Added multiple ctypes_generation definition + some winproxy functions

This commit is contained in:
hakril
2018-12-21 15:31:51 +01:00
parent 45ace331cb
commit a9a39bc53f
15 changed files with 702 additions and 87 deletions
@@ -0,0 +1,259 @@
//
// AccessSystemAcl access type
//
#define ACCESS_SYSTEM_SECURITY (0x01000000L)
//
// MaximumAllowed access type
//
#define MAXIMUM_ALLOWED (0x02000000L)
//
// Define access rights to files and directories
//
#define FILE_READ_DATA ( 0x0001 ) // file & pipe
#define FILE_LIST_DIRECTORY ( 0x0001 ) // directory
#define FILE_WRITE_DATA ( 0x0002 ) // file & pipe
#define FILE_ADD_FILE ( 0x0002 ) // directory
#define FILE_APPEND_DATA ( 0x0004 ) // file
#define FILE_ADD_SUBDIRECTORY ( 0x0004 ) // directory
#define FILE_CREATE_PIPE_INSTANCE ( 0x0004 ) // named pipe
#define FILE_READ_EA ( 0x0008 ) // file & directory
#define FILE_WRITE_EA ( 0x0010 ) // file & directory
#define FILE_EXECUTE ( 0x0020 ) // file
#define FILE_TRAVERSE ( 0x0020 ) // directory
#define FILE_DELETE_CHILD ( 0x0040 ) // directory
#define FILE_READ_ATTRIBUTES ( 0x0080 ) // all
#define FILE_WRITE_ATTRIBUTES ( 0x0100 ) // all
#define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
#define FILE_GENERIC_READ (STANDARD_RIGHTS_READ |\
FILE_READ_DATA |\
FILE_READ_ATTRIBUTES |\
FILE_READ_EA |\
SYNCHRONIZE)
#define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE |\
FILE_WRITE_DATA |\
FILE_WRITE_ATTRIBUTES |\
FILE_WRITE_EA |\
FILE_APPEND_DATA |\
SYNCHRONIZE)
#define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE |\
FILE_READ_ATTRIBUTES |\
FILE_EXECUTE |\
SYNCHRONIZE)
//
// Callback Specific Access Rights.
//
#define CALLBACK_MODIFY_STATE 0x0001
#define CALLBACK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
CALLBACK_MODIFY_STATE )
// Event Specific Access Rights.
//
#define EVENT_QUERY_STATE 0x0001
#define EVENT_MODIFY_STATE 0x0002 // winnt
#define EVENT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
//
// Mutant Specific Access Rights.
//
// begin_winnt
#define MUTANT_QUERY_STATE 0x0001
#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
MUTANT_QUERY_STATE)
//
// Semaphore Specific Access Rights.
//
#define SEMAPHORE_QUERY_STATE 0x0001
#define SEMAPHORE_MODIFY_STATE 0x0002 // winnt
#define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
// Timer Specific Access Rights.
//
#define TIMER_QUERY_STATE 0x0001
#define TIMER_MODIFY_STATE 0x0002
#define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
TIMER_QUERY_STATE|TIMER_MODIFY_STATE)
// I/O Completion Specific Access Rights.
//
#define IO_COMPLETION_QUERY_STATE 0x0001
#define IO_COMPLETION_MODIFY_STATE 0x0002 // winnt
#define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) // winnt
//
// Connection Port Type Specific Access Rights.
//
#define PORT_CONNECT (0x0001)
#define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \
SYNCHRONIZE | 0x1)
//
// Object Manager Object Type Specific Access Rights.
//
#define OBJECT_TYPE_CREATE (0x0001)
#define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
//
// Object Manager Directory Specific Access Rights.
//
#define DIRECTORY_QUERY (0x0001)
#define DIRECTORY_TRAVERSE (0x0002)
#define DIRECTORY_CREATE_OBJECT (0x0004)
#define DIRECTORY_CREATE_SUBDIRECTORY (0x0008)
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
//
// Object Manager Symbolic Link Specific Access Rights.
