mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
add simple_com / fix alignement issu in syswow64 stub
This commit is contained in:
Clement Rouault
@@ -22,4 +22,7 @@ current_thread = CurrentThread()
|
||||
# Late import: other imports should go here
|
||||
# Do not move it: risk of circular import
|
||||
|
||||
import windows.vectored_exception
|
||||
import windows.wmi
|
||||
|
||||
__all__ = ["system", "VirtualProtected", 'current_process', 'current_thread', 'winproxy']
|
||||
|
||||
@@ -488,4 +488,6 @@ DEBUG_EVENT_SYSTEM_ERROR = Flag("DEBUG_EVENT_SYSTEM_ERROR", 0x00000100)
|
||||
DEBUG_EVENT_SESSION_STATUS = Flag("DEBUG_EVENT_SESSION_STATUS", 0x00000200)
|
||||
DEBUG_EVENT_CHANGE_DEBUGGEE_STATE = Flag("DEBUG_EVENT_CHANGE_DEBUGGEE_STATE", 0x00000400)
|
||||
DEBUG_EVENT_CHANGE_ENGINE_STATE = Flag("DEBUG_EVENT_CHANGE_ENGINE_STATE", 0x00000800)
|
||||
DEBUG_EVENT_CHANGE_SYMBOL_STATE = Flag("DEBUG_EVENT_CHANGE_SYMBOL_STATE", 0x00001000)
|
||||
DEBUG_EVENT_CHANGE_SYMBOL_STATE = Flag("DEBUG_EVENT_CHANGE_SYMBOL_STATE", 0x00001000)
|
||||
WOW64_MAXIMUM_SUPPORTED_EXTENSION = Flag("WOW64_MAXIMUM_SUPPORTED_EXTENSION", 512)
|
||||
WOW64_SIZE_OF_80387_REGISTERS = Flag("WOW64_SIZE_OF_80387_REGISTERS", 80)
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'SetConsoleCtrlHandler']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler']
|
||||
|
||||
# ExitProcess(uExitCode):
|
||||
ExitProcessPrototype = WINFUNCTYPE(VOID, UINT)
|
||||
@@ -45,6 +45,10 @@ NtQueryVirtualMemoryParams = ((1, 'ProcessHandle'), (1, 'BaseAddress'), (1, 'Mem
|
||||
NtCreateThreadExPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, LPVOID, HANDLE, LPTHREAD_START_ROUTINE, LPVOID, BOOL, DWORD, DWORD, DWORD, LPVOID)
|
||||
NtCreateThreadExParams = ((1, 'ThreadHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes'), (1, 'ProcessHandle'), (1, 'lpStartAddress'), (1, 'lpParameter'), (1, 'CreateSuspended'), (1, 'dwStackSize'), (1, 'Unknown1'), (1, 'Unknown2'), (1, 'Unknown3'))
|
||||
|
||||
# NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength):
|
||||
NtQueryInformationThreadPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, THREAD_INFORMATION_CLASS, PVOID, ULONG, PULONG)
|
||||
NtQueryInformationThreadParams = ((1, 'ThreadHandle'), (1, 'ThreadInformationClass'), (1, 'ThreadInformation'), (1, 'ThreadInformationLength'), (1, 'ReturnLength'))
|
||||
|
||||
# VirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect):
|
||||
VirtualAllocPrototype = WINFUNCTYPE(LPVOID, LPVOID, SIZE_T, DWORD, DWORD)
|
||||
VirtualAllocParams = ((1, 'lpAddress'), (1, 'dwSize'), (1, 'flAllocationType'), (1, 'flProtect'))
|
||||
@@ -105,6 +109,10 @@ CreateProcessWParams = ((1, 'lpApplicationName'), (1, 'lpCommandLine'), (1, 'lpP
|
||||
GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCONTEXT)
|
||||
GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
|
||||
|
||||
# NtGetContextThread(hThread, lpContext):
|
||||
NtGetContextThreadPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCONTEXT)
|
||||
NtGetContextThreadParams = ((1, 'hThread'), (1, 'lpContext'))
|
||||
|
||||
# SetThreadContext(hThread, lpContext):
|
||||
SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCONTEXT)
|
||||
SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
|
||||
