From a4090ea215b8832b17f89c271da8d1a3e140c000 Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Wed, 16 Mar 2016 16:33:38 +0100 Subject: [PATCH] Add some defs + wintrust catalog functions --- TODO | 4 + ctypes_generation/generate.py | 14 +- ctypes_generation/windef.txt | 122 +++++++++++++++ ctypes_generation/winfunc.txt | 208 +++++++++++++++++++++++++ ctypes_generation/winstruct.txt | 164 +++++++++++++++++++- windows/__init__.py | 8 +- windows/generated_def/__init__.py | 10 ++ windows/generated_def/windef.py | 96 +++++++++++- windows/generated_def/winfuncs.py | 114 +++++++++++++- windows/generated_def/winstructs.py | 225 +++++++++++++++++++++++++++- windows/wintrust.py | 43 +++++- 11 files changed, 998 insertions(+), 10 deletions(-) diff --git a/TODO b/TODO index 5be96ce..6fe3788 100644 --- a/TODO +++ b/TODO @@ -28,6 +28,10 @@ TODO: - Debugger ? Veh ? + - TransparentApiProxy + + double name (params and args) for same info.. + FIXME: - WMI diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py index 27a118b..b1d0c6b 100644 --- a/ctypes_generation/generate.py +++ b/ctypes_generation/generate.py @@ -21,12 +21,16 @@ TYPE_EQUIVALENCE = [ ('PDWORD', 'POINTER(DWORD)'), ('LPDWORD', 'POINTER(DWORD)'), ('LPTHREAD_START_ROUTINE', 'PVOID'), + ('WNDENUMPROC', 'PVOID'), ('PHANDLER_ROUTINE', 'PVOID'), ('LPBYTE', 'POINTER(BYTE)'), ('ULONG_PTR','PULONG'), ('CHAR', 'c_char'), + ('INT', 'c_int'), ('UCHAR', 'c_char'), + ('CSHORT', 'c_short'), ('PUCHAR', 'POINTER(UCHAR)'), + ('double', 'c_double'), ('FARPROC', 'PVOID'), ('HGLOBAL', 'PVOID'), ('PSID', 'PVOID'), @@ -35,17 +39,24 @@ TYPE_EQUIVALENCE = [ ('ULONGLONG', 'c_ulonglong'), ('LONGLONG', 'c_longlong'), ('ULONG64', 'c_ulonglong'), + ('LARGE_INTEGER', 'LONGLONG'), + ('PLARGE_INTEGER', 'POINTER(LARGE_INTEGER)'), ('DWORD64', 'ULONG64'), ('PULONG64', 'POINTER(ULONG64)'), ('PHANDLE', 'POINTER(HANDLE)'), ('HKEY', 'HANDLE'), + ('HCATADMIN', 'HANDLE'), + ('HCATINFO', 'HANDLE'), + ('SC_HANDLE', 'HANDLE'), ('PHKEY', 'POINTER(HKEY)'), ('ACCESS_MASK', 'DWORD'), ('REGSAM', 'ACCESS_MASK'), + ('SECURITY_CONTEXT_TRACKING_MODE', 'BOOLEAN'), # Will be changed at import time ('LPCONTEXT', 'PVOID'), ('HCERTSTORE', 'PVOID'), ('HCRYPTMSG', 'PVOID'), + ('PALPC_PORT_ATTRIBUTES', 'PVOID'), ] # For functions returning void @@ -86,7 +97,6 @@ def verif_funcs_type(funcs, structs, enums): for f in funcs: ret_type = f.return_type if ret_type not in known_type and ret_type not in all_struct_name: - import pdb; pdb.set_trace() raise ValueError("UNKNOW RET TYPE {0}".format(ret_type)) for param_type, _ in f.params: @@ -94,7 +104,6 @@ def verif_funcs_type(funcs, structs, enums): if param_type.startswith("POINTER(") and param_type.endswith(")"): param_type = param_type[len("POINTER("): -1] if param_type not in known_type and param_type not in all_struct_name: - import pdb; pdb.set_trace() raise ValueError("UNKNOW PARAM TYPE {0}".format(param_type)) def check_in_define(name, defs): @@ -105,7 +114,6 @@ def validate_structs(structs, enums, defs): for struct in structs: for field_type, field_name, nb_rep in struct.fields: if field_type.name not in known_type + all_struct_name: - import pdb; pdb.set_trace() raise ValueError("UNKNOW TYPE {0}".format(field_type)) try: int(nb_rep) diff --git a/ctypes_generation/windef.txt b/ctypes_generation/windef.txt index 8d84b5b..494384c 100644 --- a/ctypes_generation/windef.txt +++ b/ctypes_generation/windef.txt @@ -605,3 +605,125 @@ #define IMAGE_FILE_MACHINE_AMD64 0x8664 #define IMAGE_FILE_MACHINE_M32R 0x9041 #define IMAGE_FILE_MACHINE_CEE 0xC0EE + + + +#define SECURITY_MANDATORY_UNTRUSTED_RID (0x00000000L) +#define SECURITY_MANDATORY_LOW_RID (0x00001000L) +#define SECURITY_MANDATORY_MEDIUM_RID (0x00002000L) +#define SECURITY_MANDATORY_MEDIUM_PLUS_RID (SECURITY_MANDATORY_MEDIUM_RID + 0x100) +#define SECURITY_MANDATORY_HIGH_RID (0x00003000L) +#define SECURITY_MANDATORY_SYSTEM_RID (0x00004000L) +#define SECURITY_MANDATORY_PROTECTED_PROCESS_RID (0x00005000L) + +#define SECTION_QUERY 0x0001 +#define SECTION_MAP_WRITE 0x0002 +#define SECTION_MAP_READ 0x0004 +#define SECTION_MAP_EXECUTE 0x0008 +#define SECTION_EXTEND_SIZE 0x0010 +#define SECTION_MAP_EXECUTE_EXPLICIT 0x0020 + + +#define SECTION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SECTION_QUERY| SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE | SECTION_EXTEND_SIZE) + +#define FILE_MAP_COPY SECTION_QUERY +#define FILE_MAP_WRITE SECTION_MAP_WRITE +#define FILE_MAP_READ SECTION_MAP_READ +#define FILE_MAP_ALL_ACCESS SECTION_ALL_ACCESS +#define FILE_MAP_EXECUTE SECTION_MAP_EXECUTE_EXPLICIT + + +#define SC_MANAGER_CONNECT 0x0001 +#define SC_MANAGER_CREATE_SERVICE 0x0002 +#define SC_MANAGER_ENUMERATE_SERVICE 0x0004 +#define SC_MANAGER_LOCK 0x0008 +#define SC_MANAGER_QUERY_LOCK_STATUS 0x0010 +#define SC_MANAGER_MODIFY_BOOT_CONFIG 0x0020 + +#define SC_MANAGER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE | SC_MANAGER_ENUMERATE_SERVICE | SC_MANAGER_LOCK | SC_MANAGER_QUERY_LOCK_STATUS | SC_MANAGER_MODIFY_BOOT_CONFIG) + +#define SERVICE_QUERY_CONFIG 0x0001 +#define SERVICE_CHANGE_CONFIG 0x0002 +#define SERVICE_QUERY_STATUS 0x0004 +#define SERVICE_ENUMERATE_DEPENDENTS 0x0008 +#define SERVICE_START 0x0010 +#define SERVICE_STOP 0x0020 +#define SERVICE_PAUSE_CONTINUE 0x0040 +#define SERVICE_INTERROGATE 0x0080 +#define SERVICE_USER_DEFINED_CONTROL 0x0100 + +#define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_START | SERVICE_STOP | SERVICE_PAUSE_CONTINUE | SERVICE_INTERROGATE | SERVICE_USER_DEFINED_CONTROL) + + +#define SERVICE_RUNS_IN_SYSTEM_PROCESS 0x00000001 + + +#define SERVICE_KERNEL_DRIVER 0x00000001 +#define SERVICE_FILE_SYSTEM_DRIVER 0x00000002 +#define SERVICE_ADAPTER 0x00000004 +#define SERVICE_RECOGNIZER_DRIVER 