//
#define SYMBOLIC_LINK_QUERY (0x0001)
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
//
// Process Specific Access Rights
//
#define PROCESS_TERMINATE (0x0001)
#define PROCESS_CREATE_THREAD (0x0002)
#define PROCESS_SET_SESSIONID (0x0004)
#define PROCESS_VM_OPERATION (0x0008)
#define PROCESS_VM_READ (0x0010)
#define PROCESS_VM_WRITE (0x0020)
#define PROCESS_DUP_HANDLE (0x0040)
#define PROCESS_CREATE_PROCESS (0x0080)
#define PROCESS_SET_QUOTA (0x0100)
#define PROCESS_SET_INFORMATION (0x0200)
#define PROCESS_QUERY_INFORMATION (0x0400)
#define PROCESS_SUSPEND_RESUME (0x0800)
#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000)
#define PROCESS_SET_LIMITED_INFORMATION (0x2000)
#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
0xFFF)
//
// Thread Specific Access Rights
//
#define THREAD_TERMINATE (0x0001)
#define THREAD_SUSPEND_RESUME (0x0002)
#define THREAD_GET_CONTEXT (0x0008)
#define THREAD_SET_CONTEXT (0x0010)
#define THREAD_QUERY_INFORMATION (0x0040)
#define THREAD_SET_INFORMATION (0x0020)
#define THREAD_SET_THREAD_TOKEN (0x0080)
#define THREAD_IMPERSONATE (0x0100)
#define THREAD_DIRECT_IMPERSONATION (0x0200)
#define THREAD_ALL_ACCESS 0x001F03FF
//
// Job Object Specific Access Rights
//
// begin_winnt
#define JOB_OBJECT_ASSIGN_PROCESS (0x0001)
#define JOB_OBJECT_SET_ATTRIBUTES (0x0002)
#define JOB_OBJECT_QUERY (0x0004)
#define JOB_OBJECT_TERMINATE (0x0008)
#define JOB_OBJECT_SET_SECURITY_ATTRIBUTES (0x0010)
#define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \
0x1F )
//
// Registry Specific Access Rights.
//
#define KEY_QUERY_VALUE (0x0001)
#define KEY_SET_VALUE (0x0002)
#define KEY_CREATE_SUB_KEY (0x0004)
#define KEY_ENUMERATE_SUB_KEYS (0x0008)
#define KEY_NOTIFY (0x0010)
#define KEY_CREATE_LINK (0x0020)
#define KEY_WOW64_32KEY (0x0200)
#define KEY_WOW64_64KEY (0x0100)
#define KEY_WOW64_RES (0x0300)
#define KEY_READ ((STANDARD_RIGHTS_READ|KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY)&(~SYNCHRONIZE))
#define KEY_WRITE ((STANDARD_RIGHTS_WRITE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY)&(~SYNCHRONIZE))
#define KEY_EXECUTE ((KEY_READ)&(~SYNCHRONIZE))
#define KEY_ALL_ACCESS ((STANDARD_RIGHTS_ALL|KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK)&(~SYNCHRONIZE))
//
// Token Specific Access Rights.
