag("SERVICE_INTERROGATE", 0x0080)
|
||||
SERVICE_USER_DEFINED_CONTROL = Flag("SERVICE_USER_DEFINED_CONTROL", 0x0100)
|
||||
SERVICE_ALL_ACCESS = Flag("SERVICE_ALL_ACCESS", ( STANDARD_RIGHTS_REQUIRED | SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_START | SERVICE_STOP | SERVICE_PAUSE_CONTINUE | SERVICE_INTERROGATE | SERVICE_USER_DEFINED_CONTROL ))
|
||||
SERVICE_RUNS_IN_SYSTEM_PROCESS = Flag("SERVICE_RUNS_IN_SYSTEM_PROCESS", 0x00000001)
|
||||
SERVICE_KERNEL_DRIVER = Flag("SERVICE_KERNEL_DRIVER", 0x00000001)
|
||||
SERVICE_FILE_SYSTEM_DRIVER = Flag("SERVICE_FILE_SYSTEM_DRIVER", 0x00000002)
|
||||
SERVICE_ADAPTER = Flag("SERVICE_ADAPTER", 0x00000004)
|
||||
SERVICE_RECOGNIZER_DRIVER = Flag("SERVICE_RECOGNIZER_DRIVER", 0x00000008)
|
||||
SERVICE_DRIVER = Flag("SERVICE_DRIVER", ( SERVICE_KERNEL_DRIVER | SERVICE_FILE_SYSTEM_DRIVER | SERVICE_RECOGNIZER_DRIVER ))
|
||||
SERVICE_WIN32_OWN_PROCESS = Flag("SERVICE_WIN32_OWN_PROCESS", 0x00000010)
|
||||
SERVICE_WIN32_SHARE_PROCESS = Flag("SERVICE_WIN32_SHARE_PROCESS", 0x00000020)
|
||||
SERVICE_WIN32 = Flag("SERVICE_WIN32", ( SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS ))
|
||||
SERVICE_INTERACTIVE_PROCESS = Flag("SERVICE_INTERACTIVE_PROCESS", 0x00000100)
|
||||
SERVICE_TYPE_ALL = Flag("SERVICE_TYPE_ALL", ( SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS ))
|
||||
SERVICE_BOOT_START = Flag("SERVICE_BOOT_START", 0x00000000)
|
||||
SERVICE_SYSTEM_START = Flag("SERVICE_SYSTEM_START", 0x00000001)
|
||||
SERVICE_AUTO_START = Flag("SERVICE_AUTO_START", 0x00000002)
|
||||
SERVICE_DEMAND_START = Flag("SERVICE_DEMAND_START", 0x00000003)
|
||||
SERVICE_DISABLED = Flag("SERVICE_DISABLED", 0x00000004)
|
||||
SERVICE_ERROR_IGNORE = Flag("SERVICE_ERROR_IGNORE", 0x00000000)
|
||||
SERVICE_ERROR_NORMAL = Flag("SERVICE_ERROR_NORMAL", 0x00000001)
|
||||
SERVICE_ERROR_SEVERE = Flag("SERVICE_ERROR_SEVERE", 0x00000002)
|
||||
SERVICE_ERROR_CRITICAL = Flag("SERVICE_ERROR_CRITICAL", 0x00000003)
|
||||
SERVICE_ACTIVE = Flag("SERVICE_ACTIVE", 0x00000001)
|
||||
SERVICE_INACTIVE = Flag("SERVICE_INACTIVE", 0x00000002)
|
||||
SERVICE_STATE_ALL = Flag("SERVICE_STATE_ALL", ( SERVICE_ACTIVE | SERVICE_INACTIVE ))
|
||||
SERVICE_CONTROL_STOP = Flag("SERVICE_CONTROL_STOP", 0x00000001)
|
||||
SERVICE_CONTROL_PAUSE = Flag("SERVICE_CONTROL_PAUSE", 0x00000002)
|
||||
SERVICE_CONTROL_CONTINUE = Flag("SERVICE_CONTROL_CONTINUE", 0x00000003)
|
||||
SERVICE_CONTROL_INTERROGATE = Flag("SERVICE_CONTROL_INTERROGATE", 0x00000004)
|
||||
SERVICE_CONTROL_SHUTDOWN = Flag("SERVICE_CONTROL_SHUTDOWN", 0x00000005)
|
||||
SERVICE_CONTROL_PARAMCHANGE = Flag("SERVICE_CONTROL_PARAMCHANGE", 0x00000006)
|
||||
SERVICE_CONTROL_NETBINDADD = Flag("SERVICE_CONTROL_NETBINDADD", 0x00000007)
|
||||
SERVICE_CONTROL_NETBINDREMOVE = Flag("SERVICE_CONTROL_NETBINDREMOVE", 0x00000008)
|
||||
SERVICE_CONTROL_NETBINDENABLE = Flag("SERVICE_CONTROL_NETBINDENABLE", 0x00000009)
|
||||
SERVICE_CONTROL_NETBINDDISABLE = Flag("SERVICE_CONTROL_NETBINDDISABLE", 0x0000000A)
|
||||
SERVICE_CONTROL_DEVICEEVENT = Flag("SERVICE_CONTROL_DEVICEEVENT", 0x0000000B)
|
||||
SERVICE_CONTROL_HARDWAREPROFILECHANGE = Flag("SERVICE_CONTROL_HARDWAREPROFILECHANGE", 0x0000000C)
|
||||
