mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Added simple_x[86/64] listing of instrtuction to documentation + regenerated doc
This commit is contained in:
hakril
+13
-1
@@ -232,6 +232,10 @@
|
||||
<span class="k">def</span> <span class="nf">basetype</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BasicType</span><span class="o">.</span><span class="n">mapper</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_BASETYPE</span><span class="p">)]</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">parent</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">new_typeid</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_CLASSPARENTID</span><span class="p">))</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">datakind</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DataKind</span><span class="o">.</span><span class="n">mapper</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_DATAKIND</span><span class="p">)]</span>
|
||||
@@ -248,6 +252,10 @@
|
||||
<span class="k">def</span> <span class="nf">nb_children</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_CHILDRENCOUNT</span><span class="p">)</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">value</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_VALUE</span><span class="p">)</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
<span class="k">def</span> <span class="nf">children</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">count</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">nb_children</span>
|
||||
@@ -270,7 +278,10 @@
|
||||
|
||||
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagBaseType</span><span class="p">:</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> <basetype> </span><span class="si">{1}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">basetype</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> <basetype> </span><span class="si">{1!r}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">basetype</span><span class="p">)</span>
|
||||
<span class="k">elif</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagPointerType</span><span class="p">:</span>
|
||||
<span class="n">target_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">type</span><span class="o">.</span><span class="n">name</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> PTR TO "</span><span class="si">{1}</span><span class="s1">" tag=</span><span class="si">{2}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">target_type</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="s1">'<</span><span class="si">{0}</span><span class="s1"> name="</span><span class="si">{1}</span><span class="s1">" tag=</span><span class="si">{2}</span><span class="s1">>'</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
|
||||
|
||||
|
||||
@@ -771,6 +782,7 @@
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_ADDRESS</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG64</span><span class="p">,</span>
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GTIEX_REQS_VALID</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG64</span><span class="p">,</span>
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_SYMTAG</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagEnum</span><span class="p">,</span>
|
||||
<span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_VALUE</span><span class="p">:</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">Variant</span><span class="p">,</span>
|
||||
<span class="p">}</span>
|
||||
</pre></div>
|
||||
|
||||
|
||||
+4877
-4576
File diff suppressed because one or more lines are too long
@@ -47,59 +47,12 @@
|
||||
|
||||
<span class="kn">import</span> <span class="nn">windows</span>
|
||||
<span class="kn">import</span> <span class="nn">windows.winproxy</span>
|
||||
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
||||
|
||||
<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">simple_x86</span> <span class="k">as</span> <span class="n">x86</span>
|
||||
<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">simple_x64</span> <span class="k">as</span> <span class="n">x64</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">PyObj</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="s2">"ob_refcnt"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"ob_type"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)]</span> <span class="c1"># must be cast</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">PyMmap</span><span class="p">(</span><span class="n">PyObj</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="s2">"ob_addr"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">),</span> <span class="p">(</span><span class="s2">"ob_size"</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">)]</span>
|
||||
|
||||
|
||||
<span class="c1"># Specific mmap class for code injection</span>
|
||||
<span class="k">class</span> <span class="nc">MyMap</span><span class="p">(</span><span class="n">mmap</span><span class="o">.</span><span class="n">mmap</span><span class="p">):</span>
|
||||
<span class="sd">""" A mmap that is never unmapped and that contains the page address """</span>
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwarg</span><span class="p">):</span>
|
||||
<span class="c1"># Get the page address by 'introspection' of the C struct</span>
|
||||
<span class="n">m</span> <span class="o">=</span> <span class="n">PyMmap</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">m</span><span class="o">.</span><span class="n">ob_addr</span>
|
||||
<span class="c1"># Prevent garbage collection (so unmaping) of the page</span>
|
||||
<span class="n">m</span><span class="o">.</span><span class="n">ob_refcnt</span> <span class="o">+=</span> <span class="mi">1</span>
|
||||
|
||||
<span class="nd">@classmethod</span>
|
||||
<span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="sd">""" Dispatch to the good mmap implem depending on the current system """</span>
|
||||
<span class="n">systems</span> <span class="o">=</span> <span class="p">{</span><span class="s1">'windows'</span><span class="p">:</span> <span class="n">Win32MyMap</span><span class="p">,</span>
|
||||
<span class="s1">'linux'</span><span class="p">:</span> <span class="n">UnixMyMap</span><span class="p">}</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="n">platform</span><span class="o">.</span><span class="n">system</span><span class="p">()</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
|
||||
<span class="k">if</span> <span class="n">x</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">systems</span><span class="p">:</span>