//// Documentation purpose only real define are in token.txt
// #define TOKEN_ASSIGN_PRIMARY (0x0001)
// #define TOKEN_DUPLICATE (0x0002)
// #define TOKEN_IMPERSONATE (0x0004)
// #define TOKEN_QUERY (0x0008)
// #define TOKEN_QUERY_SOURCE (0x0010)
// #define TOKEN_ADJUST_PRIVILEGES (0x0020)
// #define TOKEN_ADJUST_GROUPS (0x0040)
// #define TOKEN_ADJUST_DEFAULT (0x0080)
// #define TOKEN_ADJUST_SESSIONID (0x0100)
//
// Cluster API Specific Access Rights
//
#define CLUSAPI_READ_ACCESS 0x00000001L
#define CLUSAPI_CHANGE_ACCESS 0x00000002L
#define CLUSAPI_NO_ACCESS 0x00000004L
#define CLUSAPI_ALL_ACCESS (CLUSAPI_READ_ACCESS | CLUSAPI_CHANGE_ACCESS)
//
// Fax Specific Access Rights
//
#define FAX_JOB_SUBMIT (0x0001)
#define FAX_JOB_QUERY (0x0002)
#define FAX_CONFIG_QUERY (0x0004)
#define FAX_CONFIG_SET (0x0008)
#define FAX_PORT_QUERY (0x0010)
#define FAX_PORT_SET (0x0020)
#define FAX_JOB_MANAGE (0x0040)
@@ -13,33 +13,8 @@
#define WARMING_NOT_SAME_FLAG_FOR_WINXP 0
#define PROCESS_TERMINATE (0x0001)
#define PROCESS_CREATE_THREAD (0x0002)
#define PROCESS_SET_SESSIONID (0x0004)
#define PROCESS_VM_OPERATION (0x0008)
#define PROCESS_VM_READ (0x0010)
#define PROCESS_VM_WRITE (0x0020)
#define PROCESS_DUP_HANDLE (0x0040)
#define PROCESS_CREATE_PROCESS (0x0080)
#define PROCESS_SET_QUOTA (0x0100)
#define PROCESS_SET_INFORMATION (0x0200)
#define PROCESS_QUERY_INFORMATION (0x0400)
#define PROCESS_SUSPEND_RESUME (0x0800)
#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000)
#define THREAD_TERMINATE (0x0001)
#define THREAD_SUSPEND_RESUME (0x0002)
#define THREAD_GET_CONTEXT (0x0008)
#define THREAD_SET_CONTEXT (0x0010)
#define THREAD_QUERY_INFORMATION (0x0040)
#define THREAD_SET_INFORMATION (0x0020)
#define THREAD_SET_THREAD_TOKEN (0x0080)
#define THREAD_IMPERSONATE (0x0100)
#define THREAD_DIRECT_IMPERSONATION (0x0200)
#define PROCESS_ALL_ACCESS 0x001F0FFF
#define THREAD_ALL_ACCESS 0x001F03FF
#define STARTF_USESHOWWINDOW 0x00000001
@@ -366,21 +341,6 @@
#define RRF_ZEROONFAILURE 0x20000000
#define KEY_QUERY_VALUE (0x0001)
#define KEY_SET_VALUE (0x0002)
#define KEY_CREATE_SUB_KEY (0x0004)
#define KEY_ENUMERATE_SUB_KEYS (0x0008)
#define KEY_NOTIFY (0x0010)
#define KEY_CREATE_LINK (0x0020)
#define KEY_WOW64_32KEY (0x0200)
#define KEY_WOW64_64KEY (0x0100)
#define KEY_WOW64_RES (0x0300)
#define KEY_READ ((STANDARD_RIGHTS_READ|KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY)&(~SYNCHRONIZE))
#define KEY_WRITE ((STANDARD_RIGHTS_WRITE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY)&(~SYNCHRONIZE))
#define KEY_EXECUTE ((KEY_READ)&(~SYNCHRONIZE))
#define KEY_ALL_ACCESS ((STANDARD_RIGHTS_ALL|KEY_QUERY_VALUE|KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_CREATE_LINK)&(~SYNCHRONIZE))
#define ERROR_NOT_ALL_ASSIGNED 1300
@@ -738,12 +698,6 @@
