diff --git a/ctypes_generation/definitions/custom_rpc_windef.txt b/ctypes_generation/definitions/custom_rpc_windef.txt new file mode 100644 index 0000000..fb509b3 --- /dev/null +++ b/ctypes_generation/definitions/custom_rpc_windef.txt @@ -0,0 +1,10 @@ +#define RPC_REQUEST_TYPE_CALL 0 +#define RPC_REQUEST_TYPE_BIND 1 + +#define RPC_RESPONSE_TYPE_BIND_OK 1 +#define RPC_RESPONSE_TYPE_FAIL 2 +#define RPC_RESPONSE_TYPE_SUCESS 3 + +#define BIND_IF_SYNTAX_NDR32 1 +#define BIND_IF_SYNTAX_NDR64 2 +#define BIND_IF_SYNTAX_UNKNOWN 4 \ No newline at end of file diff --git a/ctypes_generation/definitions/windef.txt b/ctypes_generation/definitions/windef.txt index 3022139..4e5aa09 100644 --- a/ctypes_generation/definitions/windef.txt +++ b/ctypes_generation/definitions/windef.txt @@ -1052,6 +1052,9 @@ #define ALPC_MESSAGE_VIEW_ATTRIBUTE 0x40000000 #define ALPC_MESSAGE_CONTEXT_ATTRIBUTE 0x20000000 #define ALPC_MESSAGE_HANDLE_ATTRIBUTE 0x10000000 +#define ALPC_MESSAGE_TOKEN_ATTRIBUTE 0x8000000 +#define ALPC_MESSAGE_DIRECT_ATTRIBUTE 0x4000000 +#define ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE 0x2000000 #define ALPC_MSGFLG_REPLY_MESSAGE 0x1 diff --git a/ctypes_generation/definitions/windef_error.txt b/ctypes_generation/definitions/windef_error.txt index ae67ccd..4aea362 100644 --- a/ctypes_generation/definitions/windef_error.txt +++ b/ctypes_generation/definitions/windef_error.txt @@ -495,4 +495,10 @@ #define ERROR_NO_LOG_SPACE 1019L #define ERROR_KEY_HAS_CHILDREN 1020L #define ERROR_CHILD_MUST_BE_VOLATILE 1021L -#define ERROR_NOTIFY_ENUM_DIR 1022L \ No newline at end of file +#define ERROR_NOTIFY_ENUM_DIR 1022L + +#define RPC_X_BAD_STUB_DATA 1783 +#define RPC_S_UNKNOWN_IF 1717 +#define RPC_S_PROTOCOL_ERROR 1728 +#define RPC_S_UNSUPPORTED_TRANS_SYN 1730 +#define RPC_S_PROCNUM_OUT_OF_RANGE 1745 \ No newline at end of file diff --git a/ctypes_generation/definitions/winstruct_alpc.txt b/ctypes_generation/definitions/winstruct_alpc.txt new file mode 100644 index 0000000..01f601e --- /dev/null +++ b/ctypes_generation/definitions/winstruct_alpc.txt @@ -0,0 +1,263 @@ + +typedef enum _ALPC_PORT_INFORMATION_CLASS +{ + AlpcBasicInformation, + AlpcPortInformation, + AlpcAssociateCompletionPortInformation, + AlpcConnectedSIDInformation, + AlpcServerInformation, + AlpcMessageZoneInformation, + AlpcRegisterCompletionListInformation, + AlpcUnregisterCompletionListInformation, + AlpcAdjustCompletionListConcurrencyCountInformation, + AlpcRegisterCallbackInformation, + AlpcCompletionListRundownInformation, + AlpcWaitForPortReferences, + MaxAlpcPortInfoClass +} ALPC_PORT_INFORMATION_CLASS; + + +typedef struct _ALPC_PORT_ATTRIBUTES32 +{ + ULONG Flags; + SECURITY_QUALITY_OF_SERVICE SecurityQos; + SIZE_T MaxMessageLength; + SIZE_T MemoryBandwidth; + SIZE_T