diff --git a/ctypes_generation/definitions/structures/mitigations.txt b/ctypes_generation/definitions/structures/mitigations.txt new file mode 100644 index 0000000..90bcf34 --- /dev/null +++ b/ctypes_generation/definitions/structures/mitigations.txt @@ -0,0 +1,182 @@ +typedef enum _PROCESS_MITIGATION_POLICY { + ProcessDEPPolicy, + ProcessASLRPolicy, + ProcessDynamicCodePolicy, + ProcessStrictHandleCheckPolicy, + ProcessSystemCallDisablePolicy, + ProcessMitigationOptionsMask, + ProcessExtensionPointDisablePolicy, + ProcessReserved1Policy, + ProcessSignaturePolicy, + MaxProcessMitigationPolicy +} PROCESS_MITIGATION_POLICY, *PPROCESS_MITIGATION_POLICY; + + +// DEP Policy + +struct _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD { + DWORD Enable : 1; + DWORD DisableAtlThunkEmulation : 1; + DWORD ReservedFlags : 30; +}; + +union _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_DEP_POLICY_BITFIELD anon; +}; + +typedef struct _PROCESS_MITIGATION_DEP_POLICY { + _ANON_PROCESS_MITIGATION_DEP_POLICY_UNION anon; + BOOLEAN Permanent; +} PROCESS_MITIGATION_DEP_POLICY, *PPROCESS_MITIGATION_DEP_POLICY; + + +// ASLR policy + +struct _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD { + DWORD EnableBottomUpRandomization : 1; + DWORD EnableForceRelocateImages : 1; + DWORD EnableHighEntropy : 1; + DWORD DisallowStrippedImages : 1; + DWORD ReservedFlags : 28; +}; + +union _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_ASLR_POLICY_BITFIELD anon; +}; + + +typedef struct _PROCESS_MITIGATION_ASLR_POLICY { + _ANON_PROCESS_MITIGATION_ASLR_POLICY_UNION anon; +} PROCESS_MITIGATION_ASLR_POLICY, *PPROCESS_MITIGATION_ASLR_POLICY; + +// Dynamic code policy + +struct _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD { + DWORD ProhibitDynamicCode :1; + DWORD AllowThreadOptOut :1; + DWORD AllowRemoteDowngrade :1; + DWORD ReservedFlags :30; +}; + +union _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_BITFIELD anon; +}; + +typedef struct _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY { + _ANON_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY_UNION anon; +} PROCESS_MITIGATION_DYNAMIC_CODE_POLICY, *PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY; + + +//Strict handle policy + +struct _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD { + DWORD RaiseExceptionOnInvalidHandleReference : 1; + DWORD HandleExceptionsPermanentlyEnabled : 1; + DWORD ReservedFlags : 30; +}; + +union _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_BITFIELD ANON_STRUCT; +}; + + +typedef struct _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY { + _ANON_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY_UNION anon; +} PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY, *PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY; + + + +// System Call policy + +struct _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD { + DWORD DisallowWin32kSystemCalls : 1; + DWORD ReservedFlags : 31; +}; + +union _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_BITFIELD ANON_STRUCT; +}; + +typedef struct _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY { + _ANON_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY_UNION anon; +} PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY, *PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY; + + +// EXTENSION POINT policy + +struct _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD { + DWORD DisableExtensionPoints : 1; + DWORD ReservedFlags : 31; +}; + +union _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_BITFIELD ANON_STRUCT; +}; + +typedef struct _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY { + _ANON_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY_UNION anon; +} PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY, *PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY; + + +// CFG policy + +struct _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD { + DWORD EnableControlFlowGuard :1; + DWORD EnableExportSuppression :1; + DWORD StrictMode :1; + DWORD ReservedFlags :29; +}; + +union _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_BITFIELD ANON_STRUCT; +}; + +typedef struct _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY { + _ANON_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY_UNION anon; +} PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, *PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY; + + +// BINARY SIGNATURE policy + + +struct _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD { + DWORD MicrosoftSignedOnly :1; + DWORD StoreSignedOnly :1; + DWORD MitigationOptIn :1; + DWORD ReservedFlags :29; +}; + +union _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_BITFIELD ANON_STRUCT; +}; + +typedef struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY { + _ANON_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY_UNION anon; +} PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, *PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY; + + +// Font disable policy + +struct _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD { + DWORD NoRemoteImages :1; + DWORD NoLowMandatoryLabelImages :1; + DWORD