mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Added simple_x[86/64] listing of instrtuction to documentation + regenerated doc
This commit is contained in:
hakril
+13
-1
@@ -232,6 +232,10 @@
|
||||
<span class="k">def</span> <span class="nf">basetype</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BasicType</span><span class="o">.</span><span class="n">mapper</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_BASETYPE</span><span class="p">)]</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">parent</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">new_typeid</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_CLASSPARENTID</span><span class="p">))</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">datakind</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DataKind</span><span class="o">.</span><span class="n">mapper</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_DATAKIND</span><span class="p">)]</span>
|
||||
@@ -248,6 +252,10 @@
|
||||
<span class="k">def</span> <span class="nf">nb_children</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_CHILDRENCOUNT</span><span class="p">)</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">value</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_VALUE</span><span class="p">)</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">children</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">count</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">nb_children</span>
|
||||
@@ -270,7 +278,10 @@
|
||||
|
||||
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagBaseType</span><span class="p">:</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> <basetype> </span><span class="si">{1}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">basetype</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> <basetype> </span><span class="si">{1!r}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">basetype</span><span class="p">)</span>
|
||||
<span class="k">elif</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagPointerType</span><span class="p">:</span>
|
||||
<span class="n">target_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">type</span><span class="o">.</span><span class="n">name</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> PTR TO "</span><span class="si">{1}</span><span class="s1">" tag=</span><span class="si">{2}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">target_type</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> name="</span><span class="si">{1}</span><span class="s1">" tag=</span><span class="si">{2}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
|
||||
|
||||
|
||||
@@ -771,6 +782,7 @@
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_ADDRESS</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG64</span><span class="p">,</span>
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GTIEX_REQS_VALID</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG64</span><span class="p">,</span>
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_SYMTAG</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagEnum</span><span class="p">,</span>
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_VALUE</span><span class="p">:</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">Variant</span><span class="p">,</span>
|
||||
<span class="p">}</span>
|
||||
</pre></div>
|
||||
|
||||
|
||||
+4877
-4576
File diff suppressed because one or more lines are too long
@@ -47,59 +47,12 @@
|
||||
|
||||
<span class="kn">import</span> <span class="nn">windows</span>
|
||||
<span class="kn">import</span> <span class="nn">windows.winproxy</span>
|
||||
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
||||
|
||||
<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">simple_x86</span> <span class="k">as</span> <span class="n">x86</span>
|
||||
<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">simple_x64</span> <span class="k">as</span> <span class="n">x64</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">PyObj</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="s2">"ob_refcnt"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"ob_type"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)]</span> <span class="c1"># must be cast</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">PyMmap</span><span class="p">(</span><span class="n">PyObj</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="s2">"ob_addr"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">),</span> <span class="p">(</span><span class="s2">"ob_size"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">)]</span>
|
||||
|
||||
|
||||
<span class="c1"># Specific mmap class for code injection</span>
|
||||
<span class="k">class</span> <span class="nc">MyMap</span><span class="p">(</span><span class="n">mmap</span><span class="o">.</span><span class="n">mmap</span><span class="p">):</span>
|
||||
<span class="sd">""" A mmap that is never unmapped and that contains the page address """</span>
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwarg</span><span class="p">):</span>
|
||||
<span class="c1"># Get the page address by 'introspection' of the C struct</span>
|
||||
<span class="n">m</span> <span class="o">=</span> <span class="n">PyMmap</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">m</span><span class="o">.</span><span class="n">ob_addr</span>
|
||||
<span class="c1"># Prevent garbage collection (so unmaping) of the page</span>
|
||||
<span class="n">m</span><span class="o">.</span><span class="n">ob_refcnt</span> <span class="o">+=</span> <span class="mi">1</span>
|
||||
|
||||
<span class="nd">@classmethod</span>
|
||||
<span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="sd">""" Dispatch to the good mmap implem depending on the current system """</span>
|
||||
<span class="n">systems</span> <span class="o">=</span> <span class="p">{</span><span class="s1">'windows'</span><span class="p">:</span> <span class="n">Win32MyMap</span><span class="p">,</span>
|
||||
<span class="s1">'linux'</span><span class="p">:</span> <span class="n">UnixMyMap</span><span class="p">}</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="n">platform</span><span class="o">.</span><span class="n">system</span><span class="p">()</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
|
||||
<span class="k">if</span> <span class="n">x</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">systems</span><span class="p">:</span>
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Unknow system </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
|
||||
<span class="k">return</span> <span class="n">systems</span><span class="p">[</span><span class="n">x</span><span class="p">]</span><span class="o">.</span><span class="n">get_map</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Win32MyMap</span><span class="p">(</span><span class="n">MyMap</span><span class="p">):</span>
|
||||
<span class="nd">@classmethod</span>
|
||||
<span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="n">addr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="mh">0x40</span><span class="p">)</span>
|
||||
<span class="n">new_map</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">size</span><span class="p">)</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
||||
<span class="n">new_map</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
|
||||
<span class="k">if</span> <span class="n">new_map</span><span class="o">.</span><span class="n">addr</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
|
||||
<span class="k">raise</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinError</span><span class="p">()</span>
|
||||
<span class="k">return</span> <span class="n">new_map</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">UnixMyMap</span><span class="p">(</span><span class="n">MyMap</span><span class="p">):</span>
|
||||
<span class="nd">@classmethod</span>
|
||||
<span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="n">prot</span> <span class="o">=</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_EXEC</span> <span class="o">|</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_WRITE</span> <span class="o">|</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_READ</span>
|
||||
<span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">CustomAllocator</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
||||
<span class="n">int_size</span> <span class="o">=</span> <span class="p">{</span><span class="s1">'32bit'</span><span class="p">:</span> <span class="mi">4</span><span class="p">,</span> <span class="s1">'64bit'</span><span class="p">:</span> <span class="mi">8</span><span class="p">}</span>
|
||||
|
||||
@@ -117,7 +70,10 @@
|
||||
<span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">int_size</span><span class="p">[</span><span class="n">bits</span><span class="p">]</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_new_page</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">maps</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">MyMap</span><span class="o">.</span><span class="n">get_map</span><span class="p">(</span><span class="n">size</span><span class="p">))</span>
|
||||
<span class="n">addr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">)</span>
|
||||
<span class="n">mymap</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">size</span><span class="p">)</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
||||
<span class="n">mymap</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">maps</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">mymap</span><span class="p">)</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_page_size</span> <span class="o">=</span> <span class="n">size</span>
|
||||
|
||||
@@ -141,6 +97,20 @@
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">+=</span> <span class="n">size</span>
|
||||
<span class="k">return</span> <span class="n">addr</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">close</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">maps</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">maps</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">maps</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_page_size</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">sys</span><span class="p">,</span> <span class="s2">"path"</span><span class="p">,</span> <span class="kc">None</span><span class="p">)</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="c1"># Path is None -> Python shutdown</span>
|
||||
<span class="k">return</span>
|
||||
<span class="k">for</span> <span class="n">mymap</span> <span class="ow">in</span> <span class="n">maps</span><span class="p">:</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFree</span><span class="p">(</span><span class="n">mymap</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwFreeType</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_RELEASE</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
||||
|
||||
<span class="n">allocator</span> <span class="o">=</span> <span class="n">CustomAllocator</span><span class="p">()</span>
|
||||
|
||||
|
||||
|
||||
@@ -70,6 +70,12 @@
|
||||
<span class="k">if</span> <span class="n">size</span> <span class="o">></span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">array</span> <span class="o">=</span> <span class="p">([</span><span class="mi">0</span><span class="p">]</span> <span class="o">*</span> <span class="p">(</span><span class="n">size</span> <span class="o">-</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">)))</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">array</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">copy</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">new</span> <span class="o">=</span> <span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)(</span><span class="mi">0</span><span class="p">,</span> <span class="s2">""</span><span class="p">)</span>
|
||||
<span class="n">new</span><span class="o">.</span><span class="n">size</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">size</span>
|
||||
<span class="n">new</span><span class="o">.</span><span class="n">array</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">new</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">dump</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">size</span> <span class="o">//</span> <span class="mi">8</span><span class="p">):</span>
|
||||
@@ -325,7 +331,7 @@
|
||||
|
||||
<span class="k">class</span> <span class="nc">RawBits</span><span class="p">(</span><span class="n">BitArray</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">accept_arg</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">args</span><span class="p">,</span> <span class="n">instr_state</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">copy</span><span class="p">())</span>
|
||||
|
||||
|
||||
<span class="c1"># Immediat value logic</span>
|
||||
@@ -446,8 +452,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">ModRM</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">sub_modrm</span><span class="p">,</span> <span class="n">accept_reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">accept_reverse</span> <span class="o">=</span> <span class="n">accept_reverse</span>
|
||||
@@ -480,7 +484,6 @@
|
||||
<span class="k">def</span> <span class="nf">match</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">arg1</span><span class="p">,</span> <span class="n">arg2</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">X86</span><span class="o">.</span><span class="n">is_reg</span><span class="p">(</span><span class="n">arg1</span><span class="p">)</span> <span class="ow">and</span> <span class="n">X86</span><span class="o">.</span><span class="n">is_reg</span><span class="p">(</span><span class="n">arg2</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">arg1</span><span class="p">,</span> <span class="n">arg2</span><span class="p">,</span> <span class="nb">reversed</span><span class="p">,</span> <span class="n">instr_state</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">mod</span> <span class="o">=</span> <span class="n">BitArray</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="s2">"11"</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="n">X86</span><span class="o">.</span><span class="n">reg_size</span><span class="p">(</span><span class="n">arg1</span><span class="p">)</span> <span class="o">!=</span> <span class="n">X86</span><span class="o">.</span><span class="n">reg_size</span><span class="p">(</span><span class="n">arg2</span><span class="p">):</span>
|
||||
@@ -643,6 +646,7 @@
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">initial_args</span><span class="p">):</span>
|
||||
<span class="c1"># print(self, initial_args)</span>
|
||||
<span class="k">for</span> <span class="n">type_encoding</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">encoding</span><span class="p">:</span>
|
||||
<span class="n">args</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">initial_args</span><span class="p">)</span>
|
||||
<span class="n">prefix</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
@@ -662,6 +666,7 @@
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Cannot encode <</span><span class="si">{0}</span><span class="s2"> </span><span class="si">{1}</span><span class="s2">>:("</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">initial_args</span><span class="p">))</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="c1"># print(self.value)</span>
|
||||
<span class="n">prefix_opcode</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="nb">chr</span><span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">PREFIX_VALUE</span><span class="p">)</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">prefix</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">prefix_opcode</span> <span class="o">+</span> <span class="nb">bytes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span><span class="o">.</span><span class="n">dump</span><span class="p">())</span>
|
||||
|
||||
@@ -743,10 +748,10 @@
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xff</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9a</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span>
|
||||
|
||||
<span class="k">class</span> <span class="nc">Jmp</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
