diff --git a/ctypes_generation/generate.py b/ctypes_generation/generate.py index 6c0822a..262400d 100644 --- a/ctypes_generation/generate.py +++ b/ctypes_generation/generate.py @@ -26,7 +26,7 @@ TYPE_EQUIVALENCE = [ ('WNDENUMPROC', 'PVOID'), ('PHANDLER_ROUTINE', 'PVOID'), ('LPBYTE', 'POINTER(BYTE)'), - ('ULONG_PTR','PULONG'), + ('ULONG_PTR','PVOID'), ('CHAR', 'c_char'), ('INT', 'c_int'), ('UCHAR', 'c_char'), diff --git a/ctypes_generation/windef.txt b/ctypes_generation/windef.txt index 84097e5..7c09958 100644 --- a/ctypes_generation/windef.txt +++ b/ctypes_generation/windef.txt @@ -922,4 +922,35 @@ #define FILE_OPEN_IF 0x00000003 #define FILE_OVERWRITE 0x00000004 #define FILE_OVERWRITE_IF 0x00000005 -#define FILE_MAXIMUM_DISPOSITION 0x00000005 \ No newline at end of file +#define FILE_MAXIMUM_DISPOSITION 0x00000005 + +#define TRUST_E_PROVIDER_UNKNOWN (0x800B0001L) +#define TRUST_E_ACTION_UNKNOWN (0x800B0002L) +#define TRUST_E_SUBJECT_FORM_UNKNOWN (0x800B0003L) +#define DIGSIG_E_ENCODE (0x800B0005L) +#define TRUST_E_SUBJECT_NOT_TRUSTED (0x800B0004L) +#define DIGSIG_E_DECODE (0x800B0006L) +#define DIGSIG_E_EXTENSIBILITY (0x800B0007L) +#define PERSIST_E_SIZEDEFINITE (0x800B0009L) +#define DIGSIG_E_CRYPTO (0x800B0008L) +#define PERSIST_E_SIZEINDEFINITE (0x800B000AL) +#define PERSIST_E_NOTSELFSIZING (0x800B000BL) +#define TRUST_E_NOSIGNATURE (0x800B0100L) +#define CERT_E_EXPIRED (0x800B0101L) +#define CERT_E_VALIDITYPERIODNESTING (0x800B0102L) +#define CERT_E_PURPOSE (0x800B0106L) +#define CERT_E_ISSUERCHAINING (0x800B0107L) +#define CERT_E_MALFORMED (0x800B0108L) +#define CERT_E_UNTRUSTEDROOT (0x800B0109L) +#define CERT_E_CHAINING (0x800B010AL) +#define TRUST_E_FAIL (0x800B010BL) +#define CERT_E_REVOKED (0x800B010CL) +#define CERT_E_UNTRUSTEDTESTROOT (0x800B010DL) +#define CERT_E_REVOCATION_FAILURE (0x800B010EL) +#define CERT_E_CN_NO_MATCH (0x800B010FL) +#define CERT_E_WRONG_USAGE (0x800B0110L) +#define TRUST_E_EXPLICIT_DISTRUST (0x800B0111L) +#define CERT_E_UNTRUSTEDCA (0x800B0112L) +#define CERT_E_INVALID_POLICY (0x800B0113L) +#define CERT_E_INVALID_NAME (0x800B0114L) +#define CRYPT_E_FILE_ERROR (0x80092003L) \ No newline at end of file diff --git a/ctypes_generation/winfunc.txt b/ctypes_generation/winfunc.txt index 43e038b..56bbe6f 100644 --- a/ctypes_generation/winfunc.txt +++ b/ctypes_generation/winfunc.txt @@ -143,6 +143,12 @@ SIZE_T WINAPI VirtualQueryEx( _In_ SIZE_T dwLength ); +BOOL WINAPI QueryWorkingSet( + _In_ HANDLE hProcess, + _Out_ PVOID pv, + _In_ DWORD cb +); + DWORD WINAPI GetModuleFileNameA( _In_opt_ HMODULE hModule, @@ -801,6 +807,14 @@ NTSTATUS WINAPI NtOpenEvent( ); + +NTSTATUS WINAPI NtAlpcCreatePort( + _Out_ PHANDLE PortHandle, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes +); + + NTSTATUS WINAPI NtAlpcConnectPort( _Out_ PHANDLE PortHandle, _In_ PUNICODE_STRING PortName, @@ -812,9 +826,34 @@ NTSTATUS WINAPI NtAlpcConnectPort( _Inout_opt_ PULONG BufferLength, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES OutMessageAttributes, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES InMessageAttributes, - _In_opt_ PLARGE_INTEGER Timeout); + _In_opt_ PLARGE_INTEGER Timeout +); +NTSTATUS WINAPI NtAlpcAcceptConnectPort( + _Out_ PHANDLE PortHandle, + _In_ HANDLE ConnectionPortHandle, + _In_ ULONG Flags, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes, + _In_opt_ PVOID PortContext, + _In_ PPORT_MESSAGE ConnectionRequest, + _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ConnectionMessageAttributes, + _In_ BOOLEAN AcceptConnection +); + +NTSTATUS WINAPI AlpcInitializeMessageAttribute( + _In_ ULONG AttributeFlags, + _Out_opt_ PALPC_MESSAGE_ATTRIBUTES