0x00000008 + +#define SERVICE_DRIVER (SERVICE_KERNEL_DRIVER | SERVICE_FILE_SYSTEM_DRIVER | SERVICE_RECOGNIZER_DRIVER) + +#define SERVICE_WIN32_OWN_PROCESS 0x00000010 +#define SERVICE_WIN32_SHARE_PROCESS 0x00000020 +#define SERVICE_WIN32 (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS) + +#define SERVICE_INTERACTIVE_PROCESS 0x00000100 + +#define SERVICE_TYPE_ALL (SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS) + + +#define SERVICE_BOOT_START 0x00000000 +#define SERVICE_SYSTEM_START 0x00000001 +#define SERVICE_AUTO_START 0x00000002 +#define SERVICE_DEMAND_START 0x00000003 +#define SERVICE_DISABLED 0x00000004 + +#define SERVICE_ERROR_IGNORE 0x00000000 +#define SERVICE_ERROR_NORMAL 0x00000001 +#define SERVICE_ERROR_SEVERE 0x00000002 +#define SERVICE_ERROR_CRITICAL 0x00000003 + +#define SERVICE_ACTIVE 0x00000001 +#define SERVICE_INACTIVE 0x00000002 +#define SERVICE_STATE_ALL (SERVICE_ACTIVE | SERVICE_INACTIVE) + +#define SERVICE_CONTROL_STOP 0x00000001 +#define SERVICE_CONTROL_PAUSE 0x00000002 +#define SERVICE_CONTROL_CONTINUE 0x00000003 +#define SERVICE_CONTROL_INTERROGATE 0x00000004 +#define SERVICE_CONTROL_SHUTDOWN 0x00000005 +#define SERVICE_CONTROL_PARAMCHANGE 0x00000006 +#define SERVICE_CONTROL_NETBINDADD 0x00000007 +#define SERVICE_CONTROL_NETBINDREMOVE 0x00000008 +#define SERVICE_CONTROL_NETBINDENABLE 0x00000009 +#define SERVICE_CONTROL_NETBINDDISABLE 0x0000000A +#define SERVICE_CONTROL_DEVICEEVENT 0x0000000B +#define SERVICE_CONTROL_HARDWAREPROFILECHANGE 0x0000000C +#define SERVICE_CONTROL_POWEREVENT 0x0000000D +#define SERVICE_CONTROL_SESSIONCHANGE 0x0000000E +#define SERVICE_CONTROL_PRESHUTDOWN 0x0000000F +#define SERVICE_CONTROL_TIMECHANGE 0x00000010 +#define SERVICE_CONTROL_TRIGGEREVENT 0x00000020 + +#define SERVICE_STOPPED 0x00000001 +#define SERVICE_START_PENDING 0x00000002 +#define SERVICE_STOP_PENDING 0x00000003 +#define SERVICE_RUNNING 0x00000004 +#define SERVICE_CONTINUE_PENDING 0x00000005 +#define SERVICE_PAUSE_PENDING 0x00000006 +#define SERVICE_PAUSED 0x00000007 + + +#define SERVICE_ACCEPT_STOP 0x00000001 +#define SERVICE_ACCEPT_PAUSE_CONTINUE 0x00000002 +#define SERVICE_ACCEPT_SHUTDOWN 0x00000004 +#define SERVICE_ACCEPT_PARAMCHANGE 0x00000008 +#define SERVICE_ACCEPT_NETBINDCHANGE 0x00000010 +#define SERVICE_ACCEPT_HARDWAREPROFILECHANGE 0x00000020 +#define SERVICE_ACCEPT_POWEREVENT 0x00000040 +#define SERVICE_ACCEPT_SESSIONCHANGE 0x00000080 +#define SERVICE_ACCEPT_PRESHUTDOWN 0x00000100 +#define SERVICE_ACCEPT_TIMECHANGE 0x00000200 +#define SERVICE_ACCEPT_TRIGGEREVENT 0x00000400 \ No newline at end of file diff --git a/ctypes_generation/winfunc.txt b/ctypes_generation/winfunc.txt index 271c897..54efdac 100644 --- a/ctypes_generation/winfunc.txt +++ b/ctypes_generation/winfunc.txt @@ -761,4 +761,212 @@ DWORD WINAPI GetMappedFileNameA ( __in LPVOID lpv, __out PVOID lpFilename, __in DWORD nSize +); + +VOID RtlInitString ( + PSTRING DestinationString, + LPCSTR SourceString +); + + +VOID RtlInitUnicodeString ( + PUNICODE_STRING DestinationString, + LPCWSTR SourceString +); + +NTSTATUS RtlAnsiStringToUnicodeString ( + PUNICODE_STRING DestinationString, + PCANSI_STRING SourceString, + BOOLEAN AllocateDestinationString +); + + +HANDLE WINAPI OpenEventA( + __in DWORD dwDesiredAccess, + __in BOOL bInheritHandle, + __in LPCSTR lpName +); + + +HANDLE WINAPI OpenEventW( + __in DWORD dwDesiredAccess, + __in BOOL bInheritHandle, + __in LPCWSTR lpName +); + +NTSTATUS WINAPI NtOpenEvent( + __out PHANDLE EventHandle, + __in ACCESS_MASK DesiredAccess, + __in POBJECT_ATTRIBUTES ObjectAttributes +); + + +NTSTATUS WINAPI NtAlpcConnectPort( + _Out_ PHANDLE PortHandle, + _In_ PUNICODE_STRING PortName, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes, + _In_ ULONG Flags, + _In_opt_ PSID RequiredServerSid, + _Inout_opt_ PPORT_MESSAGE ConnectionMessage, + _Inout_opt_ PULONG BufferLength, + _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes, + _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes, + _In_opt_ PLARGE_INTEGER Timeout); + + +NTSTATUS WINAPI NtAlpcSendWaitReceivePort( + _In_ HANDLE PortHandle, + _In_ ULONG Flags, + _In_opt_ PPORT_MESSAGE SendMessage, + _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes, + _Out_opt_ PPORT_MESSAGE ReceiveMessage, + _Inout_opt_ PSIZE_T BufferLength, + _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes, + _In_opt_ PLARGE_INTEGER Timeout + ); + + +INT WINAPI lstrcmpA( + __in LPCSTR lpString1, + __in LPCSTR lpString2 +); + +INT WINAPI lstrcmpW( + __in LPCWSTR lpString1, + __in LPCWSTR lpString2 +); + + +HANDLE WINAPI CreateFileMappingA( + __in HANDLE hFile, + __in_opt LPSECURITY_ATTRIBUTES lpFileMappingAttributes, + __in DWORD flProtect, + __in DWORD dwMaximumSizeHigh, + __in DWORD dwMaximumSizeLow, + __in_opt LPCSTR lpName +); + +HANDLE WINAPI CreateFileMappingW( + __in HANDLE hFile, + __in_opt LPSECURITY_ATTRIBUTES lpFileMappingAttributes, + __in DWORD flProtect, + __in DWORD dwMaximumSizeHigh, + __in DWORD dwMaximumSizeLow, + __in_opt LPCWSTR lpName +); + + +LPVOID WINAPI MapViewOfFile( + __in HANDLE hFileMappingObject, + __in DWORD dwDesiredAccess, + __in DWORD dwFileOffsetHigh, + __in DWORD dwFileOffsetLow, + __in SIZE_T dwNumberOfBytesToMap +); + + +SC_HANDLE WINAPI OpenSCManagerA( + __in_opt LPCSTR lpMachineName, + __in_opt LPCSTR lpDatabaseName, + __in DWORD dwDesiredAccess +); + +SC_HANDLE WINAPI OpenSCManagerW( + __in_opt LPCWSTR lpMachineName, + __in_opt LPCWSTR lpDatabaseName, + __in DWORD dwDesiredAccess +); + +BOOL WINAPI EnumServicesStatusExA( + __in SC_HANDLE hSCManager, + __in SC_ENUM_TYPE InfoLevel, + __in DWORD dwServiceType, + __in DWORD dwServiceState, + _Out_opt_ LPBYTE lpServices, + __in DWORD cbBufSize, + __out LPDWORD