<div class="viewcode-block" id="Jmp"><a class="viewcode-back" href="../../../native_exec.html#windows.native_exec.simple_x86.Jmp">[docs]</a><span class="k">class</span> <span class="nc">Jmp</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xeb</span><span class="p">),</span> <span class="n">JmpImm8</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xe9</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">5</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xea</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xea</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span></div>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Jz</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
@@ -754,6 +759,9 @@
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f84</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">6</span><span class="p">))]</span>
|
||||
|
||||
|
||||
<span class="n">Je</span> <span class="o">=</span> <span class="n">Jz</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Jnz</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x75</span><span class="p">),</span> <span class="n">JmpImm8</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f85</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">6</span><span class="p">))]</span>
|
||||
@@ -813,13 +821,13 @@
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x29</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">]))]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Mov</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<div class="viewcode-block" id="Mov"><a class="viewcode-back" href="../../../native_exec.html#windows.native_exec.simple_x86.Mov">[docs]</a><span class="k">class</span> <span class="nc">Mov</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x89</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">])),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xc7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">0</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mh">0xB8</span> <span class="o">>></span> <span class="mi">3</span><span class="p">),</span> <span class="n">X86RegisterSelector</span><span class="p">(),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x8C</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__SEGREG</span><span class="p">])),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f20</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">False</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f22</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">True</span><span class="p">))]</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f22</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">True</span><span class="p">))]</span></div>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Movsb</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
@@ -830,6 +838,22 @@
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xa5</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Pushfd</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9c</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Pushad</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x60</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Popfd</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9d</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Popad</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x61</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Lea</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x8d</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__MEM</span><span class="p">],</span> <span class="n">accept_reverse</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">False</span><span class="p">))]</span>
|
||||
|
||||
@@ -841,7 +865,7 @@
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Test</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xf7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">7</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xf7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">0</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x85</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">],</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">False</span><span class="p">))]</span>
|
||||
|
||||
|
||||
|
||||
+54
-26
@@ -122,6 +122,14 @@
|
||||
<span class="p">(</span><span class="s2">"AddressOfData"</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span>
|
||||
<span class="p">]</span>
|
||||
|
||||
<span class="c1"># Special case for .NET PE32 rewrite as 64b</span>
|
||||
<span class="c1"># We may have a PE in a 64b process with a 32b IAT</span>
|
||||
<span class="k">class</span> <span class="nc">THUNK_DATA_32</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
|
||||
<span class="p">(</span><span class="s2">"Ordinal"</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"AddressOfData"</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">)</span>
|
||||
<span class="p">]</span>
|
||||
|
||||
<span class="k">class</span> <span class="nc">IMPORT_BY_NAME</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
|
||||
<span class="p">(</span><span class="s2">"Hint"</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
|
||||
@@ -224,7 +232,6 @@
|
||||
<span class="k">def</span> <span class="nf">on_destroy</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
|
||||
<span class="c1"># We cannot know if the hook was enabled here..</span>
|
||||
<span class="nb">print</span><span class="p">(</span><span class="s2">"DESTROY: </span><span class="si">{0}</span><span class="s2"> -> "</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">enabled</span><span class="p">))</span>
|
||||
<span class="c1"># import pdb;pdb.set_trace()</span>
|
||||
<span class="c1"># print(args[0]())</span>
|
||||
|
||||
<div class="viewcode-block" id="IATEntry.remove_hook"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.remove_hook">[docs]</a> <span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
@@ -242,11 +249,16 @@
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs.IMAGE_IMPORT_DESCRIPTOR</span>
|
||||
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="p">:</span>
|
||||
<span class="k">return</span> <span class="kc">None</span>
|
||||
<span class="c1"># We may have 32bits PE mapped in 32bits process (thanks to .NET PE)</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
|
||||
<span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">"Mapped 64b PE in current process 32b not handled"</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
|
||||
<span class="n">int_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">while</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span><span class="p">:</span>
|
||||
@@ -254,23 +266,24 @@
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">import_by_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMPORT_BY_NAME</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span><span class="p">)</span>
|
||||
<span class="n">name_address</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span> <span class="o">+</span> <span class="nb">type</span><span class="p">(</span><span class="n">import_by_name</span><span class="p">)</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">offset</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">import_by_name</span><span class="o">.</span><span class="n">Hint</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
|
||||
<span class="n">int_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">int_entry</span><span class="p">))</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
|
||||
<span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">"Mapped 64b PE in current process 32b not handled"</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
|
||||
<span class="n">iat_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">FirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">while</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">IATEntry</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">iat_addr</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="s2">"??"</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="p">))</span>
|
||||
<span class="n">iat_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">iat_entry</span><span class="p">))</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
|
||||
<span class="nd">@classmethod</span>
|
||||
@@ -356,21 +369,37 @@
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS32</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS64</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span> <span class="o">=</span> <span class="p">{</span>
|
||||
<span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">,</span>
|
||||
<span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">,</span>
|
||||
<span class="p">}</span>
|
||||
|
||||
<span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span> <span class="o">=</span> <span class="p">(</span>
|
||||
<span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">)),</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_OptionalHeader</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
|
||||
<span class="c1"># We can have a 32bits PE with a 64 bits OptionalHeader</span>
|
||||
<span class="c1"># Ex : PE32 .NET that allow to be loaded in 64b process</span>
|
||||
<span class="c1"># See: https://github.com/dotnet/runtime/blob/8bbe33819464216becffb7cf8b7ea8dd3bab5836/src/coreclr/src/vm/peimagelayout.cpp#L599</span>
|
||||
<span class="c1"># In this case the OptionalHeader is transformed in 64bits & OptionalHeader.Magic is changed accordingly</span>
|
||||
<span class="c1"># So we cannot just rely on get_NT_HEADER() to give us the correct OptionalHeader type. some re-check are required</span>
|
||||
<span class="n">default_opth</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
|
||||
<span class="c1"># Cannot juste compare types with type(default_opth) as it may be a remoteType</span>
|
||||
<span class="n">current_opth_infos</span> <span class="o">=</span> <span class="p">(</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">))</span>
|
||||
<span class="k">if</span> <span class="n">current_opth_infos</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span><span class="p">:</span>
|
||||
<span class="c1"># The default OptionalHeader structure match what we expect based on the magic (most of the cases)</span>
|
||||
<span class="k">return</span> <span class="n">default_opth</span>
|
||||
<span class="c1"># Mismatch -> PE32 remapped as 64b (with OptionalHeader rewrite)</span>
|
||||
<span class="c1"># Remap the correct OptionalHeader</span>
|
||||
<span class="n">opt_header_real_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span><span class="p">[</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">]</span>
|
||||
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">default_opth</span><span class="o">.</span><span class="n">_base_addr</span> <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="k">else</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">opt_header_real_type</span><span class="p">,</span> <span class="n">opt_header_addr</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_DataDirectory</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="c1"># This won't work if we load a PE32 in a 64bit process</span>
|
||||
<span class="c1"># PE32 .NET...</span>
|
||||
<span class="c1"># return self.get_OptionalHeader().DataDirectory</span>
|
||||
<span class="n">DataDirectory_type</span> <span class="o">=</span> <span class="n">IMAGE_DATA_DIRECTORY</span> <span class="o">*</span> <span class="n">IMAGE_NUMBEROF_DIRECTORY_ENTRIES</span>
|
||||
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
|
||||
<span class="n">DataDirectory_addr</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">,</span> <span class="n">DataDirectory_addr</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_OptionalHeader</span><span class="p">()</span><span class="o">.</span><span class="n">DataDirectory</span>
|
||||
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_IMPORT_DESCRIPTORS</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
@@ -422,7 +451,6 @@
|
||||
<span class="n">export_end</span> <span class="o">=</span> <span class="n">export_start</span> <span class="o">+</span> <span class="n">export_datadir</span><span class="o">.</span><span class="n">Size</span>
|
||||
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
<span class="c1"># import pdb;pdb.set_trace()</span>
|
||||
<span class="n">raw_exports</span> <span class="o">=</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">get_exports</span><span class="p">()</span>
|
||||
<span class="k">for</span> <span class="nb">id</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">,</span> <span class="n">rva_name</span> <span class="ow">in</span> <span class="n">raw_exports</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">export_start</span> <span class="o"><=</span> <span class="n">rva_addr</span> <span class="o"><</span> <span class="n">export_end</span><span class="p">:</span>
|
||||
@@ -455,8 +483,8 @@
|
||||
<span class="sd"> :type: {:class:`str` : [:class:`IATEntry`]}"""</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
|
||||
<span class="k">for</span> <span class="n">import_descriptor</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_IMPORT_DESCRIPTORS</span><span class="p">():</span>
|
||||
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">()</span>
|
||||
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">()</span>
|
||||
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
|
||||
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="n">INT</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="k">for</span> <span class="n">iat_entry</span><span class="p">,</span> <span class="p">(</span><span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">IAT</span><span class="p">,</span> <span class="n">INT</span><span class="p">):</span>
|
||||
<span class="c1"># str(name.decode()) -> python2 and python3 compatible for str result</span>
|
||||
|
||||
+31
-16
@@ -133,16 +133,23 @@
|
||||
<span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
|
||||
<span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
|
||||
<span class="k">if</span> <span class="n">show_windows</span><span class="p">:</span>
|
||||
<span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOA</span><span class="p">()</span>
|
||||
<span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
|
||||
<span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
|
||||
<span class="n">StartupInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
|
||||
<span class="n">lpCommandLine</span> <span class="o">=</span> <span class="kc">None</span>
|
||||
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
|
||||
<span class="n">path</span> <span class="o">=</span> <span class="n">path</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
|
||||
<span class="k">if</span> <span class="n">args</span><span class="p">:</span>
|
||||
<span class="n">lpCommandLine</span> <span class="o">=</span> <span class="p">(</span><span class="sa">b</span><span class="s2">" "</span><span class="o">.</span><span class="n">join</span><span class="p">([</span><span class="n">a</span> <span class="k">for</span> <span class="n">a</span> <span class="ow">in</span> <span class="n">args</span><span class="p">]))</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessA</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">lpCommandLine</span><span class="o">=</span><span class="n">lpCommandLine</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">,</span> <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span> <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">lpStartupInfo</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessA new process handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessA new thread handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">unicode_args</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">for</span> <span class="n">arg</span> <span class="ow">in</span> <span class="n">args</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">arg</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
|
||||
<span class="n">arg</span> <span class="o">=</span> <span class="n">arg</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
|
||||