#define MAXLEN_IFDESCR 256
#define MAX_INTERFACE_NAME_LEN 256
#define DIRECTORY_QUERY (0x0001)
#define DIRECTORY_TRAVERSE (0x0002)
#define DIRECTORY_CREATE_OBJECT (0x0004)
#define DIRECTORY_CREATE_SUBDIRECTORY (0x0008)
#define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF)
#define OBJ_INHERIT 0x00000002L
#define OBJ_PERMANENT 0x00000010L
@@ -973,26 +927,6 @@
#define FILE_EXISTS 0x00000004
#define FILE_DOES_NOT_EXIST 0x00000005
#define FILE_READ_DATA ( 0x0001 ) // file & pipe
#define FILE_LIST_DIRECTORY ( 0x0001 ) // directory
#define FILE_WRITE_DATA ( 0x0002 ) // file & pipe
#define FILE_ADD_FILE ( 0x0002 ) // directory
#define FILE_APPEND_DATA ( 0x0004 ) // file
#define FILE_ADD_SUBDIRECTORY ( 0x0004 ) // directory
#define FILE_CREATE_PIPE_INSTANCE ( 0x0004 ) // named pipe
#define FILE_READ_EA ( 0x0008 ) // file & directory
#define FILE_WRITE_EA ( 0x0010 ) // file & directory
#define FILE_EXECUTE ( 0x0020 ) // file
#define FILE_TRAVERSE ( 0x0020 ) // directory
#define FILE_DELETE_CHILD ( 0x0040 ) // directory
#define FILE_READ_ATTRIBUTES ( 0x0080 ) // all
#define FILE_WRITE_ATTRIBUTES ( 0x0100 ) // all
#define FILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF)
#define FILE_GENERIC_READ (STANDARD_RIGHTS_READ | FILE_READ_DATA | FILE_READ_ATTRIBUTES | FILE_READ_EA | SYNCHRONIZE)
#define FILE_GENERIC_WRITE (STANDARD_RIGHTS_WRITE | FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES| FILE_WRITE_EA | FILE_APPEND_DATA | SYNCHRONIZE)
#define FILE_GENERIC_EXECUTE (STANDARD_RIGHTS_EXECUTE | FILE_READ_ATTRIBUTES | FILE_EXECUTE | SYNCHRONIZE)
#define API_SET_SCHEMA_VERSION_V2 0x00000002L
#define API_SET_SCHEMA_VERSION_V3 0x00000003L // No offline support.
@@ -0,0 +1,37 @@
DWORD64 WINAPI SymLoadModuleExA(
_In_ HANDLE hProcess,
_In_ HANDLE hFile,
_In_ PCSTR ImageName,
_In_ PCSTR ModuleName,
_In_ DWORD64 BaseOfDll,
_In_ DWORD DllSize,
_In_ PMODLOAD_DATA Data,
_In_ DWORD Flags
);
DWORD64 WINAPI SymLoadModuleExW(
_In_ HANDLE hProcess,
_In_ HANDLE hFile,
_In_ PCWSTR ImageName,
_In_ PCWSTR ModuleName,
_In_ DWORD64 BaseOfDll,
_In_ DWORD DllSize,
_In_ PMODLOAD_DATA Data,
_In_ DWORD Flags
);
BOOL WINAPI SymFromAddr(
_In_ HANDLE hProcess,
_In_ DWORD64 Address,
_Out_opt_ PDWORD64 Displacement,
_Inout_ PSYMBOL_INFO Symbol
);
BOOL WINAPI SymGetModuleInfo64(
_In_ HANDLE hProcess,
_In_ DWORD64 dwAddr,
_Out_ PIMAGEHLP_MODULE64 ModuleInfo
);
@@ -0,0 +1,29 @@
HINSTANCE WINAPI ShellExecuteA(
_In_opt_ HWND hwnd,
_In_opt_ LPCSTR lpOperation,
_In_ LPCSTR lpFile,
_In_opt_ LPCSTR lpParameters,
_In_opt_ LPCSTR lpDirectory,
_In_ INT nShowCmd
);
HINSTANCE WINAPI ShellExecuteW(
_In_opt_ HWND hwnd,
_In_opt_ LPWSTR lpOperation,
_In_ LPWSTR lpFile,
_In_opt_ LPWSTR lpParameters,
_In_opt_ LPWSTR lpDirectory,
_In_ INT nShowCmd
);