pcbBytesNeeded, + __out LPDWORD lpServicesReturned, + __inout_opt LPDWORD lpResumeHandle, + __in_opt LPCSTR pszGroupName +); + + +BOOL WINAPI EnumServicesStatusExW( + __in SC_HANDLE hSCManager, + __in SC_ENUM_TYPE InfoLevel, + __in DWORD dwServiceType, + __in DWORD dwServiceState, + _Out_opt_ LPBYTE lpServices, + __in DWORD cbBufSize, + __out LPDWORD pcbBytesNeeded, + __out LPDWORD lpServicesReturned, + __inout_opt LPDWORD lpResumeHandle, + __in_opt LPCWSTR pszGroupName + ); + +BOOL WINAPI EnumWindows( + __in WNDENUMPROC lpEnumFunc, + __in LPARAM lParam +); + + +INT WINAPI GetWindowTextA( + __in HWND hWnd, + __out LPSTR lpString, + __in INT nMaxCount +); + +INT WINAPI GetWindowTextW( + __in HWND hWnd, + __out LPWSTR lpString, + __in INT nMaxCount +); + +UINT WINAPI GetWindowModuleFileNameA( + __in HWND hwnd, + __out LPSTR pszFileName, + __in UINT cchFileNameMax); + +UINT WINAPI GetWindowModuleFileNameW( + __in HWND hwnd, + __out LPWSTR pszFileName, + __in UINT cchFileNameMax); + + +BOOL WINAPI CryptCATAdminCalcHashFromFileHandle( + __in HANDLE hFile, + __inout DWORD *pcbHash, + _Out_opt_ BYTE *pbHash, + __in DWORD dwFlags); + +HCATINFO WINAPI CryptCATAdminEnumCatalogFromHash( + __in HCATADMIN hCatAdmin, + __in BYTE *pbHash, + __in DWORD cbHash, + __in DWORD dwFlags, + __inout HCATINFO *phPrevCatInfo); + +BOOL WINAPI CryptCATAdminAcquireContext( + _Out_ HCATADMIN *phCatAdmin, + _In_ GUID *pgSubsystem, + _In_ DWORD dwFlags +); + +BOOL WINAPI CryptCATCatalogInfoFromContext( + _In_ HCATINFO hCatInfo, + _Inout_ CATALOG_INFO *psCatInfo, + _In_ DWORD dwFlags +); + + +BOOL WINAPI CryptCATAdminReleaseCatalogContext( + _In_ HCATADMIN hCatAdmin, + _In_ HCATINFO hCatInfo, + _In_ DWORD dwFlags +); + +BOOL WINAPI CryptCATAdminReleaseContext( + _In_ HCATADMIN hCatAdmin, + _In_ DWORD dwFlags ); \ No newline at end of file diff --git a/ctypes_generation/winstruct.txt b/ctypes_generation/winstruct.txt index acbb521..40c44e9 100644 --- a/ctypes_generation/winstruct.txt +++ b/ctypes_generation/winstruct.txt @@ -328,6 +328,22 @@ typedef enum _TOKEN_INFORMATION_CLASS { MaxTokenInfoClass, } TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS; + +typedef enum _SECURITY_IMPERSONATION_LEVEL { + SecurityAnonymous, + SecurityIdentification, + SecurityImpersonation, + SecurityDelegation + } SECURITY_IMPERSONATION_LEVEL, * PSECURITY_IMPERSONATION_LEVEL; + +typedef enum _SC_ENUM_TYPE { + SC_ENUM_PROCESS_INFO = 0 +} SC_ENUM_TYPE; + +typedef enum _SC_STATUS_TYPE { + SC_STATUS_PROCESS_INFO = 0 +} SC_STATUS_TYPE; + typedef struct _LDR_DATA_TABLE_ENTRY { PVOID Reserved1[2]; LIST_ENTRY InMemoryOrderLinks; @@ -1560,4 +1576,150 @@ typedef struct _DEBUG_EVENT { DWORD dwProcessId; DWORD dwThreadId; _TMP_UNION_DEBUG_INFO u; -} DEBUG_EVENT, *LPDEBUG_EVENT; \ No newline at end of file +} DEBUG_EVENT, *LPDEBUG_EVENT; + + +typedef struct _STRING { + USHORT Length; + USHORT MaximumLength; + LPCSTR Buffer; +} STRING, *PSTRING, *PANSI_STRING, *PCANSI_STRING; + +typedef struct _OBJECT_ATTRIBUTES { + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; + PVOID SecurityQualityOfService; +} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; + + +typedef struct _SECURITY_QUALITY_OF_SERVICE { + DWORD Length; + SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; + SECURITY_CONTEXT_TRACKING_MODE ContextTrackingMode; + BOOLEAN EffectiveOnly; +} SECURITY_QUALITY_OF_SERVICE, * PSECURITY_QUALITY_OF_SERVICE; + +typedef struct _ALPC_PORT_ATTRIBUTES32 +{ + ULONG Flags; + SECURITY_QUALITY_OF_SERVICE SecurityQos; + SIZE_T MaxMessageLength; + SIZE_T MemoryBandwidth; + SIZE_T MaxPoolUsage; + SIZE_T MaxSectionSize; + SIZE_T MaxViewSize; + SIZE_T MaxTotalSectionSize; + ULONG DupObjectTypes; +} ALPC_PORT_ATTRIBUTES32, *PALPC_PORT_ATTRIBUTES32; + + +typedef struct _ALPC_PORT_ATTRIBUTES64 +{ + ULONG Flags; + SECURITY_QUALITY_OF_SERVICE SecurityQos; + SIZE_T MaxMessageLength; + SIZE_T MemoryBandwidth; + SIZE_T MaxPoolUsage; + SIZE_T MaxSectionSize; + SIZE_T MaxViewSize; + SIZE_T MaxTotalSectionSize; + ULONG DupObjectTypes; + ULONG Reserved; +} ALPC_PORT_ATTRIBUTES64, *PALPC_PORT_ATTRIBUTES64; + +typedef struct _ALPC_MESSAGE_ATTRIBUTES +{ + ULONG AllocatedAttributes; + ULONG ValidAttributes; +} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES; + + +typedef union _PORT_MESSAGE_TMP_UNION +{ + SIZE_T ClientViewSize; + ULONG CallbackId; +} PORT_MESSAGE_TMP_UNION; + + +typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1 +{ + CSHORT DataLength; + CSHORT TotalLength; +} _PORT_MESSAGE_TMP_SUBSTRUCT_S1; + + +typedef union _PORT_MESSAGE_TMP_UNION_U1 +{ + ULONG Length; + _PORT_MESSAGE_TMP_SUBSTRUCT_S1 s1; +} _PORT_MESSAGE_TMP_UNION_U1; + + +typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2 +{ + CSHORT Type; + CSHORT DataInfoOffset; +} _PORT_MESSAGE_TMP_SUBSTRUCT_S2; + + +typedef union _PORT_MESSAGE_TMP_UNION_U2 +{ + ULONG ZeroInit; + _PORT_MESSAGE_TMP_SUBSTRUCT_S2 s2; +} _PORT_MESSAGE_TMP_UNION_U2; + + +typedef struct _PORT_MESSAGE +{ + _PORT_MESSAGE_TMP_UNION_U1 u1; + _PORT_MESSAGE_TMP_UNION_U2 u2; + double DoNotUseThisField; + ULONG MessageId; + _PORT_MESSAGE_TMP_UNION tmp_union; +} PORT_MESSAGE, *PPORT_MESSAGE; + + +typedef struct _SERVICE_STATUS { + DWORD dwServiceType; + DWORD dwCurrentState; + DWORD dwControlsAccepted; + DWORD dwWin32ExitCode; + DWORD dwServiceSpecificExitCode; + DWORD dwCheckPoint; + DWORD dwWaitHint; +} SERVICE_STATUS, *LPSERVICE_STATUS; + +typedef struct _SERVICE_STATUS_PROCESS { + DWORD dwServiceType; + DWORD dwCurrentState; + DWORD dwControlsAccepted; + DWORD dwWin32ExitCode; + DWORD dwServiceSpecificExitCode; + DWORD dwCheckPoint; + DWORD dwWaitHint; + DWORD dwProcessId; + DWORD dwServiceFlags; +} SERVICE_STATUS_PROCESS, *LPSERVICE_STATUS_PROCESS; + +typedef