diff --git a/__init__.py b/__init__.py index 05ed690..c468570 100644 --- a/__init__.py +++ b/__init__.py @@ -22,4 +22,7 @@ current_thread = CurrentThread() # Late import: other imports should go here # Do not move it: risk of circular import +import windows.vectored_exception +import windows.wmi + __all__ = ["system", "VirtualProtected", 'current_process', 'current_thread', 'winproxy'] diff --git a/generated_def/windef.py b/generated_def/windef.py index 6649369..5f0fb57 100644 --- a/generated_def/windef.py +++ b/generated_def/windef.py @@ -488,4 +488,6 @@ DEBUG_EVENT_SYSTEM_ERROR = Flag("DEBUG_EVENT_SYSTEM_ERROR", 0x00000100) DEBUG_EVENT_SESSION_STATUS = Flag("DEBUG_EVENT_SESSION_STATUS", 0x00000200) DEBUG_EVENT_CHANGE_DEBUGGEE_STATE = Flag("DEBUG_EVENT_CHANGE_DEBUGGEE_STATE", 0x00000400) DEBUG_EVENT_CHANGE_ENGINE_STATE = Flag("DEBUG_EVENT_CHANGE_ENGINE_STATE", 0x00000800) -DEBUG_EVENT_CHANGE_SYMBOL_STATE = Flag("DEBUG_EVENT_CHANGE_SYMBOL_STATE", 0x00001000) \ No newline at end of file +DEBUG_EVENT_CHANGE_SYMBOL_STATE = Flag("DEBUG_EVENT_CHANGE_SYMBOL_STATE", 0x00001000) +WOW64_MAXIMUM_SUPPORTED_EXTENSION = Flag("WOW64_MAXIMUM_SUPPORTED_EXTENSION", 512) +WOW64_SIZE_OF_80387_REGISTERS = Flag("WOW64_SIZE_OF_80387_REGISTERS", 80) \ No newline at end of file diff --git a/generated_def/winfuncs.py b/generated_def/winfuncs.py index d67753e..9f21695 100644 --- a/generated_def/winfuncs.py +++ b/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'SetConsoleCtrlHandler'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -45,6 +45,10 @@ NtQueryVirtualMemoryParams = ((1, 'ProcessHandle'), (1, 'BaseAddress'), (1, 'Mem NtCreateThreadExPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, LPVOID, HANDLE, LPTHREAD_START_ROUTINE, LPVOID, BOOL, DWORD, DWORD, DWORD, LPVOID) NtCreateThreadExParams = ((1, 'ThreadHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes'), (1, 'ProcessHandle'), (1, 'lpStartAddress'), (1, 'lpParameter'), (1, 'CreateSuspended'), (1, 'dwStackSize'), (1, 'Unknown1'), (1, 'Unknown2'), (1, 'Unknown3')) +# NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength): +NtQueryInformationThreadPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, THREAD_INFORMATION_CLASS, PVOID, ULONG, PULONG) +NtQueryInformationThreadParams = ((1, 'ThreadHandle'), (1, 'ThreadInformationClass'), (1, 'ThreadInformation'), (1, 'ThreadInformationLength'), (1, 'ReturnLength')) + # VirtualAlloc(lpAddress, dwSize, flAllocationType, flProtect): VirtualAllocPrototype = WINFUNCTYPE(LPVOID, LPVOID, SIZE_T, DWORD, DWORD) VirtualAllocParams = ((1, 'lpAddress'), (1, 'dwSize'), (1, 'flAllocationType'), (1, 'flProtect')) @@ -105,6 +109,10 @@ CreateProcessWParams = ((1, 'lpApplicationName'), (1, 'lpCommandLine'), (1, 'lpP GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCONTEXT) GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext')) +# NtGetContextThread(hThread, lpContext): +NtGetContextThreadPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCONTEXT) +NtGetContextThreadParams = ((1, 'hThread'), (1, 'lpContext')) + # SetThreadContext(hThread, lpContext): SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCONTEXT) SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext')) @@ -373,6 +381,10 @@ Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),) Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN) Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),) +# Wow64GetThreadContext(hThread, lpContext): +Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT) +Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext')) + # SetConsoleCtrlHandler(HandlerRoutine, Add): SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL) SetConsoleCtrlHandlerParams = ((1, 'HandlerRoutine'), (1, 'Add')) diff --git a/generated_def/winstructs.py b/generated_def/winstructs.py index a099c73..6fecad8 100644 --- a/generated_def/winstructs.py +++ b/generated_def/winstructs.py @@ -36,9 +36,9 @@ HCERTSTORE = PVOID HCRYPTMSG = PVOID VOID = DWORD -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION'] -enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] +enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS'] # Enum _SYSTEM_INFORMATION_CLASS definitions _SYSTEM_INFORMATION_CLASS = DWORD @@ -134,6 +134,30 @@ MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS MemoryBasicInformation = 0x0 +# Enum _THREAD_INFORMATION_CLASS definitions +_THREAD_INFORMATION_CLASS = DWORD +THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS +PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS) + +ThreadBasicInformation = 0x0 +ThreadTimes = 0x1 +ThreadPriority = 0x2 +ThreadBasePriority = 0x3 +ThreadAffinityMask = 0x4 +ThreadImpersonationToken = 0x5 +ThreadDescriptorTableEntry = 0x6 +ThreadEnableAlignmentFaultFixup = 0x7 +ThreadEventPair = 0x8 +ThreadQuerySetWin32StartAddress = 0x9 +ThreadZeroTlsCell = 0xa +ThreadPerformanceCount = 0xb +ThreadAmILastThread = 0xc +ThreadIdealProcessor = 0xd +ThreadPriorityBoost = 0xe +ThreadSetTlsArrayAddress = 0xf +ThreadIsIoPending = 0x10 +ThreadHideFromDebugger = 0x11 + # Enum _TCP_TABLE_CLASS definitions _TCP_TABLE_CLASS = DWORD TCP_TABLE_CLASS = _TCP_TABLE_CLASS @@ -776,6 +800,53 @@ PCONTEXT32 = POINTER(_CONTEXT32) CONTEXT32 = _CONTEXT32 LPCONTEXT32 = POINTER(_CONTEXT32) +# Struct _WOW64_FLOATING_SAVE_AREA definitions +class _WOW64_FLOATING_SAVE_AREA(Structure): + _fields_ = [ + ("ControlWord", DWORD), + ("StatusWord", DWORD), + ("TagWord", DWORD), + ("ErrorOffset", DWORD), + ("ErrorSelector", DWORD), + ("DataOffset", DWORD), + ("DataSelector", DWORD), + ("RegisterArea", BYTE * WOW64_SIZE_OF_80387_REGISTERS), + ("Cr0NpxState", DWORD), + ] +WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA + +# Struct _WOW64_CONTEXT definitions +class _WOW64_CONTEXT(Structure): + _fields_ = [ + ("ContextFlags", DWORD), + ("Dr0", DWORD), + ("Dr1", DWORD), + ("Dr2", DWORD), + ("Dr3", DWORD), + ("Dr6", DWORD), + ("Dr7", DWORD), + ("FloatSave", WOW64_FLOATING_SAVE_AREA), + ("SegGs", DWORD), + ("SegFs", DWORD), + ("SegEs", DWORD), + ("SegDs", DWORD), + ("Edi", DWORD), + ("Esi", DWORD), + ("Ebx", DWORD), + ("Edx", DWORD), + ("Ecx", DWORD), + ("Eax", DWORD), + ("Ebp", DWORD), + ("Eip", DWORD), + ("SegCs", DWORD), + ("EFlags", DWORD), + ("Esp", DWORD), + ("SegSs", DWORD), + ("ExtendedRegisters", BYTE * WOW64_MAXIMUM_SUPPORTED_EXTENSION), + ] +PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT) +WOW64_CONTEXT = _WOW64_CONTEXT + # Struct _M128A definitions class _M128A(Structure): _fields_ = [ @@ -787,6 +858,7 @@ PM128A = POINTER(_M128A) # Struct _CONTEXT64 definitions class _CONTEXT64(Structure): + _pack_ = 8 _fields_ = [ ("P1Home", DWORD64), ("P2Home", DWORD64), diff --git a/simple_com.py b/simple_com.py new file mode 100644 index 0000000..aacc2b9 --- /dev/null +++ b/simple_com.py @@ -0,0 +1,82 @@ +import struct +import ctypes +import functools +from ctypes.wintypes import HRESULT +from windows.generated_def.winstructs import * + +# Simple Abstraction to call COM interface in Python (Python -> COM) +IID_PACK = " Python) + +def create_c_callable(func, types, keepalive=[]): + func_type = ctypes.WINFUNCTYPE(*types) + c_callable = func_type(func) + # Dirty, but the other method require native code execution + c_callback_addr = ctypes.c_ulong.from_address(id(c_callable._objects['0']) + 