BOOL SHGetPathFromIDListA(
PCIDLIST_ABSOLUTE pidl,
LPCSTR pszPath
);
BOOL SHGetPathFromIDListW(
PCIDLIST_ABSOLUTE pidl,
LPWSTR pszPath
);
@@ -1566,26 +1566,6 @@ LONG WINAPI RegQueryValueExW(
);
HINSTANCE WINAPI ShellExecuteA(
_In_opt_ HWND hwnd,
_In_opt_ LPCSTR lpOperation,
_In_ LPCSTR lpFile,
_In_opt_ LPCSTR lpParameters,
_In_opt_ LPCSTR lpDirectory,
_In_ INT nShowCmd
);
HINSTANCE WINAPI ShellExecuteW(
_In_opt_ HWND hwnd,
_In_opt_ LPWSTR lpOperation,
_In_ LPWSTR lpFile,
_In_opt_ LPWSTR lpParameters,
_In_opt_ LPWSTR lpDirectory,
_In_ INT nShowCmd
);
BOOL WINAPI InitializeProcThreadAttributeList(
_Out_opt_ LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
_In_ DWORD dwAttributeCount,
@@ -31,4 +31,17 @@ NTSTATUS WINAPI NtSetEaFile(
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_reads_bytes_(Length) PVOID Buffer,
_In_ ULONG Length
);
NTSTATUS WINAPI NtCreateProcessEx(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_ HANDLE ParentProcess,
_In_ ULONG Flags,
_In_ HANDLE SectionHandle,
_In_ HANDLE DebugPort,
_In_ HANDLE ExceptionPort,
_In_ BOOLEAN InJob
);
@@ -0,0 +1,276 @@
typedef enum _ALPC_PORT_INFORMATION_CLASS
{
AlpcBasicInformation,
AlpcPortInformation,
AlpcAssociateCompletionPortInformation,
AlpcConnectedSIDInformation,
AlpcServerInformation,
AlpcMessageZoneInformation,
AlpcRegisterCompletionListInformation,
AlpcUnregisterCompletionListInformation,
AlpcAdjustCompletionListConcurrencyCountInformation,
AlpcRegisterCallbackInformation,
AlpcCompletionListRundownInformation,
AlpcWaitForPortReferences,
MaxAlpcPortInfoClass
} ALPC_PORT_INFORMATION_CLASS;
typedef enum _ALPC_MESSAGE_INFORMATION_CLASS
{
AlpcMessageSidInformation,
AlpcMessageTokenModifiedIdInformation,
MaxAlpcMessageInfoClass,
AlpcMessageHandleInformation,
} ALPC_MESSAGE_INFORMATION_CLASS, *PALPC_MESSAGE_INFORMATION_CLASS;
typedef struct _ALPC_PORT_ATTRIBUTES32
{
ULONG Flags;
SECURITY_QUALITY_OF_SERVICE SecurityQos;
SIZE_T MaxMessageLength;
SIZE_T MemoryBandwidth;
SIZE_T MaxPoolUsage;
SIZE_T MaxSectionSize;
SIZE_T MaxViewSize;
SIZE_T MaxTotalSectionSize;
ULONG DupObjectTypes;
} ALPC_PORT_ATTRIBUTES32, *PALPC_PORT_ATTRIBUTES32;
typedef struct _ALPC_PORT_ATTRIBUTES64
{
ULONG Flags;
SECURITY_QUALITY_OF_SERVICE SecurityQos;
SIZE_T MaxMessageLength;
SIZE_T MemoryBandwidth;
SIZE_T MaxPoolUsage;
SIZE_T MaxSectionSize;
SIZE_T MaxViewSize;
SIZE_T MaxTotalSectionSize;
ULONG DupObjectTypes;
ULONG Reserved;
} ALPC_PORT_ATTRIBUTES64, *PALPC_PORT_ATTRIBUTES64;
typedef struct _ALPC_MESSAGE_ATTRIBUTES
{
ULONG AllocatedAttributes;
ULONG ValidAttributes;
} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;
typedef union _PORT_MESSAGE32_TMP_UNION
{
ULONG ClientViewSize;
ULONG CallbackId;
} PORT_MESSAGE_TMP_UNION;
typedef union _PORT_MESSAGE64_TMP_UNION
{
ULONGLONG ClientViewSize;