struct _ENUM_SERVICE_STATUS_PROCESSA { + LPSTR lpServiceName; + LPSTR lpDisplayName; + SERVICE_STATUS_PROCESS ServiceStatusProcess; +} ENUM_SERVICE_STATUS_PROCESSA, *LPENUM_SERVICE_STATUS_PROCESSA; + + +typedef struct _ENUM_SERVICE_STATUS_PROCESSW { + LPWSTR lpServiceName; + LPWSTR lpDisplayName; + SERVICE_STATUS_PROCESS ServiceStatusProcess; +} ENUM_SERVICE_STATUS_PROCESSW, *LPENUM_SERVICE_STATUS_PROCESSW; + + +typedef struct CATALOG_INFO_ +{ + DWORD cbStruct; + WCHAR wszCatalogFile[MAX_PATH]; +} CATALOG_INFO; \ No newline at end of file diff --git a/windows/__init__.py b/windows/__init__.py index 2e5ca16..9ca8ef8 100644 --- a/windows/__init__.py +++ b/windows/__init__.py @@ -19,6 +19,10 @@ system = System() current_process = CurrentProcess() current_thread = CurrentThread() +del System +del CurrentProcess +del CurrentThread + # Late import: other imports should go here # Do not move it: risk of circular import @@ -26,8 +30,10 @@ import windows.exception import windows.wmi import windows.utils import windows.debug +import windows.service +import windows.wintrust -__all__ = ["system", "VirtualProtected", 'current_process', 'current_thread', 'winproxy'] +__all__ = ["system", 'current_process', 'current_thread'] import os diff --git a/windows/generated_def/__init__.py b/windows/generated_def/__init__.py index a6c911d..b49ee7b 100644 --- a/windows/generated_def/__init__.py +++ b/windows/generated_def/__init__.py @@ -18,6 +18,9 @@ if bitness() == 32: winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE32 winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION32 + + winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES32 + else: winstructs.CONTEXT = winstructs.CONTEXT64 winstructs.PCONTEXT = winstructs.PCONTEXT64 @@ -29,8 +32,15 @@ else: winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE64 winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION64 + winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES64 + from . import winfuncs from . import windef +# Fuck it +from winstructs import * +from winfuncs import * +from windef import * + diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index 0574624..0b52f80 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -2350,4 +2350,98 @@ IMAGE_FILE_MACHINE_CEF = Flag("IMAGE_FILE_MACHINE_CEF", 0x0CEF) IMAGE_FILE_MACHINE_EBC = Flag("IMAGE_FILE_MACHINE_EBC", 0x0EBC) IMAGE_FILE_MACHINE_AMD64 = Flag("IMAGE_FILE_MACHINE_AMD64", 0x8664) IMAGE_FILE_MACHINE_M32R = Flag("IMAGE_FILE_MACHINE_M32R", 0x9041) -IMAGE_FILE_MACHINE_CEE = Flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE) \ No newline at end of file +IMAGE_FILE_MACHINE_CEE = Flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE) +SECURITY_MANDATORY_UNTRUSTED_RID = Flag("SECURITY_MANDATORY_UNTRUSTED_RID", ( 0x00000000 )) +SECURITY_MANDATORY_LOW_RID = Flag("SECURITY_MANDATORY_LOW_RID", ( 0x00001000 )) +SECURITY_MANDATORY_MEDIUM_RID = Flag("SECURITY_MANDATORY_MEDIUM_RID", ( 0x00002000 )) +SECURITY_MANDATORY_MEDIUM_PLUS_RID = Flag("SECURITY_MANDATORY_MEDIUM_PLUS_RID", ( SECURITY_MANDATORY_MEDIUM_RID + 0x100 )) +SECURITY_MANDATORY_HIGH_RID = Flag("SECURITY_MANDATORY_HIGH_RID", ( 0x00003000 )) +SECURITY_MANDATORY_SYSTEM_RID = Flag("SECURITY_MANDATORY_SYSTEM_RID", ( 0x00004000 )) +SECURITY_MANDATORY_PROTECTED_PROCESS_RID = Flag("SECURITY_MANDATORY_PROTECTED_PROCESS_RID", ( 0x00005000 )) +SECTION_QUERY = Flag("SECTION_QUERY", 0x0001) +SECTION_MAP_WRITE = Flag("SECTION_MAP_WRITE", 0x0002) +SECTION_MAP_READ = Flag("SECTION_MAP_READ", 0x0004) +SECTION_MAP_EXECUTE = Flag("SECTION_MAP_EXECUTE", 0x0008) +SECTION_EXTEND_SIZE = Flag("SECTION_EXTEND_SIZE", 0x0010) +SECTION_MAP_EXECUTE_EXPLICIT = Flag("SECTION_MAP_EXECUTE_EXPLICIT", 0x0020) +SECTION_ALL_ACCESS = Flag("SECTION_ALL_ACCESS", ( STANDARD_RIGHTS_REQUIRED|SECTION_QUERY| SECTION_MAP_WRITE | SECTION_MAP_READ | SECTION_MAP_EXECUTE | SECTION_EXTEND_SIZE )) +FILE_MAP_COPY = Flag("FILE_MAP_COPY", SECTION_QUERY) +FILE_MAP_WRITE = Flag("FILE_MAP_WRITE", SECTION_MAP_WRITE) +FILE_MAP_READ = Flag("FILE_MAP_READ", SECTION_MAP_READ) +FILE_MAP_ALL_ACCESS = Flag("FILE_MAP_ALL_ACCESS", SECTION_ALL_ACCESS) +FILE_MAP_EXECUTE = Flag("FILE_MAP_EXECUTE", SECTION_MAP_EXECUTE_EXPLICIT) +SC_MANAGER_CONNECT = Flag("SC_MANAGER_CONNECT", 0x0001) +SC_MANAGER_CREATE_SERVICE = Flag("SC_MANAGER_CREATE_SERVICE", 0x0002) +SC_MANAGER_ENUMERATE_SERVICE = Flag("SC_MANAGER_ENUMERATE_SERVICE", 0x0004) +SC_MANAGER_LOCK = Flag("SC_MANAGER_LOCK", 0x0008) +SC_MANAGER_QUERY_LOCK_STATUS = Flag("SC_MANAGER_QUERY_LOCK_STATUS", 0x0010) +SC_MANAGER_MODIFY_BOOT_CONFIG = Flag("SC_MANAGER_MODIFY_BOOT_CONFIG", 0x0020) +SC_MANAGER_ALL_ACCESS = Flag("SC_MANAGER_ALL_ACCESS", ( STANDARD_RIGHTS_REQUIRED | SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE | SC_MANAGER_ENUMERATE_SERVICE | SC_MANAGER_LOCK | SC_MANAGER_QUERY_LOCK_STATUS | SC_MANAGER_MODIFY_BOOT_CONFIG )) +SERVICE_QUERY_CONFIG = Flag("SERVICE_QUERY_CONFIG", 0x0001) +SERVICE_CHANGE_CONFIG = Flag("SERVICE_CHANGE_CONFIG", 0x0002) +SERVICE_QUERY_STATUS = Flag("SERVICE_QUERY_STATUS", 0x0004) +SERVICE_ENUMERATE_DEPENDENTS = Flag("SERVICE_ENUMERATE_DEPENDENTS", 0x0008) +SERVICE_START = Flag("SERVICE_START", 0x0010) +SERVICE_STOP = Flag("SERVICE_STOP", 0x0020) +SERVICE_PAUSE_CONTINUE = Flag("SERVICE_PAUSE_CONTINUE", 0x0040) +SERVICE_INTERROGATE = Flag("SERVICE_INTERROGATE", 0x0080) +SERVICE_USER_DEFINED_CONTROL = Flag("SERVICE_USER_DEFINED_CONTROL", 0x0100) +SERVICE_ALL_ACCESS = Flag("SERVICE_ALL_ACCESS", ( STANDARD_RIGHTS_REQUIRED | SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_START | SERVICE_STOP | SERVICE_PAUSE_CONTINUE | SERVICE_INTERROGATE | SERVICE_USER_DEFINED_CONTROL )) +SERVICE_RUNS_IN_SYSTEM_PROCESS = Flag("SERVICE_RUNS_IN_SYSTEM_PROCESS", 