From aaa680c61c3cb3e413e47e53e5ef9d3b5f0f14f3 Mon Sep 17 00:00:00 2001 From: hakril Date: Sun, 22 May 2016 12:00:34 +0200 Subject: [PATCH] Fix CurrentProcessReadSyswow for windows10 --- CHANGELOG | 3 ++- windows/syswow64.py | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 4256074..9ea76b0 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -7,4 +7,5 @@ Since 0.2: * utils.get_short_path / utils.get_long_path * Object returned by `windows.native_exec.create_function` has an attribute `code_addr` with the address of the executable code * add `windows.winproxy.is_implemented` Ex: windows.winproxy.is_implemented(windows.winproxy.QueryWorkingSetEx) - * registry.py handle REG_QWORD manually (_winreg does not) \ No newline at end of file + * registry.py handle REG_QWORD manually (_winreg does not) + * CurrentProcessReadSyswow doest not use ``current_process.handle`` anymore but ``OpenProcess(current_process.pid)`` (Compat windows10 where method 1 doest not work) \ No newline at end of file diff --git a/windows/syswow64.py b/windows/syswow64.py index b28b0cb..a8ae3e9 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -181,9 +181,13 @@ def get_current_process_syswow_peb(): class CurrentProcessReadSyswow(process.Process): bitness = 64 + def _get_handle(self): + print("CurrentProcessReadSyswow get_handler") + return winproxy.OpenProcess(dwProcessId=current_process.pid) + def read_memory(self, addr, size): buffer_addr = ctypes.create_string_buffer(size) - winproxy.NtWow64ReadVirtualMemory64(current_process.handle, addr, buffer_addr, size) + winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) return buffer_addr[:] peb_addr = get_current_process_syswow_peb_addr() return windows.winobject.process.RemotePEB64(peb_addr, CurrentProcessReadSyswow())