3 * ctypes.sizeof(ctypes.c_void_p)).value + keepalive.append(c_callable) + return c_callback_addr + + +class ComVtable(object): + # Name, types + _funcs_ = [("QueryInterface", [ctypes.HRESULT, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]), + ("AddRef", [ctypes.HRESULT, ctypes.c_void_p]), + ("Release", [ctypes.HRESULT, ctypes.c_void_p]) + ] + + def __init__(self, **implem_overwrite): + self.implems = [] + self.vtable = self._create_vtable(**implem_overwrite) + self.vtable_pointer = ctypes.pointer(self.vtable) + self._as_parameter_ = ctypes.addressof(self.vtable_pointer) + + def _create_vtable(self, **implem_overwrite): + vtables_names = [x[0] for x in self._funcs_] + non_expected_args = [func_name for func_name in implem_overwrite if func_name not in vtables_names] + if non_expected_args: + raise ValueError("Non expected function : {0}".format(non_expected_args)) + + for name, types in self._funcs_: + func_implem = implem_overwrite.get(name) + if func_implem is None: + if hasattr(self, name): + func_implem = getattr(self, name) + else: + raise ValueError("Missing implementation for function <{0}>".format(name)) + + if isinstance(func_implem, (int, long)): + self.implems.append(func_implem) + else: + self.implems.append(create_c_callable(func_implem, types)) + + class Vtable(ctypes.Structure): + _fields_ = [(name, ctypes.c_void_p) for name in vtables_names] + return Vtable(*self.implems) + + def QueryInterface(self, *args): + return 1 + + def AddRef(self, *args): + return 1 + + def Release(self, *args): + return 0 \ No newline at end of file diff --git a/syswow64.py b/syswow64.py index dbe272a..1ef430c 100644 --- a/syswow64.py +++ b/syswow64.py @@ -1,5 +1,6 @@ import struct import ctypes +from ctypes import byref import codecs import functools @@ -29,7 +30,9 @@ def execute_64bits_code_from_syswow(shellcode): current_process = windows.current_process if not current_process.is_wow_64: raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process") - addr = windows.winproxy.VirtualAlloc(dwSize=0x1000) + # 1 -> ret | 8 -> ljump + size_to_alloc = len(shellcode) + len(genere_return_32bits_stub(0xffffffff)) + 1 + 8 + addr = windows.current_process.allocator.reserve_size(size_to_alloc) # post-exec 32bits stub (xor eax, eax; ret) ret = "\xC3" ret_addr = addr @@ -55,11 +58,13 @@ def generate_syswow64_call(target): argument_buffer_len = (nb_args * 8) argument_buffer = windows.current_process.allocator.reserve_size(argument_buffer_len) + alignement_information = windows.current_process.allocator.reserve_size(8) - nb_args_on_stack = nb_args - 4 + nb_args_on_stack = max(nb_args - 4, 0) code_64b = x64.MultipleInstr() # Save registers + code_64b += x64.Push('RBX') code_64b += x64.Push('RCX') code_64b += x64.Push('RDX') @@ -71,7 +76,12 @@ def generate_syswow64_call(target): code_64b += x64.Push('R11') code_64b += x64.Push('R12') code_64b += x64.Push('R13') + # Alignment stuff :) + code_64b += x64.Mov('RCX', 'RSP') + code_64b += x64.And('RCX', 0x0f) + code_64b += x64.Mov(x64.deref(alignement_information), 'RCX') + code_64b += x64.Sub('RSP', 'RCX') # retrieve argument from the argument buffer if nb_args >= 1: code_64b += x64.Mov('RCX', x64.create_displacement(disp=argument_buffer)) @@ -84,7 +94,6 @@ def generate_syswow64_call(target): for i in range(nb_args_on_stack): code_64b += x64.Mov('RAX', x64.create_displacement(disp=argument_buffer + 8 * (nb_args - 1 - i))) code_64b += x64.Push('RAX') - # reserve space for register (calling convention) code_64b += x64.Push('R9') code_64b += x64.Push('R8') @@ -93,6 +102,8 @@ def generate_syswow64_call(target): # Call code_64b += x64.Mov('R13', target_addr) code_64b += x64.Call('R13') + # Realign stack :) + code_64b += x64.Add('RSP', x64.deref(alignement_information)) # Clean stack code_64b += x64.Add('RSP', (4 + nb_args_on_stack) * 8) code_64b += x64.Pop('R13') @@ -107,14 +118,14 @@ def generate_syswow64_call(target): code_64b += x64.Pop('RCX') code_64b += x64.Pop('RBX') return try_generate_stub_target(code_64b.get_code(), argument_buffer, target) - # TODO: this code should be a winfuct of type prototype :) def try_generate_stub_target(shellcode, argument_buffer, target): """shellcode must NOT end by a ret""" if not windows.current_process.is_wow_64: raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process") - addr = windows.winproxy.VirtualAlloc(dwSize=0x1000) + size_to_alloc = len(shellcode) + len(genere_return_32bits_stub(0xffffffff)) + 1 + 8 + addr = windows.current_process.allocator.reserve_size(size_to_alloc) # post-exec 32bits stub (ret) ret = "\xC3" ret_addr = addr @@ -248,3 +259,10 @@ def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationC if type(MemoryInformation) == MEMORY_BASIC_INFORMATION64: MemoryInformation = byref(MemoryInformation) return NtQueryVirtualMemory_32_to_64.ctypes_function(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength) + + +@Syswow64ApiProxy(windows.winproxy.NtGetContextThread) +def NtGetContextThread_32_to_64(hThread, lpContext): + if type(lpContext) == windows.vectored_exception.EnhancedCONTEXT64: + lpContext = byref(lpContext) + return NtGetContextThread_32_to_64.ctypes_function(hThread, lpContext) \ No newline at end of file diff --git a/test/__init__.py b/test/__init__.py index 52d5673..bea6043 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -1,3 +1,4 @@ -from mytest import WindowsTestCase +from mytest import WindowsTestCase, pop_calc_32, pop_calc_64 + __all__ = ["WindowsTestCase"] diff --git a/winproxy.py b/winproxy.py index c608ae5..610baed 100644 --- a/winproxy.py +++ b/winproxy.py @@ -230,6 +230,7 @@ VirtualQueryEx = TransparentKernel32Proxy("VirtualQueryEx") Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection") Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection") Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection") +Wow64GetThreadContext = OptionalExport(TransparentKernel32Proxy)("Wow64GetThreadContext") @@ -450,6 +451,10 @@ def ntquerysysteminformation_error_check(func_name, result, func, args): return args raise Kernel32Error("{0} failed with NTStatus {1}".format(func_name, hex(result))) +@NtdllProxy("NtGetContextThread", error_ntstatus) +def NtGetContextThread(hThread, lpContext): + return NtGetContextThread.ctypes_function(hThread, lpContext) + @NtdllProxy('NtQuerySystemInformation', ntquerysysteminformation_error_check) def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter): @@ -469,6 +474,15 @@ def NtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInf return NtQueryInformationProcess.ctypes_function(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength) +@NtdllProxy('NtQueryInformationThread', error_ntstatus) +def NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength=0, ReturnLength=None): + if ReturnLength is None: + ReturnLength = byref(ULONG()) + if ThreadInformation is not None and ThreadInformationLength == 0: + ThreadInformationLength = ctypes.sizeof(ThreadInformation) + return NtQueryInformationThread.ctypes_function(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength) + + @OptionalExport(NtdllProxy('NtQueryVirtualMemory', error_ntstatus)) def NtQueryVirtualMemory(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation=NeededParameter, MemoryInformationLength=0, ReturnLength=None): if ReturnLength is None: