Update some doc / test + some ctypes generation definition

ctypes_generation/definitions/structures/mitigations.txt

@@ -0,0 +1,182 @@
+typedef enum _PROCESS_MITIGATION_POLICY {
+    ProcessDEPPolicy,
+    ProcessASLRPolicy,
+    ProcessDynamicCodePolicy,
+    ProcessStrictHandleCheckPolicy,
+    ProcessSystemCallDisablePolicy,
+    ProcessMitigationOptionsMask,
+    ProcessExtensionPointDisablePolicy,
+    ProcessReserved1Policy,
+    ProcessSignaturePolicy,
+    MaxProcessMitigationPolicy
+} PROCESS_MITIGATION_POLICY, *PPROCESS_MITIGATION_POLICY;
+
+
+// DEP Policy
+
+struct _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD {
+    DWORD Enable : 1;
+    DWORD DisableAtlThunkEmulation : 1;
+    DWORD ReservedFlags : 30;
+};
+
+union _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD anon;
+};
+
+typedef struct _PROCESS_MITIGATION_DEP_POLICY {
+  _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION anon;
+  BOOLEAN Permanent;
+} PROCESS_MITIGATION_DEP_POLICY, *PPROCESS_MITIGATION_DEP_POLICY;
+
+
+// ASLR policy
+
+struct _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD {
+      DWORD EnableBottomUpRandomization : 1;
+      DWORD EnableForceRelocateImages : 1;
+      DWORD EnableHighEntropy : 1;
+      DWORD DisallowStrippedImages : 1;
+      DWORD ReservedFlags : 28;
+};
+
+union _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD anon;
+};
+
+
+typedef struct _PROCESS_MITIGATION_ASLR_POLICY {
+    _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION anon;
+} PROCESS_MITIGATION_ASLR_POLICY, *PPROCESS_MITIGATION_ASLR_POLICY;
+
+// Dynamic code policy
+
+struct _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD {
+      DWORD ProhibitDynamicCode  :1;
+      DWORD AllowThreadOptOut  :1;
+      DWORD AllowRemoteDowngrade  :1;
+      DWORD ReservedFlags  :30;
+};
+
+union _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD anon;
+};
+
+typedef struct _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY {
+    _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION anon;
+} PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, *PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY;
+
+
+//Strict handle policy
+
+struct _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD {
+  DWORD RaiseExceptionOnInvalidHandleReference : 1;
+  DWORD HandleExceptionsPermanentlyEnabled : 1;
+  DWORD ReservedFlags : 30;
+};
+
+union _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD ANON_STRUCT;
+};
+
+
+typedef struct _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY {
+    _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION  anon;
+} PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, *PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY;
+
+
+
+// System Call policy
+
+struct _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD {
+    DWORD DisallowWin32kSystemCalls : 1;
+    DWORD ReservedFlags : 31;
+};
+
+union _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY {
+    _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION  anon;
+} PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, *PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY;
+
+
+// EXTENSION POINT policy
+
+struct _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD {
+    DWORD DisableExtensionPoints : 1;
+    DWORD ReservedFlags : 31;
+};
+
+union _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY {
+    _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION  anon;
+} PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, *PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY;
+
+
+// CFG policy
+
+struct _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD {
+      DWORD EnableControlFlowGuard  :1;
+      DWORD EnableExportSuppression  :1;
+      DWORD StrictMode  :1;
+      DWORD ReservedFlags  :29;
+};
+
+union _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY  {
+    _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION  anon;
+} PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, *PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY;
+
+
+// BINARY SIGNATURE  policy
+
+
+struct _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD {
+      DWORD MicrosoftSignedOnly  :1;
+      DWORD StoreSignedOnly  :1;
+      DWORD MitigationOptIn  :1;
+      DWORD ReservedFlags  :29;
+};
+
+union _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY  {
+    _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION  anon;
+} PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, *PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY;
+
+
+// Font disable policy
+
+struct _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD {
+      DWORD NoRemoteImages  :1;
+      DWORD NoLowMandatoryLabelImages  :1;
+      DWORD PreferSystem32Images  :1;
+      DWORD ReservedFlags  :29;
+};
+
+union _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION {
+    DWORD Flags;
+    _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD ANON_STRUCT;
+};
+
+typedef struct _PROCESS_MITIGATION_IMAGE_LOAD_POLICY  {
+    _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION  anon;
+} PROCESS_MITIGATION_IMAGE_LOAD_POLICY, *PPROCESS_MITIGATION_IMAGE_LOAD_POLICY;