Buffer, + _In_ ULONG BufferSize, + _Out_ PULONG RequiredBufferSize +); + +PVOID WINAPI AlpcGetMessageAttribute( + _In_ PALPC_MESSAGE_ATTRIBUTES Buffer, + _In_ ULONG AttributeFlag +); + NTSTATUS WINAPI NtAlpcSendWaitReceivePort( _In_ HANDLE PortHandle, _In_ ULONG Flags, @@ -824,7 +863,7 @@ NTSTATUS WINAPI NtAlpcSendWaitReceivePort( _Inout_opt_ PSIZE_T BufferLength, _Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes, _In_opt_ PLARGE_INTEGER Timeout - ); +); INT WINAPI lstrcmpA( diff --git a/ctypes_generation/winstruct.txt b/ctypes_generation/winstruct.txt index a13a417..f038083 100644 --- a/ctypes_generation/winstruct.txt +++ b/ctypes_generation/winstruct.txt @@ -813,6 +813,44 @@ typedef struct _MEMORY_BASIC_INFORMATION64 { DWORD __alignment2; } MEMORY_BASIC_INFORMATION64, *PMEMORY_BASIC_INFORMATION64; + +typedef union _PSAPI_WORKING_SET_BLOCK { + PVOID Flags; +} PSAPI_WORKING_SET_BLOCK, *PPSAPI_WORKING_SET_BLOCK; + +typedef union _PSAPI_WORKING_SET_BLOCK32 { + DWORD Flags; +} PSAPI_WORKING_SET_BLOCK32, *PPSAPI_WORKING_SET_BLOCK32; + +typedef union _PSAPI_WORKING_SET_BLOCK64 { + ULONG64 Flags; +} PSAPI_WORKING_SET_BLOCK64, *PPSAPI_WORKING_SET_BLOCK64; + +typedef struct _PSAPI_WORKING_SET_INFORMATION { + PVOID NumberOfEntries; + PSAPI_WORKING_SET_BLOCK WorkingSetInfo[1]; +} PSAPI_WORKING_SET_INFORMATION, *PPSAPI_WORKING_SET_INFORMATION; + +typedef struct _PSAPI_WORKING_SET_INFORMATION32 { + DWORD NumberOfEntries; + PSAPI_WORKING_SET_BLOCK32 WorkingSetInfo[1]; +} PSAPI_WORKING_SET_INFORMATION32, *PPSAPI_WORKING_SET_INFORMATION32; + + +typedef struct _PSAPI_WORKING_SET_INFORMATION64 { + ULONG64 NumberOfEntries; + PSAPI_WORKING_SET_BLOCK64 WorkingSetInfo[1]; +} PSAPI_WORKING_SET_INFORMATION64, *PPSAPI_WORKING_SET_INFORMATION64; + +typedef union _PSAPI_WORKING_SET_EX_BLOCK { + PVOID Flags; +} PSAPI_WORKING_SET_EX_BLOCK, *PPSAPI_WORKING_SET_EX_BLOCK; + +typedef struct _PSAPI_WORKING_SET_EX_INFORMATION { + PVOID VirtualAddress; + PSAPI_WORKING_SET_EX_BLOCK VirtualAttributes; +} PSAPI_WORKING_SET_EX_INFORMATION, *PPSAPI_WORKING_SET_EX_INFORMATION; + typedef struct _STARTUPINFOA { DWORD cb; LPSTR lpReserved; @@ -2208,11 +2246,17 @@ typedef union _PORT_MESSAGE_TMP_UNION_U2 } _PORT_MESSAGE_TMP_UNION_U2; +typedef struct _CLIENT_ID{ + HANDLE UniqueProcess; + HANDLE UniqueThread; + } CLIENT_ID; + + typedef struct _PORT_MESSAGE { _PORT_MESSAGE_TMP_UNION_U1 u1; _PORT_MESSAGE_TMP_UNION_U2 u2; - double DoNotUseThisField; + CLIENT_ID ClientId; ULONG MessageId; _PORT_MESSAGE_TMP_UNION tmp_union; } PORT_MESSAGE, *PPORT_MESSAGE; diff --git a/windows/generated_def/__init__.py b/windows/generated_def/__init__.py index f0f02d2..c8496c7 100644 --- a/windows/generated_def/__init__.py +++ b/windows/generated_def/__init__.py @@ -20,6 +20,7 @@ if bitness() == 32: winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION32 winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES32 + winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES32 else: winstructs.CONTEXT = winstructs.CONTEXT64 @@ -33,6 +34,8 @@ else: winstructs.SYSTEM_MODULE_INFORMATION = winstructs.SYSTEM_MODULE_INFORMATION64 winstructs.PALPC_PORT_ATTRIBUTES = winstructs.PALPC_PORT_ATTRIBUTES64 + winstructs.ALPC_PORT_ATTRIBUTES = winstructs.ALPC_PORT_ATTRIBUTES64 + from . import winfuncs from . import windef diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index 42b2bc8..f958ca5 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -2619,4 +2619,34 @@ FILE_CREATE = Flag("FILE_CREATE", 0x00000002) FILE_OPEN_IF = Flag("FILE_OPEN_IF", 0x00000003) FILE_OVERWRITE = Flag("FILE_OVERWRITE", 0x00000004) FILE_OVERWRITE_IF = Flag("FILE_OVERWRITE_IF", 