mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Add process.query_working_set
This commit is contained in:
Clement Rouault
@@ -26,7 +26,7 @@ TYPE_EQUIVALENCE = [
|
||||
('WNDENUMPROC', 'PVOID'),
|
||||
('PHANDLER_ROUTINE', 'PVOID'),
|
||||
('LPBYTE', 'POINTER(BYTE)'),
|
||||
('ULONG_PTR','PULONG'),
|
||||
('ULONG_PTR','PVOID'),
|
||||
('CHAR', 'c_char'),
|
||||
('INT', 'c_int'),
|
||||
('UCHAR', 'c_char'),
|
||||
|
||||
@@ -922,4 +922,35 @@
|
||||
#define FILE_OPEN_IF 0x00000003
|
||||
#define FILE_OVERWRITE 0x00000004
|
||||
#define FILE_OVERWRITE_IF 0x00000005
|
||||
#define FILE_MAXIMUM_DISPOSITION 0x00000005
|
||||
#define FILE_MAXIMUM_DISPOSITION 0x00000005
|
||||
|
||||
#define TRUST_E_PROVIDER_UNKNOWN (0x800B0001L)
|
||||
#define TRUST_E_ACTION_UNKNOWN (0x800B0002L)
|
||||
#define TRUST_E_SUBJECT_FORM_UNKNOWN (0x800B0003L)
|
||||
#define DIGSIG_E_ENCODE (0x800B0005L)
|
||||
#define TRUST_E_SUBJECT_NOT_TRUSTED (0x800B0004L)
|
||||
#define DIGSIG_E_DECODE (0x800B0006L)
|
||||
#define DIGSIG_E_EXTENSIBILITY (0x800B0007L)
|
||||
#define PERSIST_E_SIZEDEFINITE (0x800B0009L)
|
||||
#define DIGSIG_E_CRYPTO (0x800B0008L)
|
||||
#define PERSIST_E_SIZEINDEFINITE (0x800B000AL)
|
||||
#define PERSIST_E_NOTSELFSIZING (0x800B000BL)
|
||||
#define TRUST_E_NOSIGNATURE (0x800B0100L)
|
||||
#define CERT_E_EXPIRED (0x800B0101L)
|
||||
#define CERT_E_VALIDITYPERIODNESTING (0x800B0102L)
|
||||
#define CERT_E_PURPOSE (0x800B0106L)
|
||||
#define CERT_E_ISSUERCHAINING (0x800B0107L)
|
||||
#define CERT_E_MALFORMED (0x800B0108L)
|
||||
#define CERT_E_UNTRUSTEDROOT (0x800B0109L)
|
||||
#define CERT_E_CHAINING (0x800B010AL)
|
||||
#define TRUST_E_FAIL (0x800B010BL)
|
||||
#define CERT_E_REVOKED (0x800B010CL)
|
||||
#define CERT_E_UNTRUSTEDTESTROOT (0x800B010DL)
|
||||
#define CERT_E_REVOCATION_FAILURE (0x800B010EL)
|
||||
#define CERT_E_CN_NO_MATCH (0x800B010FL)
|
||||
#define CERT_E_WRONG_USAGE (0x800B0110L)
|
||||
#define TRUST_E_EXPLICIT_DISTRUST (0x800B0111L)
|
||||
#define CERT_E_UNTRUSTEDCA (0x800B0112L)
|
||||
#define CERT_E_INVALID_POLICY (0x800B0113L)
|
||||
#define CERT_E_INVALID_NAME (0x800B0114L)
|
||||
#define CRYPT_E_FILE_ERROR (0x80092003L)
|
||||
@@ -143,6 +143,12 @@ SIZE_T WINAPI VirtualQueryEx(
|
||||
_In_ SIZE_T dwLength
|
||||
);
|
||||
|
||||
BOOL WINAPI QueryWorkingSet(
|
||||
_In_ HANDLE hProcess,
|
||||
_Out_ PVOID pv,
|
||||
_In_ DWORD cb
|
||||
);
|
||||
|
||||
|
||||
DWORD WINAPI GetModuleFileNameA(
|
||||
_In_opt_ HMODULE hModule,
|
||||
@@ -801,6 +807,14 @@ NTSTATUS WINAPI NtOpenEvent(
|
||||
);
|
||||
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtAlpcCreatePort(
|
||||
_Out_ PHANDLE PortHandle,
|
||||
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtAlpcConnectPort(
|
||||
_Out_ PHANDLE PortHandle,
|
||||
_In_ PUNICODE_STRING PortName,
|
||||
@@ -812,9 +826,34 @@ NTSTATUS WINAPI NtAlpcConnectPort(
|
||||
_Inout_opt_ PULONG BufferLength,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes,
|
||||
_In_opt_ PLARGE_INTEGER Timeout);
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
|
||||
NTSTATUS WINAPI NtAlpcAcceptConnectPort(
|
||||
_Out_ PHANDLE PortHandle,
|
||||
_In_ HANDLE ConnectionPortHandle,
|
||||
_In_ ULONG Flags,
|
||||
_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes,
|
||||
_In_opt_ PVOID PortContext,
|
||||
_In_ PPORT_MESSAGE ConnectionRequest,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes,
|
||||
_In_ BOOLEAN AcceptConnection
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI AlpcInitializeMessageAttribute(
|
||||
_In_ ULONG AttributeFlags,
|
||||
_Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer,
|
||||
_In_ ULONG BufferSize,
|
||||
_Out_ PULONG RequiredBufferSize
|
||||
);
|
||||
|
||||
PVOID WINAPI AlpcGetMessageAttribute(
|
||||
_In_ PALPC_MESSAGE_ATTRIBUTES Buffer,
|
||||
_In_ ULONG AttributeFlag
