replace PORT_MESSAGE struct def with PORT_MESSAGE[32|64] + FunctionBP can get the function via a class parameter

ctypes_generation/definitions/winstruct.txt

@@ -753,7 +753,17 @@ typedef enum _SE_OBJECT_TYPE {
 typedef struct _CLIENT_ID{
    HANDLE UniqueProcess;
    HANDLE UniqueThread;
- } CLIENT_ID;
+} CLIENT_ID;
+
+typedef struct _CLIENT_ID64{
+   ULONG64 UniqueProcess;
+   ULONG64 UniqueThread;
+} CLIENT_ID64;
+
+typedef struct _CLIENT_ID32{
+   ULONG UniqueProcess;
+   ULONG UniqueThread;
+} CLIENT_ID32;
 
 typedef struct _LDR_DATA_TABLE_ENTRY {
     PVOID Reserved1[2];
@@ -2392,9 +2402,15 @@ typedef struct _ALPC_MESSAGE_ATTRIBUTES
 } ALPC_MESSAGE_ATTRIBUTES, *PALPC_MESSAGE_ATTRIBUTES;
 
 
-typedef union _PORT_MESSAGE_TMP_UNION
+typedef union _PORT_MESSAGE32_TMP_UNION
 {
-        SIZE_T ClientViewSize;
+        ULONG ClientViewSize;
+        ULONG CallbackId;
+} PORT_MESSAGE_TMP_UNION;
+
+typedef union _PORT_MESSAGE64_TMP_UNION
+{
+        ULONGLONG ClientViewSize;
         ULONG CallbackId;
 } PORT_MESSAGE_TMP_UNION;
 
@@ -2427,14 +2443,23 @@ typedef union _PORT_MESSAGE_TMP_UNION_U2
 } _PORT_MESSAGE_TMP_UNION_U2;
 
 
-typedef struct _PORT_MESSAGE
+typedef struct _PORT_MESSAGE32
 {
     _PORT_MESSAGE_TMP_UNION_U1 u1;
     _PORT_MESSAGE_TMP_UNION_U2 u2;
-    CLIENT_ID ClientId;
+    CLIENT_ID32 ClientId;
     ULONG MessageId;
-    _PORT_MESSAGE_TMP_UNION tmp_union;
-} PORT_MESSAGE, *PPORT_MESSAGE;
+    _PORT_MESSAGE32_TMP_UNION tmp_union;
+} PORT_MESSAGE32, *PPORT_MESSAGE32;
+
+typedef struct _PORT_MESSAGE64
+{
+    _PORT_MESSAGE_TMP_UNION_U1 u1;
+    _PORT_MESSAGE_TMP_UNION_U2 u2;
+    CLIENT_ID64 ClientId;
+    ULONG MessageId;
+    _PORT_MESSAGE64_TMP_UNION tmp_union;
+} PORT_MESSAGE64, *PPORT_MESSAGE64;
 
 
 typedef struct _SERVICE_STATUS {

ctypes_generation/generate.py

@@ -305,6 +305,9 @@ class StructGenerator(CtypesGenerator):
                 except:
                     self.add_imports(nb_rep)
 
+        # We have PPORT_MESSAGE32 and PPORT_MESSAGE64 and PPORT_MESSAGE is choosed at runtime
+        self.add_exports("PPORT_MESSAGE")
+
 
     def generate(self):
         type_equivalences = "\n".join(["{0} = {1}".format(*x) for x in TYPE_EQUIVALENCE])

windows/alpc.py

@@ -125,7 +125,8 @@ def send_receive_data(port_handle, data):
     size = gn.SIZE_T(0x1000)
     receive = AlpcMessage(size.value)
     receive_attr = MessageAttribute(0)
-
+    # Its strange that this line does not always have the same effect has the one bellow
+    # winproxy.NtAlpcSendWaitReceivePort(port_handle, ALPC_MSGFLG_SYNC_REQUEST, sendmsg, sendmsg_attr, receive, ctypes.byref(size), receive_attr, None)
     winproxy.NtAlpcSendWaitReceivePort(port_handle, ALPC_MSGFLG_SYNC_REQUEST, sendmsg, sendmsg_attr, receive, size, receive_attr, None)
     return receive_attr, receive
 

windows/debug/breakpoints.py

@@ -74,7 +74,12 @@ class X64ArgumentRetriever(object):
 
 ## Behaviour breakpoint !
 class FunctionParamDumpBP(Breakpoint):
-    def __init__(self, target, addr=None):
+    def __init__(self, target=None, addr=None):
+        if target is None:
+            try:
+                target = self.TARGET
+            except AttributeError as e:
+                raise ValueError("{0} bp without a <target> must have a <TARGET> class attribute")
         if addr is None:
             addr = "{0}!{1}".format(target.target_dll, target.target_func)
         super(FunctionParamDumpBP, self).__init__(addr)

windows/generated_def/__init__.py

@@ -22,6 +22,9 @@ if bitness() == 32:
     winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES32
     winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES32
 