<span class="n">unicode_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">arg</span><span class="p">)</span>
|
||||
<span class="n">lpCommandLine</span> <span class="o">=</span> <span class="p">(</span><span class="s2">" "</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">unicode_args</span><span class="p">))</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessW</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">lpCommandLine</span><span class="o">=</span><span class="n">lpCommandLine</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">,</span> <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span> <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">lpStartupInfo</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessW new process handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessW new thread handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"Automatic close of thread handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">)</span> <span class="c1"># Give access to a WinThread in addition of the WinProcess ?</span>
|
||||
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span></div>
|
||||
@@ -234,15 +241,8 @@
|
||||
|
||||
<span class="sd"> https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx#_______noumex______</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="n">hkresult</span> <span class="o">=</span> <span class="n">HKEY</span><span class="p">()</span>
|
||||
<span class="n">cbsize</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">(</span><span class="mi">1024</span><span class="p">)</span>
|
||||
<span class="n">bufferres</span> <span class="o">=</span> <span class="p">(</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">cbsize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
|
||||
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExA</span><span class="p">(</span><span class="n">HKEY_LOCAL_MACHINE</span><span class="p">,</span> <span class="s2">"System</span><span class="se">\\</span><span class="s2">CurrentControlSet</span><span class="se">\\</span><span class="s2">Control"</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">KEY_READ</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">hkresult</span><span class="p">))</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegGetValueA</span><span class="p">(</span><span class="n">hkresult</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="s2">"SystemStartOptions"</span><span class="p">,</span> <span class="n">RRF_RT_REG_SZ</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">bufferres</span><span class="p">),</span> <span class="n">byref</span><span class="p">(</span><span class="n">cbsize</span><span class="p">))</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegCloseKey</span><span class="p">(</span><span class="n">hkresult</span><span class="p">)</span>
|
||||
|
||||
<span class="n">control</span> <span class="o">=</span> <span class="n">bufferres</span><span class="p">[:]</span>
|
||||
<span class="n">options</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">registry</span><span class="p">(</span><span class="sa">r</span><span class="s1">'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control'</span><span class="p">)[</span><span class="s1">'SystemStartOptions'</span><span class="p">]</span>
|
||||
<span class="n">control</span> <span class="o">=</span> <span class="n">options</span><span class="o">.</span><span class="n">value</span>
|
||||
<span class="k">if</span> <span class="s2">"DEBUG"</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">control</span><span class="p">:</span>
|
||||
<span class="c1"># print "[-] Enable debug boot!"</span>
|
||||
<span class="c1"># print "> bcdedit /debug on"</span>
|
||||
@@ -489,7 +489,8 @@
|
||||
<span class="k">if</span> <span class="n">volume_info_class</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FileFsAttributeInformation</span><span class="p">:</span>
|
||||
<span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">FileSystemNameLength</span>
|
||||
<span class="k">elif</span> <span class="n">volume_info_class</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FileFsVolumeInformation</span><span class="p">:</span>
|
||||
<span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">VolumeLabelLength</span> <span class="o">+</span> <span class="mh">0x8</span> <span class="c1"># I have seen cases where the VolumeLabelLength is not even enough..</span>
|
||||
<span class="c1"># Well VolumeLabelLength is clearly broken (after testing..) so we are adding some bytes to it..</span>
|
||||
<span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">VolumeLabelLength</span> <span class="o">+</span> <span class="mh">0x100</span> <span class="c1"># I have seen cases where the VolumeLabelLength is not even enough..</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="n">full_size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info</span><span class="p">)</span> <span class="o">+</span> <span class="n">file_name_length</span> <span class="c1"># We add a little too much size for the sake of simplicity</span>
|
||||
@@ -566,7 +567,7 @@
|
||||
<span class="c1"># addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)</span>
|
||||
<span class="c1"># return addr</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
||||
<span class="k">if</span> <span class="n">uncompress_size</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span> <span class="o">*</span> <span class="mi">10</span>
|
||||
<span class="n">result_size</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
|
||||
@@ -574,6 +575,20 @@
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlDecompressBuffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">uncompressed</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">result_size</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">uncompressed</span><span class="p">[:</span><span class="n">result_size</span><span class="o">.</span><span class="n">value</span><span class="p">]</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">compress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">):</span>
|
||||
<span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
|
||||
<span class="n">CompressedBufferSize</span> <span class="o">=</span> <span class="n">uncompress_size</span> <span class="o">+</span> <span class="mh">0x1000</span>
|
||||
<span class="n">CompressedBuffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">CompressedBufferSize</span><span class="p">)</span>
|
||||
<span class="n">chunk</span> <span class="o">=</span> <span class="mi">4096</span>
|
||||
<span class="n">final_size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
|
||||
<span class="n">work_space_size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
|
||||
<span class="n">ignore_data</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
|
||||
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlGetCompressionWorkSpaceSize</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">work_space_size</span><span class="p">,</span> <span class="n">ignore_data</span><span class="p">)</span>
|
||||
<span class="n">work_space</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">work_space_size</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlCompressBuffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="p">,</span> <span class="n">CompressedBuffer</span><span class="p">,</span> <span class="n">CompressedBufferSize</span><span class="p">,</span> <span class="n">chunk</span><span class="p">,</span> <span class="n">final_size</span><span class="p">,</span> <span class="n">work_space</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">CompressedBuffer</span><span class="p">[:</span><span class="n">final_size</span><span class="o">.</span><span class="n">value</span><span class="p">]</span>
|
||||
|
||||
|
||||
<span class="c1"># sid.py + real SID type ?</span>
|
||||
|
||||
|
||||
@@ -53,6 +53,7 @@
|
||||
|
||||
<span class="c1"># Helpers</span>
|
||||
|
||||
|
||||
<span class="nd">@contextmanager</span>
|
||||
<span class="k">def</span> <span class="nf">ClosingEvtHandle</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
@@ -225,17 +226,20 @@
|
||||
<span class="c1"># Each value wil return 1 node :)</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="n">nbelt</span><span class="p">,</span> <span class="n">pwstr_rarray</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">system_values</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span> <span class="c1"># POC: use this for all @property based on system data ?</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextSystem</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span>
|
||||
|
||||
<div class="viewcode-block" id="EvtEvent.event_values"><a class="viewcode-back" href="../../../evtlog.html#windows.winobject.event_log.EvtEvent.event_values">[docs]</a> <span class="k">def</span> <span class="nf">event_values</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="sd">"""The values of the event in a list"""</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextUser</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span></div>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_raw_values</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">values</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">):</span>
|
||||
@@ -247,6 +251,7 @@
|
||||
<span class="c1"># Each value will return 1 node :)</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="n">nbelt</span><span class="p">,</span> <span class="n">pwstr_rarray</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="n">result</span><span class="p">)</span>
|
||||
|
||||
|
||||
@@ -490,6 +495,9 @@
|
||||
<span class="sd"> List all events with an EventID of 2006:</span>
|
||||
<span class="sd"> ``Event/System[EventID=2006]``</span>
|
||||
|
||||
<span class="sd"> List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</span>
|
||||
<span class="sd"> ``Event/System[EventID=3] and Event/EventData/Data[@Name='DestinationIp'] and Event/EventData[Data='10.0.0.2']``</span>
|
||||
|
||||
<span class="sd"> :rtype: :class:`EvtQuery`</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="k">if</span> <span class="n">ids</span> <span class="ow">and</span> <span class="nb">filter</span><span class="p">:</span>
|
||||
|
||||
@@ -228,17 +228,18 @@
|
||||
<span class="k">raise</span> <span class="c1"># Other error -> reraise</span>
|
||||
<span class="k">return</span> <span class="kc">True</span></div>
|
||||
|
||||
<div class="viewcode-block" id="EtwTrace.start"><a class="viewcode-back" href="../../../etw.html#windows.winobject.event_trace.EtwTrace.start">[docs]</a> <span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
|
||||
<div class="viewcode-block" id="EtwTrace.start"><a class="viewcode-back" href="../../../etw.html#windows.winobject.event_trace.EtwTrace.start">[docs]</a> <span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">mode</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
|
||||
<span class="sd">"""Start the tracing"""</span>
|
||||
<span class="n">prop</span> <span class="o">=</span> <span class="n">EventTraceProperties</span><span class="o">.</span><span class="n">create</span><span class="p">()</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">NumberOfBuffers</span> <span class="o">=</span> <span class="mi">42</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">EnableFlags</span> <span class="o">=</span> <span class="n">flags</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">=</span> <span class="n">mode</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span><span class="p">:</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">Wnode</span><span class="o">.</span><span class="n">Guid</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">logfile</span><span class="p">:</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">logfile</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">logfile</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">:</span> <span class="c1"># Base REAL_TIME on option ? name presence ? logfile presence ?</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EVENT_TRACE_REAL_TIME_MODE</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EVENT_TRACE_REAL_TIME_MODE</span>
|
||||
<span class="n">handle</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">TRACEHANDLE</span><span class="p">()</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">StartTraceA</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">prop</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span><span class="p">:</span>
|
||||
|
||||
+17
-11
@@ -145,13 +145,13 @@
|
||||
<span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
|
||||
<span class="c1"># Fuck-it <3</span>
|
||||
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
|
||||
<span class="c1"># Map a remote64bits(PROCESS_BASIC_INFORMATION) at the address of 'data'</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="n">xtype</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">x</span><span class="o">.</span><span class="n">InheritedFromUniqueProcessId</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
@@ -390,13 +390,13 @@
|
||||
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">itertools</span><span class="o">.</span><span class="n">count</span><span class="p">():</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
|
||||
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="c1"># handle read_wstring at end of page</span>
|
||||
<span class="c1"># Of read failed: read only the half of size</span>
|
||||
<span class="c1"># read_size must remain a multiple of 2</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
|
||||
<span class="k">continue</span>
|
||||
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
|
||||
<span class="k">if</span> <span class="sa">b</span><span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
|
||||
@@ -414,13 +414,13 @@
|
||||
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
|
||||
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="c1"># handle read_wstring at end of page</span>
|
||||
<span class="c1"># Of read failed: read only the half of size</span>
|
||||
<span class="c1"># read_size must remain a multiple of 2</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span><span class="p">)</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
|
||||
<span class="k">continue</span>
|
||||
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
|
||||
<span class="c1"># Bytearray will work on py2 & py3</span>
|
||||
@@ -429,10 +429,10 @@
|
||||
<span class="n">utf16_chars</span> <span class="o">=</span> <span class="p">[</span><span class="nb">bytearray</span><span class="p">(</span><span class="n">c</span><span class="p">)</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="o">*</span><span class="p">[</span><span class="nb">iter</span><span class="p">(</span><span class="n">x</span><span class="p">)]</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)]</span>
|
||||
<span class="k">if</span> <span class="sa">b</span><span class="s2">"</span><span class="se">\x00\x00</span><span class="s2">"</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">:</span>
|
||||
<span class="c1"># Translate bytearray to str/bytes for both py2 & py3</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="nb">bytes</span><span class="p">(</span><span class="n">x</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">"</span><span class="se">\x00\x00</span><span class="s2">"</span><span class="p">)])</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">"</span><span class="se">\x00\x00</span><span class="s2">"</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">])</span>
|
||||
<span class="k">break</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="sa">b</span><span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'utf16'</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="nb">bytearray</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">"utf-16"</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">write_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">byte</span><span class="p">):</span>
|
||||
<span class="sd">"""write a byte at ``addr``"""</span>
|
||||
@@ -770,9 +770,15 @@
|
||||
<span class="sd"> """</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Not a syswow process"</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span></div>
|