0x00000005) -FILE_MAXIMUM_DISPOSITION = Flag("FILE_MAXIMUM_DISPOSITION", 0x00000005) \ No newline at end of file +FILE_MAXIMUM_DISPOSITION = Flag("FILE_MAXIMUM_DISPOSITION", 0x00000005) +TRUST_E_PROVIDER_UNKNOWN = Flag("TRUST_E_PROVIDER_UNKNOWN", ( 0x800B0001 )) +TRUST_E_ACTION_UNKNOWN = Flag("TRUST_E_ACTION_UNKNOWN", ( 0x800B0002 )) +TRUST_E_SUBJECT_FORM_UNKNOWN = Flag("TRUST_E_SUBJECT_FORM_UNKNOWN", ( 0x800B0003 )) +DIGSIG_E_ENCODE = Flag("DIGSIG_E_ENCODE", ( 0x800B0005 )) +TRUST_E_SUBJECT_NOT_TRUSTED = Flag("TRUST_E_SUBJECT_NOT_TRUSTED", ( 0x800B0004 )) +DIGSIG_E_DECODE = Flag("DIGSIG_E_DECODE", ( 0x800B0006 )) +DIGSIG_E_EXTENSIBILITY = Flag("DIGSIG_E_EXTENSIBILITY", ( 0x800B0007 )) +PERSIST_E_SIZEDEFINITE = Flag("PERSIST_E_SIZEDEFINITE", ( 0x800B0009 )) +DIGSIG_E_CRYPTO = Flag("DIGSIG_E_CRYPTO", ( 0x800B0008 )) +PERSIST_E_SIZEINDEFINITE = Flag("PERSIST_E_SIZEINDEFINITE", ( 0x800B000A )) +PERSIST_E_NOTSELFSIZING = Flag("PERSIST_E_NOTSELFSIZING", ( 0x800B000B )) +TRUST_E_NOSIGNATURE = Flag("TRUST_E_NOSIGNATURE", ( 0x800B0100 )) +CERT_E_EXPIRED = Flag("CERT_E_EXPIRED", ( 0x800B0101 )) +CERT_E_VALIDITYPERIODNESTING = Flag("CERT_E_VALIDITYPERIODNESTING", ( 0x800B0102 )) +CERT_E_PURPOSE = Flag("CERT_E_PURPOSE", ( 0x800B0106 )) +CERT_E_ISSUERCHAINING = Flag("CERT_E_ISSUERCHAINING", ( 0x800B0107 )) +CERT_E_MALFORMED = Flag("CERT_E_MALFORMED", ( 0x800B0108 )) +CERT_E_UNTRUSTEDROOT = Flag("CERT_E_UNTRUSTEDROOT", ( 0x800B0109 )) +CERT_E_CHAINING = Flag("CERT_E_CHAINING", ( 0x800B010A )) +TRUST_E_FAIL = Flag("TRUST_E_FAIL", ( 0x800B010B )) +CERT_E_REVOKED = Flag("CERT_E_REVOKED", ( 0x800B010C )) +CERT_E_UNTRUSTEDTESTROOT = Flag("CERT_E_UNTRUSTEDTESTROOT", ( 0x800B010D )) +CERT_E_REVOCATION_FAILURE = Flag("CERT_E_REVOCATION_FAILURE", ( 0x800B010E )) +CERT_E_CN_NO_MATCH = Flag("CERT_E_CN_NO_MATCH", ( 0x800B010F )) +CERT_E_WRONG_USAGE = Flag("CERT_E_WRONG_USAGE", ( 0x800B0110 )) +TRUST_E_EXPLICIT_DISTRUST = Flag("TRUST_E_EXPLICIT_DISTRUST", ( 0x800B0111 )) +CERT_E_UNTRUSTEDCA = Flag("CERT_E_UNTRUSTEDCA", ( 0x800B0112 )) +CERT_E_INVALID_POLICY = Flag("CERT_E_INVALID_POLICY", ( 0x800B0113 )) +CERT_E_INVALID_NAME = Flag("CERT_E_INVALID_NAME", ( 0x800B0114 )) +CRYPT_E_FILE_ERROR = Flag("CRYPT_E_FILE_ERROR", ( 0x80092003 )) \ No newline at end of file diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index 2671291..cc63432 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcConnectPort', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcConnectPort', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject'] #def ExitProcess(uExitCode): # return ExitProcess.ctypes_function(uExitCode) @@ -110,6 +110,11 @@ VirtualQueryParams = ((1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength')) VirtualQueryExPrototype = WINFUNCTYPE(SIZE_T, HANDLE, LPCVOID, PMEMORY_BASIC_INFORMATION, SIZE_T) VirtualQueryExParams = ((1, 'hProcess'), (1, 'lpAddress'), (1, 'lpBuffer'), (1, 'dwLength')) +#def QueryWorkingSet(hProcess, pv, cb): +# return QueryWorkingSet.ctypes_function(hProcess, pv, cb) +QueryWorkingSetPrototype = WINFUNCTYPE(BOOL, HANDLE, PVOID, DWORD) +QueryWorkingSetParams = ((1, 'hProcess'), (1, 'pv'), (1, 'cb')) + #def GetModuleFileNameA(hModule, lpFilename, nSize): # return GetModuleFileNameA.ctypes_function(hModule, lpFilename, nSize) GetModuleFileNameAPrototype = WINFUNCTYPE(DWORD, HMODULE, LPSTR, DWORD) @@ -695,11 +700,31 @@ OpenEventWParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lpName') NtOpenEventPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES) NtOpenEventParams = ((1, 'EventHandle'), (1, 'DesiredAccess'), (1, 'ObjectAttributes')) +#def NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes): +# return