MaxPoolUsage; + SIZE_T MaxSectionSize; + SIZE_T MaxViewSize; + SIZE_T MaxTotalSectionSize; + ULONG DupObjectTypes; +} ALPC_PORT_ATTRIBUTES32, *PALPC_PORT_ATTRIBUTES32; + + +typedef struct _ALPC_PORT_ATTRIBUTES64 +{ + ULONG Flags; + SECURITY_QUALITY_OF_SERVICE SecurityQos; + SIZE_T MaxMessageLength; + SIZE_T MemoryBandwidth; + SIZE_T MaxPoolUsage; + SIZE_T MaxSectionSize; + SIZE_T MaxViewSize; + SIZE_T MaxTotalSectionSize; + ULONG DupObjectTypes; + ULONG Reserved; +} ALPC_PORT_ATTRIBUTES64, *PALPC_PORT_ATTRIBUTES64; + +typedef struct _ALPC_MESSAGE_ATTRIBUTES +{ + ULONG AllocatedAttributes; + ULONG ValidAttributes; +} ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES; + + +typedef union _PORT_MESSAGE32_TMP_UNION +{ + ULONG ClientViewSize; + ULONG CallbackId; +} PORT_MESSAGE_TMP_UNION; + +typedef union _PORT_MESSAGE64_TMP_UNION +{ + ULONGLONG ClientViewSize; + ULONG CallbackId; +} PORT_MESSAGE_TMP_UNION; + + +typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S1 +{ + CSHORT DataLength; + CSHORT TotalLength; +} _PORT_MESSAGE_TMP_SUBSTRUCT_S1; + + +typedef union _PORT_MESSAGE_TMP_UNION_U1 +{ + ULONG Length; + _PORT_MESSAGE_TMP_SUBSTRUCT_S1 s1; +} _PORT_MESSAGE_TMP_UNION_U1; + + +typedef struct _PORT_MESSAGE_TMP_SUBSTRUCT_S2 +{ + CSHORT Type; + CSHORT DataInfoOffset; +} _PORT_MESSAGE_TMP_SUBSTRUCT_S2; + + +typedef union _PORT_MESSAGE_TMP_UNION_U2 +{ + ULONG ZeroInit; + _PORT_MESSAGE_TMP_SUBSTRUCT_S2 s2; +} _PORT_MESSAGE_TMP_UNION_U2; + + +typedef struct _PORT_MESSAGE32 +{ + _PORT_MESSAGE_TMP_UNION_U1 u1; + _PORT_MESSAGE_TMP_UNION_U2 u2; + CLIENT_ID32 ClientId; + ULONG MessageId; + _PORT_MESSAGE32_TMP_UNION tmp_union; +} PORT_MESSAGE32, *PPORT_MESSAGE32; + +typedef struct _PORT_MESSAGE64 +{ + _PORT_MESSAGE_TMP_UNION_U1 u1; + _PORT_MESSAGE_TMP_UNION_U2 u2; + CLIENT_ID64 ClientId; + ULONG MessageId; + _PORT_MESSAGE64_TMP_UNION tmp_union; +} PORT_MESSAGE64, *PPORT_MESSAGE64; + + +typedef struct _ALPC_SERVER_INFORMATION_TMP_IN +{ + HANDLE ThreadHandle; +} ALPC_SERVER_INFORMATION_TMP_IN; + +typedef struct _ALPC_SERVER_INFORMATION_TMP_OUT +{ + BOOLEAN ThreadBlocked; + HANDLE ConnectedProcessId; + UNICODE_STRING ConnectionPortName; +} ALPC_SERVER_INFORMATION_TMP_OUT; + +typedef union ALPC_SERVER_INFORMATION +{ + ALPC_SERVER_INFORMATION_TMP_IN In; + ALPC_SERVER_INFORMATION_TMP_OUT Out; +} ALPC_SERVER_INFORMATION; + + +typedef struct _ALPC_CONTEXT_ATTR +{ + PVOID PortContext; + PVOID MessageContext; + ULONG Sequence; + ULONG MessageId; + ULONG CallbackId; +} ALPC_CONTEXT_ATTR, *PALPC_CONTEXT_ATTR; + +typedef struct _ALPC_CONTEXT_ATTR32 +{ + ULONG PortContext; + ULONG MessageContext; + ULONG Sequence; + ULONG MessageId; + ULONG CallbackId; +} ALPC_CONTEXT_ATTR32, *PALPC_CONTEXT_ATTR32; + +typedef struct _ALPC_CONTEXT_ATTR64 +{ + ULONGLONG PortContext; + ULONGLONG MessageContext; + ULONG Sequence; + ULONG MessageId; + ULONG CallbackId; +} ALPC_CONTEXT_ATTR64, *PALPC_CONTEXT_ATTR64; + + +typedef struct _ALPC_HANDLE_ATTR +{ + ULONG Flags; + HANDLE Handle; + ULONG ObjectType; + ACCESS_MASK DesiredAccess; +} ALPC_HANDLE_ATTR, *PALPC_HANDLE_ATTR; + +typedef struct _ALPC_HANDLE_ATTR32 +{ + ULONG Flags; + ULONG Handle; + ULONG ObjectType; + ACCESS_MASK DesiredAccess; +} ALPC_HANDLE_ATTR32, *PALPC_HANDLE_ATTR32; + + +typedef struct _ALPC_HANDLE_ATTR64 +{ + ULONG Flags; + ULONGLONG Handle; + ULONG ObjectType; + ACCESS_MASK DesiredAccess; +} ALPC_HANDLE_ATTR64, *PALPC_HANDLE_ATTR64; + + +typedef struct _ALPC_SECURITY_ATTR +{ + ULONG Flags; + PSECURITY_QUALITY_OF_SERVICE QoS; + ALPC_HANDLE ContextHandle; +} ALPC_SECURITY_ATTR, *PALPC_SECURITY_ATTR; + +typedef struct _ALPC_SECURITY_ATTR32 +{ + ULONG Flags; + ULONG QoS; + ULONG ContextHandle; +} ALPC_SECURITY_ATTR32, *PALPC_SECURITY_ATTR32; + + +typedef struct _ALPC_SECURITY_ATTR64 +{ + ULONGLONG Flags; + ULONGLONG QoS; + ULONGLONG ContextHandle; +} ALPC_SECURITY_ATTR64, *PALPC_SECURITY_ATTR64; + +typedef struct _ALPC_DATA_VIEW_ATTR +{ + ULONG Flags; + ALPC_HANDLE SectionHandle; + PVOID ViewBase; + PVOID ViewSize; +} ALPC_DATA_VIEW_ATTR, *PALPC_DATA_VIEW_ATTR; + +typedef struct _ALPC_DATA_VIEW_ATTR32 +{ + ULONG Flags; + ULONG SectionHandle; + ULONG ViewBase; + ULONG ViewSize; +} ALPC_DATA_VIEW_ATTR32, *PALPC_DATA_VIEW_ATTR32; + + +typedef struct _ALPC_DATA_VIEW_ATTR64 +{ + ULONG Flags; + ULONGLONG SectionHandle; + ULONGLONG ViewBase; + ULONGLONG ViewSize; +} ALPC_DATA_VIEW_ATTR64, *PALPC_DATA_VIEW_ATTR64; + + +typedef struct _ALPC_TOKEN_ATTR +{ + ULONGLONG TokenId; + ULONGLONG AuthenticationId; + ULONGLONG ModifiedId; +} ALPC_TOKEN_ATTR, *PALPC_TOKEN_ATTR; + + +typedef struct _ALPC_DIRECT_ATTR +{ + HANDLE Event; +} ALPC_DIRECT_ATTR, *PALPC_DIRECT_ATTR; + +typedef struct _ALPC_DIRECT_ATTR32 +{ + ULONG Event; +} ALPC_DIRECT_ATTR32, *PALPC_DIRECT_ATTR32; + +typedef struct _ALPC_DIRECT_ATTR64 +{ + ULONGLONG Event; +} ALPC_DIRECT_ATTR64, *PALPC_DIRECT_ATTR64; + + +typedef struct _ALPC_WORK_ON_BEHALF_ATTR +{ + ULONGLONG Ticket; +} ALPC_WORK_ON_BEHALF_ATTR, *PALPC_WORK_ON_BEHALF_ATTR; diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py index ee8f913..3b3b275 100644 --- a/ctypes_generation/generate.py +++ b/ctypes_generation/generate.py @@ -725,6 +725,7 @@ defs_with_ntstatus = InitialDefGenerator(from_here("definitions\\windef.txt"), f # YOLO HACK FOR NOW :DD defs_with_ntstatus.append_input_file(from_here("definitions\\wintrust_crypt_def.txt")) defs_with_ntstatus.append_input_file(from_here("definitions\\windef_error.txt")) +defs_with_ntstatus.append_input_file(from_here("definitions\\custom_rpc_windef.txt")) structs = StructGenerator(from_here("definitions\\winstruct.txt"), from_here(r"..