||||
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
|
||||
|
||||
<span class="c1"># TODO: use ctypes.string_ad / ctypes.wstring_at for read_string / read_wstring ?</span>
|
||||
<span class="c1"># TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?</span>
|
||||
|
||||
<div class="viewcode-block" id="CurrentProcess.read_string"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_string">[docs]</a> <span class="k">def</span> <span class="nf">read_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">string_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div>
|
||||
|
||||
<div class="viewcode-block" id="CurrentProcess.read_wstring"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_wstring">[docs]</a> <span class="k">def</span> <span class="nf">read_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">wstring_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div></div>
|
||||
|
||||
<div class="viewcode-block" id="WinThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a><span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
|
||||
<span class="sd">"""Represent a thread """</span>
|
||||
@@ -1023,7 +1029,7 @@
|
||||
<span class="sd"> :type: :class:`str`</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
|
||||
<span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
|
||||
<span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span> <span class="c1"># Use a syscall and not some remote process reading</span>
|
||||
<span class="c1"># GetProcessImageFileNameA returns the fullpath</span>
|
||||
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"</span><span class="se">\\</span><span class="s2">"</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
|
||||
|
||||
|
||||
+19
-4
@@ -200,7 +200,7 @@
|
||||
|
||||
<span class="k">def</span> <span class="nf">_open_key</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">sam</span><span class="p">):</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="n">WinRegistryKey</span><span class="p">()</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExW</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">sam</span><span class="p">,</span> <span class="n">result</span><span class="p">)</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExW</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">sam</span><span class="p">,</span> <span class="n">result</span><span class="p">)</span> <span class="c1"># TODO: options REG_OPTION_OPEN_LINK</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="sa">u</span><span class="s2">"Opening registry key <</span><span class="si">{0}</span><span class="s2">> (handle=</span><span class="si">{1:#x}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">result</span><span class="o">.</span><span class="n">value</span><span class="p">),</span> <span class="s2">"REGISTRY"</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">result</span>
|
||||
|
||||
@@ -283,21 +283,36 @@
|
||||
<span class="n">databuffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">,</span> <span class="n">nbelt</span><span class="o">=</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
|
||||
<span class="c1"># A value can have been added in-between.</span>
|
||||
<span class="c1"># So recheck the size given by get_key_size_info :)</span>
|
||||
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
|
||||
<span class="c1"># But check 10 times max as RegEnumValueW may bug (seen) and always return ERROR_MORE_DATA even with enought size</span>
|
||||
<span class="k">for</span> <span class="n">_</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">10</span><span class="p">):</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegEnumValueW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">phkey</span><span class="p">,</span> <span class="n">i</span><span class="p">,</span> <span class="n">keyname</span><span class="p">,</span> <span class="n">namesize</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">value_type</span><span class="p">,</span> <span class="n">databuffer</span><span class="p">,</span> <span class="n">datasize</span><span class="p">)</span>
|
||||
<span class="k">break</span>
|
||||
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_MORE_DATA</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="c1"># I found some strange Windows where even with a big enought buffer:</span>
|
||||
<span class="c1"># - the data was filled</span>
|
||||
<span class="c1"># - ERROR_MORE_DATA was returned</span>
|
||||
<span class="c1">## To prevent such bug to trigger and infinite loop, two things</span>
|
||||
<span class="c1"># - If the retuned namesize <= the passed keysize and keyname is not empty -> return the data`</span>
|
||||
<span class="c1"># - Max 10 test to prevent Infinite loop</span>
|
||||
<span class="k">if</span> <span class="p">((</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span> <span class="o"><=</span> <span class="n">max_name_size</span><span class="p">)</span> <span class="ow">and</span> <span class="p">(</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span> <span class="o"><=</span> <span class="n">max_data_size</span><span class="p">)</span> <span class="ow">and</span>
|
||||
<span class="p">(</span><span class="n">keyname</span><span class="p">[:</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">]</span><span class="o">.</span><span class="n">count</span><span class="p">(</span><span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span><span class="p">)</span> <span class="o"><</span> <span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">)):</span> <span class="c1"># Not just 0 Zero ?</span>
|
||||
<span class="k">break</span>
|
||||
|
||||
<span class="c1"># Update the sizes / buffers & try again :)</span>
|
||||
<span class="n">max_name_size</span><span class="p">,</span> <span class="n">max_data_size</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_key_size_info</span><span class="p">()</span>
|
||||
<span class="n">max_name_size</span> <span class="o">+=</span> <span class="mi">1</span>
|
||||
<span class="n">max_data_size</span> <span class="o">+=</span> <span class="mi">2</span>
|
||||
<span class="n">max_name_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">max_name_size</span> <span class="o">+</span> <span class="mi">1</span><span class="p">,</span> <span class="n">namesize</span><span class="o">.</span><span class="n">value</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="c1"># namesize.value may be > to max_name_size apparently (guessed)</span>
|
||||
<span class="n">max_data_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">max_data_size</span> <span class="o">+</span> <span class="mi">2</span><span class="p">,</span> <span class="n">datasize</span><span class="o">.</span><span class="n">value</span> <span class="o">+</span> <span class="mi">2</span><span class="p">)</span> <span class="c1"># datasize.value may be > to max_data_size apparently (seen)</span>
|
||||
<span class="n">namesize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">(</span><span class="n">max_name_size</span><span class="p">)</span>
|
||||
<span class="n">keyname</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
|
||||
<span class="n">datasize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">(</span><span class="n">max_data_size</span><span class="p">)</span>
|
||||
<span class="n">databuffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">,</span> <span class="n">nbelt</span><span class="o">=</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="c1"># Probably a windows bug that prevent us from retrieving the data</span>
|
||||
<span class="c1"># Raise something (thus preventing getting the other values..) ? ignore it ?</span>
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Could not extract registry key values, problably a Windows/hook bug"</span><span class="p">)</span>
|
||||
<span class="n">vobj</span> <span class="o">=</span> <span class="n">decode_registry_buffer</span><span class="p">(</span><span class="n">value_type</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">databuffer</span><span class="p">,</span> <span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">keyname</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">vobj</span><span class="p">,</span> <span class="n">value_type</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
|
||||
@@ -254,12 +254,16 @@
|
||||
<span class="sd"> """</span>
|
||||
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_DisplayName"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="s2">"put_DisplayName"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""The name of the principal"""</span>
|
||||
<span class="nb">id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_Id"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="nb">id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="nb">id</span><span class="p">,</span> <span class="s2">"put_Id"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""the identifier of the principal."""</span>
|
||||
<span class="n">user_id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_UserId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="n">user_id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">user_id</span><span class="p">,</span> <span class="s2">"put_UserId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""the user identifier that is required to run the task"""</span>
|
||||
<span class="n">group_id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_GroupId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="n">group_id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">group_id</span><span class="p">,</span> <span class="s2">"put_GroupId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""the user group that is required to run the task"""</span>
|
||||
<span class="n">run_level</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_RunLevel"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">TASK_RUNLEVEL_TYPE</span><span class="p">)</span>
|
||||
<span class="sd">"""the privilege level that is required to run the tasks</span>
|
||||
|
||||
+274
@@ -0,0 +1,274 @@
|
||||
.. _py_windows_encoding:
|
||||
|
||||
Python, Windows & encoding
|
||||
==========================
|
||||
|
||||
This part is only the result of my experimentations and readings and might not reflect the full picture.
|
||||
|
||||
My near-futur goal is to have PythonForWindows fully support unicode and use W (Wide) API.
|
||||
This will result in most of the strings handled by PFW being unicode strings.
|
||||
|
||||
In python3 it should work as-is because Windows console handle Wide unicode and Py3 is using the ``ConsoleWriteW`` API directly.
|
||||
The fact that python3 :class:`str` type represent unicode string helps a lot.
|
||||
|
||||
|
||||
|
||||
But, As I want to maintains Python2.7 compatibilty and easyness of use, things beging to become tricky.
|
||||
|
||||
The main problem is the ability to print unicode (chinese / russian / ...) in the console and object repr.
|
||||
|
||||
Example:
|
||||
>>> windows.crypto.Certificate.from_file("omae.cer")
|
||||
<Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
|
||||
|
||||
To achieve this in Py2 the required additionnal configuration of the console should be::
|
||||
|
||||
set PYTHONIOENCODING=utf-8 # Set environnement variable PYTHONIOENCODING to utf-8. Allowing UTF8 encoding for python output (including sys.stdout).
|
||||
chcp 65001 # Setting the console code page to 65001 (UTF-8) Allowing the console to print the correct chars when receiving UTF-8 data
|
||||
|
||||
|
||||
For it to work optimaly in Py2.7, it require some tricks in both the codebase, the python configuration and console configuration.
|
||||
|
||||
My goal is to offer the better experience even without any Python/Console configuration.
|
||||
But with the additionnal configuration it should be able to print anything without trouble.
|
||||
|
||||
What does this additional configuration does ?
|
||||
''''''''''''''''''''''''''''''''''''''''''''''
|
||||
|
||||
|
||||
PYTHONIOENCODING
|
||||
^^^^^^^^^^^^^^^^
|
||||
|
||||
|
||||
As the official `Python2 documentation <https://docs.python.org/2/using/cmdline.html#envvar-PYTHONIOENCODING>`_ says::
|
||||
|
||||
Overrides the encoding used for stdin/stdout/stderr, in the syntax encodingname:errorhandler. The :errorhandler part is optional and has the same meaning as in str.encode().
|
||||
|
||||
The goal of setting this environnement variable is to have the stdout encoding set to ``utf-8``.
|
||||
This will allow a somewhat seamless encoding of any unicode string you try to print.
|
||||
|
||||
|
||||
By default, the ``sys.stdout.encoding`` is set according to the current console output codepage (`GetConsoleOutputCP <https://docs.microsoft.com/en-us/windows/console/getconsoleoutputcp>`_) at python initialisation.
|
||||
This can be seen in `Py_InitializeEx <https://github.com/python/cpython/blob/2.7/Python/pythonrun.c#L354>`_.
|
||||
|
||||
Most of the default codepage (437 in my case) cannot encode all unicode character.
|
||||
These two elements together are the reason why priting an unicode string without any change in Python2 will lead to this type of problem::
|
||||
|
||||
|
||||
$ chcp
|
||||
Active code page: 437
|
||||
|
||||
$ python -s -E
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
>>> import sys
|
||||
>>> sys.stdout.encoding
|
||||
'cp437'
|
||||
>>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
|
||||
Traceback (most recent call last):
|
||||
File "<stdin>", line 1, in <module>
|
||||
File "C:\Python27\lib\encodings\cp437.py", line 12, in encode
|
||||
return codecs.charmap_encode(input,errors,encoding_map)
|
||||
UnicodeEncodeError: 'charmap' codec can't encode characters in position 0-8: character maps to <undefined>
|
||||
|
||||
|
||||
.. note::
|
||||
|
||||
Note that the fails is in ``cp437.py`` directly linked to ``sys.stdout.encoding``
|
||||
|
||||
|
||||
By setting ``PYTHONIOENCODING`` you force the ``sys.stdout.encoding``::
|
||||
|
||||
$ chcp
|
||||
Active code page: 437
|
||||
|
||||
$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ python
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
>>> import sys
|
||||
>>> sys.stdout.encoding
|
||||
'utf-8'
|
||||
>>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
|
||||
お前はもう死んでい # Gibberish due to bad codepage in console
|
||||
|
||||
|
||||
Well, it does not raise an exception anymore but it's printing gibberish.
|
||||
This is because, as-is the console still expects cp437 as an output.
|
||||
|
||||
|
||||
chcp 65001
|
||||
^^^^^^^^^^
|
||||
|
||||
The `chcp <https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/chcp>`_ commande allow to display/change the active console code page.
|
||||
The codepage 65001 stand for UTF-8.
|
||||
|
||||
Thus, setting the console code page to 65001 will tell it to expect UTF-8 as a program output. Which is perfect with our previous setup of ``PYTHONIOENCODING``::
|
||||
|
||||
$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ chcp 65001
|
||||
Active code page: 65001
|
||||
|
||||
$ python
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
>>> import sys
|
||||
>>> sys.stdout.encoding
|
||||
'utf-8'
|
||||
>>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
|
||||
お前はもう死んでい
|
||||
|
||||
|
||||
.. warning:
|
||||
|
||||
Well, if ``chcp 65001`` stand for UTF-8 and that without ``PYTHONIOENCODING`` python use the code page has encoding. We do we even need to setup ``PYTHONIOENCODING`` ?
|
||||
|
||||
The response is quite sad..
|
||||
Python setp stdout encoding to cp65001 but it does not recognize the cp65001 encoding as UTF-8. It does not know about it !
|
||||
|
||||
See::
|
||||
|
||||
$ set PYTHONIOENCODING=
|
||||
|
||||
$ chcp 65001
|
||||
Active code page: 65001
|
||||
|
||||
$ python
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
|
||||
>>> import sys
|
||||
|
||||
LookupError: unknown encoding: cp65001 # Broken Interactive console :(
|
||||
|
||||
$ python -c "import sys; print(sys.stdout.encoding); print(u'\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044')"
|
||||
cp65001
|
||||
Traceback (most recent call last):
|
||||
File "<string>", line 1, in <module>
|
||||
LookupError: unknown encoding: cp65001
|
||||
|
||||
|
||||
The case of __repr__
|
||||
''''''''''''''''''''
|
||||
|
||||
The case of UTF-8 and __repr__ in Python2.7 is more tricky.