ULONG CallbackId;
} PORT_MESSAGE_TMP_UNION;
typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1
{
CSHORT DataLength;
CSHORT TotalLength;
} _PORT_MESSAGE_TMP_SUBSTRUCT_S1;
typedef union _PORT_MESSAGE_TMP_UNION_U1
{
ULONG Length;
_PORT_MESSAGE_TMP_SUBSTRUCT_S1 s1;
} _PORT_MESSAGE_TMP_UNION_U1;
typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2
{
CSHORT Type;
CSHORT DataInfoOffset;
} _PORT_MESSAGE_TMP_SUBSTRUCT_S2;
typedef union _PORT_MESSAGE_TMP_UNION_U2
{
ULONG ZeroInit;
_PORT_MESSAGE_TMP_SUBSTRUCT_S2 s2;
} _PORT_MESSAGE_TMP_UNION_U2;
typedef struct _PORT_MESSAGE32
{
_PORT_MESSAGE_TMP_UNION_U1 u1;
_PORT_MESSAGE_TMP_UNION_U2 u2;
CLIENT_ID32 ClientId;
ULONG MessageId;
_PORT_MESSAGE32_TMP_UNION tmp_union;
} PORT_MESSAGE32, *PPORT_MESSAGE32;
typedef struct _PORT_MESSAGE64
{
_PORT_MESSAGE_TMP_UNION_U1 u1;
_PORT_MESSAGE_TMP_UNION_U2 u2;
CLIENT_ID64 ClientId;
ULONG MessageId;
_PORT_MESSAGE64_TMP_UNION tmp_union;
} PORT_MESSAGE64, *PPORT_MESSAGE64;
typedef struct _ALPC_SERVER_INFORMATION_TMP_IN
{
HANDLE ThreadHandle;
} ALPC_SERVER_INFORMATION_TMP_IN;
typedef struct _ALPC_SERVER_INFORMATION_TMP_OUT
{
BOOLEAN ThreadBlocked;
HANDLE ConnectedProcessId;
UNICODE_STRING ConnectionPortName;
} ALPC_SERVER_INFORMATION_TMP_OUT;
typedef union ALPC_SERVER_INFORMATION
{
ALPC_SERVER_INFORMATION_TMP_IN In;
ALPC_SERVER_INFORMATION_TMP_OUT Out;
} ALPC_SERVER_INFORMATION;
typedef struct _ALPC_CONTEXT_ATTR
{
PVOID PortContext;
PVOID MessageContext;
ULONG Sequence;
ULONG MessageId;
ULONG CallbackId;
} ALPC_CONTEXT_ATTR, *PALPC_CONTEXT_ATTR;
typedef struct _ALPC_CONTEXT_ATTR32
{
ULONG PortContext;
ULONG MessageContext;
ULONG Sequence;
ULONG MessageId;
ULONG CallbackId;
} ALPC_CONTEXT_ATTR32, *PALPC_CONTEXT_ATTR32;
typedef struct _ALPC_CONTEXT_ATTR64
{
ULONGLONG PortContext;
ULONGLONG MessageContext;
ULONG Sequence;
ULONG MessageId;
ULONG CallbackId;
} ALPC_CONTEXT_ATTR64, *PALPC_CONTEXT_ATTR64;
typedef struct _ALPC_HANDLE_ATTR
{
ULONG Flags;
HANDLE Handle;
ULONG ObjectType;
ACCESS_MASK DesiredAccess;
} ALPC_HANDLE_ATTR, *PALPC_HANDLE_ATTR;
typedef struct _ALPC_HANDLE_ATTR32
{
ULONG Flags;
ULONG Handle;
ULONG ObjectType;
ACCESS_MASK DesiredAccess;
} ALPC_HANDLE_ATTR32, *PALPC_HANDLE_ATTR32;
typedef struct _ALPC_HANDLE_ATTR64
{
ULONG Flags;
ULONGLONG Handle;
ULONG ObjectType;
ACCESS_MASK DesiredAccess;
} ALPC_HANDLE_ATTR64, *PALPC_HANDLE_ATTR64;
typedef struct _ALPC_SECURITY_ATTR
{
ULONG Flags;
PSECURITY_QUALITY_OF_SERVICE QoS;
ALPC_HANDLE ContextHandle;
} ALPC_SECURITY_ATTR, *PALPC_SECURITY_ATTR;
typedef struct _ALPC_SECURITY_ATTR32
{
ULONG Flags;
ULONG QoS;
ULONG ContextHandle;
} ALPC_SECURITY_ATTR32, *PALPC_SECURITY_ATTR32;
typedef struct _ALPC_SECURITY_ATTR64
{
ULONGLONG Flags;
ULONGLONG QoS;
ULONGLONG ContextHandle;