\windows\generated_def\\winstructs.py"), dependances=[defs_with_ntstatus]) diff --git a/windows/alpc.py b/windows/alpc.py index f7ea80d..127c8a8 100644 --- a/windows/alpc.py +++ b/windows/alpc.py @@ -6,9 +6,19 @@ from windows import winproxy from windows import generated_def as gdef +## For 64b python +# 0x1f: 0x80000000: ALPC_MESSAGE_SECURITY_ATTRIBUTE(0x80000000) : size=0x18? +# 0x1e: 0x40000000: ALPC_MESSAGE_VIEW_ATTRIBUTE(0x40000000): size=0x20 +# 0x1d: 0x20000000: ALPC_MESSAGE_CONTEXT_ATTRIBUTE(0x20000000): size=0x20 +# 0x1c: 0x10000000: ALPC_MESSAGE_HANDLE_ATTRIBUTE(0x10000000): size=0x18 +# 0x1b: 0x8000000: ALPC_MESSAGE_TOKEN_ATTRIBUTE(0x8000000): size=0x18 +# 0x1a: 0x4000000: ALPC_MESSAGE_DIRECT_ATTRIBUTE(0x4000000) size=0x8 +# 0x19: 0x2000000: ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE(0x2000000) size=0x8 + + class AlpcMessage(object): # PORT_MESSAGE + MessageAttribute - def __init__(self, msg_or_size=None, attributes=None): + def __init__(self, msg_or_size=0x1000, attributes=None): # Init the PORT_MESSAGE if isinstance(msg_or_size, (long, int)): self.port_message_buffer_size = msg_or_size @@ -19,10 +29,13 @@ class AlpcMessage(object): self.port_message = msg_or_size self.port_message_raw_buffer = self.port_message.raw_buffer self.port_message_buffer_size = len(self.port_message_raw_buffer) + else: + raise NotImplementedError("Uneexpected type for : {0}".format(msg_or_size)) # Init the MessageAttributes if attributes is None: - self.attributes = MessageAttribute.with_all_attributes() + # self.attributes = MessageAttribute.with_all_attributes() + self.attributes = MessageAttribute.with_all_attributes() ## Testing else: self.attributes = attributes @@ -63,6 +76,25 @@ class AlpcMessage(object): def view_is_valid(self): # Change the name ? return self.attributes.is_valid(gdef.ALPC_MESSAGE_VIEW_ATTRIBUTE) + @property + def security_is_valid(self): # Change the name ? + return self.attributes.is_valid(gdef.ALPC_MESSAGE_SECURITY_ATTRIBUTE) + + @property + def handle_is_valid(self): # Change the name ? + return self.attributes.is_valid(gdef.ALPC_MESSAGE_HANDLE_ATTRIBUTE) + + @property + def context_is_valid(self): # Change the name ? + return self.attributes.is_valid(gdef.ALPC_MESSAGE_CONTEXT_ATTRIBUTE) + + @property + def valid_attributes(self): + return self.attributes.valid_list + + @property + def allocated_attributes(self): + return self.attributes.allocated_list ## High level setup (Test) def setup_view(self, size, section_handle=0, flags=None): @@ -109,13 +141,30 @@ class AlpcMessagePort(gdef.PORT_MESSAGE): datalen = property(get_datalen, set_datalen) +KNOWN_ALPC_ATTRIBUTES = (gdef.ALPC_MESSAGE_SECURITY_ATTRIBUTE, + gdef.ALPC_MESSAGE_VIEW_ATTRIBUTE, + gdef.ALPC_MESSAGE_CONTEXT_ATTRIBUTE, + gdef.ALPC_MESSAGE_HANDLE_ATTRIBUTE, + gdef.ALPC_MESSAGE_TOKEN_ATTRIBUTE, + gdef.ALPC_MESSAGE_DIRECT_ATTRIBUTE, + gdef.ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE) + +KNOWN_ALPC_ATTRIBUTES_MAPPING = {x:x for x in KNOWN_ALPC_ATTRIBUTES} class MessageAttribute(gdef.ALPC_MESSAGE_ATTRIBUTES): ATTRIBUTE_BY_FLAG = [(gdef.ALPC_MESSAGE_SECURITY_ATTRIBUTE, gdef.ALPC_SECURITY_ATTR), (gdef.ALPC_MESSAGE_VIEW_ATTRIBUTE, gdef.ALPC_DATA_VIEW_ATTR), (gdef.ALPC_MESSAGE_CONTEXT_ATTRIBUTE, gdef.ALPC_CONTEXT_ATTR), - (gdef.ALPC_MESSAGE_HANDLE_ATTRIBUTE, gdef.ALPC_HANDLE_ATTR)] + (gdef.ALPC_MESSAGE_HANDLE_ATTRIBUTE, gdef.ALPC_HANDLE_ATTR), + (gdef.ALPC_MESSAGE_TOKEN_ATTRIBUTE, gdef.ALPC_TOKEN_ATTR), + (gdef.ALPC_MESSAGE_DIRECT_ATTRIBUTE, gdef.ALPC_DIRECT_ATTR), + (gdef.ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE, gdef.ALPC_WORK_ON_BEHALF_ATTR), + ] + + # 0x1b: 0x8000000: ALPC_MESSAGE_TOKEN_ATTRIBUTE(0x8000000): size=0x18 +# 0x1a: 0x4000000: ALPC_MESSAGE_DIRECT_ATTRIBUTE(0x4000000) size=0x8 +# 0x19: 0x2000000: ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE(0x2000000) size=0x8 @classmethod def with_attributes(cls, flags): @@ -130,9 +179,13 @@ class MessageAttribute(gdef.ALPC_MESSAGE_ATTRIBUTES): @classmethod def with_all_attributes(cls): return cls.with_attributes(gdef.ALPC_MESSAGE_SECURITY_ATTRIBUTE | - gdef.ALPC_MESSAGE_VIEW_ATTRIBUTE | - gdef.ALPC_MESSAGE_CONTEXT_ATTRIBUTE | - gdef.ALPC_MESSAGE_HANDLE_ATTRIBUTE) + gdef.ALPC_MESSAGE_VIEW_ATTRIBUTE | + gdef.ALPC_MESSAGE_CONTEXT_ATTRIBUTE | + gdef.ALPC_MESSAGE_HANDLE_ATTRIBUTE | + gdef.ALPC_MESSAGE_TOKEN_ATTRIBUTE | + gdef.ALPC_MESSAGE_DIRECT_ATTRIBUTE | + gdef.ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE) + @staticmethod def _get_required_buffer_size(flags): @@ -156,11 +209,28 @@ class MessageAttribute(gdef.ALPC_MESSAGE_ATTRIBUTES): offset = ctypes.sizeof(self) for sflag, struct in self.ATTRIBUTE_BY_FLAG: if sflag == attribute: + # print("Attr {0:#x} was at offet {1:#x}".format(attribute, offset)) return struct.from_address(ctypes.addressof(self) + offset) elif self.is_allocated(sflag): offset += ctypes.sizeof(struct) raise ValueError("ALPC Attribute <{0}> not found :(".format(attribute)) + def _extract_alpc_attributes_values(self, value): + attrs = [] + for mask in (1 << i for i in range(64)): + if value & mask: + attrs.append(mask) + return [KNOWN_ALPC_ATTRIBUTES_MAPPING.get(x, x) for x in attrs] + + @property + def valid_list(self): + return self._extract_alpc_attributes_values(self.ValidAttributes) + + @property + def allocated_list(self): + return self._extract_alpc_attributes_values(self.AllocatedAttributes) + + AlpcSection = namedtuple("AlpcSection", ["handle", "size"]) class