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtAlpcSendWaitReceivePort(
|
||||
_In_ HANDLE PortHandle,
|
||||
_In_ ULONG Flags,
|
||||
@@ -824,7 +863,7 @@ NTSTATUS WINAPI NtAlpcSendWaitReceivePort(
|
||||
_Inout_opt_ PSIZE_T BufferLength,
|
||||
_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
);
|
||||
|
||||
|
||||
INT WINAPI lstrcmpA(
|
||||
|
||||
@@ -813,6 +813,44 @@ typedef struct _MEMORY_BASIC_INFORMATION64 {
|
||||
DWORD __alignment2;
|
||||
} MEMORY_BASIC_INFORMATION64, *PMEMORY_BASIC_INFORMATION64;
|
||||
|
||||
|
||||
typedef union _PSAPI_WORKING_SET_BLOCK {
|
||||
PVOID Flags;
|
||||
} PSAPI_WORKING_SET_BLOCK, *PPSAPI_WORKING_SET_BLOCK;
|
||||
|
||||
typedef union _PSAPI_WORKING_SET_BLOCK32 {
|
||||
DWORD Flags;
|
||||
} PSAPI_WORKING_SET_BLOCK32, *PPSAPI_WORKING_SET_BLOCK32;
|
||||
|
||||
typedef union _PSAPI_WORKING_SET_BLOCK64 {
|
||||
ULONG64 Flags;
|
||||
} PSAPI_WORKING_SET_BLOCK64, *PPSAPI_WORKING_SET_BLOCK64;
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_INFORMATION {
|
||||
PVOID NumberOfEntries;
|
||||
PSAPI_WORKING_SET_BLOCK WorkingSetInfo[1];
|
||||
} PSAPI_WORKING_SET_INFORMATION, *PPSAPI_WORKING_SET_INFORMATION;
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_INFORMATION32 {
|
||||
DWORD NumberOfEntries;
|
||||
PSAPI_WORKING_SET_BLOCK32 WorkingSetInfo[1];
|
||||
} PSAPI_WORKING_SET_INFORMATION32, *PPSAPI_WORKING_SET_INFORMATION32;
|
||||
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_INFORMATION64 {
|
||||
ULONG64 NumberOfEntries;
|
||||
PSAPI_WORKING_SET_BLOCK64 WorkingSetInfo[1];
|
||||
} PSAPI_WORKING_SET_INFORMATION64, *PPSAPI_WORKING_SET_INFORMATION64;
|
||||
|
||||
typedef union _PSAPI_WORKING_SET_EX_BLOCK {
|
||||
PVOID Flags;
|
||||
} PSAPI_WORKING_SET_EX_BLOCK, *PPSAPI_WORKING_SET_EX_BLOCK;
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_EX_INFORMATION {
|
||||
PVOID VirtualAddress;
|
||||
PSAPI_WORKING_SET_EX_BLOCK VirtualAttributes;
|
||||
} PSAPI_WORKING_SET_EX_INFORMATION, *PPSAPI_WORKING_SET_EX_INFORMATION;
|
||||
|
||||
typedef struct _STARTUPINFOA {
|
||||
DWORD cb;
|
||||
LPSTR lpReserved;
|
||||
@@ -2208,11 +2246,17 @@ typedef union _PORT_MESSAGE_TMP_UNION_U2
|
||||
} _PORT_MESSAGE_TMP_UNION_U2;
|
||||
|
||||
|
||||
typedef struct _CLIENT_ID{
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID;
|
||||
|
||||
|
||||
typedef struct _PORT_MESSAGE
|
||||
{
|
||||
_PORT_MESSAGE_TMP_UNION_U1 u1;
|
||||
_PORT_MESSAGE_TMP_UNION_U2 u2;
|
||||
double DoNotUseThisField;
|
||||
CLIENT_ID ClientId;
|
||||
ULONG MessageId;
|
||||
_PORT_MESSAGE_TMP_UNION tmp_union;
|
||||
} PORT_MESSAGE, *PPORT_MESSAGE;
|
||||
|
||||
@@ -20,6 +20,7 @@ if bitness() == 32:
|
||||
winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION32
|
||||
|
||||
winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES32
|
||||
winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES32
|
||||
|
||||
else:
|
||||
winstructs.CONTEXT = winstructs.CONTEXT64
|
||||
@@ -33,6 +34,8 @@ else:
|
||||
winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION64
|
||||
|
||||
winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES64
|
||||
winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES64
|
||||
|
||||
|
||||
from . import winfuncs
|
||||
from . import windef
|
||||
|
||||
@@ -2619,4 +2619,34 @@ FILE_CREATE = Flag("FILE_CREATE", 0x00000002)
|
||||
FILE_OPEN_IF = Flag("FILE_OPEN_IF", 0x00000003)
|
||||
FILE_OVERWRITE = Flag("FILE_OVERWRITE", 0x00000004)
|
||||
FILE_OVERWRITE_IF = Flag("FILE_OVERWRITE_IF", 0x00000005)
|
||||
FILE_MAXIMUM_DISPOSITION = Flag("FILE_MAXIMUM_DISPOSITION", 0x00000005)
|
||||
FILE_MAXIMUM_DISPOSITION = Flag("FILE_MAXIMUM_DISPOSITION", 0x00000005)
|
||||
TRUST_E_PROVIDER_UNKNOWN = Flag("TRUST_E_PROVIDER_UNKNOWN", ( 0x800B0001 ))
|
||||
TRUST_E_ACTION_UNKNOWN = Flag("TRUST_E_ACTION_UNKNOWN", ( 0x800B0002 ))
|
||||