} ALPC_SECURITY_ATTR64, *PALPC_SECURITY_ATTR64;
typedef struct _ALPC_DATA_VIEW_ATTR
{
ULONG Flags;
ALPC_HANDLE SectionHandle;
PVOID ViewBase;
PVOID ViewSize;
} ALPC_DATA_VIEW_ATTR, *PALPC_DATA_VIEW_ATTR;
typedef struct _ALPC_DATA_VIEW_ATTR32
{
ULONG Flags;
ULONG SectionHandle;
ULONG ViewBase;
ULONG ViewSize;
} ALPC_DATA_VIEW_ATTR32, *PALPC_DATA_VIEW_ATTR32;
typedef struct _ALPC_DATA_VIEW_ATTR64
{
ULONG Flags;
ULONGLONG SectionHandle;
ULONGLONG ViewBase;
ULONGLONG ViewSize;
} ALPC_DATA_VIEW_ATTR64, *PALPC_DATA_VIEW_ATTR64;
typedef struct _ALPC_TOKEN_ATTR
{
ULONGLONG TokenId;
ULONGLONG AuthenticationId;
ULONGLONG ModifiedId;
} ALPC_TOKEN_ATTR, *PALPC_TOKEN_ATTR;
typedef struct _ALPC_DIRECT_ATTR
{
HANDLE Event;
} ALPC_DIRECT_ATTR, *PALPC_DIRECT_ATTR;
typedef struct _ALPC_DIRECT_ATTR32
{
ULONG Event;
} ALPC_DIRECT_ATTR32, *PALPC_DIRECT_ATTR32;
typedef struct _ALPC_DIRECT_ATTR64
{
ULONGLONG Event;
} ALPC_DIRECT_ATTR64, *PALPC_DIRECT_ATTR64;
typedef struct _ALPC_WORK_ON_BEHALF_ATTR
{
ULONGLONG Ticket;
} ALPC_WORK_ON_BEHALF_ATTR, *PALPC_WORK_ON_BEHALF_ATTR;
typedef struct _RPC_IF_ID {
IID Uuid;
USHORT VersMajor;
USHORT VersMinor;
} RPC_IF_ID;
@@ -0,0 +1,38 @@
typedef enum {
SymNone,
SymCoff,
SymCv,
SymPdb,
SymExport,
SymDeferred,
SymSym, // .sym file
SymDia,
SymVirtual,
NumSymTypes
} SYM_TYPE;
typedef struct _IMAGEHLP_MODULE64 {
DWORD SizeOfStruct;
DWORD64 BaseOfImage;
DWORD ImageSize;
DWORD TimeDateStamp;
DWORD CheckSum;
DWORD NumSyms;
SYM_TYPE SymType;
CHAR ModuleName[32];
CHAR ImageName[256];
CHAR LoadedImageName[256];
CHAR LoadedPdbName[256];
DWORD CVSig;
CHAR CVData[780]; // MAX_PATH * 3
DWORD PdbSig;
GUID PdbSig70;
DWORD PdbAge;
BOOL PdbUnmatched;
BOOL DbgUnmatched;
BOOL LineNumbers;
BOOL GlobalSymbols;
BOOL TypeInfo;
BOOL SourceIndexed;
BOOL Publics;
} IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64;
+1 -1
View File
@@ -42,7 +42,7 @@ class PSID(_INITIAL_PSID): # _INITIAL_PSID -> PVOID
return """<{0} "{1}">""".format(type(self).__name__, self.to_string())
except WindowsError: # Case of PSID is not valide
if not self:
return """<{0} "None" at {1:#x}>""".format(type(self).__name__, id(self))
return """<{0} (NULL) at {1:#x}>""".format(type(self).__name__, id(self))
return """<{0} "<conversion-failed>" at {1:#x}>""".format(type(self).__name__, id(self))
__sprint__ = __repr__
@@ -3,5 +3,8 @@ class _LUID(_INITIAL_LUID):
def __int__(self):
return (self.HighPart << 32) | self.LowPart
def __eq__(self, other):
return (self.HighPart, self.LowPart) == (other.HighPart, other.LowPart)
def __repr__(self):
return "<{0} HighPart={1} LowPart={2}>".format(type(self).__name__, self.HighPart, self.LowPart)
+1
View File
@@ -1,6 +1,7 @@
from advapi32 import *
from crypt32 import *
from cryptui import *
from dbghelp import *
from iphlpapi import *