ctypes_generation/definitions/structures/ntregistry.txt

@@ -0,0 +1,34 @@
+typedef enum _KEY_VALUE_INFORMATION_CLASS {
+  KeyValueBasicInformation           ,
+  KeyValueFullInformation            ,
+  KeyValuePartialInformation         ,
+  KeyValueFullInformationAlign64     ,
+  KeyValuePartialInformationAlign64  ,
+  KeyValueLayerInformation           ,
+  MaxKeyValueInfoClass
+} KEY_VALUE_INFORMATION_CLASS;
+
+
+typedef struct _KEY_VALUE_BASIC_INFORMATION {
+  ULONG TitleIndex;
+  ULONG Type;
+  ULONG NameLength;
+  WCHAR Name[1];
+} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION;
+
+typedef struct _KEY_VALUE_FULL_INFORMATION {
+  ULONG TitleIndex;
+  ULONG Type;
+  ULONG DataOffset;
+  ULONG DataLength;
+  ULONG NameLength;
+  WCHAR Name[1];
+} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION;
+
+
+typedef struct _KEY_VALUE_PARTIAL_INFORMATION {
+  ULONG TitleIndex;
+  ULONG Type;
+  ULONG DataLength;
+  UCHAR Data[1];
+} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION;

docs/source/sample.rst

@@ -116,6 +116,19 @@ Output
 .. literalinclude:: samples_output\scheduled_task_scheduled_task.txt
 
 
+.. _sample_event_log:
+
+Event Log
+"""""""""
+
+.. literalinclude:: ..\..\samples\event_log\eventlog.py
+
+Output
+
+.. literalinclude:: samples_output\event_log_eventlog.txt
+
+
+
 
 .. _sample_wintrust:
 

docs/source/task_scheduler.rst

@@ -7,6 +7,10 @@ Task scheduler
 
     See sample :ref:`sample_scheduled_task`
 
+.. warning::
+
+    This API have not been tested on real case yet and may be subject to changes.
+
 
 TaskService
 """""""""""

docs/source/winobject.rst

@@ -17,4 +17,5 @@ This sections describes them by group of relation.
     volume.rst
     wmi.rst
     handle.rst
-    task_scheduler.rst
+    task_scheduler.rst
+    evtlog.rst

tests/conftest.py

@@ -174,6 +174,7 @@ def pytest_terminal_summary(terminalreporter, exitstatus):
             terminalreporter.write_sep("_", "{0}::{1}".format(file, test))
             for type, items in leak_report.LEAK.items():
                 terminalreporter.write_line("Leaked handles of type <{0}>".format(type) , Purple=True, bold=True)
+                terminalreporter.write_line("* <{0}>".format(items) , Purple=True, bold=True)
                 for item in items:
                     try:
                         descr = item.description()

tests/pfwtest.py

@@ -13,12 +13,15 @@ is_windows_64_bits = windows.system.bitness == 64
 
 is_windows_10 = (windows.system.version[0] == 10)
 
+is_admin = windows.current_process.token.is_elevated
+
 windows_32bit_only = pytest.mark.skipif(not is_windows_32_bits, reason="Test for 32bits Kernel only")
 windows_64bit_only = pytest.mark.skipif(not is_windows_64_bits, reason="Test for 64bits Kernel only")
 
 process_32bit_only = pytest.mark.skipif(not is_process_32_bits, reason="Test for 32bits process only")
 process_64bit_only = pytest.mark.skipif(not is_process_64_bits, reason="Test for 64bits process only")
 process_syswow_only = pytest.mark.skipif(not is_process_syswow, reason="Test for syswow process only")
+require_admin = pytest.mark.skipif(not is_admin, reason="Test must be launched as admin")
 
 
 check_for_gc_garbage = pytest.mark.usefixtures("check_for_gc_garbage")

tests/test_process.py

@@ -140,7 +140,7 @@ class TestProcessWithCheckGarbage(object):
                 proc32.execute(shellcode.get_code())
                 time.sleep(0.1)
                 dword = proc32.read_dword(addr)
-                assert dword, 0x42424242
+                assert dword == 0x42424242
 
     @windows_64bit_only
     def test_execute_to_64(self, proc64):

tests/test_scheduled_tasks.py

@@ -5,8 +5,6 @@ import os.path
 import windows
 import windows.generated_def as gdef
 
-from pfwtest import require_admin
-
 SCHTASKS = "c:\Windows\System32\schtasks.exe"
 
 task_scheduler = windows.system.task_scheduler