0x00000001) +SERVICE_KERNEL_DRIVER = Flag("SERVICE_KERNEL_DRIVER", 0x00000001) +SERVICE_FILE_SYSTEM_DRIVER = Flag("SERVICE_FILE_SYSTEM_DRIVER", 0x00000002) +SERVICE_ADAPTER = Flag("SERVICE_ADAPTER", 0x00000004) +SERVICE_RECOGNIZER_DRIVER = Flag("SERVICE_RECOGNIZER_DRIVER", 0x00000008) +SERVICE_DRIVER = Flag("SERVICE_DRIVER", ( SERVICE_KERNEL_DRIVER | SERVICE_FILE_SYSTEM_DRIVER | SERVICE_RECOGNIZER_DRIVER )) +SERVICE_WIN32_OWN_PROCESS = Flag("SERVICE_WIN32_OWN_PROCESS", 0x00000010) +SERVICE_WIN32_SHARE_PROCESS = Flag("SERVICE_WIN32_SHARE_PROCESS", 0x00000020) +SERVICE_WIN32 = Flag("SERVICE_WIN32", ( SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS )) +SERVICE_INTERACTIVE_PROCESS = Flag("SERVICE_INTERACTIVE_PROCESS", 0x00000100) +SERVICE_TYPE_ALL = Flag("SERVICE_TYPE_ALL", ( SERVICE_WIN32 | SERVICE_ADAPTER | SERVICE_DRIVER | SERVICE_INTERACTIVE_PROCESS )) +SERVICE_BOOT_START = Flag("SERVICE_BOOT_START", 0x00000000) +SERVICE_SYSTEM_START = Flag("SERVICE_SYSTEM_START", 0x00000001) +SERVICE_AUTO_START = Flag("SERVICE_AUTO_START", 0x00000002) +SERVICE_DEMAND_START = Flag("SERVICE_DEMAND_START", 0x00000003) +SERVICE_DISABLED = Flag("SERVICE_DISABLED", 0x00000004) +SERVICE_ERROR_IGNORE = Flag("SERVICE_ERROR_IGNORE", 0x00000000) +SERVICE_ERROR_NORMAL = Flag("SERVICE_ERROR_NORMAL", 0x00000001) +SERVICE_ERROR_SEVERE = Flag("SERVICE_ERROR_SEVERE", 0x00000002) +SERVICE_ERROR_CRITICAL = Flag("SERVICE_ERROR_CRITICAL", 0x00000003) +SERVICE_ACTIVE = Flag("SERVICE_ACTIVE", 0x00000001) +SERVICE_INACTIVE = Flag("SERVICE_INACTIVE", 0x00000002) +SERVICE_STATE_ALL = Flag("SERVICE_STATE_ALL", ( SERVICE_ACTIVE | SERVICE_INACTIVE )) +SERVICE_CONTROL_STOP = Flag("SERVICE_CONTROL_STOP", 0x00000001) +SERVICE_CONTROL_PAUSE = Flag("SERVICE_CONTROL_PAUSE", 0x00000002) +SERVICE_CONTROL_CONTINUE = Flag("SERVICE_CONTROL_CONTINUE", 0x00000003) +SERVICE_CONTROL_INTERROGATE = Flag("SERVICE_CONTROL_INTERROGATE", 0x00000004) +SERVICE_CONTROL_SHUTDOWN = Flag("SERVICE_CONTROL_SHUTDOWN", 0x00000005) +SERVICE_CONTROL_PARAMCHANGE = Flag("SERVICE_CONTROL_PARAMCHANGE", 0x00000006) +SERVICE_CONTROL_NETBINDADD = Flag("SERVICE_CONTROL_NETBINDADD", 0x00000007) +SERVICE_CONTROL_NETBINDREMOVE = Flag("SERVICE_CONTROL_NETBINDREMOVE", 0x00000008) +SERVICE_CONTROL_NETBINDENABLE = Flag("SERVICE_CONTROL_NETBINDENABLE", 0x00000009) +SERVICE_CONTROL_NETBINDDISABLE = Flag("SERVICE_CONTROL_NETBINDDISABLE", 0x0000000A) +SERVICE_CONTROL_DEVICEEVENT = Flag("SERVICE_CONTROL_DEVICEEVENT", 0x0000000B) +SERVICE_CONTROL_HARDWAREPROFILECHANGE = Flag("SERVICE_CONTROL_HARDWAREPROFILECHANGE", 0x0000000C) +SERVICE_CONTROL_POWEREVENT = Flag("SERVICE_CONTROL_POWEREVENT", 0x0000000D) +SERVICE_CONTROL_SESSIONCHANGE = Flag("SERVICE_CONTROL_SESSIONCHANGE", 0x0000000E) +SERVICE_CONTROL_PRESHUTDOWN = Flag("SERVICE_CONTROL_PRESHUTDOWN", 0x0000000F) +SERVICE_CONTROL_TIMECHANGE = Flag("SERVICE_CONTROL_TIMECHANGE", 0x00000010) +SERVICE_CONTROL_TRIGGEREVENT = Flag("SERVICE_CONTROL_TRIGGEREVENT", 0x00000020) +SERVICE_STOPPED = Flag("SERVICE_STOPPED", 0x00000001) +SERVICE_START_PENDING = Flag("SERVICE_START_PENDING", 0x00000002) +SERVICE_STOP_PENDING = Flag("SERVICE_STOP_PENDING", 0x00000003) +SERVICE_RUNNING = Flag("SERVICE_RUNNING", 0x00000004) +SERVICE_CONTINUE_PENDING = Flag("SERVICE_CONTINUE_PENDING", 0x00000005) +SERVICE_PAUSE_PENDING = Flag("SERVICE_PAUSE_PENDING", 0x00000006) +SERVICE_PAUSED = Flag("SERVICE_PAUSED", 0x00000007) +SERVICE_ACCEPT_STOP = Flag("SERVICE_ACCEPT_STOP", 0x00000001) +SERVICE_ACCEPT_PAUSE_CONTINUE = Flag("SERVICE_ACCEPT_PAUSE_CONTINUE", 0x00000002) +SERVICE_ACCEPT_SHUTDOWN = Flag("SERVICE_ACCEPT_SHUTDOWN", 0x00000004) +SERVICE_ACCEPT_PARAMCHANGE = Flag("SERVICE_ACCEPT_PARAMCHANGE", 0x00000008) +SERVICE_ACCEPT_NETBINDCHANGE = Flag("SERVICE_ACCEPT_NETBINDCHANGE", 0x00000010) +SERVICE_ACCEPT_HARDWAREPROFILECHANGE = Flag("SERVICE_ACCEPT_HARDWAREPROFILECHANGE", 0x00000020) +SERVICE_ACCEPT_POWEREVENT = Flag("SERVICE_ACCEPT_POWEREVENT", 0x00000040) +SERVICE_ACCEPT_SESSIONCHANGE = Flag("SERVICE_ACCEPT_SESSIONCHANGE", 0x00000080) +SERVICE_ACCEPT_PRESHUTDOWN = Flag("SERVICE_ACCEPT_PRESHUTDOWN", 0x00000100) +SERVICE_ACCEPT_TIMECHANGE = Flag("SERVICE_ACCEPT_TIMECHANGE", 0x00000200) +SERVICE_ACCEPT_TRIGGEREVENT = Flag("SERVICE_ACCEPT_TRIGGEREVENT", 0x00000400) \ No newline at end of file diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 848125b..bf340da 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -533,3 +533,115 @@ GetMappedFileNameWParams = ((1, 'hProcess'), (1, 'lpv'), (1, 'lpFilename'), (1, GetMappedFileNameAPrototype = WINFUNCTYPE(DWORD, HANDLE, LPVOID, PVOID, DWORD) GetMappedFileNameAParams = ((1, 'hProcess'), (1, 'lpv'), (1, 'lpFilename'), (1, 'nSize')) +# RtlInitString(DestinationString, SourceString): +RtlInitStringPrototype = WINFUNCTYPE(VOID, PSTRING, LPCSTR) +RtlInitStringParams = ((1, 'DestinationString'), (1, 'SourceString')) + +# RtlInitUnicodeString(DestinationString, SourceString): +RtlInitUnicodeStringPrototype = WINFUNCTYPE(VOID, PUNICODE_STRING, LPCWSTR) +RtlInitUnicodeStringParams = ((1, 'DestinationString'), (1, 'SourceString')) + +# RtlAnsiStringToUnicodeString(DestinationString, SourceString, AllocateDestinationString): +RtlAnsiStringToUnicodeStringPrototype = WINFUNCTYPE(NTSTATUS, PUNICODE_STRING, PCANSI_STRING, BOOLEAN) +RtlAnsiStringToUnicodeStringParams = ((1, 'DestinationString'), (1, 'SourceString'), (1, 'AllocateDestinationString')) + +# OpenEventA(dwDesiredAccess, bInheritHandle, lpName): +OpenEventAPrototype = WINFUNCTYPE(HANDLE, DWORD, BOOL, LPCSTR) +OpenEventAParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lpName')) + +# OpenEventW(dwDesiredAccess, bInheritHandle, lpName): +OpenEventWPrototype = WINFUNCTYPE(HANDLE, DWORD, BOOL, LPCWSTR) +OpenEventWParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lpName')) + +# NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes): +NtOpenEventPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES) +NtOpenEventParams = ((1, 'EventHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes')) + +# NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout): +NtAlpcConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, PUNICODE_STRING, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, ULONG, PSID, PPORT_MESSAGE, PULONG, PALPC_MESSAGE_ATTRIBUTES, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER) +NtAlpcConnectPortParams = ((1, 'PortHandle'), (1, 'PortName'), (1, 'ObjectAttributes'), (1, 'PortAttributes'), (1, 'Flags'), (1, 'RequiredServerSid'), (1, 'ConnectionMessage'), (1, 'BufferLength'), (1, 'OutMessageAttributes'), (1, 'InMessageAttributes'), (1, 'Timeout')) + +# NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout): +NtAlpcSendWaitReceivePortPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG, PPORT_MESSAGE, PALPC_MESSAGE_ATTRIBUTES, PPORT_MESSAGE, PSIZE_T, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER) +NtAlpcSendWaitReceivePortParams = ((1, 'PortHandle'), (1, 'Flags'), (1, 'SendMessage'), (1, 'SendMessageAttributes'), (1, 'ReceiveMessage'), (1, 'BufferLength'), (1, 'ReceiveMessageAttributes'), (1, 'Timeout')) + +# lstrcmpA(lpString1, lpString2): +lstrcmpAPrototype = WINFUNCTYPE(INT, LPCSTR, LPCSTR) +lstrcmpAParams = ((1, 'lpString1'), (1, 'lpString2')) + +# lstrcmpW(lpString1, lpString2): +lstrcmpWPrototype = WINFUNCTYPE(INT, LPCWSTR, LPCWSTR) +lstrcmpWParams = ((1, 'lpString1'), (1, 'lpString2')) + +# CreateFileMappingA(hFile, lpFileMappingAttributes, flProtect, dwMaximumSizeHigh, dwMaximumSizeLow, lpName): +CreateFileMappingAPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCSTR) +CreateFileMappingAParams = ((1, 'hFile'), (1, 'lpFileMappingAttributes'), (1, 'flProtect'), (1, 'dwMaximumSizeHigh'), (1, 'dwMaximumSizeLow'), (1, 'lpName')) + +# CreateFileMappingW(hFile, lpFileMappingAttributes, flProtect, dwMaximumSizeHigh, dwMaximumSizeLow, lpName): +CreateFileMappingWPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCWSTR) +CreateFileMappingWParams = ((1, 'hFile'), (1, 'lpFileMappingAttributes'), (1, 'flProtect'), (1, 'dwMaximumSizeHigh'), (1, 'dwMaximumSizeLow'), (1, 'lpName')) + +# MapViewOfFile(hFileMappingObject, dwDesiredAccess, dwFileOffsetHigh, dwFileOffsetLow, dwNumberOfBytesToMap): +MapViewOfFilePrototype = WINFUNCTYPE(LPVOID, HANDLE, DWORD, DWORD, DWORD, SIZE_T) +MapViewOfFileParams = ((1, 'hFileMappingObject'), (1, 'dwDesiredAccess'), (1, 'dwFileOffsetHigh'), (1, 'dwFileOffsetLow'), (1, 'dwNumberOfBytesToMap')) + +# OpenSCManagerA(lpMachineName, lpDatabaseName, dwDesiredAccess): +OpenSCManagerAPrototype = WINFUNCTYPE(SC_HANDLE, LPCSTR, LPCSTR, DWORD) +OpenSCManagerAParams = ((1, 'lpMachineName'), (1, 'lpDatabaseName'), (1, 'dwDesiredAccess')) + +# OpenSCManagerW(lpMachineName, lpDatabaseName, dwDesiredAccess): +OpenSCManagerWPrototype = WINFUNCTYPE(SC_HANDLE, LPCWSTR, LPCWSTR, DWORD) +OpenSCManagerWParams = ((1, 'lpMachineName'), (1, 'lpDatabaseName'), (1, 'dwDesiredAccess')) + +# EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName): +EnumServicesStatusExAPrototype = WINFUNCTYPE(BOOL, SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPBYTE, DWORD, LPDWORD, LPDWORD, LPDWORD, LPCSTR) +EnumServicesStatusExAParams = ((1, 'hSCManager'), (1, 'InfoLevel'), (1, 'dwServiceType'), (1, 'dwServiceState'), (1, 'lpServices'), (1, 'cbBufSize'), (1, 'pcbBytesNeeded'), (1, 'lpServicesReturned'), (1, 'lpResumeHandle'), (1, 'pszGroupName')) + +# EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName): +EnumServicesStatusExWPrototype = WINFUNCTYPE(BOOL, SC_HANDLE, SC_ENUM_TYPE, DWORD, DWORD, LPBYTE, DWORD, LPDWORD, LPDWORD, LPDWORD, LPCWSTR) +EnumServicesStatusExWParams = ((1, 'hSCManager'), (1, 'InfoLevel'), (1, 'dwServiceType'), (1, 'dwServiceState'), (1, 'lpServices'), (1, 'cbBufSize'), (1, 'pcbBytesNeeded'), (1, 'lpServicesReturned'), (1, 'lpResumeHandle'), (1, 'pszGroupName')) + +# EnumWindows(lpEnumFunc, lParam): +EnumWindowsPrototype = WINFUNCTYPE(BOOL, WNDENUMPROC, LPARAM) +EnumWindowsParams = ((1, 'lpEnumFunc'), (1, 'lParam')) + +# GetWindowTextA(hWnd, lpString, nMaxCount): +GetWindowTextAPrototype = WINFUNCTYPE(INT, HWND, LPSTR, INT) +GetWindowTextAParams = ((1, 'hWnd'), (1, 'lpString'), (1, 'nMaxCount')) + +# GetWindowTextW(hWnd, lpString, nMaxCount): +GetWindowTextWPrototype = WINFUNCTYPE(INT, HWND, LPWSTR, INT) +GetWindowTextWParams = ((1, 'hWnd'), (1, 'lpString'), (1, 'nMaxCount')) + +# GetWindowModuleFileNameA(hwnd, pszFileName, cchFileNameMax): +GetWindowModuleFileNameAPrototype = WINFUNCTYPE(UINT, HWND, LPSTR, UINT) +GetWindowModuleFileNameAParams = ((1, 'hwnd'), (1, 'pszFileName'), (1, 'cchFileNameMax')) + +# GetWindowModuleFileNameW(hwnd, pszFileName, cchFileNameMax): +GetWindowModuleFileNameWPrototype = WINFUNCTYPE(UINT, HWND, LPWSTR, UINT) +GetWindowModuleFileNameWParams = ((1, 'hwnd'), (1, 'pszFileName'), (1, 'cchFileNameMax')) + +# CryptCATAdminCalcHashFromFileHandle(hFile, pcbHash, pbHash, dwFlags): +CryptCATAdminCalcHashFromFileHandlePrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(DWORD), POINTER(BYTE), DWORD) +CryptCATAdminCalcHashFromFileHandleParams = ((1, 'hFile'), (1, 'pcbHash'), (1, 'pbHash'), (1, 'dwFlags')) + +# CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo): +CryptCATAdminEnumCatalogFromHashPrototype = WINFUNCTYPE(HCATINFO, HCATADMIN, POINTER(BYTE), DWORD, DWORD, POINTER(HCATINFO)) +CryptCATAdminEnumCatalogFromHashParams = ((1, 'hCatAdmin'), (1, 'pbHash'), (1, 'cbHash'), (1, 'dwFlags'), (1, 