NtAlpcCreatePort.ctypes_function(PortHandle, ObjectAttributes, PortAttributes) +NtAlpcCreatePortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES) +NtAlpcCreatePortParams = ((1, 'PortHandle'), (1, 'ObjectAttributes'), (1, 'PortAttributes')) + #def NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout): # return NtAlpcConnectPort.ctypes_function(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout) NtAlpcConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, PUNICODE_STRING, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, ULONG, PSID, PPORT_MESSAGE, PULONG, PALPC_MESSAGE_ATTRIBUTES, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER) NtAlpcConnectPortParams = ((1, 'PortHandle'), (1, 'PortName'), (1, 'ObjectAttributes'), (1, 'PortAttributes'), (1, 'Flags'), (1, 'RequiredServerSid'), (1, 'ConnectionMessage'), (1, 'BufferLength'), (1, 'OutMessageAttributes'), (1, 'InMessageAttributes'), (1, 'Timeout')) +#def NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection): +# return NtAlpcAcceptConnectPort.ctypes_function(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection) +NtAlpcAcceptConnectPortPrototype = WINFUNCTYPE(NTSTATUS, PHANDLE, HANDLE, ULONG, POBJECT_ATTRIBUTES, PALPC_PORT_ATTRIBUTES, PVOID, PPORT_MESSAGE, PALPC_MESSAGE_ATTRIBUTES, BOOLEAN) +NtAlpcAcceptConnectPortParams = ((1, 'PortHandle'), (1, 'ConnectionPortHandle'), (1, 'Flags'), (1, 'ObjectAttributes'), (1, 'PortAttributes'), (1, 'PortContext'), (1, 'ConnectionRequest'), (1, 'ConnectionMessageAttributes'), (1, 'AcceptConnection')) + +#def AlpcInitializeMessageAttribute(AttributeFlags, Buffer, BufferSize, RequiredBufferSize): +# return AlpcInitializeMessageAttribute.ctypes_function(AttributeFlags, Buffer, BufferSize, RequiredBufferSize) +AlpcInitializeMessageAttributePrototype = WINFUNCTYPE(NTSTATUS, ULONG, PALPC_MESSAGE_ATTRIBUTES, ULONG, PULONG) +AlpcInitializeMessageAttributeParams = ((1, 'AttributeFlags'), (1, 'Buffer'), (1, 'BufferSize'), (1, 'RequiredBufferSize')) + +#def AlpcGetMessageAttribute(Buffer, AttributeFlag): +# return AlpcGetMessageAttribute.ctypes_function(Buffer, AttributeFlag) +AlpcGetMessageAttributePrototype = WINFUNCTYPE(PVOID, PALPC_MESSAGE_ATTRIBUTES, ULONG) +AlpcGetMessageAttributeParams = ((1, 'Buffer'), (1, 'AttributeFlag')) + #def NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout): # return NtAlpcSendWaitReceivePort.ctypes_function(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout) NtAlpcSendWaitReceivePortPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG, PPORT_MESSAGE, PALPC_MESSAGE_ATTRIBUTES, PPORT_MESSAGE, PSIZE_T, PALPC_MESSAGE_ATTRIBUTES, PLARGE_INTEGER) diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index 414facb..303f546 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -44,7 +44,7 @@ LPTHREAD_START_ROUTINE = PVOID WNDENUMPROC = PVOID PHANDLER_ROUTINE = PVOID LPBYTE = POINTER(BYTE) -ULONG_PTR = PULONG +ULONG_PTR = PVOID CHAR = c_char INT = c_int UCHAR = c_char @@ -93,7 +93,7 @@ PALPC_PORT_ATTRIBUTES = PVOID VOID = DWORD ITypeInfo = PVOID -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_PSAPI_WORKING_SET_BLOCK', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_BLOCK64', '_PSAPI_WORKING_SET_INFORMATION', '_PSAPI_WORKING_SET_INFORMATION32', '_PSAPI_WORKING_SET_INFORMATION64', '_PSAPI_WORKING_SET_EX_BLOCK', '_PSAPI_WORKING_SET_EX_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_CLIENT_ID', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION'] enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', 'NET_FW_RULE_DIRECTION_', 'NET_FW_PROFILE_TYPE2_', '_MIB_TCP_STATE', 