TRUST_E_SUBJECT_FORM_UNKNOWN = Flag("TRUST_E_SUBJECT_FORM_UNKNOWN", ( 0x800B0003 ))
|
||||
DIGSIG_E_ENCODE = Flag("DIGSIG_E_ENCODE", ( 0x800B0005 ))
|
||||
TRUST_E_SUBJECT_NOT_TRUSTED = Flag("TRUST_E_SUBJECT_NOT_TRUSTED", ( 0x800B0004 ))
|
||||
DIGSIG_E_DECODE = Flag("DIGSIG_E_DECODE", ( 0x800B0006 ))
|
||||
DIGSIG_E_EXTENSIBILITY = Flag("DIGSIG_E_EXTENSIBILITY", ( 0x800B0007 ))
|
||||
PERSIST_E_SIZEDEFINITE = Flag("PERSIST_E_SIZEDEFINITE", ( 0x800B0009 ))
|
||||
DIGSIG_E_CRYPTO = Flag("DIGSIG_E_CRYPTO", ( 0x800B0008 ))
|
||||
PERSIST_E_SIZEINDEFINITE = Flag("PERSIST_E_SIZEINDEFINITE", ( 0x800B000A ))
|
||||
PERSIST_E_NOTSELFSIZING = Flag("PERSIST_E_NOTSELFSIZING", ( 0x800B000B ))
|
||||
TRUST_E_NOSIGNATURE = Flag("TRUST_E_NOSIGNATURE", ( 0x800B0100 ))
|
||||
CERT_E_EXPIRED = Flag("CERT_E_EXPIRED", ( 0x800B0101 ))
|
||||
CERT_E_VALIDITYPERIODNESTING = Flag("CERT_E_VALIDITYPERIODNESTING", ( 0x800B0102 ))
|
||||
CERT_E_PURPOSE = Flag("CERT_E_PURPOSE", ( 0x800B0106 ))
|
||||
CERT_E_ISSUERCHAINING = Flag("CERT_E_ISSUERCHAINING", ( 0x800B0107 ))
|
||||
CERT_E_MALFORMED = Flag("CERT_E_MALFORMED", ( 0x800B0108 ))
|
||||
CERT_E_UNTRUSTEDROOT = Flag("CERT_E_UNTRUSTEDROOT", ( 0x800B0109 ))
|
||||
CERT_E_CHAINING = Flag("CERT_E_CHAINING", ( 0x800B010A ))
|
||||
TRUST_E_FAIL = Flag("TRUST_E_FAIL", ( 0x800B010B ))
|
||||
CERT_E_REVOKED = Flag("CERT_E_REVOKED", ( 0x800B010C ))
|
||||
CERT_E_UNTRUSTEDTESTROOT = Flag("CERT_E_UNTRUSTEDTESTROOT", ( 0x800B010D ))
|
||||
CERT_E_REVOCATION_FAILURE = Flag("CERT_E_REVOCATION_FAILURE", ( 0x800B010E ))
|
||||
CERT_E_CN_NO_MATCH = Flag("CERT_E_CN_NO_MATCH", ( 0x800B010F ))
|
||||
CERT_E_WRONG_USAGE = Flag("CERT_E_WRONG_USAGE", ( 0x800B0110 ))
|
||||
TRUST_E_EXPLICIT_DISTRUST = Flag("TRUST_E_EXPLICIT_DISTRUST", ( 0x800B0111 ))
|
||||
CERT_E_UNTRUSTEDCA = Flag("CERT_E_UNTRUSTEDCA", ( 0x800B0112 ))
|
||||
CERT_E_INVALID_POLICY = Flag("CERT_E_INVALID_POLICY", ( 0x800B0113 ))
|
||||
CERT_E_INVALID_NAME = Flag("CERT_E_INVALID_NAME", ( 0x800B0114 ))
|
||||
CRYPT_E_FILE_ERROR = Flag("CRYPT_E_FILE_ERROR", ( 0x80092003 ))
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcConnectPort', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject']
|
||||
|
||||
#def ExitProcess(uExitCode):
|
||||
# return ExitProcess.ctypes_function(uExitCode)
|
||||
@@ -110,6 +110,11 @@ VirtualQueryParams = ((1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength'))
|
||||
VirtualQueryExPrototype = WINFUNCTYPE(SIZE_T, HANDLE, LPCVOID, PMEMORY_BASIC_INFORMATION, SIZE_T)
|
||||
VirtualQueryExParams = ((1, 'hProcess'), (1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength'))
|
||||
|
||||
#def QueryWorkingSet(hProcess, pv, cb):
|
||||
# return QueryWorkingSet.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSetPrototype = WINFUNCTYPE(BOOL, HANDLE, PVOID, DWORD)
|
||||
QueryWorkingSetParams = ((1, 'hProcess'), (1, 'pv'), (1, 'cb'))
|
||||
|
||||
#def GetModuleFileNameA(hModule, lpFilename, nSize):
|
||||
# return GetModuleFileNameA.ctypes_function(hModule, lpFilename, nSize)
|
||||
GetModuleFileNameAPrototype = WINFUNCTYPE(DWORD, HMODULE, LPSTR, DWORD)
|
||||
@@ -695,11 +700,31 @@ OpenEventWParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lpName')
|
||||
NtOpenEventPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES)
|
||||
NtOpenEventParams = ((1, 'EventHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes'))
|
||||
|
||||
#def NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes):
|
||||
# return NtAlpcCreatePort.ctypes_function(PortHandle, ObjectAttributes, PortAttributes)
|
||||
NtAlpcCreatePortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES)
|
||||
NtAlpcCreatePortParams = ((1, 'PortHandle'), (1, 'ObjectAttributes'), (1, 'PortAttributes'))
|
||||
|
||||
#def NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout):
|
||||