PreferSystem32Images :1; + DWORD ReservedFlags :29; +}; + +union _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION { + DWORD Flags; + _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_BITFIELD ANON_STRUCT; +}; + +typedef struct _PROCESS_MITIGATION_IMAGE_LOAD_POLICY { + _ANON_PROCESS_MITIGATION_IMAGE_LOAD_POLICY_UNION anon; +} PROCESS_MITIGATION_IMAGE_LOAD_POLICY, *PPROCESS_MITIGATION_IMAGE_LOAD_POLICY; diff --git a/ctypes_generation/definitions/structures/ntregistry.txt b/ctypes_generation/definitions/structures/ntregistry.txt new file mode 100644 index 0000000..d21e780 --- /dev/null +++ b/ctypes_generation/definitions/structures/ntregistry.txt @@ -0,0 +1,34 @@ +typedef enum _KEY_VALUE_INFORMATION_CLASS { + KeyValueBasicInformation , + KeyValueFullInformation , + KeyValuePartialInformation , + KeyValueFullInformationAlign64 , + KeyValuePartialInformationAlign64 , + KeyValueLayerInformation , + MaxKeyValueInfoClass +} KEY_VALUE_INFORMATION_CLASS; + + +typedef struct _KEY_VALUE_BASIC_INFORMATION { + ULONG TitleIndex; + ULONG Type; + ULONG NameLength; + WCHAR Name[1]; +} KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION; + +typedef struct _KEY_VALUE_FULL_INFORMATION { + ULONG TitleIndex; + ULONG Type; + ULONG DataOffset; + ULONG DataLength; + ULONG NameLength; + WCHAR Name[1]; +} KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION; + + +typedef struct _KEY_VALUE_PARTIAL_INFORMATION { + ULONG TitleIndex; + ULONG Type; + ULONG DataLength; + UCHAR Data[1]; +} KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION; \ No newline at end of file diff --git a/docs/source/sample.rst b/docs/source/sample.rst index 0d4377c..5115863 100644 --- a/docs/source/sample.rst +++ b/docs/source/sample.rst @@ -116,6 +116,19 @@ Output .. literalinclude:: samples_output\scheduled_task_scheduled_task.txt +.. _sample_event_log: + +Event Log +""""""""" + +.. literalinclude:: ..\..\samples\event_log\eventlog.py + +Output + +.. literalinclude:: samples_output\event_log_eventlog.txt + + + .. _sample_wintrust: diff --git a/docs/source/task_scheduler.rst b/docs/source/task_scheduler.rst index a097df4..ac82db2 100644 --- a/docs/source/task_scheduler.rst +++ b/docs/source/task_scheduler.rst @@ -7,6 +7,10 @@ Task scheduler See sample :ref:`sample_scheduled_task` +.. warning:: + + This API have not been tested on real case yet and may be subject to changes. + TaskService """"""""""" diff --git a/docs/source/winobject.rst b/docs/source/winobject.rst index 6387797..b6644ee 100644 --- a/docs/source/winobject.rst +++ b/docs/source/winobject.rst @@ -17,4 +17,5 @@ This sections describes them by group of relation. volume.rst wmi.rst handle.rst - task_scheduler.rst \ No newline at end of file + task_scheduler.rst + evtlog.rst \ No newline at end of file diff --git a/tests/conftest.py b/tests/conftest.py index a69a19a..95f39e9 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -174,6 +174,7 @@ def pytest_terminal_summary(terminalreporter, exitstatus): terminalreporter.write_sep("_", "{0}::{1}".format(file, test)) for type, items in leak_report.LEAK.items(): terminalreporter.write_line("Leaked handles of type <{0}>".format(type) , Purple=True, bold=True) + terminalreporter.write_line("* <{0}>".format(items) , Purple=True, bold=True) for item in items: try: descr = item.description() diff --git a/tests/pfwtest.py b/tests/pfwtest.py index 4cb9b2e..5214fcb 100644 --- a/tests/pfwtest.py +++ b/tests/pfwtest.py @@ -13,12 +13,15 @@ is_windows_64_bits = windows.system.bitness == 64 is_windows_10 = (windows.system.version[0] == 10) +is_admin = windows.current_process.token.is_elevated + windows_32bit_only = pytest.mark.skipif(not is_windows_32_bits, reason="Test for 32bits Kernel only") windows_64bit_only = pytest.mark.skipif(not is_windows_64_bits, reason="Test for 64bits Kernel only") process_32bit_only = pytest.mark.skipif(not is_process_32_bits, reason="Test for 32bits process only") process_64bit_only = pytest.mark.skipif(not is_process_64_bits, reason="Test for 64bits process only") process_syswow_only = pytest.mark.skipif(not is_process_syswow, reason="Test for syswow process only") +require_admin = pytest.mark.skipif(not is_admin, reason="Test must be launched as admin") check_for_gc_garbage = pytest.mark.usefixtures("check_for_gc_garbage") diff --git a/tests/test_process.py b/tests/test_process.py index 9058870..64faad3 100644 --- a/tests/test_process.py +++ b/tests/test_process.py @@ -140,7 +140,7 @@ class TestProcessWithCheckGarbage(object): proc32.execute(shellcode.get_code()) time.sleep(0.1) dword = proc32.read_dword(addr) - assert dword, 0x42424242 + assert dword == 0x42424242 @windows_64bit_only def test_execute_to_64(self, proc64): diff --git a/tests/test_tasks.py b/tests/test_scheduled_tasks.py similarity index 98% rename from tests/test_tasks.py rename to tests/test_scheduled_tasks.py index e45b9fd..8b02046 100644 --- a/tests/test_tasks.py +++ b/tests/test_scheduled_tasks.py @@ -5,8 +5,6 @@ import os.path import windows import windows.generated_def as gdef -from pfwtest import require_admin - SCHTASKS = "c:\Windows\System32\schtasks.exe" task_scheduler = windows.system.task_scheduler