+    winstructs.PORT_MESSAGE = winstructs.PORT_MESSAGE32
+    winstructs.PPORT_MESSAGE = winstructs.PPORT_MESSAGE32
+
 else:
     winstructs.CONTEXT = winstructs.CONTEXT64
     winstructs.PCONTEXT = winstructs.PCONTEXT64
@@ -36,6 +39,9 @@ else:
     winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES64
     winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES64
 
+    winstructs.PORT_MESSAGE64 = winstructs.PORT_MESSAGE64
+    winstructs.PPORT_MESSAGE64 = winstructs.PPORT_MESSAGE64
+
 
 from . import winfuncs
 from . import windef

windows/generated_def/winstructs.py

@@ -1108,6 +1108,20 @@ class _CLIENT_ID(Structure):
     ]
 CLIENT_ID = _CLIENT_ID
 
+class _CLIENT_ID64(Structure):
+    _fields_ = [
+        ("UniqueProcess", ULONG64),
+        ("UniqueThread", ULONG64),
+    ]
+CLIENT_ID64 = _CLIENT_ID64
+
+class _CLIENT_ID32(Structure):
+    _fields_ = [
+        ("UniqueProcess", ULONG),
+        ("UniqueThread", ULONG),
+    ]
+CLIENT_ID32 = _CLIENT_ID32
+
 class _LDR_DATA_TABLE_ENTRY(Structure):
     _fields_ = [
         ("Reserved1", PVOID * 2),
@@ -3049,12 +3063,19 @@ class _ALPC_MESSAGE_ATTRIBUTES(Structure):
 ALPC_MESSAGE_ATTRIBUTES = _ALPC_MESSAGE_ATTRIBUTES
 PALPC_MESSAGE_ATTRIBUTES = POINTER(_ALPC_MESSAGE_ATTRIBUTES)
 
-class _PORT_MESSAGE_TMP_UNION(Union):
+class _PORT_MESSAGE32_TMP_UNION(Union):
     _fields_ = [
-        ("ClientViewSize", SIZE_T),
+        ("ClientViewSize", ULONG),
         ("CallbackId", ULONG),
     ]
-PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE_TMP_UNION
+PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE32_TMP_UNION
+
+class _PORT_MESSAGE64_TMP_UNION(Union):
+    _fields_ = [
+        ("ClientViewSize", ULONGLONG),
+        ("CallbackId", ULONG),
+    ]
+PORT_MESSAGE_TMP_UNION = _PORT_MESSAGE64_TMP_UNION
 
 class _PORT_MESSAGE_TMP_SUBSTRUCT_S1(Structure):
     _fields_ = [
@@ -3084,16 +3105,27 @@ class _PORT_MESSAGE_TMP_UNION_U2(Union):
     ]
 _PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2
 
-class _PORT_MESSAGE(Structure):
+class _PORT_MESSAGE32(Structure):
     _fields_ = [
         ("u1", _PORT_MESSAGE_TMP_UNION_U1),
         ("u2", _PORT_MESSAGE_TMP_UNION_U2),
-        ("ClientId", CLIENT_ID),
+        ("ClientId", CLIENT_ID32),
         ("MessageId", ULONG),
-        ("tmp_union", _PORT_MESSAGE_TMP_UNION),
+        ("tmp_union", _PORT_MESSAGE32_TMP_UNION),
     ]
-PPORT_MESSAGE = POINTER(_PORT_MESSAGE)
-PORT_MESSAGE = _PORT_MESSAGE
+PORT_MESSAGE32 = _PORT_MESSAGE32
+PPORT_MESSAGE32 = POINTER(_PORT_MESSAGE32)
+
+class _PORT_MESSAGE64(Structure):
+    _fields_ = [
+        ("u1", _PORT_MESSAGE_TMP_UNION_U1),
+        ("u2", _PORT_MESSAGE_TMP_UNION_U2),
+        ("ClientId", CLIENT_ID64),
+        ("MessageId", ULONG),
+        ("tmp_union", _PORT_MESSAGE64_TMP_UNION),
+    ]
+PPORT_MESSAGE64 = POINTER(_PORT_MESSAGE64)
+PORT_MESSAGE64 = _PORT_MESSAGE64
 
 class _SERVICE_STATUS(Structure):
     _fields_ = [

windows/winobject/process.py

@@ -11,6 +11,7 @@ from collections import namedtuple
 import windows
 import windows.native_exec.simple_x86 as x86
 import windows.native_exec.simple_x64 as x64
+import windows.remotectypes as rctypes
 
 from windows import injection
 from windows import native_exec
@@ -1395,9 +1396,6 @@ class EPSAPI_WORKING_SET_EX_INFORMATION64(ctypes.Structure):
     _fields_ = windows.utils.transform_ctypes_fields(PSAPI_WORKING_SET_EX_INFORMATION64, {"VirtualAttributes": EPSAPI_WORKING_SET_EX_BLOCK64})
 
 
-import windows.remotectypes as rctypes
-
-
 class RemoteLoadedModule(rctypes.RemoteStructure.from_structure(LoadedModule)):
     @property
     def pe(self):