# return NtAlpcConnectPort.ctypes_function(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout)
|
||||
NtAlpcConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, PUNICODE_STRING, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, ULONG, PSID, PPORT_MESSAGE, PULONG, PALPC_MESSAGE_ATTRIBUTES, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER)
|
||||
NtAlpcConnectPortParams = ((1, 'PortHandle'), (1, 'PortName'), (1, 'ObjectAttributes'), (1, 'PortAttributes'), (1, 'Flags'), (1, 'RequiredServerSid'), (1, 'ConnectionMessage'), (1, 'BufferLength'), (1, 'OutMessageAttributes'), (1, 'InMessageAttributes'), (1, 'Timeout'))
|
||||
|
||||
#def NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection):
|
||||
# return NtAlpcAcceptConnectPort.ctypes_function(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection)
|
||||
NtAlpcAcceptConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, HANDLE, ULONG, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, PVOID, PPORT_MESSAGE, PALPC_MESSAGE_ATTRIBUTES, BOOLEAN)
|
||||
NtAlpcAcceptConnectPortParams = ((1, 'PortHandle'), (1, 'ConnectionPortHandle'), (1, 'Flags'), (1, 'ObjectAttributes'), (1, 'PortAttributes'), (1, 'PortContext'), (1, 'ConnectionRequest'), (1, 'ConnectionMessageAttributes'), (1, 'AcceptConnection'))
|
||||
|
||||
#def AlpcInitializeMessageAttribute(AttributeFlags, Buffer, BufferSize, RequiredBufferSize):
|
||||
# return AlpcInitializeMessageAttribute.ctypes_function(AttributeFlags, Buffer, BufferSize, RequiredBufferSize)
|
||||
AlpcInitializeMessageAttributePrototype = WINFUNCTYPE(NTSTATUS, ULONG, PALPC_MESSAGE_ATTRIBUTES, ULONG, PULONG)
|
||||
AlpcInitializeMessageAttributeParams = ((1, 'AttributeFlags'), (1, 'Buffer'), (1, 'BufferSize'), (1, 'RequiredBufferSize'))
|
||||
|
||||
#def AlpcGetMessageAttribute(Buffer, AttributeFlag):
|
||||
# return AlpcGetMessageAttribute.ctypes_function(Buffer, AttributeFlag)
|
||||
AlpcGetMessageAttributePrototype = WINFUNCTYPE(PVOID, PALPC_MESSAGE_ATTRIBUTES, ULONG)
|
||||
AlpcGetMessageAttributeParams = ((1, 'Buffer'), (1, 'AttributeFlag'))
|
||||
|
||||
#def NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout):
|
||||
# return NtAlpcSendWaitReceivePort.ctypes_function(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout)
|
||||
NtAlpcSendWaitReceivePortPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG, PPORT_MESSAGE, PALPC_MESSAGE_ATTRIBUTES, PPORT_MESSAGE, PSIZE_T, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER)
|
||||
|
||||
@@ -44,7 +44,7 @@ LPTHREAD_START_ROUTINE = PVOID
|
||||
WNDENUMPROC = PVOID
|
||||
PHANDLER_ROUTINE = PVOID
|
||||
LPBYTE = POINTER(BYTE)
|
||||
ULONG_PTR = PULONG
|
||||
ULONG_PTR = PVOID
|
||||
CHAR = c_char
|
||||
INT = c_int
|
||||
UCHAR = c_char
|
||||
@@ -93,7 +93,7 @@ PALPC_PORT_ATTRIBUTES = PVOID
|
||||
VOID = DWORD
|
||||
ITypeInfo = PVOID
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_PSAPI_WORKING_SET_BLOCK', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_BLOCK64', '_PSAPI_WORKING_SET_INFORMATION', '_PSAPI_WORKING_SET_INFORMATION32', '_PSAPI_WORKING_SET_INFORMATION64', '_PSAPI_WORKING_SET_EX_BLOCK', '_PSAPI_WORKING_SET_EX_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_CLIENT_ID', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', 'NET_FW_RULE_DIRECTION_', 'NET_FW_PROFILE_TYPE2_', '_MIB_TCP_STATE', 'NET_FW_IP_PROTOCOL_', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_OBJECT_INFORMATION_CLASS', '_SID_NAME_USE', 'NET_FW_PROFILE_TYPE2_', 'NET_FW_ACTION_', 'NET_FW_MODIFY_STATE_', 'NET_FW_RULE_DIRECTION_', 'tag_WBEMSTATUS', 'tagCLSCTX', '_INTERNAL_IF_OPER_STATUS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS', 'tagCOINIT', 'tagTYPEKIND']
|
||||
|
||||
@@ -1166,6 +1166,74 @@ class _MEMORY_BASIC_INFORMATION64(Structure):
|
||||
PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64)
|
||||
MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_BLOCK definitions
|
||||
class _PSAPI_WORKING_SET_BLOCK(Union):
|
||||
_fields_ = [
|
||||
("Flags", PVOID),
|
||||
]
|
||||
PSAPI_WORKING_SET_BLOCK = _PSAPI_WORKING_SET_BLOCK
|
||||
PPSAPI_WORKING_SET_BLOCK = POINTER(_PSAPI_WORKING_SET_BLOCK)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_BLOCK32 definitions
|
||||
class _PSAPI_WORKING_SET_BLOCK32(Union):
|
||||
_fields_ = [
|
||||
("Flags", DWORD),
|
||||
]
|
||||
PSAPI_WORKING_SET_BLOCK32 = _PSAPI_WORKING_SET_BLOCK32
|
||||
PPSAPI_WORKING_SET_BLOCK32 = POINTER(_PSAPI_WORKING_SET_BLOCK32)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_BLOCK64 definitions
|
||||
class _PSAPI_WORKING_SET_BLOCK64(Union):
|
||||
_fields_ = [
|
||||
("Flags", ULONG64),
|
||||
]
|
||||
PSAPI_WORKING_SET_BLOCK64 = _PSAPI_WORKING_SET_BLOCK64
|
||||
PPSAPI_WORKING_SET_BLOCK64 = POINTER(_PSAPI_WORKING_SET_BLOCK64)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_INFORMATION definitions
|
||||
class _PSAPI_WORKING_SET_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("NumberOfEntries", PVOID),
|
||||
("WorkingSetInfo", PSAPI_WORKING_SET_BLOCK * 1),
|
||||
]
|
||||
PPSAPI_WORKING_SET_INFORMATION = POINTER(_PSAPI_WORKING_SET_INFORMATION)
|
||||
PSAPI_WORKING_SET_INFORMATION = _PSAPI_WORKING_SET_INFORMATION
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_INFORMATION32 definitions
|
||||
class _PSAPI_WORKING_SET_INFORMATION32(Structure):
|
||||
_fields_ = [
|
||||
("NumberOfEntries", DWORD),
|
||||
("WorkingSetInfo", PSAPI_WORKING_SET_BLOCK32 * 1),
|
||||
]
|
||||
PPSAPI_WORKING_SET_INFORMATION32 = POINTER(_PSAPI_WORKING_SET_INFORMATION32)
|
||||
PSAPI_WORKING_SET_INFORMATION32 = _PSAPI_WORKING_SET_INFORMATION32
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_INFORMATION64 definitions
|
||||
class _PSAPI_WORKING_SET_INFORMATION64(Structure):
|
||||
_fields_ = [
|
||||
("NumberOfEntries", ULONG64),
|
||||
("WorkingSetInfo", PSAPI_WORKING_SET_BLOCK64 * 1),
|
||||
]
|
||||
PSAPI_WORKING_SET_INFORMATION64 = _PSAPI_WORKING_SET_INFORMATION64
|
||||
PPSAPI_WORKING_SET_INFORMATION64 = POINTER(_PSAPI_WORKING_SET_INFORMATION64)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_BLOCK definitions
|
||||
class _PSAPI_WORKING_SET_EX_BLOCK(Union):
|
||||
_fields_ = [
|
||||
("Flags", PVOID),
|
||||
]
|
||||
PSAPI_WORKING_SET_EX_BLOCK = _PSAPI_WORKING_SET_EX_BLOCK
|
||||
PPSAPI_WORKING_SET_EX_BLOCK = POINTER(_PSAPI_WORKING_SET_EX_BLOCK)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_INFORMATION definitions
|
||||
class _PSAPI_WORKING_SET_EX_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("VirtualAddress", PVOID),
|
||||
("VirtualAttributes", PSAPI_WORKING_SET_EX_BLOCK),
|
||||
]
|
||||
PPSAPI_WORKING_SET_EX_INFORMATION = POINTER(_PSAPI_WORKING_SET_EX_INFORMATION)
|
||||
PSAPI_WORKING_SET_EX_INFORMATION = _PSAPI_WORKING_SET_EX_INFORMATION
|
||||
|
||||
# Struct _STARTUPINFOA definitions
|
||||
class _STARTUPINFOA(Structure):
|
||||
_fields_ = [
|
||||
@@ -2914,12 +2982,20 @@ class _PORT_MESSAGE_TMP_UNION_U2(Union):
|
||||
]
|
||||
_PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2
|
||||
|
||||
# Struct _CLIENT_ID definitions
|
||||
class _CLIENT_ID(Structure):
|
||||
_fields_ = [
|
||||
("UniqueProcess", HANDLE),
|
||||
("UniqueThread", HANDLE),
|
||||
]
|
||||
CLIENT_ID = _CLIENT_ID
|
||||
|
||||
# Struct _PORT_MESSAGE definitions
|
||||
class _PORT_MESSAGE(Structure):
|
||||
_fields_ = [
|
||||
("u1", _PORT_MESSAGE_TMP_UNION_U1),
|
||||
("u2", _PORT_MESSAGE_TMP_UNION_U2),
|
||||
("DoNotUseThisField", double),
|
||||
("ClientId", CLIENT_ID),
|
||||
("MessageId", ULONG),
|
||||
("tmp_union", _PORT_MESSAGE_TMP_UNION),
|
||||
]
|
||||
|
||||
+6
-3
@@ -149,9 +149,12 @@ def try_generate_stub_target(shellcode, argument_buffer, target):
|
||||