AlpcTransportBase(object): @@ -221,7 +291,7 @@ class AlpcClient(AlpcTransportBase): port_attr.MaxSectionSize = 0xffffffff port_attr.MaxViewSize = 0xffffffff port_attr.MaxTotalSectionSize = 0xffffffff - port_attr.DupObjectTypes = 0 + port_attr.DupObjectTypes = 0xffffffff port_attr.SecurityQos.Length = ctypes.sizeof(port_attr.SecurityQos) port_attr.SecurityQos.ImpersonationLevel = gdef.SecurityImpersonation @@ -237,8 +307,12 @@ class AlpcClient(AlpcTransportBase): send_msg = AlpcMessagePort.from_buffer_size(buffersize.value) send_msg.data = connect_message send_msg_attr = MessageAttribute.with_all_attributes() + elif isinstance(connect_message, AlpcMessage): + send_msg = connect_message.port_message + send_msg_attr = connect_message.attributes + buffersize = gdef.DWORD(connect_message.port_message_buffer_size) else: - raise NotImplementedError("TODO: connect_to_port with type(connect_message) == AlpcMessage") + raise ValueError("Don't know how to send <{0!r}> as connect message".format(connect_message)) receive_attr = MessageAttribute.with_all_attributes() winproxy.NtAlpcConnectPort(handle, port_name_unicode, obj_attr, port_attr, flags, None, send_msg, buffersize, send_msg_attr, receive_attr, timeout) @@ -296,30 +370,37 @@ class AlpcServer(AlpcTransportBase): obj_attr.SecurityQualityOfService = None if port_attr is None: port_attr = gdef.ALPC_PORT_ATTRIBUTES() - port_attr.Flags = 0 + # port_attr.Flags = port_attr_flags + # port_attr.Flags = 0x2080000 + port_attr.Flags = 0x90000 port_attr.MaxMessageLength = msglen port_attr.MemoryBandwidth = 0 port_attr.MaxPoolUsage = 0xffffffff port_attr.MaxSectionSize = 0xffffffff port_attr.MaxViewSize = 0xffffffff port_attr.MaxTotalSectionSize = 0xffffffff - port_attr.DupObjectTypes = 0 + port_attr.DupObjectTypes = 0xffffffff + # windows.utils.print_ctypes_struct(port_attr, " - PORT_ATTR", hexa=True) winproxy.NtAlpcCreatePort(handle, obj_attr, port_attr) self.port_name = raw_name self.handle = handle.value - def accept_connection(self, msg, port_attr=None): + def accept_connection(self, msg, port_attr=None, port_context=None): rhandle = gdef.HANDLE() if port_attr is None: port_attr = gdef.ALPC_PORT_ATTRIBUTES() - port_attr.Flags = gdef.ALPC_HANDLEFLG_DUPLICATE_INHERIT - port_attr.Flags = 0 # Testing - port_attr.DupObjectTypes = 4 - port_attr.MaxMessageLength = 0x1000 + port_attr.Flags = 0x80000 + # port_attr.Flags = 0x80000 + 0x2000000 + # port_attr.Flags = 0x2000000 + port_attr.MaxMessageLength = self.DEFAULT_MAX_MESSAGE_LENGTH port_attr.MemoryBandwidth = 0 port_attr.MaxPoolUsage = 0xffffffff - - winproxy.NtAlpcAcceptConnectPort(rhandle, self.handle, 0, None, port_attr, None, msg.port_message, None, True) - return rhandle.value, msg + port_attr.MaxSectionSize = 0xffffffff + port_attr.MaxViewSize = 0xffffffff + port_attr.MaxTotalSectionSize = 0xffffffff + port_attr.DupObjectTypes = 0xffffffff + # windows.utils.print_ctypes_struct(port_attr, " - CONN_PORT_ATTR", hexa=True) + winproxy.NtAlpcAcceptConnectPort(rhandle, self.handle, 0, None, port_attr, port_context, msg.port_message, None, True) + return rhandle.value, msg \ No newline at end of file diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index cc6c0b4..adbdcd6 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -972,6 +972,9 @@ ALPC_MESSAGE_SECURITY_ATTRIBUTE = make_flag("ALPC_MESSAGE_SECURITY_ATTRIBUTE", 0 ALPC_MESSAGE_VIEW_ATTRIBUTE = make_flag("ALPC_MESSAGE_VIEW_ATTRIBUTE", 0x40000000) ALPC_MESSAGE_CONTEXT_ATTRIBUTE = make_flag("ALPC_MESSAGE_CONTEXT_ATTRIBUTE", 0x20000000) ALPC_MESSAGE_HANDLE_ATTRIBUTE = make_flag("ALPC_MESSAGE_HANDLE_ATTRIBUTE", 0x10000000) +ALPC_MESSAGE_TOKEN_ATTRIBUTE = make_flag("ALPC_MESSAGE_TOKEN_ATTRIBUTE", 0x8000000) +ALPC_MESSAGE_DIRECT_ATTRIBUTE = make_flag("ALPC_MESSAGE_DIRECT_ATTRIBUTE", 0x4000000) +ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE = make_flag("ALPC_MESSAGE_WORK_ON_BEHALF_ATTRIBUTE", 0x2000000) ALPC_MSGFLG_REPLY_MESSAGE = make_flag("ALPC_MSGFLG_REPLY_MESSAGE", 0x1) ALPC_MSGFLG_LPC_MODE = make_flag("ALPC_MSGFLG_LPC_MODE", 0x2) ALPC_MSGFLG_RELEASE_MESSAGE = make_flag("ALPC_MSGFLG_RELEASE_MESSAGE", 0x10000) @@ -2053,4 +2056,17 @@ ERROR_KEY_DELETED = make_flag("ERROR_KEY_DELETED", 1018L) ERROR_NO_LOG_SPACE = make_flag("ERROR_NO_LOG_SPACE", 1019L) ERROR_KEY_HAS_CHILDREN = make_flag("ERROR_KEY_HAS_CHILDREN", 1020L) ERROR_CHILD_MUST_BE_VOLATILE = make_flag("ERROR_CHILD_MUST_BE_VOLATILE", 1021L) -ERROR_NOTIFY_ENUM_DIR = make_flag("ERROR_NOTIFY_ENUM_DIR", 1022L) \ No newline at end of file +ERROR_NOTIFY_ENUM_DIR = make_flag("ERROR_NOTIFY_ENUM_DIR", 1022L) +RPC_X_BAD_STUB_DATA = make_flag("RPC_X_BAD_STUB_DATA", 1783) +RPC_S_UNKNOWN_IF = make_flag("RPC_S_UNKNOWN_IF", 1717) +RPC_S_PROTOCOL_ERROR = make_flag("RPC_S_PROTOCOL_ERROR", 1728) +RPC_S_UNSUPPORTED_TRANS_SYN = make_flag("RPC_S_UNSUPPORTED_TRANS_SYN", 1730) +RPC_S_PROCNUM_OUT_OF_RANGE = make_flag("RPC_S_PROCNUM_OUT_OF_RANGE", 1745) +RPC_REQUEST_TYPE_CALL = make_flag("RPC_REQUEST_TYPE_CALL", 0) +RPC_REQUEST_TYPE_BIND = make_flag("RPC_REQUEST_TYPE_BIND", 1) +RPC_RESPONSE_TYPE_BIND_OK = make_flag("RPC_RESPONSE_TYPE_BIND_OK", 1) +RPC_RESPONSE_TYPE_FAIL = make_flag("RPC_RESPONSE_TYPE_FAIL", 2) +RPC_RESPONSE_TYPE_SUCESS = make_flag("RPC_RESPONSE_TYPE_SUCESS", 3) +BIND_IF_SYNTAX_NDR32 = make_flag("BIND_IF_SYNTAX_NDR32", 1) +BIND_IF_SYNTAX_NDR64 = make_flag("BIND_IF_SYNTAX_NDR64", 2) +BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4) \ No newline at end of file diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 920c678..78eddba 