admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add struct + thread.teb_base

Browse Source
This commit is contained in:
Clement Rouault
2016-04-25 17:48:49 +02:00
parent 57634f076c
commit a988ad03e3
6 changed files with 53 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO
+7
View File
@@ -2,6 +2,9 @@ TODO:
- Documentation
- Pass 0.2 when doc is done <3
- type pass to dbg callback
- Context.regs
- explain what is a DeadThread (do I still need it ?)
- Eflags (raw stuff)
- ProcessMemory object ? (metasm like)
@@ -38,6 +41,10 @@ TODO:
- Add test for debugger with breakpoint that add another breakpoint on trigger
- NtQueryVirtualMemory_32_to_64 (stop using hardcoded value for request type: add it to enum)
CHANGELOG:
* NEW REGISTRY -> change examples and documentation
ctypes_generation/generate.py
+2
View File
@@ -27,6 +27,8 @@ TYPE_EQUIVALENCE = [
('PHANDLER_ROUTINE', 'PVOID'),
('LPBYTE', 'POINTER(BYTE)'),
('ULONG_PTR','PVOID'),
('KAFFINITY','ULONG_PTR'),
('KPRIORITY','LONG'),
('CHAR', 'c_char'),
('INT', 'c_int'),
('UCHAR', 'c_char'),
ctypes_generation/winstruct.txt
+16 -6
View File
@@ -630,6 +630,11 @@ typedef enum tagCLSCTX {
CLSCTX_PS_DLL = 0x80000000
} CLSCTX;
typedef struct _CLIENT_ID{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID;
typedef struct _LDR_DATA_TABLE_ENTRY {
PVOID Reserved1[2];
LIST_ENTRY InMemoryOrderLinks;
@@ -791,6 +796,17 @@ typedef struct _MEMORY_BASIC_INFORMATION {
DWORD Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;
typedef struct _THREAD_BASIC_INFORMATION {
NTSTATUS ExitStatus;
PVOID TebBaseAddress;
CLIENT_ID ClientId;
KAFFINITY AffinityMask;
KPRIORITY Priority;
KPRIORITY BasePriority;
} THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION;
typedef struct _MEMORY_BASIC_INFORMATION32 {
DWORD BaseAddress;
DWORD AllocationBase;
@@ -2264,12 +2280,6 @@ typedef union _PORT_MESSAGE_TMP_UNION_U2
} _PORT_MESSAGE_TMP_UNION_U2;
typedef struct _CLIENT_ID{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID;
typedef struct _PORT_MESSAGE
{
_PORT_MESSAGE_TMP_UNION_U1 u1;
windows/generated_def/winstructs.py
+24 -9
View File
@@ -45,6 +45,8 @@ WNDENUMPROC = PVOID
PHANDLER_ROUTINE = PVOID
LPBYTE = POINTER(BYTE)
ULONG_PTR = PVOID
KAFFINITY = ULONG_PTR
KPRIORITY = LONG
CHAR = c_char
INT = c_int
UCHAR = c_char
@@ -93,7 +95,7 @@ PALPC_PORT_ATTRIBUTES = PVOID
VOID = DWORD
ITypeInfo = PVOID
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_PSAPI_WORKING_SET_BLOCK', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_BLOCK64', '_PSAPI_WORKING_SET_INFORMATION', '_PSAPI_WORKING_SET_INFORMATION32', '_PSAPI_WORKING_SET_INFORMATION64', '_PSAPI_WORKING_SET_EX_BLOCK', '_PSAPI_WORKING_SET_EX_BLOCK32', '_PSAPI_WORKING_SET_EX_BLOCK64', '_PSAPI_WORKING_SET_EX_INFORMATION', '_PSAPI_WORKING_SET_EX_INFORMATION32', '_PSAPI_WORKING_SET_EX_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_CLIENT_ID', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION']