'NET_FW_IP_PROTOCOL_', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_OBJECT_INFORMATION_CLASS', '_SID_NAME_USE', 'NET_FW_PROFILE_TYPE2_', 'NET_FW_ACTION_', 'NET_FW_MODIFY_STATE_', 'NET_FW_RULE_DIRECTION_', 'tag_WBEMSTATUS', 'tagCLSCTX', '_INTERNAL_IF_OPER_STATUS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS', 'tagCOINIT', 'tagTYPEKIND'] @@ -1166,6 +1166,74 @@ class _MEMORY_BASIC_INFORMATION64(Structure): PMEMORY_BASIC_INFORMATION64 = POINTER(_MEMORY_BASIC_INFORMATION64) MEMORY_BASIC_INFORMATION64 = _MEMORY_BASIC_INFORMATION64 +# Struct _PSAPI_WORKING_SET_BLOCK definitions +class _PSAPI_WORKING_SET_BLOCK(Union): + _fields_ = [ + ("Flags", PVOID), + ] +PSAPI_WORKING_SET_BLOCK = _PSAPI_WORKING_SET_BLOCK +PPSAPI_WORKING_SET_BLOCK = POINTER(_PSAPI_WORKING_SET_BLOCK) + +# Struct _PSAPI_WORKING_SET_BLOCK32 definitions +class _PSAPI_WORKING_SET_BLOCK32(Union): + _fields_ = [ + ("Flags", DWORD), + ] +PSAPI_WORKING_SET_BLOCK32 = _PSAPI_WORKING_SET_BLOCK32 +PPSAPI_WORKING_SET_BLOCK32 = POINTER(_PSAPI_WORKING_SET_BLOCK32) + +# Struct _PSAPI_WORKING_SET_BLOCK64 definitions +class _PSAPI_WORKING_SET_BLOCK64(Union): + _fields_ = [ + ("Flags", ULONG64), + ] +PSAPI_WORKING_SET_BLOCK64 = _PSAPI_WORKING_SET_BLOCK64 +PPSAPI_WORKING_SET_BLOCK64 = POINTER(_PSAPI_WORKING_SET_BLOCK64) + +# Struct _PSAPI_WORKING_SET_INFORMATION definitions +class _PSAPI_WORKING_SET_INFORMATION(Structure): + _fields_ = [ + ("NumberOfEntries", PVOID), + ("WorkingSetInfo", PSAPI_WORKING_SET_BLOCK * 1), + ] +PPSAPI_WORKING_SET_INFORMATION = POINTER(_PSAPI_WORKING_SET_INFORMATION) +PSAPI_WORKING_SET_INFORMATION = _PSAPI_WORKING_SET_INFORMATION + +# Struct _PSAPI_WORKING_SET_INFORMATION32 definitions +class _PSAPI_WORKING_SET_INFORMATION32(Structure): + _fields_ = [ + ("NumberOfEntries", DWORD), + ("WorkingSetInfo", PSAPI_WORKING_SET_BLOCK32 * 1), + ] +PPSAPI_WORKING_SET_INFORMATION32 = POINTER(_PSAPI_WORKING_SET_INFORMATION32) +PSAPI_WORKING_SET_INFORMATION32 = _PSAPI_WORKING_SET_INFORMATION32 + +# Struct _PSAPI_WORKING_SET_INFORMATION64 definitions +class _PSAPI_WORKING_SET_INFORMATION64(Structure): + _fields_ = [ + ("NumberOfEntries", ULONG64), + ("WorkingSetInfo", PSAPI_WORKING_SET_BLOCK64 * 1), + ] +PSAPI_WORKING_SET_INFORMATION64 = _PSAPI_WORKING_SET_INFORMATION64 +PPSAPI_WORKING_SET_INFORMATION64 = POINTER(_PSAPI_WORKING_SET_INFORMATION64) + +# Struct _PSAPI_WORKING_SET_EX_BLOCK definitions +class _PSAPI_WORKING_SET_EX_BLOCK(Union): + _fields_ = [ + ("Flags", PVOID), + ] +PSAPI_WORKING_SET_EX_BLOCK = _PSAPI_WORKING_SET_EX_BLOCK +PPSAPI_WORKING_SET_EX_BLOCK = POINTER(_PSAPI_WORKING_SET_EX_BLOCK) + +# Struct _PSAPI_WORKING_SET_EX_INFORMATION definitions +class _PSAPI_WORKING_SET_EX_INFORMATION(Structure): + _fields_ = [ + ("VirtualAddress", PVOID), + ("VirtualAttributes", PSAPI_WORKING_SET_EX_BLOCK), + ] +PPSAPI_WORKING_SET_EX_INFORMATION = POINTER(_PSAPI_WORKING_SET_EX_INFORMATION) +PSAPI_WORKING_SET_EX_INFORMATION = _PSAPI_WORKING_SET_EX_INFORMATION + # Struct _STARTUPINFOA definitions class _STARTUPINFOA(Structure): _fields_ = [ @@ -2914,12 +2982,20 @@ class _PORT_MESSAGE_TMP_UNION_U2(Union): ] _PORT_MESSAGE_TMP_UNION_U2 = _PORT_MESSAGE_TMP_UNION_U2 +# Struct _CLIENT_ID definitions +class _CLIENT_ID(Structure): + _fields_ = [ + ("UniqueProcess", HANDLE), + ("UniqueThread", HANDLE), + ] +CLIENT_ID = _CLIENT_ID + # Struct _PORT_MESSAGE definitions class _PORT_MESSAGE(Structure): _fields_ = [ ("u1", _PORT_MESSAGE_TMP_UNION_U1), ("u2", _PORT_MESSAGE_TMP_UNION_U2), - ("DoNotUseThisField", double), + ("ClientId", CLIENT_ID), ("MessageId", ULONG), ("tmp_union", _PORT_MESSAGE_TMP_UNION), ] diff --git a/windows/syswow64.py b/windows/syswow64.py index 4044225..4e365cf 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -149,9 +149,12 @@ def try_generate_stub_target(shellcode, argument_buffer, target): raise ValueError("{0} syswow accept {1} args ({2} given)".format(target.