|
||||
I pay particular attention to this case because I am an heavy user of the interactive console and object ``__repr__`` to explore Windows.
|
||||
|
||||
the ``__repr__`` function cannot return an ``unicode`` object and must return a ``str``.
|
||||
But as I want to be able to output repr for objects with unicode attributes (like a お前はもう死んでい certificate), I need to encode my unicode __repr__.
|
||||
|
||||
In those cases, I encode the repr with the stdout encoding (with backslash escape for non-encodable error).
|
||||
This should assure that the result can always be written to stdout.
|
||||
|
||||
But based on the encoding of stdout and the code page 3 case may appear.
|
||||
For exmple with an object having the following unicode repr:
|
||||
|
||||
* <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
|
||||
|
||||
The possibilities are:
|
||||
|
||||
* stdout encoding do not handle full unicode (like cp437)
|
||||
* repr will be backslash escaped to allow printing
|
||||
* <Certificate "\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
|
||||
|
||||
* stdout encoding is utf-8 but code page is not (like cp437)
|
||||
* console will output gibberish by trying to interpret utf-8 as a custom CodePage
|
||||
* <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
|
||||
|
||||
* stdout encoding is utf-8 and code page is 65001
|
||||
* it works !
|
||||
* <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
|
||||
|
||||
|
||||
|
||||
Sample of test
|
||||
''''''''''''''
|
||||
|
||||
I have created a sample ``samples\encoding\check_encoding_config.py`` that should help to understand and verify the current configuration of the console.
|
||||
The code check and display the values of ``PYTHONIOENCODING``, ``sys.stdout.encoding`` and the current console code page. It also tries to print an unicode string as well as an unicode object __repr__.
|
||||
|
||||
|
||||
No setup
|
||||
^^^^^^^^
|
||||
|
||||
``PYTHONIOENCODING`` is not set and code page is something like 437.
|
||||
|
||||
* The printing of an unicode string will fail
|
||||
* The printing of an unicode __repr__ will display escaped unicode values
|
||||
* PFW make its best to not raise an encoding related exception on __repr__ by checking ``sys.stdout.encoding``
|
||||
|
||||
Example::
|
||||
|
||||
$ chcp 437
|
||||
Active code page: 437
|
||||
|
||||
$ set PYTHONIOENCODING=
|
||||
|
||||
$ python samples\encoding\check_encoding_config.py
|
||||
Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
|
||||
Py2 python/console configuration analysis:
|
||||
[*] env[PYTHONIOENCODING] = None
|
||||
[-] No env variable <PYTHONIOENCODING>.
|
||||
sys.stdout encoding will only depends on your console codepage. Leading to high probability of EncodingError if printing unicode string
|
||||
[*] sys.stdout.encoding = cp437
|
||||
[-] Unoptimal stdout encoding
|
||||
Recommended fix is setting PYTHONIOENCODING == utf-8
|
||||
[*] Console Codepage = 437
|
||||
[-] Non UTF-8 codepage for the current console
|
||||
Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
|
||||
[-] Error printing unicode string: 'charmap' codec can't encode characters in position 23-31: character maps to <undefined>
|
||||
Unicode object repr: <MyUtf8Object name="\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044-\u043a\u0430\u043a\u0438\u0435_\u0444\u0436\u044e\u0449\u0434\u0444\u044f">
|
||||
|
||||
|
||||
PYTHONIOENCODING only
|
||||
^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
``PYTHONIOENCODING`` is set to ``utf-8`` and code page is something like 437.
|
||||
|
||||
* The printing of an unicode string will work but display gibberish
|
||||
* The printing of an unicode __repr__ will work but display gibberish
|
||||
|
||||
This is due to a mis-match between python output encoding and the console expected output.
|
||||
|
||||
Example::
|
||||
|
||||
$ chcp
|
||||
Active code page: 437
|
||||
|
||||
$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ python samples\encoding\check_encoding_config.py
|
||||
Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
|
||||
Py2 python/console configuration analysis:
|
||||
[*] env[PYTHONIOENCODING] = utf-8
|
||||
[+] Optimal PYTHONIOENCODING
|
||||
[*] sys.stdout.encoding = utf-8
|
||||
[*] Console Codepage = 437
|
||||
[-] Non UTF-8 codepage for the current console
|
||||
Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
|
||||
Unicode string print: <お前はもう死んでい-какие_фжющдфя>
|
||||
Unicode object repr: <MyUtf8Object name="お前はもう死んでい-какие_фжющдфя">
|
||||
|
||||
|
||||
Full setup
|
||||
^^^^^^^^^^
|
||||
|
||||
``PYTHONIOENCODING`` is set to ``utf-8`` and code page is 65001.
|
||||
Everything should work::
|
||||
|
||||
$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ chcp 65001
|
||||
Active code page: 65001
|
||||
|
||||
$ python samples\encoding\check_encoding_config.py
|
||||
Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
|
||||
Py2 python/console configuration analysis:
|
||||
[*] env[PYTHONIOENCODING] = utf-8
|
||||
[+] Optimal PYTHONIOENCODING
|
||||
[*] sys.stdout.encoding = utf-8
|
||||
[*] Console Codepage = 65001
|
||||
Unicode string print: <お前はもう死んでい-какие_фжющдфя>
|
||||
Unicode object repr: <MyUtf8Object name="お前はもう死んでい-какие_фжющдфя">
|
||||
+125
@@ -147,6 +147,74 @@ Another example from a project::
|
||||
'\x81~\x08\x0c\x00\x00\x00u&\x8bN\x10\x8bQ\x04\x8bA\x08\x8b\t\x81\xf9\x01\x00\x00\x00u\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00u\x04f\xef\xeb\x01\xef1\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3'
|
||||
|
||||
|
||||
Available Instructions in X86 assembler
|
||||
'''''''''''''''''''''''''''''''''''''''
|
||||
|
||||
.. note::
|
||||
Not all encodings may be implemented for each of the instructions.
|
||||
|
||||
``Byte`` and ``Raw`` are not x86 instruction and allow to insert arbitrary data to the generated code.
|
||||
|
||||
Listing:
|
||||
|
||||
* Add
|
||||
* And
|
||||
* Byte
|
||||
* Cmp
|
||||
* CmpsB
|
||||
* CmpsD
|
||||
* CmpsW
|
||||
* Cpuid
|
||||
* Dec
|
||||
* In
|
||||
* Inc
|
||||
* Int
|
||||
* Int3
|
||||
* Iret
|
||||
* Lea
|
||||
* Mov
|
||||
* Movsb
|
||||
* Movsd
|
||||
* Nop
|
||||
* Not
|
||||
* Or
|
||||
* Out
|
||||
* Pop
|
||||
* Popad
|
||||
* Popfd
|
||||
* Push
|
||||
* Pushad
|
||||
* Pushfd
|
||||
* Raw
|
||||
* Ret
|
||||
* Retf
|
||||
* Rol
|
||||
* Ror
|
||||
* ScasB
|
||||
* ScasD
|
||||
* ScasW
|
||||
* Shl
|
||||
* Shr
|
||||
* StosB
|
||||
* StosD
|
||||
* StosW
|
||||
* Sub
|
||||
* Test
|
||||
* Xchg
|
||||
* Xor
|
||||
|
||||
.. note::
|
||||
|
||||
``Raw``: Output raw data from an hexadecimal string
|
||||
|
||||
>>> windows.native_exec.simple_x64.Raw("90C332FCFF").get_code()
|
||||
'\x90\xc32\xfc\xff'
|
||||
|
||||
``Byte``: Output a raw byte
|
||||
|
||||
>>> windows.native_exec.simple_x86.Byte(0x42).get_code()
|
||||
'B'
|
||||
|
||||
:mod:`windows.native_exec.simple_x64` -- X64 Assembler
|
||||
""""""""""""""""""""""""""""""""""""""""""""""""""""""
|
||||
|
||||
@@ -180,6 +248,63 @@ Demo::
|
||||
'g\x8b\x00'
|
||||
|
||||
|
||||
Available Instructions in X64 assembler
|
||||
'''''''''''''''''''''''''''''''''''''''
|
||||
|
||||
.. note::
|
||||
Not all encodings may be implemented for each of the instructions.
|
||||
|
||||
``Raw`` is not an x64 instruction and allow to insert arbitrary data to the generated code.
|
||||
|
||||
Listing:
|
||||
* Add
|
||||
* And
|
||||
* Cmp
|
||||
* CmpsB
|
||||
* CmpsD
|
||||
* CmpsQ
|
||||
* CmpsW
|
||||
* Cpuid
|
||||
* Dec
|
||||
* In
|
||||
* Inc
|
||||
* Int
|
||||
* Int3
|
||||
* Lea
|
||||
* Mov
|
||||
* Nop
|
||||
* Not
|
||||
* Or
|
||||
* Out
|
||||
* Pop
|
||||
* Popfq
|
||||
* Push
|
||||
* Pushfq
|
||||
* Raw
|
||||
* Ret
|
||||
* Retf
|
||||
* Retf32
|
||||
* ScasB
|
||||
* ScasD
|
||||
* ScasQ
|
||||
* ScasW
|
||||
* Shl
|
||||
* Shr
|
||||
* Sub
|
||||
* Test
|
||||
* Xchg
|
||||
* Xor
|
||||
|
||||
|
||||
.. note::
|
||||
|
||||
``Raw``: Output raw data from an hexadecimal string
|
||||
|
||||
>>> windows.native_exec.simple_x64.Raw("90C332FCFF").get_code()
|
||||
'\x90\xc32\xfc\xff'
|
||||
|
||||
|
||||
|
||||
|
||||
:mod:`windows.native_exec.nativeutils` -- Native utility functions
|
||||
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
|
||||
|
||||
+1778
-1568
File diff suppressed because it is too large
Load Diff
+1155
-213
File diff suppressed because it is too large
Load Diff
Vendored
+372
@@ -0,0 +1,372 @@
|
||||
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<title>17. Python, Windows & encoding — PythonForWindows 0.6 documentation</title>
|
||||
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
|
||||
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
|
||||
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css" />
|
||||
|
||||
<script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
|
||||
<script type="text/javascript" src="_static/jquery.js"></script>
|
||||
<script type="text/javascript" src="_static/underscore.js"></script>
|
||||
<script type="text/javascript" src="_static/doctools.js"></script>
|
||||
<script type="text/javascript" src="_static/language_data.js"></script>
|
||||
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="next" title="18. Internals" href="internals.html" />
|
||||
<link rel="prev" title="16. Early Work In Progress" href="wip.html" />
|
||||
</head><body>
|
||||
<div class="related" role="navigation" aria-label="related navigation">
|
||||
<h3>Navigation</h3>
|
||||
<ul>
|
||||
<li class="right" style="margin-right: 10px">
|
||||
<a href="genindex.html" title="General Index"
|
||||
accesskey="I">index</a></li>
|
||||
<li class="right" >
|
||||
<a href="py-modindex.html" title="Python Module Index"
|
||||
>modules</a> |</li>
|
||||
<li class="right" >
|
||||
<a href="internals.html" title="18. Internals"
|
||||
accesskey="N">next</a> |</li>
|
||||
<li class="right" >
|
||||
<a href="wip.html" title="16. Early Work In Progress"
|
||||
accesskey="P">previous</a> |</li>
|
||||
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> »</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<div class="document">
|
||||
<div class="documentwrapper">
|
||||
<div class="bodywrapper">
|
||||
<div class="body" role="main">
|
||||
|
||||
<div class="section" id="python-windows-encoding">
|
||||
<span id="py-windows-encoding"></span><h1>17. Python, Windows & encoding<a class="headerlink" href="#python-windows-encoding" title="Permalink to this headline">¶</a></h1>
|
||||
<p>This part is only the result of my experimentations and readings and might not reflect the full picture.</p>
|
||||
<p>My near-futur goal is to have PythonForWindows fully support unicode and use W (Wide) API.