@@ -373,6 +381,10 @@ Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),)
|
||||
Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
|
||||
Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
|
||||
|
||||
# Wow64GetThreadContext(hThread, lpContext):
|
||||
Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
|
||||
Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
|
||||
|
||||
# SetConsoleCtrlHandler(HandlerRoutine, Add):
|
||||
SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL)
|
||||
SetConsoleCtrlHandlerParams = ((1, 'HandlerRoutine'), (1, 'Add'))
|
||||
|
||||
@@ -36,9 +36,9 @@ HCERTSTORE = PVOID
|
||||
HCRYPTMSG = PVOID
|
||||
VOID = DWORD
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS']
|
||||
|
||||
# Enum _SYSTEM_INFORMATION_CLASS definitions
|
||||
_SYSTEM_INFORMATION_CLASS = DWORD
|
||||
@@ -134,6 +134,30 @@ MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
|
||||
|
||||
MemoryBasicInformation = 0x0
|
||||
|
||||
# Enum _THREAD_INFORMATION_CLASS definitions
|
||||
_THREAD_INFORMATION_CLASS = DWORD
|
||||
THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS
|
||||
PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS)
|
||||
|
||||
ThreadBasicInformation = 0x0
|
||||
ThreadTimes = 0x1
|
||||
ThreadPriority = 0x2
|
||||
ThreadBasePriority = 0x3
|
||||
ThreadAffinityMask = 0x4
|
||||
ThreadImpersonationToken = 0x5
|
||||
ThreadDescriptorTableEntry = 0x6
|
||||
ThreadEnableAlignmentFaultFixup = 0x7
|
||||
ThreadEventPair = 0x8
|
||||
ThreadQuerySetWin32StartAddress = 0x9
|
||||
ThreadZeroTlsCell = 0xa
|
||||
ThreadPerformanceCount = 0xb
|
||||
ThreadAmILastThread = 0xc
|
||||
ThreadIdealProcessor = 0xd
|
||||
ThreadPriorityBoost = 0xe
|
||||
ThreadSetTlsArrayAddress = 0xf
|
||||
ThreadIsIoPending = 0x10
|
||||
ThreadHideFromDebugger = 0x11
|
||||
|
||||
# Enum _TCP_TABLE_CLASS definitions
|
||||
_TCP_TABLE_CLASS = DWORD
|
||||
TCP_TABLE_CLASS = _TCP_TABLE_CLASS
|
||||
@@ -776,6 +800,53 @@ PCONTEXT32 = POINTER(_CONTEXT32)
|
||||
CONTEXT32 = _CONTEXT32
|
||||
LPCONTEXT32 = POINTER(_CONTEXT32)
|
||||
|
||||
# Struct _WOW64_FLOATING_SAVE_AREA definitions
|
||||
class _WOW64_FLOATING_SAVE_AREA(Structure):
|
||||
_fields_ = [
|
||||
("ControlWord", DWORD),
|
||||
("StatusWord", DWORD),
|
||||
("TagWord", DWORD),
|
||||
("ErrorOffset", DWORD),
|
||||
("ErrorSelector", DWORD),
|
||||
("DataOffset", DWORD),
|
||||
("DataSelector", DWORD),
|
||||
("RegisterArea", BYTE * WOW64_SIZE_OF_80387_REGISTERS),
|
||||
("Cr0NpxState", DWORD),
|
||||
]
|
||||
WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA
|
||||
|
||||
# Struct _WOW64_CONTEXT definitions
|
||||
class _WOW64_CONTEXT(Structure):
|
||||
_fields_ = [
|
||||
("ContextFlags", DWORD),
|
||||
("Dr0", DWORD),
|
||||
("Dr1", DWORD),
|
||||
("Dr2", DWORD),
|
||||
("Dr3", DWORD),
|
||||
("Dr6", DWORD),
|
||||
("Dr7", DWORD),
|
||||
("FloatSave", WOW64_FLOATING_SAVE_AREA),
|
||||
("SegGs", DWORD),
|
||||
("SegFs", DWORD),
|
||||
("SegEs", DWORD),
|
||||
("SegDs", DWORD),
|
||||
("Edi", DWORD),
|
||||
("Esi", DWORD),
|
||||
("Ebx", DWORD),
|
||||
("Edx", DWORD),
|
||||
("Ecx", DWORD),
|
||||
("Eax", DWORD),
|
||||
("Ebp", DWORD),
|
||||
("Eip", DWORD),
|
||||
("SegCs", DWORD),
|
||||
("EFlags", DWORD),
|
||||
("Esp", DWORD),
|
||||
("SegSs", DWORD),
|
||||