__name__, expected_arguments_number, len(args))) # Transform args (ctypes byref possibly) to int writable_args = [] - for value in args: + for i, value in enumerate(args): if not isinstance(value, (int, long)): - value = ctypes.cast(value, ctypes.c_void_p).value + try: + value = ctypes.cast(value, ctypes.c_void_p).value + except ctypes.ArgumentError as e: + raise ctypes.ArgumentError("Argument {0}: wrong type <{1}>".format(i, type(value).__name__)) writable_args.append(value) # Build buffer @@ -278,7 +281,7 @@ def NtQueryVirtualMemory_32_to_64(ProcessHandle, BaseAddress, MemoryInformationC ReturnLength = byref(ULONG()) if MemoryInformation is not None and MemoryInformationLength == 0: MemoryInformationLength = ctypes.sizeof(MemoryInformation) - if type(MemoryInformation) == MEMORY_BASIC_INFORMATION64: + if isinstance(MemoryInformation, ctypes.Structure): MemoryInformation = byref(MemoryInformation) return NtQueryVirtualMemory_32_to_64.ctypes_function(ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength) diff --git a/windows/test/mytest.py b/windows/test/mytest.py index a06d598..ec7aff4 100644 --- a/windows/test/mytest.py +++ b/windows/test/mytest.py @@ -94,6 +94,10 @@ class SystemTestCase(unittest.TestCase): def test_wmi(self): return windows.system.wmi.select("Win32_Process", "*") + def test_processes(self): + procs = windows.system.processes + self.assertIn(windows.current_process.pid, [p.pid for p in procs]) + class WindowsTestCase(unittest.TestCase): def setUp(self): @@ -130,6 +134,16 @@ class WindowsTestCase(unittest.TestCase): k32_base = windows.winproxy.LoadLibraryA("kernel32.dll") self.assertEqual(windows.winproxy.GetProcAddress(k32_base, "GetCurrentProcessId"), get_current_proc_id) + def test_local_process_pe_sections(self): + mods = [m for m in windows.current_process.peb.modules if m.name == "kernel32.dll"] + self.assertTrue(mods, 'Could not find "kernel32.dll" in current process modules') + k32 = mods[0] + sections = k32.pe.sections + all_sections_name = [s.name for s in sections] + self.assertIn(".text", all_sections_name) + sections[0].start + sections[0].size + # Native execution def test_execute_to_32(self): with Calc32() as calc: @@ -415,6 +429,46 @@ class WindowsTestCase(unittest.TestCase): self.assertIsInstance(token.integrity, (int, long)) self.assertIsInstance(token.is_elevated, (bool)) + def test_get_working_set_32(self): + with Calc32() as calc: + k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0] + api_addr = k32.pe.exports["CreateFileA"] + data = calc.read_memory(api_addr, 5) + page_target = api_addr >> 12 + for page_info in calc.query_working_set(): + if page_info.virtualpage == page_target: + self.assertEqual(page_info.shared, True) + break + else: + raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target)) + data = calc.write_memory(api_addr, data) + for page_info in calc.query_working_set(): + if page_info.virtualpage == page_target: + self.assertEqual(page_info.shared, False) + break + else: + raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target)) + + @windows_64bit_only + def test_get_working_set_64(self): + with Calc32() as calc: + k32 = [m for m in calc.peb.modules if m.name == "kernel32.dll"][0] + api_addr = k32.pe.exports["CreateFileA"] + data = calc.read_memory(api_addr, 5) + page_target = api_addr >> 12 + for page_info in calc.query_working_set(): + if page_info.virtualpage == page_target: + self.assertEqual(page_info.shared, True) + break + else: + raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target)) + data = calc.write_memory(api_addr, data) + for page_info in calc.query_working_set(): + if page_info.virtualpage == page_target: + self.assertEqual(page_info.shared, False) + break + else: + raise ValueError("query_working_set page info for <0x{0:x}> not found".format(page_target)) class WindowsAPITestCase(unittest.TestCase): def test_createfileA_fail(self): diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 6c624b2..2161a69 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -325,6 +325,46 @@ class Process(AutoHandle): return addr += x.RegionSize + def query_working_set(self): + if self.bitness == 64 or windows.current_process.bitness == 64: + WSET_BLOCK = EPSAPI_WORKING_SET_BLOCK64 + dummy = PSAPI_WORKING_SET_INFORMATION64() + else: + WSET_BLOCK = EPSAPI_WORKING_SET_BLOCK32 + dummy = PSAPI_WORKING_SET_INFORMATION32() + try: + windows.winproxy.QueryWorkingSet(self.handle, ctypes.byref(dummy), ctypes.sizeof(dummy)) + except WindowsError as e: + if e.winerror != 24: + raise + + for i in range(10): + # use the same type as WSET_BLOCK.Flags + NumberOfEntriesType = [f for f in WSET_BLOCK._fields_ if f[0] == "Flags"][0][1] + class GENERATED_PSAPI_WORKING_SET_INFORMATION(ctypes.Structure): + _fields_ = [ + ("NumberOfEntries", NumberOfEntriesType), + ("WorkingSetInfo", WSET_BLOCK * dummy.NumberOfEntries), + ] + res = GENERATED_PSAPI_WORKING_SET_INFORMATION() + try: + if windows.current_process.bitness == 32 and self.bitness == 64: + windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, 1, res) + else: + windows.winproxy.QueryWorkingSet(self.handle, ctypes.byref(res), ctypes.sizeof(res)) + except WindowsError as e: + if e.winerror != 24: + raise + dummy.NumberOfEntries = res.NumberOfEntries + continue + except windows.generated_def.ntstatus.NtStatusException as e: + if e.code != STATUS_INFO_LENGTH_MISMATCH: + raise + dummy.NumberOfEntries = res.NumberOfEntries + continue + return res.WorkingSetInfo + return None + def mapped_filename(self, addr): """The filename mapped at address ``addr`` or ``None`` @@ -983,6 +1023,35 @@ class PEB(Structure): return [LoadedModule.from_address(addressof(LDR)) for LDR in res] + +# Memory stuff + +class EPSAPI_WORKING_SET_BLOCK_BASE(object): + @property + def protection(self): + return self.Flags & 0b11111 + + @property + def sharecount(self): + return (self.Flags >> 5) & 0b111 + + @property + def shared(self): + return (self.Flags >> 8) & 1 + + @property + def virtualpage(self): + return (self.Flags >> 12) + +class EPSAPI_WORKING_SET_BLOCK(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK): + pass + +class EPSAPI_WORKING_SET_BLOCK32(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK32): + pass + +class EPSAPI_WORKING_SET_BLOCK64(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK64): + pass + import windows.remotectypes as rctypes diff --git a/windows/winproxy.py b/windows/winproxy.py index 0d33ec0..04f18b3 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -276,6 +276,7 @@ GetComputerNameA = TransparentKernel32Proxy("GetComputerNameA") GetComputerNameW = TransparentKernel32Proxy("GetComputerNameW") + Wow64DisableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64DisableWow64FsRedirection") Wow64RevertWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64RevertWow64FsRedirection") Wow64EnableWow64FsRedirection = OptionalExport(TransparentKernel32Proxy)("Wow64EnableWow64FsRedirection") @@ -419,7 +420,7 @@ def CreateToolhelp32Snapshot(dwFlags, th32ProcessID=0): return CreateToolhelp32Snapshot.ctypes_function(dwFlags, th32ProcessID) -@Kernel32Proxy("Thread32First", no_error_check) +@Kernel32Proxy("Thread32First") def