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -4119,3 +4119,40 @@ class _ALPC_DATA_VIEW_ATTR64(Structure): ] PALPC_DATA_VIEW_ATTR64 = POINTER(_ALPC_DATA_VIEW_ATTR64) ALPC_DATA_VIEW_ATTR64 = _ALPC_DATA_VIEW_ATTR64 + +class _ALPC_TOKEN_ATTR(Structure): + _fields_ = [ + ("TokenId", ULONGLONG), + ("AuthenticationId", ULONGLONG), + ("ModifiedId", ULONGLONG), + ] +ALPC_TOKEN_ATTR = _ALPC_TOKEN_ATTR +PALPC_TOKEN_ATTR = POINTER(_ALPC_TOKEN_ATTR) + +class _ALPC_DIRECT_ATTR(Structure): + _fields_ = [ + ("Event", HANDLE), + ] +ALPC_DIRECT_ATTR = _ALPC_DIRECT_ATTR +PALPC_DIRECT_ATTR = POINTER(_ALPC_DIRECT_ATTR) + +class _ALPC_DIRECT_ATTR32(Structure): + _fields_ = [ + ("Event", ULONG), + ] +PALPC_DIRECT_ATTR32 = POINTER(_ALPC_DIRECT_ATTR32) +ALPC_DIRECT_ATTR32 = _ALPC_DIRECT_ATTR32 + +class _ALPC_DIRECT_ATTR64(Structure): + _fields_ = [ + ("Event", ULONGLONG), + ] +ALPC_DIRECT_ATTR64 = _ALPC_DIRECT_ATTR64 +PALPC_DIRECT_ATTR64 = POINTER(_ALPC_DIRECT_ATTR64) + +class _ALPC_WORK_ON_BEHALF_ATTR(Structure): + _fields_ = [ + ("Ticket", ULONGLONG), + ] +PALPC_WORK_ON_BEHALF_ATTR = POINTER(_ALPC_WORK_ON_BEHALF_ATTR) +ALPC_WORK_ON_BEHALF_ATTR = _ALPC_WORK_ON_BEHALF_ATTR diff --git a/windows/winproxy.py b/windows/winproxy.py index ed8a78e..8d22e07 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -888,6 +888,27 @@ def NtOpenSymbolicLinkObject(LinkHandle, DesiredAccess, ObjectAttributes): def RtlDecompressBuffer(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize): return RtlDecompressBuffer.ctypes_function(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize) +# Section stuff + +@NtdllProxy("NtCreateSection", error_ntstatus) +def NtCreateSection(SectionHandle, DesiredAccess, ObjectAttributes, MaximumSize, SectionPageProtection, AllocationAttributes, FileHandle): + return NtCreateSection.ctypes_function(SectionHandle, DesiredAccess, ObjectAttributes, MaximumSize, SectionPageProtection, AllocationAttributes, FileHandle) + + +@NtdllProxy("NtOpenSection", error_ntstatus) +def NtOpenSection(SectionHandle, DesiredAccess, ObjectAttributes): + return NtOpenSection.ctypes_function(SectionHandle, DesiredAccess, ObjectAttributes) + + +@NtdllProxy("NtMapViewOfSection", error_ntstatus) +def NtMapViewOfSection(SectionHandle, ProcessHandle, BaseAddress, ZeroBits, CommitSize, SectionOffset, ViewSize, InheritDisposition, AllocationType, Win32Protect): + return NtMapViewOfSection.ctypes_function(SectionHandle, ProcessHandle, BaseAddress, ZeroBits, CommitSize, SectionOffset, ViewSize, InheritDisposition, AllocationType, Win32Protect) + + +@NtdllProxy("NtUnmapViewOfSection", error_ntstatus) +def NtUnmapViewOfSection(ProcessHandle, BaseAddress): + return NtUnmapViewOfSection.ctypes_function(ProcessHandle, BaseAddress) + # ##### ADVAPI32 ####### #