("ExtendedRegisters", BYTE * WOW64_MAXIMUM_SUPPORTED_EXTENSION),
|
||||
]
|
||||
PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT)
|
||||
WOW64_CONTEXT = _WOW64_CONTEXT
|
||||
|
||||
# Struct _M128A definitions
|
||||
class _M128A(Structure):
|
||||
_fields_ = [
|
||||
@@ -787,6 +858,7 @@ PM128A = POINTER(_M128A)
|
||||
|
||||
# Struct _CONTEXT64 definitions
|
||||
class _CONTEXT64(Structure):
|
||||
_pack_ = 8
|
||||
_fields_ = [
|
||||
("P1Home", DWORD64),
|
||||
("P2Home", DWORD64),
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
import struct
|
||||
import ctypes
|
||||
import functools
|
||||
from ctypes.wintypes import HRESULT
|
||||
from windows.generated_def.winstructs import *
|
||||
|
||||
# Simple Abstraction to call COM interface in Python (Python -> COM)
|
||||
IID_PACK = "<I", "<H", "<H", "<B", "<B", "<B", "<B", "<B", "<B", "<B", "<B"
|
||||
|
||||
|
||||
def get_IID_from_raw(raw):
|
||||
return "".join([struct.pack(i, j) for i, j in zip(IID_PACK, raw)])
|
||||
|
||||
|
||||
class COMInterface(ctypes.c_void_p):
|
||||
_functions_ = {
|
||||
"QueryInterface": ctypes.WINFUNCTYPE(HRESULT, ctypes.c_void_p, ctypes.c_void_p)(0, "QueryInterface"),
|
||||
"AddRef": ctypes.WINFUNCTYPE(HRESULT)(1, "AddRef"),
|
||||
"Release": ctypes.WINFUNCTYPE(HRESULT)(2, "Release")
|
||||
}
|
||||
|
||||
def __getattr__(self, name):
|
||||
if name in self._functions_:
|
||||
return functools.partial(self._functions_[name], self)
|
||||
return super(COMInterface, self).__getattribute__(name)
|
||||
|
||||
|
||||
# Simple Implem to create COM Interface in Python (COM -> Python)
|
||||
|
||||
def create_c_callable(func, types, keepalive=[]):
|
||||
func_type = ctypes.WINFUNCTYPE(*types)
|
||||
c_callable = func_type(func)
|
||||
# Dirty, but the other method require native code execution
|
||||
c_callback_addr = ctypes.c_ulong.from_address(id(c_callable._objects['0']) + 3 * ctypes.sizeof(ctypes.c_void_p)).value
|
||||
keepalive.append(c_callable)
|
||||
return c_callback_addr
|
||||
|
||||
|
||||
class ComVtable(object):
|
||||
# Name, types
|
||||
_funcs_ = [("QueryInterface", [ctypes.HRESULT, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]),
|
||||
("AddRef", [ctypes.HRESULT, ctypes.c_void_p]),
|
||||
("Release", [ctypes.HRESULT, ctypes.c_void_p])
|
||||
]
|
||||
|
||||
def __init__(self, **implem_overwrite):
|
||||
self.implems = []
|
||||
self.vtable = self._create_vtable(**implem_overwrite)
|
||||
self.vtable_pointer = ctypes.pointer(self.vtable)
|
||||
self._as_parameter_ = ctypes.addressof(self.vtable_pointer)
|
||||
|
||||
def _create_vtable(self, **implem_overwrite):
|
||||
vtables_names = [x[0] for x in self._funcs_]
|
||||
non_expected_args = [func_name for func_name in implem_overwrite if func_name not in vtables_names]
|
||||
if non_expected_args:
|
||||
raise ValueError("Non expected function : {0}".format(non_expected_args))
|
||||
|
||||
for name, types in self._funcs_:
|
||||
func_implem = implem_overwrite.get(name)
|
||||
if func_implem is None:
|
||||
if hasattr(self, name):
|
||||
func_implem = getattr(self, name)
|
||||
else:
|
||||
raise ValueError("Missing implementation for function <{0}>".format(name))
|
||||
|
||||
if isinstance(func_implem, (int, long)):
|
||||
self.implems.append(func_implem)
|
||||
else:
|
||||