Thread32First(hSnapshot, lpte): """Set byref(lpte) if needed""" if type(lpte) == THREADENTRY32: @@ -435,19 +436,13 @@ def Thread32Next(hSnapshot, lpte): return Thread32Next.ctypes_function(hSnapshot, lpte) -@Kernel32Proxy("Process32First", no_error_check) +@Kernel32Proxy("Process32First") def Process32First(hSnapshot, lpte): - """Set byref(lpte) if needed""" - if type(lpte) == THREADENTRY32: - lpte = ctypes.byref(lpte) return Process32First.ctypes_function(hSnapshot, lpte) @Kernel32Proxy("Process32Next", no_error_check) def Process32Next(hSnapshot, lpte): - """Set byref(lpte) if needed""" - if type(lpte) == THREADENTRY32: - lpte = ctypes.byref(lpte) return Process32Next.ctypes_function(hSnapshot, lpte) @Kernel32Proxy("OpenEventA") @@ -539,10 +534,14 @@ def GetMappedFileNameAWrapper(hProcess, lpv, lpFilename, nSize=None): return GetMappedFileNameA.ctypes_function(hProcess, lpv, lpFilename, nSize) GetMappedFileNameA = OptionalExport(Kernel32Proxy("GetMappedFileNameA"))(GetMappedFileNameAWrapper) +def QueryWorkingSetWrapper(hProcess, pv, cb): + return QueryWorkingSet.ctypes_function(hProcess, pv, cb) +QueryWorkingSet = OptionalExport(Kernel32Proxy("QueryWorkingSet"))(QueryWorkingSetWrapper) + if GetMappedFileNameA is None: GetMappedFileNameW = PsapiProxy("GetMappedFileNameW")(GetMappedFileNameWWrapper) GetMappedFileNameA = PsapiProxy("GetMappedFileNameA")(GetMappedFileNameAWrapper) - + QueryWorkingSet = PsapiProxy("QueryWorkingSet")(QueryWorkingSetWrapper) def GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None): if nSize is None: @@ -704,16 +703,35 @@ def NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes): return NtOpenEvent.ctypes_function(EventHandle, DesiredAccess, ObjectAttributes) +@NtdllProxy("NtAlpcCreatePort", error_ntstatus) +def NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes): + return NtAlpcCreatePort.ctypes_function(PortHandle, ObjectAttributes, PortAttributes) + + @NtdllProxy("NtAlpcConnectPort", error_ntstatus) def NtAlpcConnectPort(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout): return NtAlpcConnectPort.ctypes_function(PortHandle, PortName, ObjectAttributes, PortAttributes, Flags, RequiredServerSid, ConnectionMessage, BufferLength, OutMessageAttributes, InMessageAttributes, Timeout) +@NtdllProxy("NtAlpcAcceptConnectPort", error_ntstatus) +def NtAlpcAcceptConnectPort(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection): + return NtAlpcAcceptConnectPort.ctypes_function(PortHandle, ConnectionPortHandle, Flags, ObjectAttributes, PortAttributes, PortContext, ConnectionRequest, ConnectionMessageAttributes, AcceptConnection) + @NtdllProxy("NtAlpcSendWaitReceivePort", error_ntstatus) def NtAlpcSendWaitReceivePort(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout): return NtAlpcSendWaitReceivePort.ctypes_function(PortHandle, Flags, SendMessage, SendMessageAttributes, ReceiveMessage, BufferLength, ReceiveMessageAttributes, Timeout) +@NtdllProxy("AlpcInitializeMessageAttribute", error_ntstatus) +def AlpcInitializeMessageAttribute(AttributeFlags, Buffer, BufferSize, RequiredBufferSize): + return AlpcInitializeMessageAttribute.ctypes_function(AttributeFlags, Buffer, BufferSize, RequiredBufferSize) + + +@NtdllProxy("AlpcGetMessageAttribute", no_error_check) +def AlpcGetMessageAttribute(Buffer, AttributeFlag): + return AlpcGetMessageAttribute.ctypes_function(Buffer, AttributeFlag) + + @NtdllProxy("NtOpenDirectoryObject", error_ntstatus) def NtOpenDirectoryObject(DirectoryHandle, DesiredAccess, ObjectAttributes): return NtOpenDirectoryObject.ctypes_function(DirectoryHandle, DesiredAccess, ObjectAttributes)