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_CLIENT_ID', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_THREAD_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_PSAPI_WORKING_SET_BLOCK', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_BLOCK64', '_PSAPI_WORKING_SET_INFORMATION', '_PSAPI_WORKING_SET_INFORMATION32', '_PSAPI_WORKING_SET_INFORMATION64', '_PSAPI_WORKING_SET_EX_BLOCK', '_PSAPI_WORKING_SET_EX_BLOCK32', '_PSAPI_WORKING_SET_EX_BLOCK64', '_PSAPI_WORKING_SET_EX_INFORMATION', '_PSAPI_WORKING_SET_EX_INFORMATION32', '_PSAPI_WORKING_SET_EX_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION']
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', 'NET_FW_RULE_DIRECTION_', 'NET_FW_PROFILE_TYPE2_', '_MIB_TCP_STATE', 'NET_FW_IP_PROTOCOL_', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_OBJECT_INFORMATION_CLASS', '_SID_NAME_USE', 'NET_FW_PROFILE_TYPE2_', 'NET_FW_ACTION_', 'NET_FW_MODIFY_STATE_', 'NET_FW_RULE_DIRECTION_', 'tag_WBEMSTATUS', 'tagCLSCTX', '_INTERNAL_IF_OPER_STATUS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS', 'tagCOINIT', 'tagTYPEKIND']
@@ -930,6 +932,14 @@ class _SYSTEM_VERIFIER_INFORMATION(Structure):
PSYSTEM_VERIFIER_INFORMATION = POINTER(_SYSTEM_VERIFIER_INFORMATION)
SYSTEM_VERIFIER_INFORMATION = _SYSTEM_VERIFIER_INFORMATION
# Struct _CLIENT_ID definitions
class _CLIENT_ID(Structure):
_fields_ = [
("UniqueProcess", HANDLE),
("UniqueThread", HANDLE),
]
CLIENT_ID = _CLIENT_ID
# Struct _LDR_DATA_TABLE_ENTRY definitions
class _LDR_DATA_TABLE_ENTRY(Structure):
_fields_ = [
@@ -1136,6 +1146,19 @@ class _MEMORY_BASIC_INFORMATION(Structure):
PMEMORY_BASIC_INFORMATION = POINTER(_MEMORY_BASIC_INFORMATION)
MEMORY_BASIC_INFORMATION = _MEMORY_BASIC_INFORMATION
# Struct _THREAD_BASIC_INFORMATION definitions
class _THREAD_BASIC_INFORMATION(Structure):
_fields_ = [
("ExitStatus", NTSTATUS),
("TebBaseAddress", PVOID),
("ClientId", CLIENT_ID),
("AffinityMask", KAFFINITY),
("Priority", KPRIORITY),
("BasePriority", KPRIORITY),
]
THREAD_BASIC_INFORMATION = _THREAD_BASIC_INFORMATION
PTHREAD_BASIC_INFORMATION = POINTER(_THREAD_BASIC_INFORMATION)
# Struct _MEMORY_BASIC_INFORMATION32 definitions
class _MEMORY_BASIC_INFORMATION32(Structure):
_fields_ = [
@@ -3016,14 +3039,6 @@ class _PORT_MESSAGE_TMP_UNION_U2(Union):
]
_PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2
# Struct _CLIENT_ID definitions
class _CLIENT_ID(Structure):
_fields_ = [
("UniqueProcess", HANDLE),
("UniqueThread", HANDLE),
]
CLIENT_ID = _CLIENT_ID
# Struct _PORT_MESSAGE definitions
class _PORT_MESSAGE(Structure):
_fields_ = [
windows/utils/winutils.py
+3
View File
@@ -152,6 +152,9 @@ def check_debug():
def datetime_from_filetime(filetime):
return datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=filetime / 10)
def filetime_from_datetime(dtime):
return int((dtime - datetime.datetime(1601,1,1)).total_seconds() * 1000) * 10000
class FixedInteractiveConsole(code.InteractiveConsole):
def raw_input(self, prompt=">>>"):
windows/winobject/process.py
+1 -1
View File
@@ -443,7 +443,7 @@ class Process(AutoHandle):
try:
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, addr, 2, buffer, buffer_size, target_size)
except NtStatusException as e:
if e.code not in [STATUS_FILE_INVALID, STATUS_INVALID_ADDRESS]:
if e.code not in [STATUS_FILE_INVALID, STATUS_INVALID_ADDRESS, STATUS_TRANSACTION_NOT_ACTIVE]:
raise
return None
remote_winstring = rctypes.transform_type_to_remote64bits(WinUnicodeString)