'phPrevCatInfo')) + +# CryptCATAdminAcquireContext(phCatAdmin, pgSubsystem, dwFlags): +CryptCATAdminAcquireContextPrototype = WINFUNCTYPE(BOOL, POINTER(HCATADMIN), POINTER(GUID), DWORD) +CryptCATAdminAcquireContextParams = ((1, 'phCatAdmin'), (1, 'pgSubsystem'), (1, 'dwFlags')) + +# CryptCATCatalogInfoFromContext(hCatInfo, psCatInfo, dwFlags): +CryptCATCatalogInfoFromContextPrototype = WINFUNCTYPE(BOOL, HCATINFO, POINTER(CATALOG_INFO), DWORD) +CryptCATCatalogInfoFromContextParams = ((1, 'hCatInfo'), (1, 'psCatInfo'), (1, 'dwFlags')) + +# CryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfo, dwFlags): +CryptCATAdminReleaseCatalogContextPrototype = WINFUNCTYPE(BOOL, HCATADMIN, HCATINFO, DWORD) +CryptCATAdminReleaseCatalogContextParams = ((1, 'hCatAdmin'), (1, 'hCatInfo'), (1, 'dwFlags')) + +# CryptCATAdminReleaseContext(hCatAdmin, dwFlags): +CryptCATAdminReleaseContextPrototype = WINFUNCTYPE(BOOL, HCATADMIN, DWORD) +CryptCATAdminReleaseContextParams = ((1, 'hCatAdmin'), (1, 'dwFlags')) + diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 00278df..775da91 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -13,12 +13,16 @@ PULONG = POINTER(ULONG) PDWORD = POINTER(DWORD) LPDWORD = POINTER(DWORD) LPTHREAD_START_ROUTINE = PVOID +WNDENUMPROC = PVOID PHANDLER_ROUTINE = PVOID LPBYTE = POINTER(BYTE) ULONG_PTR = PULONG CHAR = c_char +INT = c_int UCHAR = c_char +CSHORT = c_short PUCHAR = POINTER(UCHAR) +double = c_double FARPROC = PVOID HGLOBAL = PVOID PSID = PVOID @@ -26,21 +30,28 @@ PVECTORED_EXCEPTION_HANDLER = PVOID ULONGLONG = c_ulonglong LONGLONG = c_longlong ULONG64 = c_ulonglong +LARGE_INTEGER = LONGLONG +PLARGE_INTEGER = POINTER(LARGE_INTEGER) DWORD64 = ULONG64 PULONG64 = POINTER(ULONG64) PHANDLE = POINTER(HANDLE) HKEY = HANDLE +HCATADMIN = HANDLE +HCATINFO = HANDLE +SC_HANDLE = HANDLE PHKEY = POINTER(HKEY) ACCESS_MASK = DWORD REGSAM = ACCESS_MASK +SECURITY_CONTEXT_TRACKING_MODE = BOOLEAN LPCONTEXT = PVOID HCERTSTORE = PVOID HCRYPTMSG = PVOID +PALPC_PORT_ATTRIBUTES = PVOID VOID = DWORD -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_'] -enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] +enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] # Enum _SYSTEM_INFORMATION_CLASS definitions _SYSTEM_INFORMATION_CLASS = DWORD @@ -304,6 +315,28 @@ TokenSecurityAttributes = 0x27 TokenIsRestricted = 0x28 MaxTokenInfoClass = 0x29 +# Enum _SECURITY_IMPERSONATION_LEVEL definitions +_SECURITY_IMPERSONATION_LEVEL = DWORD +SECURITY_IMPERSONATION_LEVEL = _SECURITY_IMPERSONATION_LEVEL +PSECURITY_IMPERSONATION_LEVEL = POINTER(_SECURITY_IMPERSONATION_LEVEL) + +SecurityAnonymous = 0x0 +SecurityIdentification = 0x1 +SecurityImpersonation = 0x2 +SecurityDelegation = 0x3 + +# Enum _SC_ENUM_TYPE definitions +_SC_ENUM_TYPE = DWORD +SC_ENUM_TYPE = _SC_ENUM_TYPE + +SC_ENUM_PROCESS_INFO = 0x0 + +# Enum _SC_STATUS_TYPE definitions +_SC_STATUS_TYPE = DWORD +SC_STATUS_TYPE = _SC_STATUS_TYPE + +SC_STATUS_PROCESS_INFO = 0x0 + # Enum _IMAGEHLP_SYMBOL_TYPE_INFO definitions _IMAGEHLP_SYMBOL_TYPE_INFO = DWORD IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO @@ -2040,3 +2073,191 @@ class _DEBUG_EVENT(Structure): LPDEBUG_EVENT = POINTER(_DEBUG_EVENT) DEBUG_EVENT = _DEBUG_EVENT +# Struct _STRING definitions +class _STRING(Structure): + _fields_ = [ + ("Length", USHORT), + ("MaximumLength", USHORT), + ("Buffer", LPCSTR), + ] +PCANSI_STRING = POINTER(_STRING) +PSTRING = POINTER(_STRING) +STRING = _STRING +PANSI_STRING = POINTER(_STRING) + +# Struct _OBJECT_ATTRIBUTES definitions +class _OBJECT_ATTRIBUTES(Structure): + _fields_ = [ + ("Length", ULONG), + ("RootDirectory", HANDLE), + ("ObjectName", PUNICODE_STRING), + ("Attributes", ULONG), + ("SecurityDescriptor", PVOID), + ("SecurityQualityOfService", PVOID), + ] +POBJECT_ATTRIBUTES = POINTER(_OBJECT_ATTRIBUTES) +OBJECT_ATTRIBUTES = _OBJECT_ATTRIBUTES + +# Struct _SECURITY_QUALITY_OF_SERVICE definitions +class _SECURITY_QUALITY_OF_SERVICE(Structure): + _fields_ = [ + ("Length", DWORD), + ("ImpersonationLevel", SECURITY_IMPERSONATION_LEVEL), + ("ContextTrackingMode", SECURITY_CONTEXT_TRACKING_MODE), + ("EffectiveOnly", BOOLEAN), + ] +PSECURITY_QUALITY_OF_SERVICE = POINTER(_SECURITY_QUALITY_OF_SERVICE) +SECURITY_QUALITY_OF_SERVICE = _SECURITY_QUALITY_OF_SERVICE + +# Struct _ALPC_PORT_ATTRIBUTES32 definitions +class _ALPC_PORT_ATTRIBUTES32(Structure): + _fields_ = [ + ("Flags", ULONG), + ("SecurityQos", SECURITY_QUALITY_OF_SERVICE), + ("MaxMessageLength", SIZE_T), + ("MemoryBandwidth", SIZE_T), + ("MaxPoolUsage", SIZE_T), + ("MaxSectionSize", SIZE_T), + ("MaxViewSize", SIZE_T), + ("MaxTotalSectionSize", SIZE_T), + ("DupObjectTypes", ULONG), + ] +PALPC_PORT_ATTRIBUTES32 = POINTER(_ALPC_PORT_ATTRIBUTES32) +ALPC_PORT_ATTRIBUTES32 = _ALPC_PORT_ATTRIBUTES32 + +# Struct _ALPC_PORT_ATTRIBUTES64 definitions +class _ALPC_PORT_ATTRIBUTES64(Structure): + _fields_ = [ + ("Flags", ULONG), + ("SecurityQos", SECURITY_QUALITY_OF_SERVICE), + ("MaxMessageLength", SIZE_T), + ("MemoryBandwidth", SIZE_T), + ("MaxPoolUsage", SIZE_T), + ("MaxSectionSize", SIZE_T), + ("MaxViewSize", SIZE_T), + ("MaxTotalSectionSize", SIZE_T), + ("DupObjectTypes", ULONG), + ("Reserved", ULONG), + ] +ALPC_PORT_ATTRIBUTES64 = _ALPC_PORT_ATTRIBUTES64 +PALPC_PORT_ATTRIBUTES64 = POINTER(_ALPC_PORT_ATTRIBUTES64) + +# Struct _ALPC_MESSAGE_ATTRIBUTES definitions +class _ALPC_MESSAGE_ATTRIBUTES(Structure): + _fields_ = [ + ("AllocatedAttributes", ULONG), + ("ValidAttributes", ULONG), + ] +ALPC_MESSAGE_ATTRIBUTES = _ALPC_MESSAGE_ATTRIBUTES +PALPC_MESSAGE_ATTRIBUTES = POINTER(_ALPC_MESSAGE_ATTRIBUTES) + +# Struct _PORT_MESSAGE_TMP_UNION definitions +class _PORT_MESSAGE_TMP_UNION(Union): + _fields_ = [ + ("ClientViewSize", SIZE_T), + ("CallbackId", ULONG), + ] +PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE_TMP_UNION + +# Struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1 definitions +class _PORT_MESSAGE_TMP_SUBSTRUCT_S1(Structure): + _fields_ = [ + ("DataLength", CSHORT), + ("TotalLength", CSHORT), + ] +_PORT_MESSAGE_TMP_SUBSTRUCT_S1 = _PORT_MESSAGE_TMP_SUBSTRUCT_S1 + +# Struct _PORT_MESSAGE_TMP_UNION_U1 definitions +class _PORT_MESSAGE_TMP_UNION_U1(Union): + _fields_ = [ + ("Length", ULONG), + ("s1", _PORT_MESSAGE_TMP_SUBSTRUCT_S1), + ] +_PORT_MESSAGE_TMP_UNION_U1 = _PORT_MESSAGE_TMP_UNION_U1 + +# Struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2 definitions +class _PORT_MESSAGE_TMP_SUBSTRUCT_S2(Structure): + _fields_ = [ + ("Type", CSHORT), + ("DataInfoOffset", CSHORT), + ] +_PORT_MESSAGE_TMP_SUBSTRUCT_S2 = _PORT_MESSAGE_TMP_SUBSTRUCT_S2 + +# Struct _PORT_MESSAGE_TMP_UNION_U2 definitions +class _PORT_MESSAGE_TMP_UNION_U2(Union): + _fields_ = [ + ("ZeroInit", ULONG), + ("s2", _PORT_MESSAGE_TMP_SUBSTRUCT_S2), + ] +_PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2 + +# Struct _PORT_MESSAGE definitions +class _PORT_MESSAGE(Structure): + _fields_ = [ + ("u1", _PORT_MESSAGE_TMP_UNION_U1), + ("u2", _PORT_MESSAGE_TMP_UNION_U2), + ("DoNotUseThisField", double), + ("MessageId", ULONG), + ("tmp_union", _PORT_MESSAGE_TMP_UNION), + ] +PPORT_MESSAGE = POINTER(_PORT_MESSAGE) +PORT_MESSAGE = _PORT_MESSAGE + +# Struct _SERVICE_STATUS definitions +class _SERVICE_STATUS(Structure): + _fields_ = [ + ("dwServiceType", DWORD), + ("dwCurrentState", DWORD), + ("dwControlsAccepted", DWORD), + ("dwWin32ExitCode", DWORD), + ("dwServiceSpecificExitCode", DWORD), + ("dwCheckPoint", DWORD), + ("dwWaitHint", DWORD), + ] +SERVICE_STATUS = _SERVICE_STATUS +LPSERVICE_STATUS = POINTER(_SERVICE_STATUS) + +# Struct _SERVICE_STATUS_PROCESS definitions +class _SERVICE_STATUS_PROCESS(Structure): + _fields_ = [ + ("dwServiceType", DWORD), + ("dwCurrentState", DWORD), + ("dwControlsAccepted", DWORD), + ("dwWin32ExitCode", DWORD), + ("dwServiceSpecificExitCode", DWORD), + ("dwCheckPoint", DWORD), + ("dwWaitHint", DWORD), + ("dwProcessId", DWORD), + ("dwServiceFlags", DWORD), + ] +LPSERVICE_STATUS_PROCESS = POINTER(_SERVICE_STATUS_PROCESS) +SERVICE_STATUS_PROCESS = _SERVICE_STATUS_PROCESS + +# Struct _ENUM_SERVICE_STATUS_PROCESSA definitions +class _ENUM_SERVICE_STATUS_PROCESSA(Structure): + _fields_ = [ + ("lpServiceName", LPSTR), + ("lpDisplayName", LPSTR), + ("ServiceStatusProcess", SERVICE_STATUS_PROCESS), + ] +LPENUM_SERVICE_STATUS_PROCESSA = POINTER(_ENUM_SERVICE_STATUS_PROCESSA) +ENUM_SERVICE_STATUS_PROCESSA = _ENUM_SERVICE_STATUS_PROCESSA + +# Struct _ENUM_SERVICE_STATUS_PROCESSW definitions +class _ENUM_SERVICE_STATUS_PROCESSW(Structure): + _fields_ = [ + ("lpServiceName", LPWSTR), + ("lpDisplayName", LPWSTR), + ("ServiceStatusProcess", SERVICE_STATUS_PROCESS), + ] +ENUM_SERVICE_STATUS_PROCESSW = _ENUM_SERVICE_STATUS_PROCESSW +LPENUM_SERVICE_STATUS_PROCESSW = POINTER(_ENUM_SERVICE_STATUS_PROCESSW) + +# Struct CATALOG_INFO_ definitions +class CATALOG_INFO_(Structure): + _fields_ = [ + ("cbStruct", DWORD), + ("wszCatalogFile", WCHAR * MAX_PATH), + ] +CATALOG_INFO = CATALOG_INFO_ + diff --git a/windows/wintrust.py b/windows/wintrust.py index 4bf568c..9008404 100644 --- a/windows/wintrust.py +++ b/windows/wintrust.py @@ -17,6 +17,10 @@ WINTRUST_ACTION_GENERIC_VERIFY_V2_STR = get_IID_from_raw(WINTRUST_ACTION_GENERIC # Otherwise there is a problem with `Data4` of `type c_char_Array_8` containing 0x00 (0x8c, 0xc2, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee) WINTRUST_ACTION_GENERIC_VERIFY_V2 = GUID.from_address(ctypes.addressof(WINTRUST_ACTION_GENERIC_VERIFY_V2_STR)) +DRIVER_ACTION_VERIFY_RAW = 0xf750e6c3, 0x38ee, 0x11d1, 0x85, 0xe5, 0x0, 0xc0, 0x4f, 0xc2, 0x95, 0xee +DRIVER_ACTION_VERIFY_STR = get_IID_from_raw(DRIVER_ACTION_VERIFY_RAW) +DRIVER_ACTION_VERIFY = GUID.from_address(ctypes.addressof(DRIVER_ACTION_VERIFY_STR)) + WTD_UI_ALL = 1 WTD_UI_NONE = 2 WTD_UI_NOBAD = 3 @@ -61,9 +65,46 @@ def check_signature(filename): win_trust_data.hWVTStateData = None win_trust_data.pwszURLReference = None win_trust_data.dwUIContext = 0 + + #win_trust_data.dwProvFlags = 0x1000 + 0x10 + 0x800 win_trust_data.tmp_union.pFile = ctypes.pointer(file_data) x = WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data)) win_trust_data.dwStateAction = WTD_STATEACTION_CLOSE WinVerifyTrust(None, ctypes.byref(WVTPolicyGUID), ctypes.byref(win_trust_data)) - return x & 0xffffffff \ No newline at end of file + return x & 0xffffffff + + +def get_catalog_for_filename(filename): + ctx = HCATADMIN() + windows.winproxy.CryptCATAdminAcquireContext(ctypes.byref(ctx), DRIVER_ACTION_VERIFY, 0) + hash = get_file_hash(filename) + t = windows.winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, None) + if t is None: + return None + tname = get_catalog_name(t) + + while t is not None: + t = windows.winproxy.CryptCATAdminEnumCatalogFromHash(ctx, hash, len(hash), 0, ctypes.byref(HCATINFO(t))) + windows.winproxy.CryptCATAdminReleaseCatalogContext(ctx, t, 0) + windows.winproxy.CryptCATAdminReleaseContext(ctx, 0) + return tname + + +def get_file_hash(filename): + f = open(filename) + handle = windows.utils.get_handle_from_file(f) + + size = DWORD(0) + x = windows.winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), None, 0) + + buffer = (BYTE * size.value)() + x = windows.winproxy.CryptCATAdminCalcHashFromFileHandle(handle, ctypes.byref(size), buffer, 0) + return buffer + + +def get_catalog_name_from_handle(handle): + cat_info = CATALOG_INFO() + cat_info.cbStruct = ctypes.sizeof(cat_info) + windows.winproxy.CryptCATCatalogInfoFromContext(handle, ctypes.byref(cat_info), 0) + return cat_info.wszCatalogFile