self.implems.append(create_c_callable(func_implem, types))
|
||||
|
||||
class Vtable(ctypes.Structure):
|
||||
_fields_ = [(name, ctypes.c_void_p) for name in vtables_names]
|
||||
return Vtable(*self.implems)
|
||||
|
||||
def QueryInterface(self, *args):
|
||||
return 1
|
||||
|
||||
def AddRef(self, *args):
|
||||
return 1
|
||||
|
||||
def Release(self, *args):
|
||||
return 0
|
||||
+23
-5
@@ -1,5 +1,6 @@
|
||||
import struct
|
||||
import ctypes
|
||||
from ctypes import byref
|
||||
import codecs
|
||||
import functools
|
||||
|
||||
@@ -29,7 +30,9 @@ def execute_64bits_code_from_syswow(shellcode):
|
||||
current_process = windows.current_process
|
||||
if not current_process.is_wow_64:
|
||||
raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process")
|
||||
addr = windows.winproxy.VirtualAlloc(dwSize=0x1000)
|
||||
# 1 -> ret | 8 -> ljump
|
||||
size_to_alloc = len(shellcode) + len(genere_return_32bits_stub(0xffffffff)) + 1 + 8
|
||||
addr = windows.current_process.allocator.reserve_size(size_to_alloc)
|
||||
# post-exec 32bits stub (xor eax, eax; ret)
|
||||
ret = "\xC3"
|
||||
ret_addr = addr
|
||||
@@ -55,11 +58,13 @@ def generate_syswow64_call(target):
|
||||
|
||||
argument_buffer_len = (nb_args * 8)
|
||||
argument_buffer = windows.current_process.allocator.reserve_size(argument_buffer_len)
|
||||
alignement_information = windows.current_process.allocator.reserve_size(8)
|
||||
|
||||
nb_args_on_stack = nb_args - 4
|
||||
nb_args_on_stack = max(nb_args - 4, 0)
|
||||
|
||||
code_64b = x64.MultipleInstr()
|
||||
# Save registers
|
||||
|
||||
code_64b += x64.Push('RBX')
|
||||
code_64b += x64.Push('RCX')
|
||||
code_64b += x64.Push('RDX')
|
||||
@@ -71,7 +76,12 @@ def generate_syswow64_call(target):
|
||||
code_64b += x64.Push('R11')
|
||||
code_64b += x64.Push('R12')
|
||||
code_64b += x64.Push('R13')
|
||||
# Alignment stuff :)
|
||||
|
||||
code_64b += x64.Mov('RCX', 'RSP')
|
||||
code_64b += x64.And('RCX', 0x0f)
|
||||
code_64b += x64.Mov(x64.deref(alignement_information), 'RCX')
|
||||
code_64b += x64.Sub('RSP', 'RCX')
|
||||
# retrieve argument from the argument buffer
|
||||
if nb_args >= 1:
|
||||
code_64b += x64.Mov('RCX', x64.create_displacement(disp=argument_buffer))
|
||||
@@ -84,7 +94,6 @@ def generate_syswow64_call(target):
|
||||
for i in range(nb_args_on_stack):
|
||||
code_64b += x64.Mov('RAX', x64.create_displacement(disp=argument_buffer + 8 * (nb_args - 1 - i)))
|
||||
code_64b += x64.Push('RAX')
|
||||
|
||||
# reserve space for register (calling convention)
|
||||
code_64b += x64.Push('R9')
|
||||
code_64b += x64.Push('R8')
|
||||
@@ -93,6 +102,8 @@ def generate_syswow64_call(target):
|
||||
# Call
|
||||
code_64b += x64.Mov('R13', target_addr)
|
||||
code_64b += x64.Call('R13')
|
||||
# Realign stack :)
|
||||
code_64b += x64.Add('RSP', x64.deref(alignement_information))
|
||||
# Clean stack
|
||||
code_64b += x64.Add('RSP', (4 + nb_args_on_stack) * 8)
|
||||
code_64b += x64.Pop('R13')
|
||||
@@ -107,14 +118,14 @@ def generate_syswow64_call(target):
|
||||
code_64b += x64.Pop('RCX')
|
||||
code_64b += x64.Pop('RBX')
|
||||
return try_generate_stub_target(code_64b.get_code(), argument_buffer, target)
|
||||
# TODO: this code should be a winfuct of type prototype :)
|
||||
|
||||
|
||||