|
||||
This will result in most of the strings handled by PFW being unicode strings.</p>
|
||||
<p>In python3 it should work as-is because Windows console handle Wide unicode and Py3 is using the <code class="docutils literal notranslate"><span class="pre">ConsoleWriteW</span></code> API directly.
|
||||
The fact that python3 <a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a> type represent unicode string helps a lot.</p>
|
||||
<p>But, As I want to maintains Python2.7 compatibilty and easyness of use, things beging to become tricky.</p>
|
||||
<p>The main problem is the ability to print unicode (chinese / russian / …) in the console and object repr.</p>
|
||||
<dl class="docutils">
|
||||
<dt>Example:</dt>
|
||||
<dd><div class="first last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">Certificate</span><span class="o">.</span><span class="n">from_file</span><span class="p">(</span><span class="s2">"omae.cer"</span><span class="p">)</span>
|
||||
<span class="go"><Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99"></span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</dd>
|
||||
</dl>
|
||||
<p>To achieve this in Py2 the required additionnal configuration of the console should be:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="nb">set</span> <span class="n">PYTHONIOENCODING</span><span class="o">=</span><span class="n">utf</span><span class="o">-</span><span class="mi">8</span> <span class="c1"># Set environnement variable PYTHONIOENCODING to utf-8. Allowing UTF8 encoding for python output (including sys.stdout).</span>
|
||||
<span class="n">chcp</span> <span class="mi">65001</span> <span class="c1"># Setting the console code page to 65001 (UTF-8) Allowing the console to print the correct chars when receiving UTF-8 data</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<p>For it to work optimaly in Py2.7, it require some tricks in both the codebase, the python configuration and console configuration.</p>
|
||||
<p>My goal is to offer the better experience even without any Python/Console configuration.
|
||||
But with the additionnal configuration it should be able to print anything without trouble.</p>
|
||||
<div class="section" id="what-does-this-additional-configuration-does">
|
||||
<h2>17.1. What does this additional configuration does ?<a class="headerlink" href="#what-does-this-additional-configuration-does" title="Permalink to this headline">¶</a></h2>
|
||||
<div class="section" id="pythonioencoding">
|
||||
<h3>17.1.1. PYTHONIOENCODING<a class="headerlink" href="#pythonioencoding" title="Permalink to this headline">¶</a></h3>
|
||||
<p>As the official <a class="reference external" href="https://docs.python.org/2/using/cmdline.html#envvar-PYTHONIOENCODING">Python2 documentation</a> says:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">Overrides</span> <span class="n">the</span> <span class="n">encoding</span> <span class="n">used</span> <span class="k">for</span> <span class="n">stdin</span><span class="o">/</span><span class="n">stdout</span><span class="o">/</span><span class="n">stderr</span><span class="p">,</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">syntax</span> <span class="n">encodingname</span><span class="p">:</span><span class="n">errorhandler</span><span class="o">.</span> <span class="n">The</span> <span class="p">:</span><span class="n">errorhandler</span> <span class="n">part</span> <span class="ow">is</span> <span class="n">optional</span> <span class="ow">and</span> <span class="n">has</span> <span class="n">the</span> <span class="n">same</span> <span class="n">meaning</span> <span class="k">as</span> <span class="ow">in</span> <span class="nb">str</span><span class="o">.</span><span class="n">encode</span><span class="p">()</span><span class="o">.</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<p>The goal of setting this environnement variable is to have the stdout encoding set to <code class="docutils literal notranslate"><span class="pre">utf-8</span></code>.
|
||||
This will allow a somewhat seamless encoding of any unicode string you try to print.</p>
|
||||
<p>By default, the <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code> is set according to the current console output codepage (<a class="reference external" href="https://docs.microsoft.com/en-us/windows/console/getconsoleoutputcp">GetConsoleOutputCP</a>) at python initialisation.
|
||||
This can be seen in <a class="reference external" href="https://github.com/python/cpython/blob/2.7/Python/pythonrun.c#L354">Py_InitializeEx</a>.</p>
|
||||
<p>Most of the default codepage (437 in my case) cannot encode all unicode character.
|
||||
These two elements together are the reason why priting an unicode string without any change in Python2 will lead to this type of problem:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp
|
||||
Active code page: 437
|
||||
|
||||
$ python -s -E
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
>>> import sys
|
||||
>>> sys.stdout.encoding
|
||||
'cp437'
|
||||
>>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
|
||||
Traceback (most recent call last):
|
||||
File "<stdin>", line 1, in <module>
|
||||
File "C:\Python27\lib\encodings\cp437.py", line 12, in encode
|
||||
return codecs.charmap_encode(input,errors,encoding_map)
|
||||
UnicodeEncodeError: 'charmap' codec can't encode characters in position 0-8: character maps to <undefined>
|
||||
</pre></div>
|
||||
</div>
|
||||
<div class="admonition note">
|
||||
<p class="first admonition-title">Note</p>
|
||||
<p class="last">Note that the fails is in <code class="docutils literal notranslate"><span class="pre">cp437.py</span></code> directly linked to <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code></p>
|
||||
</div>
|
||||
<p>By setting <code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> you force the <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code>:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp
|
||||
Active code page: 437
|
||||
|
||||
$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ python
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
>>> import sys
|
||||
>>> sys.stdout.encoding
|
||||
'utf-8'
|
||||
>>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
|
||||
お前はもう死んでい # Gibberish due to bad codepage in console
|
||||
</pre></div>
|
||||
</div>
|
||||
<p>Well, it does not raise an exception anymore but it’s printing gibberish.
|
||||
This is because, as-is the console still expects cp437 as an output.</p>
|
||||
</div>
|
||||
<div class="section" id="chcp-65001">
|
||||
<h3>17.1.2. chcp 65001<a class="headerlink" href="#chcp-65001" title="Permalink to this headline">¶</a></h3>
|
||||
<p>The <a class="reference external" href="https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/chcp">chcp</a> commande allow to display/change the active console code page.
|
||||
The codepage 65001 stand for UTF-8.</p>
|
||||
<p>Thus, setting the console code page to 65001 will tell it to expect UTF-8 as a program output. Which is perfect with our previous setup of <code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code>:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ chcp 65001
|
||||
Active code page: 65001
|
||||
|
||||
$ python
|
||||
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
|
||||
Type "help", "copyright", "credits" or "license" for more information.
|
||||
>>> import sys
|
||||
>>> sys.stdout.encoding
|
||||
'utf-8'
|
||||
>>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
|
||||
お前はもう死んでい
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="the-case-of-repr">
|
||||
<h2>17.2. The case of __repr__<a class="headerlink" href="#the-case-of-repr" title="Permalink to this headline">¶</a></h2>
|
||||
<p>The case of UTF-8 and __repr__ in Python2.7 is more tricky.
|
||||
I pay particular attention to this case because I am an heavy user of the interactive console and object <code class="docutils literal notranslate"><span class="pre">__repr__</span></code> to explore Windows.</p>
|
||||
<p>the <code class="docutils literal notranslate"><span class="pre">__repr__</span></code> function cannot return an <code class="docutils literal notranslate"><span class="pre">unicode</span></code> object and must return a <code class="docutils literal notranslate"><span class="pre">str</span></code>.
|
||||
But as I want to be able to output repr for objects with unicode attributes (like a お前はもう死んでい certificate), I need to encode my unicode __repr__.</p>
|
||||
<p>In those cases, I encode the repr with the stdout encoding (with backslash escape for non-encodable error).
|
||||
This should assure that the result can always be written to stdout.</p>
|
||||
<p>But based on the encoding of stdout and the code page 3 case may appear.
|
||||
For exmple with an object having the following unicode repr:</p>
|
||||
<blockquote>
|
||||
<div><ul class="simple">
|
||||
<li><Certificate “お前はもう死んでい” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”></li>
|
||||
</ul>
|
||||
</div></blockquote>
|
||||
<p>The possibilities are:</p>
|
||||
<blockquote>
|
||||
<div><ul class="simple">
|
||||
<li><dl class="first docutils">
|
||||
<dt>stdout encoding do not handle full unicode (like cp437)</dt>
|
||||
<dd><ul class="first last">
|
||||
<li>repr will be backslash escaped to allow printing</li>
|
||||
<li><Certificate “u304au524du306fu3082u3046u6b7bu3093u3067u3044” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”></li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
</li>
|
||||
<li><dl class="first docutils">
|
||||
<dt>stdout encoding is utf-8 but code page is not (like cp437)</dt>
|
||||
<dd><ul class="first last">
|
||||
<li>console will output gibberish by trying to interpret utf-8 as a custom CodePage</li>
|
||||
<li><Certificate “πüèσëìπü»πééπü嵡╗πéôπüºπüä” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”></li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
</li>
|
||||
<li><dl class="first docutils">
|
||||
<dt>stdout encoding is utf-8 and code page is 65001</dt>
|
||||
<dd><ul class="first last">
|
||||
<li>it works !</li>
|
||||
<li><Certificate “お前はもう死んでい” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”></li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
</li>
|
||||
</ul>
|
||||
</div></blockquote>
|
||||
</div>
|
||||
<div class="section" id="sample-of-test">
|
||||
<h2>17.3. Sample of test<a class="headerlink" href="#sample-of-test" title="Permalink to this headline">¶</a></h2>
|
||||
<p>I have created a sample <code class="docutils literal notranslate"><span class="pre">samples\encoding\check_encoding_config.py</span></code> that should help to understand and verify the current configuration of the console.
|
||||
The code check and display the values of <code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code>, <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code> and the current console code page. It also tries to print an unicode string as well as an unicode object __repr__.</p>
|
||||
<div class="section" id="no-setup">
|
||||
<h3>17.3.1. No setup<a class="headerlink" href="#no-setup" title="Permalink to this headline">¶</a></h3>
|
||||
<p><code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> is not set and code page is something like 437.</p>
|
||||
<blockquote>
|
||||
<div><ul class="simple">
|
||||
<li>The printing of an unicode string will fail</li>
|
||||
<li><dl class="first docutils">
|
||||
<dt>The printing of an unicode __repr__ will display escaped unicode values</dt>
|
||||
<dd><ul class="first last">
|
||||
<li>PFW make its best to not raise an encoding related exception on __repr__ by checking <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code></li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
</li>
|
||||
</ul>
|
||||
</div></blockquote>
|
||||
<p>Example:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp 437
|
||||
Active code page: 437
|
||||
|
||||
$ set PYTHONIOENCODING=
|
||||
|
||||
$ python samples\encoding\check_encoding_config.py
|
||||
Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
|
||||
Py2 python/console configuration analysis:
|
||||
[*] env[PYTHONIOENCODING] = None
|
||||
[-] No env variable <PYTHONIOENCODING>.
