From b0fa8642712a83a42e166da189403ae1f88b686c Mon Sep 17 00:00:00 2001
From: hakril <project@hakril.net>
Date: Mon, 5 Aug 2019 22:27:07 +0200
Subject: [PATCH] Added some API to winproxy

---
 windows/winproxy/apis/__init__.py |  3 ++-
 windows/winproxy/apis/crypt32.py  |  8 ++++++++
 windows/winproxy/apis/kernel32.py | 25 +++++++++++++++++++++++++
 windows/winproxy/apis/ntdll.py    |  6 ++++++
 windows/winproxy/apis/virtdisk.py | 18 ++++++++++++++++++
 windows/winproxy/apis/wevtapi.py  |  6 ++++++
 6 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 windows/winproxy/apis/virtdisk.py

diff --git a/windows/winproxy/apis/__init__.py b/windows/winproxy/apis/__init__.py
index 4591e92..1e4c876 100644
--- a/windows/winproxy/apis/__init__.py
+++ b/windows/winproxy/apis/__init__.py
@@ -16,4 +16,5 @@ from version import *
 from wevtapi import *
 from wintrust import *
 from tdh import *
-from dnsapi import *
\ No newline at end of file
+from dnsapi import *
+from virtdisk import *
\ No newline at end of file
diff --git a/windows/winproxy/apis/crypt32.py b/windows/winproxy/apis/crypt32.py
index 858058e..b061a67 100644
--- a/windows/winproxy/apis/crypt32.py
+++ b/windows/winproxy/apis/crypt32.py
@@ -201,3 +201,11 @@ def CryptMsgVerifyCountersignatureEncodedEx(hCryptProv, dwEncodingType, pbSigner
 @Crypt32Proxy()
 def CryptMsgClose(hCryptMsg):
     return CryptMsgClose.ctypes_function(hCryptMsg)
+
+@Crypt32Proxy()
+def CryptEnumOIDFunction(dwEncodingType, pszFuncName, pszOID, dwFlags, pvArg, pfnEnumOIDFunc):
+    return CryptEnumOIDFunction.ctypes_function(dwEncodingType, pszFuncName, pszOID, dwFlags, pvArg, pfnEnumOIDFunc)
+
+@Crypt32Proxy()
+def CryptGetOIDFunctionValue(dwEncodingType, pszFuncName, pszOID, pwszValueName, pdwValueType, pbValueData, pcbValueData):
+    return CryptGetOIDFunctionValue.ctypes_function(dwEncodingType, pszFuncName, pszOID, pwszValueName, pdwValueType, pbValueData, pcbValueData)
diff --git a/windows/winproxy/apis/kernel32.py b/windows/winproxy/apis/kernel32.py
index 17c9c94..c1016eb 100644
--- a/windows/winproxy/apis/kernel32.py
+++ b/windows/winproxy/apis/kernel32.py
@@ -504,6 +504,31 @@ def MapViewOfFile(hFileMappingObject, dwDesiredAccess=gdef.FILE_MAP_ALL_ACCESS,
     return MapViewOfFile.ctypes_function(hFileMappingObject, dwDesiredAccess, dwFileOffsetHigh, dwFileOffsetLow, dwNumberOfBytesToMap)
 
 
+@Kernel32Proxy()
+def FindFirstFileA(lpFileName, lpFindFileData):
+    return FindFirstFileA.ctypes_function(lpFileName, lpFindFileData)
+
+
+@Kernel32Proxy()
+def FindFirstFileW(lpFileName, lpFindFileData):
+    return FindFirstFileW.ctypes_function(lpFileName, lpFindFileData)
+
+
+@Kernel32Proxy()
+def FindNextFileA(hFindFile, lpFindFileData):
+    return FindNextFileA.ctypes_function(hFindFile, lpFindFileData)
+
+
+@Kernel32Proxy()
+def FindNextFileW(hFindFile, lpFindFileData):
+    return FindNextFileW.ctypes_function(hFindFile, lpFindFileData)
+
+
+@Kernel32Proxy()
+def FindClose(hFindFile):
+    return FindClose.ctypes_function(hFindFile)
+
+
 ## Tlhelp (snapshoot)
 
 @Kernel32Proxy()
diff --git a/windows/winproxy/apis/ntdll.py b/windows/winproxy/apis/ntdll.py
index f9094ea..32c316b 100644
--- a/windows/winproxy/apis/ntdll.py
+++ b/windows/winproxy/apis/ntdll.py
@@ -362,6 +362,12 @@ def NtQueryValueKey(KeyHandle, ValueName, KeyValueInformationClass, KeyValueInfo
 def NtEnumerateValueKey(KeyHandle, Index, KeyValueInformationClass, KeyValueInformation, Length, ResultLength):
     return NtEnumerateValueKey.ctypes_function(KeyHandle, Index, KeyValueInformationClass, KeyValueInformation, Length, ResultLength)
 
+@NtdllProxy()
+def NtDeleteValueKey(KeyHandle, ValueName):
+    if isinstance(ValueName, basestring):
+        ValueName = gdef.UNICODE_STRING.from_string(ValueName)
+    return NtDeleteValueKey.ctypes_function(KeyHandle, ValueName)
+
 @NtdllProxy()
 def NtQueryLicenseValue(Name, Type, Buffer, Length=None, DataLength=NeededParameter):
     if Length is None and Buffer:
diff --git a/windows/winproxy/apis/virtdisk.py b/windows/winproxy/apis/virtdisk.py
new file mode 100644
index 0000000..7352ff0
--- /dev/null
+++ b/windows/winproxy/apis/virtdisk.py
@@ -0,0 +1,18 @@
+import ctypes
+import windows.generated_def as gdef
+
+from ..apiproxy import ApiProxy, NeededParameter
+from ..error import no_error_check, result_is_error_code
+
+class VirtDiskProxy(ApiProxy):
+    APIDLL = "virtdisk"
+    default_error_check = staticmethod(result_is_error_code)
+
+
+@VirtDiskProxy()
+def OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle):
+    return OpenVirtualDisk.ctypes_function(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
+
+@VirtDiskProxy()
+def AttachVirtualDisk(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped):
+    return AttachVirtualDisk.ctypes_function(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped)
diff --git a/windows/winproxy/apis/wevtapi.py b/windows/winproxy/apis/wevtapi.py
index 319e3f0..bdaf720 100644
--- a/windows/winproxy/apis/wevtapi.py
+++ b/windows/winproxy/apis/wevtapi.py
@@ -9,6 +9,12 @@ class WevtapiProxy(ApiProxy):
     default_error_check = staticmethod(fail_on_zero)
 
 
+# Session
+
+@WevtapiProxy()
+def EvtOpenSession(LoginClass, Login, Timeout=0, Flags=0):
+    return EvtOpenSession.ctypes_function(LoginClass, Login, Timeout, Flags)
+
 # Event
 
 @WevtapiProxy()