SERVICE_CONTROL_POWEREVENT = Flag("SERVICE_CONTROL_POWEREVENT", 0x0000000D)
|
||||
SERVICE_CONTROL_SESSIONCHANGE = Flag("SERVICE_CONTROL_SESSIONCHANGE", 0x0000000E)
|
||||
SERVICE_CONTROL_PRESHUTDOWN = Flag("SERVICE_CONTROL_PRESHUTDOWN", 0x0000000F)
|
||||
SERVICE_CONTROL_TIMECHANGE = Flag("SERVICE_CONTROL_TIMECHANGE", 0x00000010)
|
||||
SERVICE_CONTROL_TRIGGEREVENT = Flag("SERVICE_CONTROL_TRIGGEREVENT", 0x00000020)
|
||||
SERVICE_STOPPED = Flag("SERVICE_STOPPED", 0x00000001)
|
||||
SERVICE_START_PENDING = Flag("SERVICE_START_PENDING", 0x00000002)
|
||||
SERVICE_STOP_PENDING = Flag("SERVICE_STOP_PENDING", 0x00000003)
|
||||
SERVICE_RUNNING = Flag("SERVICE_RUNNING", 0x00000004)
|
||||
SERVICE_CONTINUE_PENDING = Flag("SERVICE_CONTINUE_PENDING", 0x00000005)
|
||||
SERVICE_PAUSE_PENDING = Flag("SERVICE_PAUSE_PENDING", 0x00000006)
|
||||
SERVICE_PAUSED = Flag("SERVICE_PAUSED", 0x00000007)
|
||||
SERVICE_ACCEPT_STOP = Flag("SERVICE_ACCEPT_STOP", 0x00000001)
|
||||
SERVICE_ACCEPT_PAUSE_CONTINUE = Flag("SERVICE_ACCEPT_PAUSE_CONTINUE", 0x00000002)
|
||||
SERVICE_ACCEPT_SHUTDOWN = Flag("SERVICE_ACCEPT_SHUTDOWN", 0x00000004)
|
||||
SERVICE_ACCEPT_PARAMCHANGE = Flag("SERVICE_ACCEPT_PARAMCHANGE", 0x00000008)
|
||||
SERVICE_ACCEPT_NETBINDCHANGE = Flag("SERVICE_ACCEPT_NETBINDCHANGE", 0x00000010)
|
||||
SERVICE_ACCEPT_HARDWAREPROFILECHANGE = Flag("SERVICE_ACCEPT_HARDWAREPROFILECHANGE", 0x00000020)
|
||||
SERVICE_ACCEPT_POWEREVENT = Flag("SERVICE_ACCEPT_POWEREVENT", 0x00000040)
|
||||
SERVICE_ACCEPT_SESSIONCHANGE = Flag("SERVICE_ACCEPT_SESSIONCHANGE", 0x00000080)
|
||||
SERVICE_ACCEPT_PRESHUTDOWN = Flag("SERVICE_ACCEPT_PRESHUTDOWN", 0x00000100)
|
||||
SERVICE_ACCEPT_TIMECHANGE = Flag("SERVICE_ACCEPT_TIMECHANGE", 0x00000200)
|
||||
SERVICE_ACCEPT_TRIGGEREVENT = Flag("SERVICE_ACCEPT_TRIGGEREVENT", 0x00000400)
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext']
|
||||
|
||||
# ExitProcess(uExitCode):
|
||||
ExitProcessPrototype = WINFUNCTYPE(VOID, UINT)
|
||||
@@ -533,3 +533,115 @@ GetMappedFileNameWParams = ((1, 'hProcess'), (1, 'lpv'), (1, 'lpFilename'), (1,
|
||||
GetMappedFileNameAPrototype = WINFUNCTYPE(DWORD, HANDLE, LPVOID, PVOID, DWORD)
|
||||
GetMappedFileNameAParams = ((1, 'hProcess'), (1, 'lpv'), (1, 'lpFilename'), (1, 'nSize'))
|
||||
|
||||
# RtlInitString(DestinationString, SourceString):
|
||||
RtlInitStringPrototype = WINFUNCTYPE(VOID, PSTRING, LPCSTR)
|
||||
RtlInitStringParams = ((1, 'DestinationString'), (1, 'SourceString'))
|
||||
|
||||
# RtlInitUnicodeString(DestinationString, SourceString):
|
||||
RtlInitUnicodeStringPrototype = WINFUNCTYPE(VOID, PUNICODE_STRING, LPCWSTR)
|
||||
RtlInitUnicodeStringParams = ((1, 'DestinationString'), (1, 'SourceString'))
|
||||
|
||||
# RtlAnsiStringToUnicodeString(DestinationString, SourceString, AllocateDestinationString):
|
||||
RtlAnsiStringToUnicodeStringPrototype = WINFUNCTYPE(NTSTATUS, PUNICODE_STRING, PCANSI_STRING, BOOLEAN)
|
||||
RtlAnsiStringToUnicodeStringParams = ((1, 'DestinationString'), (1, 'SourceString'), (1, 'AllocateDestinationString'))
|
||||
|
||||
# OpenEventA(dwDesiredAccess, bInheritHandle, lpName):
|
||||
OpenEventAPrototype = WINFUNCTYPE(HANDLE, DWORD, BOOL, LPCSTR)
|
||||
OpenEventAParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lpName'))