|
||||
sys.stdout encoding will only depends on your console codepage. Leading to high probability of EncodingError if printing unicode string
|
||||
[*] sys.stdout.encoding = cp437
|
||||
[-] Unoptimal stdout encoding
|
||||
Recommended fix is setting PYTHONIOENCODING == utf-8
|
||||
[*] Console Codepage = 437
|
||||
[-] Non UTF-8 codepage for the current console
|
||||
Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
|
||||
[-] Error printing unicode string: 'charmap' codec can't encode characters in position 23-31: character maps to <undefined>
|
||||
Unicode object repr: <MyUtf8Object name="\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044-\u043a\u0430\u043a\u0438\u0435_\u0444\u0436\u044e\u0449\u0434\u0444\u044f">
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="pythonioencoding-only">
|
||||
<h3>17.3.2. PYTHONIOENCODING only<a class="headerlink" href="#pythonioencoding-only" title="Permalink to this headline">¶</a></h3>
|
||||
<p><code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> is set to <code class="docutils literal notranslate"><span class="pre">utf-8</span></code> and code page is something like 437.</p>
|
||||
<blockquote>
|
||||
<div><ul class="simple">
|
||||
<li>The printing of an unicode string will work but display gibberish</li>
|
||||
<li>The printing of an unicode __repr__ will work but display gibberish</li>
|
||||
</ul>
|
||||
</div></blockquote>
|
||||
<p>This is due to a mis-match between python output encoding and the console expected output.</p>
|
||||
<p>Example:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp
|
||||
Active code page: 437
|
||||
|
||||
$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ python samples\encoding\check_encoding_config.py
|
||||
Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
|
||||
Py2 python/console configuration analysis:
|
||||
[*] env[PYTHONIOENCODING] = utf-8
|
||||
[+] Optimal PYTHONIOENCODING
|
||||
[*] sys.stdout.encoding = utf-8
|
||||
[*] Console Codepage = 437
|
||||
[-] Non UTF-8 codepage for the current console
|
||||
Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
|
||||
Unicode string print: <お前はもう死んでい-какие_фжющдфя>
|
||||
Unicode object repr: <MyUtf8Object name="お前はもう死んでい-какие_фжющдфя">
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="full-setup">
|
||||
<h3>17.3.3. Full setup<a class="headerlink" href="#full-setup" title="Permalink to this headline">¶</a></h3>
|
||||
<p><code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> is set to <code class="docutils literal notranslate"><span class="pre">utf-8</span></code> and code page is 65001.
|
||||
Everything should work:</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ set PYTHONIOENCODING=utf-8
|
||||
|
||||
$ chcp 65001
|
||||
Active code page: 65001
|
||||
|
||||
$ python samples\encoding\check_encoding_config.py
|
||||
Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
|
||||
Py2 python/console configuration analysis:
|
||||
[*] env[PYTHONIOENCODING] = utf-8
|
||||
[+] Optimal PYTHONIOENCODING
|
||||
[*] sys.stdout.encoding = utf-8
|
||||
[*] Console Codepage = 65001
|
||||
Unicode string print: <お前はもう死んでい-какие_фжющдфя>
|
||||
Unicode object repr: <MyUtf8Object name="お前はもう死んでい-какие_фжющдфя">
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
||||
<div class="sphinxsidebarwrapper">
|
||||
<h3><a href="index.html">Table of Contents</a></h3>
|
||||
<ul>
|
||||
<li><a class="reference internal" href="#">17. Python, Windows & encoding</a><ul>
|
||||
<li><a class="reference internal" href="#what-does-this-additional-configuration-does">17.1. What does this additional configuration does ?</a><ul>
|
||||
<li><a class="reference internal" href="#pythonioencoding">17.1.1. PYTHONIOENCODING</a></li>
|
||||
<li><a class="reference internal" href="#chcp-65001">17.1.2. chcp 65001</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a class="reference internal" href="#the-case-of-repr">17.2. The case of __repr__</a></li>
|
||||
<li><a class="reference internal" href="#sample-of-test">17.3. Sample of test</a><ul>
|
||||
<li><a class="reference internal" href="#no-setup">17.3.1. No setup</a></li>
|
||||
<li><a class="reference internal" href="#pythonioencoding-only">17.3.2. PYTHONIOENCODING only</a></li>
|
||||
<li><a class="reference internal" href="#full-setup">17.3.3. Full setup</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<h4>Previous topic</h4>
|
||||
<p class="topless"><a href="wip.html"
|
||||
title="previous chapter">16. Early Work In Progress</a></p>
|
||||
<h4>Next topic</h4>
|
||||
<p class="topless"><a href="internals.html"
|
||||
title="next chapter">18. Internals</a></p>
|
||||
<div role="note" aria-label="source link">
|
||||
<h3>This Page</h3>
|
||||
<ul class="this-page-menu">
|
||||
<li><a href="_sources/encoding.rst.txt"
|
||||
rel="nofollow">Show Source</a></li>
|
||||
</ul>
|
||||
</div>
|
||||
<div id="searchbox" style="display: none" role="search">
|
||||
<h3>Quick search</h3>
|
||||
<div class="searchformwrapper">
|
||||
<form class="search" action="search.html" method="get">
|
||||
<input type="text" name="q" />
|
||||
<input type="submit" value="Go" />
|
||||
<input type="hidden" name="check_keywords" value="yes" />
|
||||
<input type="hidden" name="area" value="default" />
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<script type="text/javascript">$('#searchbox').show(0);</script>
|
||||
</div>
|
||||
</div>
|
||||
<div class="clearer"></div>
|
||||
</div>
|
||||
<div class="related" role="navigation" aria-label="related navigation">
|
||||
<h3>Navigation</h3>
|
||||
<ul>
|
||||
<li class="right" style="margin-right: 10px">
|
||||
<a href="genindex.html" title="General Index"
|
||||
>index</a></li>
|
||||
<li class="right" >
|
||||
<a href="py-modindex.html" title="Python Module Index"
|
||||
>modules</a> |</li>
|
||||
<li class="right" >
|
||||
<a href="internals.html" title="18. Internals"
|
||||
>next</a> |</li>
|
||||
<li class="right" >
|
||||
<a href="wip.html" title="16. Early Work In Progress"
|
||||
>previous</a> |</li>
|
||||
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> »</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="footer" role="contentinfo">
|
||||
© Copyright 2015-2020, Clement Rouault.
|
||||
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.8.5.
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
Vendored
+1
-1
@@ -174,7 +174,7 @@ This function will call <code class="docutils literal notranslate"><span class="
|
||||
|
||||
<dl class="method">
|
||||
<dt id="windows.winobject.event_trace.EtwTrace.start">
|
||||
<code class="descname">start</code><span class="sig-paren">(</span><em>flags=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_trace.html#EtwTrace.start"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_trace.EtwTrace.start" title="Permalink to this definition">¶</a></dt>
|
||||
<code class="descname">start</code><span class="sig-paren">(</span><em>flags=0</em>, <em>mode=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_trace.html#EtwTrace.start"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_trace.EtwTrace.start" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Start the tracing</p>
|
||||
</dd></dl>
|
||||
|
||||
|
||||
Vendored
+4
@@ -199,6 +199,8 @@
|
||||
<dd><code class="docutils literal notranslate"><span class="pre">Event/EventData[Data='C:\WINDOWS\System32\svchost.exe']</span></code></dd>
|
||||
<dt>List all events with an EventID of 2006:</dt>
|
||||
<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=2006]</span></code></dd>
|
||||
<dt>List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</dt>
|
||||
<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=3]</span> <span class="pre">and</span> <span class="pre">Event/EventData/Data[@Name='DestinationIp']</span> <span class="pre">and</span> <span class="pre">Event/EventData[Data='10.0.0.2']</span></code></dd>
|
||||
</dl>
|
||||
</div>
|
||||
<table class="docutils field-list" frame="void" rules="none">
|
||||
@@ -586,6 +588,8 @@
|
||||
<dd><code class="docutils literal notranslate"><span class="pre">Event/EventData[Data='C:\WINDOWS\System32\svchost.exe']</span></code></dd>
|
||||
<dt>List all events with an EventID of 2006:</dt>
|
||||
<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=2006]</span></code></dd>
|
||||
<dt>List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</dt>
|
||||
<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=3]</span> <span class="pre">and</span> <span class="pre">Event/EventData/Data[@Name='DestinationIp']</span> <span class="pre">and</span> <span class="pre">Event/EventData[Data='10.0.0.2']</span></code></dd>
|
||||
</dl>
|
||||
</div>
|
||||
<table class="docutils field-list" frame="void" rules="none">
|
||||
|
||||
Vendored
+1002
-46
File diff suppressed because it is too large
Load Diff
Vendored
+138
-2
@@ -381,6 +381,77 @@ including jump and label via the <code class="xref py py-class docutils literal
|
||||
<span class="s1">'</span><span class="se">\x81</span><span class="s1">~</span><span class="se">\x08\x0c\x00\x00\x00</span><span class="s1">u&</span><span class="se">\x8b</span><span class="s1">N</span><span class="se">\x10\x8b</span><span class="s1">Q</span><span class="se">\x04\x8b</span><span class="s1">A</span><span class="se">\x08\x8b\t\x81\xf9\x01\x00\x00\x00</span><span class="s1">u</span><span class="se">\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00</span><span class="s1">u</span><span class="se">\x04</span><span class="s1">f</span><span class="se">\xef\xeb\x01\xef</span><span class="s1">1</span><span class="se">\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3</span><span class="s1">'</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<div class="section" id="available-instructions-in-x86-assembler">
|
||||
<h3>3.2.1. Available Instructions in X86 assembler<a class="headerlink" href="#available-instructions-in-x86-assembler" title="Permalink to this headline">¶</a></h3>
|
||||
<div class="admonition note">
|
||||
<p class="first admonition-title">Note</p>
|
||||
<p>Not all encodings may be implemented for each of the instructions.</p>
|
||||
<p class="last"><code class="docutils literal notranslate"><span class="pre">Byte</span></code> and <code class="docutils literal notranslate"><span class="pre">Raw</span></code> are not x86 instruction and allow to insert arbitrary data to the generated code.</p>
|
||||
</div>
|
||||
<p>Listing:</p>
|
||||
<blockquote>
|
||||
<div><ul class="simple">
|
||||
<li>Add</li>
|
||||
<li>And</li>
|
||||
<li>Byte</li>
|
||||
<li>Cmp</li>
|
||||
<li>CmpsB</li>
|
||||
<li>CmpsD</li>
|
||||
<li>CmpsW</li>
|
||||
<li>Cpuid</li>
|
||||
<li>Dec</li>
|
||||
<li>In</li>
|
||||
<li>Inc</li>
|
||||
<li>Int</li>
|
||||
<li>Int3</li>
|
||||
<li>Iret</li>
|
||||
<li>Lea</li>
|
||||
<li>Mov</li>
|
||||