def try_generate_stub_target(shellcode, argument_buffer, target):
|
||||
"""shellcode must NOT end by a ret"""
|
||||
if not windows.current_process.is_wow_64:
|
||||
raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process")
|
||||
addr = windows.winproxy.VirtualAlloc(dwSize=0x1000)
|
||||
size_to_alloc = len(shellcode) + len(genere_return_32bits_stub(0xffffffff)) + 1 + 8
|
||||
addr = windows.current_process.allocator.reserve_size(size_to_alloc)
|
||||
# post-exec 32bits stub (ret)
|
||||
ret = "\xC3"
|
||||
ret_addr = addr
|
||||
@@ -248,3 +259,10 @@ def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationC
|
||||
if type(MemoryInformation) == MEMORY_BASIC_INFORMATION64:
|
||||
MemoryInformation = byref(MemoryInformation)
|
||||
return NtQueryVirtualMemory_32_to_64.ctypes_function(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength)
|
||||
|
||||
|
||||
@Syswow64ApiProxy(windows.winproxy.NtGetContextThread)
|
||||
def NtGetContextThread_32_to_64(hThread, lpContext):
|
||||
if type(lpContext) == windows.vectored_exception.EnhancedCONTEXT64:
|
||||
lpContext = byref(lpContext)
|
||||
return NtGetContextThread_32_to_64.ctypes_function(hThread, lpContext)
|
||||
+2
-1
@@ -1,3 +1,4 @@
|
||||
from mytest import WindowsTestCase
|
||||
from mytest import WindowsTestCase, pop_calc_32, pop_calc_64
|
||||
|
||||
|
||||
__all__ = ["WindowsTestCase"]
|
||||
|
||||
+14
@@ -230,6 +230,7 @@ VirtualQueryEx = TransparentKernel32Proxy("VirtualQueryEx")
|
||||
Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection")
|
||||
Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection")
|
||||
Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection")
|
||||
Wow64GetThreadContext = OptionalExport(TransparentKernel32Proxy)("Wow64GetThreadContext")
|
||||
|
||||
|
||||
|
||||
@@ -450,6 +451,10 @@ def ntquerysysteminformation_error_check(func_name, result, func, args):
|
||||
return args
|
||||
raise Kernel32Error("{0} failed with NTStatus {1}".format(func_name, hex(result)))
|
||||
|
||||
@NtdllProxy("NtGetContextThread", error_ntstatus)
|
||||
def NtGetContextThread(hThread, lpContext):
|
||||
return NtGetContextThread.ctypes_function(hThread, lpContext)
|
||||
|
||||
|
||||
@NtdllProxy('NtQuerySystemInformation', ntquerysysteminformation_error_check)
|
||||
def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter):
|
||||
@@ -469,6 +474,15 @@ def NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInf
|
||||
return NtQueryInformationProcess.ctypes_function(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength)
|
||||
|
||||
|
||||
@NtdllProxy('NtQueryInformationThread', error_ntstatus)
|
||||
def NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength=0, ReturnLength=None):
|
||||
if ReturnLength is None:
|
||||
ReturnLength = byref(ULONG())
|
||||
if ThreadInformation is not None and ThreadInformationLength == 0:
|
||||
ThreadInformationLength = ctypes.sizeof(ThreadInformation)
|
||||
return NtQueryInformationThread.ctypes_function(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength)
|
||||
|
||||
|
||||
@OptionalExport(NtdllProxy('NtQueryVirtualMemory', error_ntstatus))
|
||||
def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None):
|
||||
if ReturnLength is None:
|
||||
|
||||
Reference in New Issue
Block a user