|
||||
|
||||
# OpenEventW(dwDesiredAccess, bInheritHandle, lpName):
|
||||
OpenEventWPrototype = WINFUNCTYPE(HANDLE, DWORD, BOOL, LPCWSTR)
|
||||
OpenEventWParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lpName'))
|
||||
|
||||
# NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes):
|
||||
NtOpenEventPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES)
|
||||
NtOpenEventParams = ((1, 'EventHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes'))
|
||||
|
||||
# NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout):
|
||||
NtAlpcConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, PUNICODE_STRING, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, ULONG, PSID, PPORT_MESSAGE, PULONG, PALPC_MESSAGE_ATTRIBUTES, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER)
|
||||
NtAlpcConnectPortParams = ((1, 'PortHandle'), (1, 'PortName'), (1, 'ObjectAttributes'), (1, 'PortAttributes'), (1, 'Flags'), (1, 'RequiredServerSid'), (1, 'ConnectionMessage'), (1, 'BufferLength'), (1, 'OutMessageAttributes'), (1, 'InMessageAttributes'), (1, 'Timeout'))
|
||||
|
||||
# NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout):
|
||||
NtAlpcSendWaitReceivePortPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG, PPORT_MESSAGE, PALPC_MESSAGE_ATTRIBUTES, PPORT_MESSAGE, PSIZE_T, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER)
|
||||
NtAlpcSendWaitReceivePortParams = ((1, 'PortHandle'), (1, 'Flags'), (1, 'SendMessage'), (1, 'SendMessageAttributes'), (1, 'ReceiveMessage'), (1, 'BufferLength'), (1, 'ReceiveMessageAttributes'), (1, 'Timeout'))
|
||||
|
||||
# lstrcmpA(lpString1, lpString2):
|
||||
lstrcmpAPrototype = WINFUNCTYPE(INT, LPCSTR, LPCSTR)
|
||||
lstrcmpAParams = ((1, 'lpString1'), (1, 'lpString2'))
|
||||
|
||||
# lstrcmpW(lpString1, lpString2):
|
||||
lstrcmpWPrototype = WINFUNCTYPE(INT, LPCWSTR, LPCWSTR)
|
||||
lstrcmpWParams = ((1, 'lpString1'), (1, 'lpString2'))
|
||||
|
||||
# CreateFileMappingA(hFile, lpFileMappingAttributes, flProtect, dwMaximumSizeHigh, dwMaximumSizeLow, lpName):
|
||||
CreateFileMappingAPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCSTR)
|
||||
CreateFileMappingAParams = ((1, 'hFile'), (1, 'lpFileMappingAttributes'), (1, 'flProtect'), (1, 'dwMaximumSizeHigh'), (1, 'dwMaximumSizeLow'), (1, 'lpName'))
|
||||
|
||||
# CreateFileMappingW(hFile, lpFileMappingAttributes, flProtect, dwMaximumSizeHigh, dwMaximumSizeLow, lpName):
|
||||
CreateFileMappingWPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCWSTR)
|
||||
CreateFileMappingWParams = ((1, 'hFile'), (1, 'lpFileMappingAttributes'), (1, 'flProtect'), (1, 'dwMaximumSizeHigh'), (1, 'dwMaximumSizeLow'), (1, 'lpName'))
|
||||
|
||||
# MapViewOfFile(hFileMappingObject, dwDesiredAccess, dwFileOffsetHigh, dwFileOffsetLow, dwNumberOfBytesToMap):
|
||||
MapViewOfFilePrototype = WINFUNCTYPE(LPVOID, HANDLE, DWORD, DWORD, DWORD, SIZE_T)
|
||||
MapViewOfFileParams = ((1, 'hFileMappingObject'), (1, 'dwDesiredAccess'), (1, 'dwFileOffsetHigh'), (1, 'dwFileOffsetLow'), (1, 'dwNumberOfBytesToMap'))
|
||||
|
||||
# OpenSCManagerA(lpMachineName, lpDatabaseName, dwDesiredAccess):
|
||||
OpenSCManagerAPrototype = WINFUNCTYPE(SC_HANDLE, LPCSTR, LPCSTR, DWORD)