from kernel32 import *
from ktmw32 import *
+2
View File
@@ -46,6 +46,8 @@ def OpenThreadToken(ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle):
@Advapi32Proxy()
def SetThreadToken(Thread, Token):
if isinstance(Thread, (int, long)):
Thread = gdef.HANDLE(Thread)
return SetThreadToken.ctypes_function(Thread, Token)
@Advapi32Proxy()
+30
View File
@@ -0,0 +1,30 @@
import ctypes
import windows.generated_def as gdef
from ..apiproxy import ApiProxy, NeededParameter
from ..error import fail_on_zero
class DbgHelpProxy(ApiProxy):
APIDLL = "dbghelp"
default_error_check = staticmethod(fail_on_zero)
@DbgHelpProxy()
def SymInitialize(hProcess, UserSearchPath, fInvadeProcess):
return SymInitialize.ctypes_function(hProcess, UserSearchPath, fInvadeProcess)
@DbgHelpProxy()
def SymLoadModuleExA(hProcess, hFile, ImageName, ModuleName, BaseOfDll, DllSize, Data, Flags):
return SymLoadModuleExA.ctypes_function(hProcess, hFile, ImageName, ModuleName, BaseOfDll, DllSize, Data, Flags)
@DbgHelpProxy()
def SymLoadModuleExW(hProcess, hFile, ImageName, ModuleName, BaseOfDll, DllSize, Data, Flags):
return SymLoadModuleExW.ctypes_function(hProcess, hFile, ImageName, ModuleName, BaseOfDll, DllSize, Data, Flags)
@DbgHelpProxy()
def SymFromAddr(hProcess, Address, Displacement, Symbol):
return SymFromAddr.ctypes_function(hProcess, Address, Displacement, Symbol)
@DbgHelpProxy()
def SymGetModuleInfo64(hProcess, dwAddr, ModuleInfo):
return SymGetModuleInfo64.ctypes_function(hProcess, dwAddr, ModuleInfo)
+5
View File
@@ -108,6 +108,11 @@ def NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInforma
ThreadInformationLength = ctypes.sizeof(ThreadInformation)
return NtQueryInformationThread.ctypes_function(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength)
@NtdllProxy()
def NtCreateProcessEx(ProcessHandle, DesiredAccess, ObjectAttributes=None, ParentProcess=NeededParameter, Flags=NeededParameter, SectionHandle=NeededParameter, DebugPort=None, ExceptionPort=None, InJob=False):
return NtCreateProcessEx.ctypes_function(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, Flags, SectionHandle, DebugPort, ExceptionPort, InJob)
@NtdllProxy()
def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0):
if ThreadHandle is None:
+8
View File
@@ -15,3 +15,11 @@ def ShellExecuteA(hwnd, lpOperation, lpFile, lpParameters, lpDirectory, nShowCmd
@Shell32Proxy()
def ShellExecuteW(hwnd, lpOperation, lpFile, lpParameters, lpDirectory, nShowCmd):
return ShellExecuteW.ctypes_function(hwnd, lpOperation, lpFile, lpParameters, lpDirectory, nShowCmd)
@Shell32Proxy()
def SHGetPathFromIDListA(pidl, pszPath):
return SHGetPathFromIDListA.ctypes_function(pidl, pszPath)
@Shell32Proxy()
def SHGetPathFromIDListW(pidl, pszPath):
return SHGetPathFromIDListW.ctypes_function(pidl, pszPath)