<li>Movsb</li>
|
||||
<li>Movsd</li>
|
||||
<li>Nop</li>
|
||||
<li>Not</li>
|
||||
<li>Or</li>
|
||||
<li>Out</li>
|
||||
<li>Pop</li>
|
||||
<li>Popad</li>
|
||||
<li>Popfd</li>
|
||||
<li>Push</li>
|
||||
<li>Pushad</li>
|
||||
<li>Pushfd</li>
|
||||
<li>Raw</li>
|
||||
<li>Ret</li>
|
||||
<li>Retf</li>
|
||||
<li>Rol</li>
|
||||
<li>Ror</li>
|
||||
<li>ScasB</li>
|
||||
<li>ScasD</li>
|
||||
<li>ScasW</li>
|
||||
<li>Shl</li>
|
||||
<li>Shr</li>
|
||||
<li>StosB</li>
|
||||
<li>StosD</li>
|
||||
<li>StosW</li>
|
||||
<li>Sub</li>
|
||||
<li>Test</li>
|
||||
<li>Xchg</li>
|
||||
<li>Xor</li>
|
||||
</ul>
|
||||
</div></blockquote>
|
||||
<div class="admonition note">
|
||||
<p class="first admonition-title">Note</p>
|
||||
<p><code class="docutils literal notranslate"><span class="pre">Raw</span></code>: Output raw data from an hexadecimal string</p>
|
||||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">simple_x64</span><span class="o">.</span><span class="n">Raw</span><span class="p">(</span><span class="s2">"90C332FCFF"</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
|
||||
<span class="go">'\x90\xc32\xfc\xff'</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<p><code class="docutils literal notranslate"><span class="pre">Byte</span></code>: Output a raw byte</p>
|
||||
<div class="last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">simple_x86</span><span class="o">.</span><span class="n">Byte</span><span class="p">(</span><span class="mh">0x42</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
|
||||
<span class="go">'B'</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-windows.native_exec.simple_x64">
|
||||
<span id="windows-native-exec-simple-x64-x64-assembler"></span><h2>3.3. <a class="reference internal" href="#module-windows.native_exec.simple_x64" title="windows.native_exec.simple_x64"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code></a> – X64 Assembler<a class="headerlink" href="#module-windows.native_exec.simple_x64" title="Permalink to this headline">¶</a></h2>
|
||||
@@ -413,6 +484,65 @@ including jump and label via the <code class="xref py py-class docutils literal
|
||||
<span class="go">'g\x8b\x00'</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
<div class="section" id="available-instructions-in-x64-assembler">
|
||||
<h3>3.3.1. Available Instructions in X64 assembler<a class="headerlink" href="#available-instructions-in-x64-assembler" title="Permalink to this headline">¶</a></h3>
|
||||
<div class="admonition note">
|
||||
<p class="first admonition-title">Note</p>
|
||||
<p>Not all encodings may be implemented for each of the instructions.</p>
|
||||
<p class="last"><code class="docutils literal notranslate"><span class="pre">Raw</span></code> is not an x64 instruction and allow to insert arbitrary data to the generated code.</p>
|
||||
</div>
|
||||
<dl class="docutils">
|
||||
<dt>Listing:</dt>
|
||||
<dd><ul class="first last simple">
|
||||
<li>Add</li>
|
||||
<li>And</li>
|
||||
<li>Cmp</li>
|
||||
<li>CmpsB</li>
|
||||
<li>CmpsD</li>
|
||||
<li>CmpsQ</li>
|
||||
<li>CmpsW</li>
|
||||
<li>Cpuid</li>
|
||||
<li>Dec</li>
|
||||
<li>In</li>
|
||||
<li>Inc</li>
|
||||
<li>Int</li>
|
||||
<li>Int3</li>
|
||||
<li>Lea</li>
|
||||
<li>Mov</li>
|
||||
<li>Nop</li>
|
||||
<li>Not</li>
|
||||
<li>Or</li>
|
||||
<li>Out</li>
|
||||
<li>Pop</li>
|
||||
<li>Popfq</li>
|
||||
<li>Push</li>
|
||||
<li>Pushfq</li>
|
||||
<li>Raw</li>
|
||||
<li>Ret</li>
|
||||
<li>Retf</li>
|
||||
<li>Retf32</li>
|
||||
<li>ScasB</li>
|
||||
<li>ScasD</li>
|
||||
<li>ScasQ</li>
|
||||
<li>ScasW</li>
|
||||
<li>Shl</li>
|
||||
<li>Shr</li>
|
||||
<li>Sub</li>
|
||||
<li>Test</li>
|
||||
<li>Xchg</li>
|
||||
<li>Xor</li>
|
||||
</ul>
|
||||
</dd>
|
||||
</dl>
|
||||
<div class="admonition note">
|
||||
<p class="first admonition-title">Note</p>
|
||||
<p><code class="docutils literal notranslate"><span class="pre">Raw</span></code>: Output raw data from an hexadecimal string</p>
|
||||
<div class="last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">>>> </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">simple_x64</span><span class="o">.</span><span class="n">Raw</span><span class="p">(</span><span class="s2">"90C332FCFF"</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
|
||||
<span class="go">'\x90\xc32\xfc\xff'</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="section" id="module-windows.native_exec.nativeutils">
|
||||
<span id="windows-native-exec-nativeutils-native-utility-functions"></span><h2>3.4. <a class="reference internal" href="#module-windows.native_exec.nativeutils" title="windows.native_exec.nativeutils"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.nativeutils</span></code></a> – Native utility functions<a class="headerlink" href="#module-windows.native_exec.nativeutils" title="Permalink to this headline">¶</a></h2>
|
||||
@@ -500,8 +630,14 @@ the end of your <code class="xref py py-class docutils literal notranslate"><spa
|
||||
<ul>
|
||||
<li><a class="reference internal" href="#">3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a><ul>
|
||||
<li><a class="reference internal" href="#module-windows.native_exec.cpuid">3.1. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.cpuid</span></code> – Interface to native CPUID</a></li>
|
||||
<li><a class="reference internal" href="#module-windows.native_exec.simple_x86">3.2. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code> – X86 Assembler</a></li>
|
||||
<li><a class="reference internal" href="#module-windows.native_exec.simple_x64">3.3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code> – X64 Assembler</a></li>
|
||||
<li><a class="reference internal" href="#module-windows.native_exec.simple_x86">3.2. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code> – X86 Assembler</a><ul>
|
||||
<li><a class="reference internal" href="#available-instructions-in-x86-assembler">3.2.1. Available Instructions in X86 assembler</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a class="reference internal" href="#module-windows.native_exec.simple_x64">3.3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code> – X64 Assembler</a><ul>
|
||||
<li><a class="reference internal" href="#available-instructions-in-x64-assembler">3.3.1. Available Instructions in X64 assembler</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li><a class="reference internal" href="#module-windows.native_exec.nativeutils">3.4. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.nativeutils</span></code> – Native utility functions</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
Vendored
+2
-2
@@ -357,13 +357,13 @@
|
||||
|
||||
<dl class="method">
|
||||
<dt id="windows.winobject.process.CurrentProcess.read_string">
|
||||
<code class="descname">read_string</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Permalink to this definition">¶</a></dt>
|
||||
<code class="descname">read_string</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_string"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||||
</dd></dl>
|
||||
|
||||
<dl class="method">
|
||||
<dt id="windows.winobject.process.CurrentProcess.read_wstring">
|
||||
<code class="descname">read_wstring</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Permalink to this definition">¶</a></dt>
|
||||
<code class="descname">read_wstring</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_wstring"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Permalink to this definition">¶</a></dt>
|
||||
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||||
</dd></dl>
|
||||
|
||||
|
||||
Vendored
+1
-1
File diff suppressed because one or more lines are too long
+8335
-7285
File diff suppressed because it is too large
Load Diff
+2521
-1076
File diff suppressed because it is too large
Load Diff
@@ -147,6 +147,74 @@ Another example from a project::
|
||||
'\x81~\x08\x0c\x00\x00\x00u&\x8bN\x10\x8bQ\x04\x8bA\x08\x8b\t\x81\xf9\x01\x00\x00\x00u\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00u\x04f\xef\xeb\x01\xef1\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3'
|
||||
|
||||
|
||||
Available Instructions in X86 assembler
|
||||
'''''''''''''''''''''''''''''''''''''''
|
||||
|
||||
.. note::
|
||||
Not all encodings may be implemented for each of the instructions.
|
||||
|
||||
``Byte`` and ``Raw`` are not x86 instruction and allow to insert arbitrary data to the generated code.
|
||||
|
||||
Listing:
|
||||
|
||||
* Add
|
||||
* And
|
||||
* Byte
|
||||
* Cmp
|
||||
* CmpsB
|
||||
* CmpsD
|
||||
* CmpsW
|
||||
* Cpuid
|
||||
* Dec
|
||||
* In
|
||||
* Inc
|
||||
* Int
|
||||
* Int3
|
||||
* Iret
|
||||
* Lea
|
||||
* Mov
|
||||
* Movsb
|
||||
* Movsd
|
||||
* Nop
|
||||
* Not
|
||||
* Or
|
||||
* Out
|
||||
* Pop
|
||||
* Popad
|
||||
* Popfd
|
||||
* Push
|
||||
* Pushad
|
||||
* Pushfd
|
||||
* Raw
|
||||
* Ret
|
||||
* Retf
|
||||
* Rol
|
||||
* Ror
|
||||
* ScasB
|
||||
* ScasD
|
||||
* ScasW
|
||||
* Shl
|
||||
* Shr
|
||||
* StosB
|
||||
* StosD
|
||||
* StosW
|
||||
* Sub
|
||||
* Test
|
||||
* Xchg
|
||||
* Xor
|
||||
|
||||
.. note::
|
||||
|
||||
``Raw``: Output raw data from an hexadecimal string
|
||||
|
||||
>>> windows.native_exec.simple_x64.Raw("90C332FCFF").get_code()
|
||||
'\x90\xc32\xfc\xff'
|
||||
|
||||
``Byte``: Output a raw byte
|
||||
|
||||
>>> windows.native_exec.simple_x86.Byte(0x42).get_code()
|
||||
'B'
|
||||
|
||||
:mod:`windows.native_exec.simple_x64` -- X64 Assembler
|
||||
""""""""""""""""""""""""""""""""""""""""""""""""""""""
|
||||
|
||||
@@ -180,6 +248,63 @@ Demo::
|
||||
'g\x8b\x00'
|
||||
|
||||
|
||||
Available Instructions in X64 assembler
|
||||
'''''''''''''''''''''''''''''''''''''''
|
||||
|
||||
.. note::
|
||||
Not all encodings may be implemented for each of the instructions.
|
||||
|
||||
``Raw`` is not an x64 instruction and allow to insert arbitrary data to the generated code.
|
||||
|
||||
Listing:
|
||||
* Add
|
||||
* And
|
||||
* Cmp
|
||||
* CmpsB
|
||||
* CmpsD
|
||||
* CmpsQ
|
||||
* CmpsW
|
||||
* Cpuid
|
||||
* Dec
|
||||
* In
|
||||
* Inc
|
||||
* Int
|
||||
* Int3
|
||||
* Lea
|
||||
* Mov
|
||||
* Nop
|
||||
* Not
|
||||
* Or
|
||||
* Out
|
||||
* Pop
|
||||
* Popfq
|
||||
* Push
|
||||
* Pushfq
|
||||
* Raw
|
||||
* Ret
|
||||
* Retf
|
||||
* Retf32
|
||||
* ScasB
|
||||
* ScasD
|
||||
* ScasQ
|
||||
* ScasW
|
||||
* Shl
|
||||
* Shr
|
||||
* Sub
|
||||
* Test
|
||||
* Xchg
|
||||
* Xor
|
||||
|
||||
|
||||
.. note::
|
||||
|
||||
``Raw``: Output raw data from an hexadecimal string
|
||||
|
||||
>>> windows.native_exec.simple_x64.Raw("90C332FCFF").get_code()
|
||||
'\x90\xc32\xfc\xff'
|
||||
|
||||
|
||||
|
||||
|
||||
:mod:`windows.native_exec.nativeutils` -- Native utility functions
|
||||
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
|
||||
|
||||
Reference in New Issue
Block a user