|
||||
OpenSCManagerAParams = ((1, 'lpMachineName'), (1, 'lpDatabaseName'), (1, 'dwDesiredAccess'))
|
||||
|
||||
# OpenSCManagerW(lpMachineName, lpDatabaseName, dwDesiredAccess):
|
||||
OpenSCManagerWPrototype = WINFUNCTYPE(SC_HANDLE, LPCWSTR, LPCWSTR, DWORD)
|
||||
OpenSCManagerWParams = ((1, 'lpMachineName'), (1, 'lpDatabaseName'), (1, 'dwDesiredAccess'))
|
||||
|
||||
# EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName):
|
||||
EnumServicesStatusExAPrototype = WINFUNCTYPE(BOOL, SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPBYTE, DWORD, LPDWORD, LPDWORD, LPDWORD, LPCSTR)
|
||||
EnumServicesStatusExAParams = ((1, 'hSCManager'), (1, 'InfoLevel'), (1, 'dwServiceType'), (1, 'dwServiceState'), (1, 'lpServices'), (1, 'cbBufSize'), (1, 'pcbBytesNeeded'), (1, 'lpServicesReturned'), (1, 'lpResumeHandle'), (1, 'pszGroupName'))
|
||||
|
||||
# EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName):
|
||||
EnumServicesStatusExWPrototype = WINFUNCTYPE(BOOL, SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPBYTE, DWORD, LPDWORD, LPDWORD, LPDWORD, LPCWSTR)
|
||||
EnumServicesStatusExWParams = ((1, 'hSCManager'), (1, 'InfoLevel'), (1, 'dwServiceType'), (1, 'dwServiceState'), (1, 'lpServices'), (1, 'cbBufSize'), (1, 'pcbBytesNeeded'), (1, 'lpServicesReturned'), (1, 'lpResumeHandle'), (1, 'pszGroupName'))
|
||||
|
||||
# EnumWindows(lpEnumFunc, lParam):
|
||||
EnumWindowsPrototype = WINFUNCTYPE(BOOL, WNDENUMPROC, LPARAM)
|
||||
EnumWindowsParams = ((1, 'lpEnumFunc'), (1, 'lParam'))
|
||||
|
||||
# GetWindowTextA(hWnd, lpString, nMaxCount):
|
||||
GetWindowTextAPrototype = WINFUNCTYPE(INT, HWND, LPSTR, INT)
|
||||
GetWindowTextAParams = ((1, 'hWnd'), (1, 'lpString'), (1, 'nMaxCount'))
|
||||
|
||||
# GetWindowTextW(hWnd, lpString, nMaxCount):
|
||||
GetWindowTextWPrototype = WINFUNCTYPE(INT, HWND, LPWSTR, INT)
|
||||
GetWindowTextWParams = ((1, 'hWnd'), (1, 'lpString'), (1, 'nMaxCount'))
|
||||
|
||||
# GetWindowModuleFileNameA(hwnd, pszFileName, cchFileNameMax):
|
||||
GetWindowModuleFileNameAPrototype = WINFUNCTYPE(UINT, HWND, LPSTR, UINT)
|
||||
GetWindowModuleFileNameAParams = ((1, 'hwnd'), (1, 'pszFileName'), (1, 'cchFileNameMax'))
|
||||
|
||||
# GetWindowModuleFileNameW(hwnd, pszFileName, cchFileNameMax):
|
||||
GetWindowModuleFileNameWPrototype = WINFUNCTYPE(UINT, HWND, LPWSTR, UINT)
|
||||
GetWindowModuleFileNameWParams = ((1, 'hwnd'), (1, 'pszFileName'), (1, 'cchFileNameMax'))
|
||||
|
||||
# CryptCATAdminCalcHashFromFileHandle(hFile, pcbHash, pbHash, dwFlags):
|
||||
CryptCATAdminCalcHashFromFileHandlePrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(DWORD), POINTER(BYTE), DWORD)
|
||||
CryptCATAdminCalcHashFromFileHandleParams = ((1, 'hFile'), (1, 'pcbHash'), (1, 'pbHash'), (1, 'dwFlags'))
|
||||
|
||||
# CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo):
|
||||
CryptCATAdminEnumCatalogFromHashPrototype = WINFUNCTYPE(HCATINFO, HCATADMIN, POINTER(BYTE), DWORD, DWORD, POINTER(HCATINFO))
|
||||
CryptCATAdminEnumCatalogFromHashParams = ((1, 'hCatAdmin'), (1, 'pbHash'), (1, 'cbHash'), (1, 'dwFlags'), (1, 'phPrevCatInfo'))
|
||||
|
||||
# CryptCATAdminAcquireContext(phCatAdmin, pgSubsystem, dwFlags):
|
||||
CryptCATAdminAcquireContextPrototype = WINFUNCTYPE(BOOL, POINTER(HCATADMIN), POINTER(GUID), DWORD)
|
||||
CryptCATAdminAcquireContextParams = ((1, 'phCatAdmin'), (1, 'pgSubsystem'), (1, 'dwFlags'))
|
||||
|
||||
# CryptCATCatalogInfoFromContext(hCatInfo, psCatInfo, dwFlags):
|
||||
CryptCATCatalogInfoFromContextPrototype = WINFUNCTYPE(BOOL, HCATINFO, POINTER(CATALOG_INFO), DWORD)
|
||||
CryptCATCatalogInfoFromContextParams = ((1, 'hCatInfo'), (1, 'psCatInfo'), (1, 'dwFlags'))
|
||||
|
||||
# CryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfo, dwFlags):
|
||||
CryptCATAdminReleaseCatalogContextPrototype = WINFUNCTYPE(BOOL, HCATADMIN, HCATINFO, DWORD)
|
||||
CryptCATAdminReleaseCatalogContextParams = ((1, 'hCatAdmin'), (1, 'hCatInfo'), (1, 'dwFlags'))
|
||||
|
||||
# CryptCATAdminReleaseContext(hCatAdmin, dwFlags):
|
||||
CryptCATAdminReleaseContextPrototype = WINFUNCTYPE(BOOL, HCATADMIN, DWORD)
|
||||
CryptCATAdminReleaseContextParams = ((1, 'hCatAdmin'), (1, 'dwFlags'))
|
||||
|
||||
|
||||
@@ -13,12 +13,16 @@ PULONG = POINTER(ULONG)
|
||||
PDWORD = POINTER(DWORD)
|
||||
LPDWORD = POINTER(DWORD)
|
||||
LPTHREAD_START_ROUTINE = PVOID
|
||||
WNDENUMPROC = PVOID
|
||||
PHANDLER_ROUTINE = PVOID
|
||||
LPBYTE = POINTER(BYTE)
|
||||
ULONG_PTR = PULONG
|
||||
CHAR = c_char
|
||||
INT = c_int
|
||||
UCHAR = c_char
|
||||
CSHORT = c_short
|
||||
PUCHAR = POINTER(UCHAR)
|
||||
double = c_double
|
||||
FARPROC = PVOID
|
||||
HGLOBAL = PVOID
|
||||
PSID = PVOID
|
||||
@@ -26,21 +30,28 @@ PVECTORED_EXCEPTION_HANDLER = PVOID
|
||||
ULONGLONG = c_ulonglong
|
||||
LONGLONG = c_longlong
|
||||
ULONG64 = c_ulonglong
|
||||
LARGE_INTEGER = LONGLONG
|
||||
PLARGE_INTEGER = POINTER(LARGE_INTEGER)
|
||||
DWORD64 = ULONG64
|
||||
PULONG64 = POINTER(ULONG64)
|
||||
PHANDLE = POINTER(HANDLE)
|
||||
HKEY = HANDLE
|
||||
HCATADMIN = HANDLE
|
||||
HCATINFO = HANDLE
|
||||
SC_HANDLE = HANDLE
|
||||
PHKEY = POINTER(HKEY)
|
||||
ACCESS_MASK = DWORD
|
||||
REGSAM = ACCESS_MASK
|
||||
SECURITY_CONTEXT_TRACKING_MODE = BOOLEAN
|
||||
LPCONTEXT = PVOID
|
||||
HCERTSTORE = PVOID
|
||||
HCRYPTMSG = PVOID
|
||||
PALPC_PORT_ATTRIBUTES = PVOID
|
||||
VOID = DWORD
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
|
||||
# Enum _SYSTEM_INFORMATION_CLASS definitions
|
||||
_SYSTEM_INFORMATION_CLASS = DWORD
|
||||
@@ -304,6 +315,28 @@ TokenSecurityAttributes = 0x27
|
||||
TokenIsRestricted = 0x28
|
||||
MaxTokenInfoClass = 0x29
|
||||
|
||||
# Enum _SECURITY_IMPERSONATION_LEVEL definitions
|
||||
_SECURITY_IMPERSONATION_LEVEL = DWORD
|
||||
SECURITY_IMPERSONATION_LEVEL = _SECURITY_IMPERSONATION_LEVEL
|
||||
PSECURITY_IMPERSONATION_LEVEL = POINTER(_SECURITY_IMPERSONATION_LEVEL)
|
||||
|
||||
SecurityAnonymous = 0x0
|
||||
SecurityIdentification = 0x1
|
||||
SecurityImpersonation = 0x2
|
||||
SecurityDelegation = 0x3
|
||||
|
||||
# Enum _SC_ENUM_TYPE definitions
|
||||
_SC_ENUM_TYPE = DWORD
|
||||
SC_ENUM_TYPE = _SC_ENUM_TYPE
|
||||
|
||||
SC_ENUM_PROCESS_INFO = 0x0
|
||||
|
||||
# Enum _SC_STATUS_TYPE definitions
|
||||
_SC_STATUS_TYPE = DWORD
|
||||
SC_STATUS_TYPE = _SC_STATUS_TYPE
|
||||
|
||||
SC_STATUS_PROCESS_INFO = 0x0
|
||||
|
||||
# Enum _IMAGEHLP_SYMBOL_TYPE_INFO definitions
|
||||
_IMAGEHLP_SYMBOL_TYPE_INFO = DWORD