raise ValueError("{0} syswow accept {1} args ({2} given)".format(target.__name__, expected_arguments_number, len(args)))
|
||||
# Transform args (ctypes byref possibly) to int
|
||||
writable_args = []
|
||||
for value in args:
|
||||
for i, value in enumerate(args):
|
||||
if not isinstance(value, (int, long)):
|
||||
value = ctypes.cast(value, ctypes.c_void_p).value
|
||||
try:
|
||||
value = ctypes.cast(value, ctypes.c_void_p).value
|
||||
except ctypes.ArgumentError as e:
|
||||
raise ctypes.ArgumentError("Argument {0}: wrong type <{1}>".format(i, type(value).__name__))
|
||||
writable_args.append(value)
|
||||
|
||||
# Build buffer
|
||||
@@ -278,7 +281,7 @@ def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationC
|
||||
ReturnLength = byref(ULONG())
|
||||
if MemoryInformation is not None and MemoryInformationLength == 0:
|
||||
MemoryInformationLength = ctypes.sizeof(MemoryInformation)
|
||||
if type(MemoryInformation) == MEMORY_BASIC_INFORMATION64:
|
||||
if isinstance(MemoryInformation, ctypes.Structure):
|
||||
MemoryInformation = byref(MemoryInformation)
|
||||
return NtQueryVirtualMemory_32_to_64.ctypes_function(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength)
|
||||
|
||||
|
||||
@@ -94,6 +94,10 @@ class SystemTestCase(unittest.TestCase):
|
||||
def test_wmi(self):
|
||||
return windows.system.wmi.select("Win32_Process", "*")
|
||||
|
||||
def test_processes(self):
|
||||
procs = windows.system.processes
|
||||
self.assertIn(windows.current_process.pid, [p.pid for p in procs])
|
||||
|
||||
|
||||
class WindowsTestCase(unittest.TestCase):
|
||||
def setUp(self):
|
||||
@@ -130,6 +134,16 @@ class WindowsTestCase(unittest.TestCase):
|
||||
k32_base = windows.winproxy.LoadLibraryA("kernel32.dll")
|
||||
self.assertEqual(windows.winproxy.GetProcAddress(k32_base, "GetCurrentProcessId"), get_current_proc_id)
|
||||
|
||||
def test_local_process_pe_sections(self):
|
||||
mods = [m for m in windows.current_process.peb.modules if m.name == "kernel32.dll"]
|
||||
self.assertTrue(mods, 'Could not find "kernel32.dll" in current process modules')
|
||||
k32 = mods[0]
|
||||
sections = k32.pe.sections
|
||||
all_sections_name = [s.name for s in sections]
|
||||
self.assertIn(".text", all_sections_name)
|
||||
sections[0].start
|
||||
sections[0].size
|
||||
|
||||
# Native execution
|
||||
def test_execute_to_32(self):
|
||||
with Calc32() as calc:
|
||||
@@ -415,6 +429,46 @@ class WindowsTestCase(unittest.TestCase):
|
||||
self.assertIsInstance(token.integrity, (int, long))
|
||||
self.assertIsInstance(token.is_elevated, (bool))
|
||||
|
||||
def test_get_working_set_32(self):
|
||||
with Calc32() as calc:
|
||||
k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0]
|
||||
api_addr = k32.pe.exports["CreateFileA"]
|
||||
data = calc.read_memory(api_addr, 5)
|
||||
page_target = api_addr >> 12
|
||||
for page_info in calc.query_working_set():
|
||||
if page_info.virtualpage == page_target:
|
||||
self.assertEqual(page_info.shared, True)
|
||||
break
|
||||
else:
|
||||
raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target))
|
||||
data = calc.write_memory(api_addr, data)
|
||||
for page_info in calc.query_working_set():
|
||||
if page_info.virtualpage == page_target:
|
||||
self.assertEqual(page_info.shared, False)
|
||||
break
|
||||
else:
|
||||
raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target))
|
||||
|
||||
@windows_64bit_only
|
||||
def test_get_working_set_64(self):
|
||||
with Calc32() as calc:
|
||||
k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0]
|
||||
api_addr = k32.pe.exports["CreateFileA"]
|
||||
data = calc.read_memory(api_addr, 5)
|
||||
page_target = api_addr >> 12
|
||||
for page_info in calc.query_working_set():
|
||||
if page_info.virtualpage == page_target:
|
||||
self.assertEqual(page_info.shared, True)
|
||||
break
|
||||
else:
|
||||
raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target))
|
||||
data = calc.write_memory(api_addr, data)
|
||||
for page_info in calc.query_working_set():
|
||||
if page_info.virtualpage == page_target:
|
||||
self.assertEqual(page_info.shared, False)
|
||||
break
|
||||
else:
|
||||
raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target))
|
||||
|
||||
class WindowsAPITestCase(unittest.TestCase):
|
||||
def test_createfileA_fail(self):
|
||||
|
||||
@@ -325,6 +325,46 @@ class Process(AutoHandle):
|
||||
return
|
||||
addr += x.RegionSize
|
||||
|
||||
def query_working_set(self):
|
||||
if self.bitness == 64 or windows.current_process.bitness == 64:
|
||||
WSET_BLOCK = EPSAPI_WORKING_SET_BLOCK64
|
||||
dummy = PSAPI_WORKING_SET_INFORMATION64()
|
||||
else:
|
||||
WSET_BLOCK = EPSAPI_WORKING_SET_BLOCK32
|
||||
dummy = PSAPI_WORKING_SET_INFORMATION32()
|
||||
try:
|
||||
windows.winproxy.QueryWorkingSet(self.handle, ctypes.byref(dummy), ctypes.sizeof(dummy))
|
||||
except WindowsError as e:
|
||||
if e.winerror != 24:
|
||||
raise
|
||||
|
||||
for i in range(10):
|
||||
# use the same type as WSET_BLOCK.Flags
|
||||
NumberOfEntriesType = [f for f in WSET_BLOCK._fields_ if f[0] == "Flags"][0][1]
|
||||
class GENERATED_PSAPI_WORKING_SET_INFORMATION(ctypes.Structure):
|
||||
_fields_ = [
|
||||
("NumberOfEntries", NumberOfEntriesType),
|
||||
("WorkingSetInfo", WSET_BLOCK * dummy.NumberOfEntries),
|
||||
]
|
||||
res = GENERATED_PSAPI_WORKING_SET_INFORMATION()
|
||||
try:
|
||||
if windows.current_process.bitness == 32 and self.bitness == 64:
|
||||
windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, 1, res)
|
||||
else:
|
||||
windows.winproxy.QueryWorkingSet(self.handle, ctypes.byref(res), ctypes.sizeof(res))
|
||||
except WindowsError as e:
|
||||
if e.winerror != 24:
|
||||
raise
|
||||
dummy.NumberOfEntries = res.NumberOfEntries
|
||||
continue
|
||||
except windows.generated_def.ntstatus.NtStatusException as e:
|
||||
if e.code != STATUS_INFO_LENGTH_MISMATCH:
|
||||
raise
|
||||
dummy.NumberOfEntries = res.NumberOfEntries
|
||||
continue
|
||||
return res.WorkingSetInfo
|
||||
return None
|
||||
|
||||
def mapped_filename(self, addr):
|
||||
"""The filename mapped at address ``addr`` or ``None``
|
||||
|
||||
@@ -983,6 +1023,35 @@ class PEB(Structure):
|
||||
return [LoadedModule.from_address(addressof(LDR)) for LDR in res]
|
||||
|
||||
|
||||
|
||||
# Memory stuff
|
||||
|
||||
class EPSAPI_WORKING_SET_BLOCK_BASE(object):
|
||||
@property
|
||||
def protection(self):
|
||||
return self.Flags & 0b11111
|
||||
|
||||
@property
|
||||
def sharecount(self):
|
||||
return (self.Flags >> 5) & 0b111
|
||||
|
||||
@property
|
||||
def shared(self):
|
||||
return (self.Flags >> 8) & 1
|
||||
|
||||
@property
|
||||
def virtualpage(self):
|
||||
return (self.Flags >> 12)
|
||||
|
||||
class EPSAPI_WORKING_SET_BLOCK(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK):
|
||||
pass
|
||||
|
||||
class EPSAPI_WORKING_SET_BLOCK32(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK32):
|
||||
pass
|
||||
|
||||
class EPSAPI_WORKING_SET_BLOCK64(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK64):
|
||||
pass
|
||||
|
||||
import windows.remotectypes as rctypes
|
||||
|
||||
|
||||
|
||||
+27
-9
@@ -276,6 +276,7 @@ GetComputerNameA = TransparentKernel32Proxy("GetComputerNameA")
|
||||
GetComputerNameW = TransparentKernel32Proxy("GetComputerNameW")
|
||||
|
||||
|
||||
|
||||
Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection")
|
||||
Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection")
|
||||
Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection")
|
||||
@@ -419,7 +420,7 @@ def CreateToolhelp32Snapshot(dwFlags, th32ProcessID=0):
|
||||
return CreateToolhelp32Snapshot.ctypes_function(dwFlags, th32ProcessID)
|
||||
|
||||
|
||||
@Kernel32Proxy("Thread32First", no_error_check)