|
||||
IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO
|
||||
@@ -2040,3 +2073,191 @@ class _DEBUG_EVENT(Structure):
|
||||
LPDEBUG_EVENT = POINTER(_DEBUG_EVENT)
|
||||
DEBUG_EVENT = _DEBUG_EVENT
|
||||
|
||||
# Struct _STRING definitions
|
||||
class _STRING(Structure):
|
||||
_fields_ = [
|
||||
("Length", USHORT),
|
||||
("MaximumLength", USHORT),
|
||||
("Buffer", LPCSTR),
|
||||
]
|
||||
PCANSI_STRING = POINTER(_STRING)
|
||||
PSTRING = POINTER(_STRING)
|
||||
STRING = _STRING
|
||||
PANSI_STRING = POINTER(_STRING)
|
||||
|
||||
# Struct _OBJECT_ATTRIBUTES definitions
|
||||
class _OBJECT_ATTRIBUTES(Structure):
|
||||
_fields_ = [
|
||||
("Length", ULONG),
|
||||
("RootDirectory", HANDLE),
|
||||
("ObjectName", PUNICODE_STRING),
|
||||
("Attributes", ULONG),
|
||||
("SecurityDescriptor", PVOID),
|
||||
("SecurityQualityOfService", PVOID),
|
||||
]
|
||||
POBJECT_ATTRIBUTES = POINTER(_OBJECT_ATTRIBUTES)
|
||||
OBJECT_ATTRIBUTES = _OBJECT_ATTRIBUTES
|
||||
|
||||
# Struct _SECURITY_QUALITY_OF_SERVICE definitions
|
||||
class _SECURITY_QUALITY_OF_SERVICE(Structure):
|
||||
_fields_ = [
|
||||
("Length", DWORD),
|
||||
("ImpersonationLevel", SECURITY_IMPERSONATION_LEVEL),
|
||||
("ContextTrackingMode", SECURITY_CONTEXT_TRACKING_MODE),
|
||||
("EffectiveOnly", BOOLEAN),
|
||||
]
|
||||
PSECURITY_QUALITY_OF_SERVICE = POINTER(_SECURITY_QUALITY_OF_SERVICE)
|
||||
SECURITY_QUALITY_OF_SERVICE = _SECURITY_QUALITY_OF_SERVICE
|
||||
|
||||
# Struct _ALPC_PORT_ATTRIBUTES32 definitions
|
||||
class _ALPC_PORT_ATTRIBUTES32(Structure):
|
||||
_fields_ = [
|
||||
("Flags", ULONG),
|
||||
("SecurityQos", SECURITY_QUALITY_OF_SERVICE),
|
||||
("MaxMessageLength", SIZE_T),
|
||||
("MemoryBandwidth", SIZE_T),
|
||||
("MaxPoolUsage", SIZE_T),
|
||||
("MaxSectionSize", SIZE_T),
|
||||
("MaxViewSize", SIZE_T),
|
||||
("MaxTotalSectionSize", SIZE_T),
|
||||
("DupObjectTypes", ULONG),
|
||||
]
|
||||
PALPC_PORT_ATTRIBUTES32 = POINTER(_ALPC_PORT_ATTRIBUTES32)
|
||||
ALPC_PORT_ATTRIBUTES32 = _ALPC_PORT_ATTRIBUTES32
|
||||
|
||||
# Struct _ALPC_PORT_ATTRIBUTES64 definitions
|
||||
class _ALPC_PORT_ATTRIBUTES64(Structure):
|
||||
_fields_ = [
|
||||
("Flags", ULONG),
|
||||
("SecurityQos", SECURITY_QUALITY_OF_SERVICE),
|
||||
("MaxMessageLength", SIZE_T),
|
||||
("MemoryBandwidth", SIZE_T),
|
||||
("MaxPoolUsage", SIZE_T),
|
||||
("MaxSectionSize", SIZE_T),
|
||||
("MaxViewSize", SIZE_T),
|
||||
("MaxTotalSectionSize", SIZE_T),
|
||||
("DupObjectTypes", ULONG),
|
||||
("Reserved", ULONG),
|
||||
]
|
||||
ALPC_PORT_ATTRIBUTES64 = _ALPC_PORT_ATTRIBUTES64
|
||||
PALPC_PORT_ATTRIBUTES64 = POINTER(_ALPC_PORT_ATTRIBUTES64)
|
||||
|
||||
# Struct _ALPC_MESSAGE_ATTRIBUTES definitions
|
||||
class _ALPC_MESSAGE_ATTRIBUTES(Structure):
|
||||
_fields_ = [
|
||||
("AllocatedAttributes", ULONG),
|
||||
("ValidAttributes", ULONG),
|
||||
]
|
||||
ALPC_MESSAGE_ATTRIBUTES = _ALPC_MESSAGE_ATTRIBUTES
|
||||
PALPC_MESSAGE_ATTRIBUTES = POINTER(_ALPC_MESSAGE_ATTRIBUTES)
|
||||
|
||||
# Struct _PORT_MESSAGE_TMP_UNION definitions
|
||||
class _PORT_MESSAGE_TMP_UNION(Union):
|
||||
_fields_ = [
|
||||
("ClientViewSize", SIZE_T),
|
||||
("CallbackId", ULONG),
|
||||
]
|
||||
PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE_TMP_UNION
|
||||
|
||||
# Struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1 definitions
|
||||
class _PORT_MESSAGE_TMP_SUBSTRUCT_S1(Structure):
|
||||
_fields_ = [
|
||||
("DataLength", CSHORT),
|
||||
("TotalLength", CSHORT),
|
||||
]
|
||||
_PORT_MESSAGE_TMP_SUBSTRUCT_S1 = _PORT_MESSAGE_TMP_SUBSTRUCT_S1
|
||||
|
||||
# Struct _PORT_MESSAGE_TMP_UNION_U1 definitions
|
||||
class _PORT_MESSAGE_TMP_UNION_U1(Union):
|
||||
_fields_ = [
|
||||
("Length", ULONG),
|
||||
("s1", _PORT_MESSAGE_TMP_SUBSTRUCT_S1),
|
||||
]
|
||||
_PORT_MESSAGE_TMP_UNION_U1 = _PORT_MESSAGE_TMP_UNION_U1
|
||||
|
||||
# Struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2 definitions
|
||||
class _PORT_MESSAGE_TMP_SUBSTRUCT_S2(Structure):
|
||||
_fields_ = [
|
||||
("Type", CSHORT),
|
||||
("DataInfoOffset", CSHORT),
|
||||
]
|
||||
_PORT_MESSAGE_TMP_SUBSTRUCT_S2 = _PORT_MESSAGE_TMP_SUBSTRUCT_S2
|
||||
|
||||
# Struct _PORT_MESSAGE_TMP_UNION_U2 definitions
|
||||
class _PORT_MESSAGE_TMP_UNION_U2(Union):
|
||||
_fields_ = [
|
||||
("ZeroInit", ULONG),
|
||||
("s2", _PORT_MESSAGE_TMP_SUBSTRUCT_S2),
|
||||
]
|
||||
_PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2
|
||||
|
||||
# Struct _PORT_MESSAGE definitions
|
||||
class _PORT_MESSAGE(Structure):
|
||||
_fields_ = [
|
||||
("u1", _PORT_MESSAGE_TMP_UNION_U1),
|
||||
("u2", _PORT_MESSAGE_TMP_UNION_U2),
|
||||
("DoNotUseThisField", double),
|
||||
("MessageId", ULONG),
|
||||
("tmp_union", _PORT_MESSAGE_TMP_UNION),
|
||||
]
|
||||
PPORT_MESSAGE = POINTER(_PORT_MESSAGE)
|
||||
PORT_MESSAGE = _PORT_MESSAGE
|
||||
|
||||
# Struct _SERVICE_STATUS definitions
|
||||
class _SERVICE_STATUS(Structure):
|
||||
_fields_ = [
|
||||
("dwServiceType", DWORD),
|
||||
("dwCurrentState", DWORD),
|
||||
("dwControlsAccepted", DWORD),
|
||||
("dwWin32ExitCode", DWORD),
|
||||
("dwServiceSpecificExitCode", DWORD),
|
||||
("dwCheckPoint", DWORD),
|
||||
("dwWaitHint", DWORD),
|
||||
]
|
||||
SERVICE_STATUS = _SERVICE_STATUS
|
||||
LPSERVICE_STATUS = POINTER(_SERVICE_STATUS)
|
||||
|
||||
# Struct _SERVICE_STATUS_PROCESS definitions
|
||||
class _SERVICE_STATUS_PROCESS(Structure):
|
||||
_fields_ = [
|
||||
("dwServiceType", DWORD),
|
||||
("dwCurrentState", DWORD),
|
||||
("dwControlsAccepted", DWORD),
|
||||
("dwWin32ExitCode", DWORD),
|
||||
("dwServiceSpecificExitCode", DWORD),
|
||||
("dwCheckPoint", DWORD),
|
||||
("dwWaitHint", DWORD),
|
||||
("dwProcessId", DWORD),
|
||||
("dwServiceFlags", DWORD),
|
||||
]
|
||||
LPSERVICE_STATUS_PROCESS = POINTER(_SERVICE_STATUS_PROCESS)
|
||||
SERVICE_STATUS_PROCESS = _SERVICE_STATUS_PROCESS
|
||||
|
||||
# Struct _ENUM_SERVICE_STATUS_PROCESSA definitions
|
||||
class _ENUM_SERVICE_STATUS_PROCESSA(Structure):
|
||||
_fields_ = [
|
||||
("lpServiceName", LPSTR),
|
||||
("lpDisplayName", LPSTR),
|
||||
("ServiceStatusProcess", SERVICE_STATUS_PROCESS),
|
||||
]
|
||||
LPENUM_SERVICE_STATUS_PROCESSA = POINTER(_ENUM_SERVICE_STATUS_PROCESSA)
|
||||
ENUM_SERVICE_STATUS_PROCESSA = _ENUM_SERVICE_STATUS_PROCESSA
|
||||
|
||||
# Struct _ENUM_SERVICE_STATUS_PROCESSW definitions
|
||||
class _ENUM_SERVICE_STATUS_PROCESSW(Structure):
|
||||
_fields_ = [
|
||||
("lpServiceName", LPWSTR),
|
||||
("lpDisplayName", LPWSTR),
|
||||
("ServiceStatusProcess", SERVICE_STATUS_PROCESS),
|
||||
]
|
||||
ENUM_SERVICE_STATUS_PROCESSW = _ENUM_SERVICE_STATUS_PROCESSW
|
||||
LPENUM_SERVICE_STATUS_PROCESSW = POINTER(_ENUM_SERVICE_STATUS_PROCESSW)
|
||||
|
||||
# Struct CATALOG_INFO_ definitions
|
||||
class CATALOG_INFO_(Structure):
|
||||
_fields_ = [
|
||||
("cbStruct", DWORD),
|
||||
("wszCatalogFile", WCHAR * MAX_PATH),
|
||||
]
|
||||
CATALOG_INFO = CATALOG_INFO_
|
||||
|
||||
|
||||
+42
-1
@@ -17,6 +17,10 @@ WINTRUST_ACTION_GENERIC_VERIFY_V2_STR = get_IID_from_raw(WINTRUST_ACTION_GENERIC
|
||||
# Otherwise there is a problem with `Data4` of `type c_char_Array_8` containing 0x00 (0x8c, 0xc2, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee)
|
||||
WINTRUST_ACTION_GENERIC_VERIFY_V2 = GUID.from_address(ctypes.addressof(WINTRUST_ACTION_GENERIC_VERIFY_V2_STR))
|
||||
|
||||
DRIVER_ACTION_VERIFY_RAW = 0xf750e6c3, 0x38ee, 0x11d1, 0x85, 0xe5, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee
|
||||
DRIVER_ACTION_VERIFY_STR = get_IID_from_raw(DRIVER_ACTION_VERIFY_RAW)
|
||||
DRIVER_ACTION_VERIFY = GUID.from_address(ctypes.addressof(DRIVER_ACTION_VERIFY_STR))
|
||||
|
||||
WTD_UI_ALL = 1
|
||||
WTD_UI_NONE = 2
|
||||
WTD_UI_NOBAD = 3
|
||||
@@ -61,9 +65,46 @@ def check_signature(filename):
|
||||
win_trust_data.hWVTStateData = None
|
||||
win_trust_data.pwszURLReference = None
|
||||
win_trust_data.dwUIContext = 0
|
||||
|
||||
#win_trust_data.dwProvFlags = 0x1000 + 0x10 + 0x800
|
||||
win_trust_data.tmp_union.pFile = ctypes.pointer(file_data)
|
||||
|
||||
x = WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data))
|
||||
win_trust_data.dwStateAction = WTD_STATEACTION_CLOSE
|
||||
WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data))
|
||||
return x & 0xffffffff
|
||||
return x & 0xffffffff
|
||||
|
||||
|
||||
def get_catalog_for_filename(filename):
|
||||
ctx = HCATADMIN()
|
||||
windows.winproxy.CryptCATAdminAcquireContext(ctypes.byref(ctx), DRIVER_ACTION_VERIFY, 0)
|
||||
hash = get_file_hash(filename)
|
||||
t = windows.winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, None)
|
||||
if t is None:
|
||||
return None
|
||||
tname = get_catalog_name(t)
|
||||
|
||||
while t is not None:
|
||||
t = windows.winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, ctypes.byref(HCATINFO(t)))
|
||||
windows.winproxy.CryptCATAdminReleaseCatalogContext(ctx, t, 0)
|
||||
windows.winproxy.CryptCATAdminReleaseContext(ctx, 0)
|
||||
return tname
|
||||
|
||||
|
||||
def get_file_hash(filename):
|
||||
f = open(filename)
|
||||
handle = windows.utils.get_handle_from_file(f)
|
||||
|
||||
size = DWORD(0)
|
||||
x = windows.winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), None, 0)
|
||||
|
||||
buffer = (BYTE * size.value)()
|
||||
x = windows.winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), buffer, 0)
|
||||
return buffer
|
||||
|
||||
|
||||
def get_catalog_name_from_handle(handle):
|
||||
cat_info = CATALOG_INFO()
|
||||
cat_info.cbStruct = ctypes.sizeof(cat_info)
|
||||
windows.winproxy.CryptCATCatalogInfoFromContext(handle, ctypes.byref(cat_info), 0)
|
||||
return cat_info.wszCatalogFile
|
||||
|
||||
Reference in New Issue
Block a user