|
||||
@Kernel32Proxy("Thread32First")
|
||||
def Thread32First(hSnapshot, lpte):
|
||||
"""Set byref(lpte) if needed"""
|
||||
if type(lpte) == THREADENTRY32:
|
||||
@@ -435,19 +436,13 @@ def Thread32Next(hSnapshot, lpte):
|
||||
return Thread32Next.ctypes_function(hSnapshot, lpte)
|
||||
|
||||
|
||||
@Kernel32Proxy("Process32First", no_error_check)
|
||||
@Kernel32Proxy("Process32First")
|
||||
def Process32First(hSnapshot, lpte):
|
||||
"""Set byref(lpte) if needed"""
|
||||
if type(lpte) == THREADENTRY32:
|
||||
lpte = ctypes.byref(lpte)
|
||||
return Process32First.ctypes_function(hSnapshot, lpte)
|
||||
|
||||
|
||||
@Kernel32Proxy("Process32Next", no_error_check)
|
||||
def Process32Next(hSnapshot, lpte):
|
||||
"""Set byref(lpte) if needed"""
|
||||
if type(lpte) == THREADENTRY32:
|
||||
lpte = ctypes.byref(lpte)
|
||||
return Process32Next.ctypes_function(hSnapshot, lpte)
|
||||
|
||||
@Kernel32Proxy("OpenEventA")
|
||||
@@ -539,10 +534,14 @@ def GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None):
|
||||
return GetMappedFileNameA.ctypes_function(hProcess, lpv, lpFilename, nSize)
|
||||
GetMappedFileNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetMappedFileNameAWrapper)
|
||||
|
||||
def QueryWorkingSetWrapper(hProcess, pv, cb):
|
||||
return QueryWorkingSet.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSet = OptionalExport(Kernel32Proxy("QueryWorkingSet"))(QueryWorkingSetWrapper)
|
||||
|
||||
if GetMappedFileNameA is None:
|
||||
GetMappedFileNameW = PsapiProxy("GetMappedFileNameW")(GetMappedFileNameWWrapper)
|
||||
GetMappedFileNameA = PsapiProxy("GetMappedFileNameA")(GetMappedFileNameAWrapper)
|
||||
|
||||
QueryWorkingSet = PsapiProxy("QueryWorkingSet")(QueryWorkingSetWrapper)
|
||||
|
||||
def GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None):
|
||||
if nSize is None:
|
||||
@@ -704,16 +703,35 @@ def NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes):
|
||||
return NtOpenEvent.ctypes_function(EventHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
|
||||
@NtdllProxy("NtAlpcCreatePort", error_ntstatus)
|
||||
def NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes):
|
||||
return NtAlpcCreatePort.ctypes_function(PortHandle, ObjectAttributes, PortAttributes)
|
||||
|
||||
|
||||
@NtdllProxy("NtAlpcConnectPort", error_ntstatus)
|
||||
def NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout):
|
||||
return NtAlpcConnectPort.ctypes_function(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout)
|
||||
|
||||
|
||||
@NtdllProxy("NtAlpcAcceptConnectPort", error_ntstatus)
|
||||
def NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection):
|
||||
return NtAlpcAcceptConnectPort.ctypes_function(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection)
|
||||
|
||||
@NtdllProxy("NtAlpcSendWaitReceivePort", error_ntstatus)
|
||||
def NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout):
|
||||
return NtAlpcSendWaitReceivePort.ctypes_function(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout)
|
||||
|
||||
|
||||
@NtdllProxy("AlpcInitializeMessageAttribute", error_ntstatus)
|
||||
def AlpcInitializeMessageAttribute(AttributeFlags, Buffer, BufferSize, RequiredBufferSize):
|
||||
return AlpcInitializeMessageAttribute.ctypes_function(AttributeFlags, Buffer, BufferSize, RequiredBufferSize)
|
||||
|
||||
|
||||
@NtdllProxy("AlpcGetMessageAttribute", no_error_check)
|
||||
def AlpcGetMessageAttribute(Buffer, AttributeFlag):
|
||||
return AlpcGetMessageAttribute.ctypes_function(Buffer, AttributeFlag)
|
||||
|
||||
|
||||
@NtdllProxy("NtOpenDirectoryObject", error_ntstatus)
|
||||
def NtOpenDirectoryObject(DirectoryHandle, DesiredAccess, ObjectAttributes):
|
||||
return NtOpenDirectoryObject.ctypes_function(DirectoryHandle, DesiredAccess, ObjectAttributes)
|
||||
|
||||
Reference in New Issue
Block a user