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Unknow system </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
|
||||
<span class="k">return</span> <span class="n">systems</span><span class="p">[</span><span class="n">x</span><span class="p">]</span><span class="o">.</span><span class="n">get_map</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Win32MyMap</span><span class="p">(</span><span class="n">MyMap</span><span class="p">):</span>
|
||||
<span class="nd">@classmethod</span>
|
||||
<span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="n">addr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="mh">0x40</span><span class="p">)</span>
|
||||
<span class="n">new_map</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">size</span><span class="p">)</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
||||
<span class="n">new_map</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
|
||||
<span class="k">if</span> <span class="n">new_map</span><span class="o">.</span><span class="n">addr</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
|
||||
<span class="k">raise</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinError</span><span class="p">()</span>
|
||||
<span class="k">return</span> <span class="n">new_map</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">UnixMyMap</span><span class="p">(</span><span class="n">MyMap</span><span class="p">):</span>
|
||||
<span class="nd">@classmethod</span>
|
||||
<span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="n">prot</span> <span class="o">=</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_EXEC</span> <span class="o">|</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_WRITE</span> <span class="o">|</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_READ</span>
|
||||
<span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">CustomAllocator</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
||||
<span class="n">int_size</span> <span class="o">=</span> <span class="p">{</span><span class="s1">'32bit'</span><span class="p">:</span> <span class="mi">4</span><span class="p">,</span> <span class="s1">'64bit'</span><span class="p">:</span> <span class="mi">8</span><span class="p">}</span>
|
||||
|
||||
@@ -117,7 +70,10 @@
|
||||
<span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">int_size</span><span class="p">[</span><span class="n">bits</span><span class="p">]</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_new_page</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">maps</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">MyMap</span><span class="o">.</span><span class="n">get_map</span><span class="p">(</span><span class="n">size</span><span class="p">))</span>
|
||||
<span class="n">addr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">)</span>
|
||||
<span class="n">mymap</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">size</span><span class="p">)</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
||||
<span class="n">mymap</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">maps</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">mymap</span><span class="p">)</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_page_size</span> <span class="o">=</span> <span class="n">size</span>
|
||||
|
||||
@@ -141,6 +97,20 @@
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">+=</span> <span class="n">size</span>
|
||||
<span class="k">return</span> <span class="n">addr</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">close</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">maps</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">maps</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">maps</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">cur_page_size</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">sys</span><span class="p">,</span> <span class="s2">"path"</span><span class="p">,</span> <span class="kc">None</span><span class="p">)</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="c1"># Path is None -> Python shutdown</span>
|
||||
<span class="k">return</span>
|
||||
<span class="k">for</span> <span class="n">mymap</span> <span class="ow">in</span> <span class="n">maps</span><span class="p">:</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFree</span><span class="p">(</span><span class="n">mymap</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwFreeType</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_RELEASE</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
||||
|
||||
<span class="n">allocator</span> <span class="o">=</span> <span class="n">CustomAllocator</span><span class="p">()</span>
|
||||
|
||||
|
||||
|
||||
@@ -70,6 +70,12 @@
|
||||
<span class="k">if</span> <span class="n">size</span> <span class="o">></span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">array</span> <span class="o">=</span> <span class="p">([</span><span class="mi">0</span><span class="p">]</span> <span class="o">*</span> <span class="p">(</span><span class="n">size</span> <span class="o">-</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">)))</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">array</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">copy</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">new</span> <span class="o">=</span> <span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)(</span><span class="mi">0</span><span class="p">,</span> <span class="s2">""</span><span class="p">)</span>
|
||||
<span class="n">new</span><span class="o">.</span><span class="n">size</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">size</span>
|
||||
<span class="n">new</span><span class="o">.</span><span class="n">array</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">new</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">dump</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">size</span> <span class="o">//</span> <span class="mi">8</span><span class="p">):</span>
|
||||
@@ -325,7 +331,7 @@
|
||||
|
||||
<span class="k">class</span> <span class="nc">RawBits</span><span class="p">(</span><span class="n">BitArray</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">accept_arg</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">args</span><span class="p">,</span> <span class="n">instr_state</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">copy</span><span class="p">())</span>
|
||||
|
||||
|
||||
<span class="c1"># Immediat value logic</span>
|
||||
@@ -446,8 +452,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">ModRM</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">sub_modrm</span><span class="p">,</span> <span class="n">accept_reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">accept_reverse</span> <span class="o">=</span> <span class="n">accept_reverse</span>
|
||||
@@ -480,7 +484,6 @@
|
||||
<span class="k">def</span> <span class="nf">match</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">arg1</span><span class="p">,</span> <span class="n">arg2</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">X86</span><span class="o">.</span><span class="n">is_reg</span><span class="p">(</span><span class="n">arg1</span><span class="p">)</span> <span class="ow">and</span> <span class="n">X86</span><span class="o">.</span><span class="n">is_reg</span><span class="p">(</span><span class="n">arg2</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">arg1</span><span class="p">,</span> <span class="n">arg2</span><span class="p">,</span> <span class="nb">reversed</span><span class="p">,</span> <span class="n">instr_state</span><span class="p">):</span>
|
||||
<span class="bp">self</span><span class="o">.</span><span class="n">mod</span> <span class="o">=</span> <span class="n">BitArray</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="s2">"11"</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="n">X86</span><span class="o">.</span><span class="n">reg_size</span><span class="p">(</span><span class="n">arg1</span><span class="p">)</span> <span class="o">!=</span> <span class="n">X86</span><span class="o">.</span><span class="n">reg_size</span><span class="p">(</span><span class="n">arg2</span><span class="p">):</span>
|
||||
@@ -643,6 +646,7 @@
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
|
||||
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">initial_args</span><span class="p">):</span>
|
||||
<span class="c1"># print(self, initial_args)</span>
|
||||
<span class="k">for</span> <span class="n">type_encoding</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">encoding</span><span class="p">:</span>
|
||||
<span class="n">args</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">initial_args</span><span class="p">)</span>
|
||||
<span class="n">prefix</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
@@ -662,6 +666,7 @@
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Cannot encode <</span><span class="si">{0}</span><span class="s2"> </span><span class="si">{1}</span><span class="s2">>:("</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">initial_args</span><span class="p">))</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="c1"># print(self.value)</span>
|
||||
<span class="n">prefix_opcode</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="nb">chr</span><span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">PREFIX_VALUE</span><span class="p">)</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">prefix</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">prefix_opcode</span> <span class="o">+</span> <span class="nb">bytes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span><span class="o">.</span><span class="n">dump</span><span class="p">())</span>
|
||||
|
||||
@@ -743,10 +748,10 @@
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xff</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9a</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span>
|
||||
|
||||
<span class="k">class</span> <span class="nc">Jmp</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
<div class="viewcode-block" id="Jmp"><a class="viewcode-back" href="../../../native_exec.html#windows.native_exec.simple_x86.Jmp">[docs]</a><span class="k">class</span> <span class="nc">Jmp</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xeb</span><span class="p">),</span> <span class="n">JmpImm8</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xe9</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">5</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xea</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xea</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span></div>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Jz</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
@@ -754,6 +759,9 @@
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f84</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">6</span><span class="p">))]</span>
|
||||
|
||||
|
||||
<span class="n">Je</span> <span class="o">=</span> <span class="n">Jz</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Jnz</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x75</span><span class="p">),</span> <span class="n">JmpImm8</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f85</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">6</span><span class="p">))]</span>
|
||||
@@ -813,13 +821,13 @@
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x29</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">]))]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Mov</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<div class="viewcode-block" id="Mov"><a class="viewcode-back" href="../../../native_exec.html#windows.native_exec.simple_x86.Mov">[docs]</a><span class="k">class</span> <span class="nc">Mov</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x89</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">])),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xc7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">0</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mh">0xB8</span> <span class="o">>></span> <span class="mi">3</span><span class="p">),</span> <span class="n">X86RegisterSelector</span><span class="p">(),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x8C</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__SEGREG</span><span class="p">])),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f20</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">False</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f22</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">True</span><span class="p">))]</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f22</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">True</span><span class="p">))]</span></div>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Movsb</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
@@ -830,6 +838,22 @@
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xa5</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Pushfd</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9c</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Pushad</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x60</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Popfd</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9d</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Popad</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x61</span><span class="p">),)]</span>
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Lea</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x8d</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__MEM</span><span class="p">],</span> <span class="n">accept_reverse</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">False</span><span class="p">))]</span>
|
||||
|
||||
@@ -841,7 +865,7 @@
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">Test</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xf7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">7</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xf7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">0</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
|
||||
<span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x85</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">],</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">False</span><span class="p">))]</span>
|
||||
|
||||
|
||||
|
||||
+54
-26
@@ -122,6 +122,14 @@
|
||||
<span class="p">(</span><span class="s2">"AddressOfData"</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span>
|
||||
<span class="p">]</span>
|
||||
|
||||
<span class="c1"># Special case for .NET PE32 rewrite as 64b</span>
|
||||
<span class="c1"># We may have a PE in a 64b process with a 32b IAT</span>
|
||||
<span class="k">class</span> <span class="nc">THUNK_DATA_32</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
|
||||
<span class="p">(</span><span class="s2">"Ordinal"</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
|
||||
<span class="p">(</span><span class="s2">"AddressOfData"</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">)</span>
|
||||
<span class="p">]</span>
|
||||
|
||||
<span class="k">class</span> <span class="nc">IMPORT_BY_NAME</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
|
||||
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
|
||||
<span class="p">(</span><span class="s2">"Hint"</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
|
||||
@@ -224,7 +232,6 @@
|
||||
<span class="k">def</span> <span class="nf">on_destroy</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
|
||||
<span class="c1"># We cannot know if the hook was enabled here..</span>
|
||||
<span class="nb">print</span><span class="p">(</span><span class="s2">"DESTROY: </span><span class="si">{0}</span><span class="s2"> -> "</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">enabled</span><span class="p">))</span>
|
||||
<span class="c1"># import pdb;pdb.set_trace()</span>
|
||||
<span class="c1"># print(args[0]())</span>
|
||||
|
||||
<div class="viewcode-block" id="IATEntry.remove_hook"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.remove_hook">[docs]</a> <span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
@@ -242,11 +249,16 @@
|
||||
|
||||
|
||||
<span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs.IMAGE_IMPORT_DESCRIPTOR</span>
|
||||
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="p">:</span>
|
||||
<span class="k">return</span> <span class="kc">None</span>
|
||||
<span class="c1"># We may have 32bits PE mapped in 32bits process (thanks to .NET PE)</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
|
||||
<span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">"Mapped 64b PE in current process 32b not handled"</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
|
||||
<span class="n">int_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">while</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span><span class="p">:</span>
|
||||
@@ -254,23 +266,24 @@
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">import_by_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMPORT_BY_NAME</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span><span class="p">)</span>
|
||||
<span class="n">name_address</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span> <span class="o">+</span> <span class="nb">type</span><span class="p">(</span><span class="n">import_by_name</span><span class="p">)</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">offset</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">import_by_name</span><span class="o">.</span><span class="n">Hint</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
|
||||
<span class="n">int_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">int_entry</span><span class="p">))</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
|
||||
<span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">"Mapped 64b PE in current process 32b not handled"</span>
|
||||
<span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
|
||||
<span class="n">iat_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">FirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">while</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">IATEntry</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">iat_addr</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="s2">"??"</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="p">))</span>
|
||||
<span class="n">iat_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">iat_entry</span><span class="p">))</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
|
||||
<span class="nd">@classmethod</span>
|
||||
@@ -356,21 +369,37 @@
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS32</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS64</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
|
||||
|
||||
|
||||
<span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span> <span class="o">=</span> <span class="p">{</span>
|
||||
<span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">,</span>
|
||||
<span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">,</span>
|
||||
<span class="p">}</span>
|
||||
|
||||
<span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span> <span class="o">=</span> <span class="p">(</span>
|
||||
<span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">)),</span>
|
||||
<span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">)),</span>
|
||||
<span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_OptionalHeader</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
|
||||
<span class="c1"># We can have a 32bits PE with a 64 bits OptionalHeader</span>
|
||||
<span class="c1"># Ex : PE32 .NET that allow to be loaded in 64b process</span>
|
||||
<span class="c1"># See: https://github.com/dotnet/runtime/blob/8bbe33819464216becffb7cf8b7ea8dd3bab5836/src/coreclr/src/vm/peimagelayout.cpp#L599</span>
|
||||
<span class="c1"># In this case the OptionalHeader is transformed in 64bits & OptionalHeader.Magic is changed accordingly</span>
|
||||
<span class="c1"># So we cannot just rely on get_NT_HEADER() to give us the correct OptionalHeader type. some re-check are required</span>
|
||||
<span class="n">default_opth</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
|
||||
<span class="c1"># Cannot juste compare types with type(default_opth) as it may be a remoteType</span>
|
||||
<span class="n">current_opth_infos</span> <span class="o">=</span> <span class="p">(</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">))</span>
|
||||
<span class="k">if</span> <span class="n">current_opth_infos</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span><span class="p">:</span>
|
||||
<span class="c1"># The default OptionalHeader structure match what we expect based on the magic (most of the cases)</span>
|
||||
<span class="k">return</span> <span class="n">default_opth</span>
|
||||
<span class="c1"># Mismatch -> PE32 remapped as 64b (with OptionalHeader rewrite)</span>
|
||||
<span class="c1"># Remap the correct OptionalHeader</span>
|
||||
<span class="n">opt_header_real_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span><span class="p">[</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">]</span>
|
||||
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">default_opth</span><span class="o">.</span><span class="n">_base_addr</span> <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="k">else</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">opt_header_real_type</span><span class="p">,</span> <span class="n">opt_header_addr</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_DataDirectory</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="c1"># This won't work if we load a PE32 in a 64bit process</span>
|
||||
<span class="c1"># PE32 .NET...</span>
|
||||
<span class="c1"># return self.get_OptionalHeader().DataDirectory</span>
|
||||
<span class="n">DataDirectory_type</span> <span class="o">=</span> <span class="n">IMAGE_DATA_DIRECTORY</span> <span class="o">*</span> <span class="n">IMAGE_NUMBEROF_DIRECTORY_ENTRIES</span>
|
||||
<span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
|
||||
<span class="n">DataDirectory_addr</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">,</span> <span class="n">DataDirectory_addr</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_OptionalHeader</span><span class="p">()</span><span class="o">.</span><span class="n">DataDirectory</span>
|
||||
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_IMPORT_DESCRIPTORS</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
@@ -422,7 +451,6 @@
|
||||
<span class="n">export_end</span> <span class="o">=</span> <span class="n">export_start</span> <span class="o">+</span> <span class="n">export_datadir</span><span class="o">.</span><span class="n">Size</span>
|
||||
<span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
<span class="c1"># import pdb;pdb.set_trace()</span>
|
||||
<span class="n">raw_exports</span> <span class="o">=</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">get_exports</span><span class="p">()</span>
|
||||
<span class="k">for</span> <span class="nb">id</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">,</span> <span class="n">rva_name</span> <span class="ow">in</span> <span class="n">raw_exports</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">export_start</span> <span class="o"><=</span> <span class="n">rva_addr</span> <span class="o"><</span> <span class="n">export_end</span><span class="p">:</span>
|
||||
@@ -455,8 +483,8 @@
|
||||
<span class="sd"> :type: {:class:`str` : [:class:`IATEntry`]}"""</span>
|
||||
<span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
|
||||
<span class="k">for</span> <span class="n">import_descriptor</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_IMPORT_DESCRIPTORS</span><span class="p">():</span>
|
||||
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">()</span>
|
||||
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">()</span>
|
||||
<span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
|
||||
<span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="n">INT</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="k">for</span> <span class="n">iat_entry</span><span class="p">,</span> <span class="p">(</span><span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">IAT</span><span class="p">,</span> <span class="n">INT</span><span class="p">):</span>
|
||||
<span class="c1"># str(name.decode()) -> python2 and python3 compatible for str result</span>
|
||||
|
||||
+31
-16
@@ -133,16 +133,23 @@
|
||||
<span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
|
||||
<span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
|
||||
<span class="k">if</span> <span class="n">show_windows</span><span class="p">:</span>
|
||||
<span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOA</span><span class="p">()</span>
|
||||
<span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
|
||||
<span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
|
||||
<span class="n">StartupInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
|
||||
<span class="n">lpCommandLine</span> <span class="o">=</span> <span class="kc">None</span>
|
||||
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
|
||||
<span class="n">path</span> <span class="o">=</span> <span class="n">path</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
|
||||
<span class="k">if</span> <span class="n">args</span><span class="p">:</span>
|
||||
<span class="n">lpCommandLine</span> <span class="o">=</span> <span class="p">(</span><span class="sa">b</span><span class="s2">" "</span><span class="o">.</span><span class="n">join</span><span class="p">([</span><span class="n">a</span> <span class="k">for</span> <span class="n">a</span> <span class="ow">in</span> <span class="n">args</span><span class="p">]))</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessA</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">lpCommandLine</span><span class="o">=</span><span class="n">lpCommandLine</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">,</span> <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span> <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">lpStartupInfo</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessA new process handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessA new thread handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">unicode_args</span> <span class="o">=</span> <span class="p">[]</span>
|
||||
<span class="k">for</span> <span class="n">arg</span> <span class="ow">in</span> <span class="n">args</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">arg</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
|
||||
<span class="n">arg</span> <span class="o">=</span> <span class="n">arg</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
|
||||
<span class="n">unicode_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">arg</span><span class="p">)</span>
|
||||
<span class="n">lpCommandLine</span> <span class="o">=</span> <span class="p">(</span><span class="s2">" "</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">unicode_args</span><span class="p">))</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessW</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">lpCommandLine</span><span class="o">=</span><span class="n">lpCommandLine</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">,</span> <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span> <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">lpStartupInfo</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessW new process handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"CreateProcessW new thread handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">"Automatic close of thread handle </span><span class="si">{:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">"HANDLE"</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">)</span> <span class="c1"># Give access to a WinThread in addition of the WinProcess ?</span>
|
||||
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span></div>
|
||||
@@ -234,15 +241,8 @@
|
||||
|
||||
<span class="sd"> https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx#_______noumex______</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="n">hkresult</span> <span class="o">=</span> <span class="n">HKEY</span><span class="p">()</span>
|
||||
<span class="n">cbsize</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">(</span><span class="mi">1024</span><span class="p">)</span>
|
||||
<span class="n">bufferres</span> <span class="o">=</span> <span class="p">(</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">cbsize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
|
||||
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExA</span><span class="p">(</span><span class="n">HKEY_LOCAL_MACHINE</span><span class="p">,</span> <span class="s2">"System</span><span class="se">\\</span><span class="s2">CurrentControlSet</span><span class="se">\\</span><span class="s2">Control"</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">KEY_READ</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">hkresult</span><span class="p">))</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegGetValueA</span><span class="p">(</span><span class="n">hkresult</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="s2">"SystemStartOptions"</span><span class="p">,</span> <span class="n">RRF_RT_REG_SZ</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">bufferres</span><span class="p">),</span> <span class="n">byref</span><span class="p">(</span><span class="n">cbsize</span><span class="p">))</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegCloseKey</span><span class="p">(</span><span class="n">hkresult</span><span class="p">)</span>
|
||||
|
||||
<span class="n">control</span> <span class="o">=</span> <span class="n">bufferres</span><span class="p">[:]</span>
|
||||
<span class="n">options</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">registry</span><span class="p">(</span><span class="sa">r</span><span class="s1">'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control'</span><span class="p">)[</span><span class="s1">'SystemStartOptions'</span><span class="p">]</span>
|
||||
<span class="n">control</span> <span class="o">=</span> <span class="n">options</span><span class="o">.</span><span class="n">value</span>
|
||||
<span class="k">if</span> <span class="s2">"DEBUG"</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">control</span><span class="p">:</span>
|
||||
<span class="c1"># print "[-] Enable debug boot!"</span>
|
||||
<span class="c1"># print "> bcdedit /debug on"</span>
|
||||
@@ -489,7 +489,8 @@
|
||||
<span class="k">if</span> <span class="n">volume_info_class</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FileFsAttributeInformation</span><span class="p">:</span>
|
||||
<span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">FileSystemNameLength</span>
|
||||
<span class="k">elif</span> <span class="n">volume_info_class</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FileFsVolumeInformation</span><span class="p">:</span>
|
||||
<span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">VolumeLabelLength</span> <span class="o">+</span> <span class="mh">0x8</span> <span class="c1"># I have seen cases where the VolumeLabelLength is not even enough..</span>
|
||||
<span class="c1"># Well VolumeLabelLength is clearly broken (after testing..) so we are adding some bytes to it..</span>
|
||||
<span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">VolumeLabelLength</span> <span class="o">+</span> <span class="mh">0x100</span> <span class="c1"># I have seen cases where the VolumeLabelLength is not even enough..</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="n">full_size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info</span><span class="p">)</span> <span class="o">+</span> <span class="n">file_name_length</span> <span class="c1"># We add a little too much size for the sake of simplicity</span>
|
||||
@@ -566,7 +567,7 @@
|
||||
<span class="c1"># addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)</span>
|
||||
<span class="c1"># return addr</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
||||
<span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
||||
<span class="k">if</span> <span class="n">uncompress_size</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
||||
<span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span> <span class="o">*</span> <span class="mi">10</span>
|
||||
<span class="n">result_size</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
|
||||
@@ -574,6 +575,20 @@
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlDecompressBuffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">uncompressed</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">result_size</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">uncompressed</span><span class="p">[:</span><span class="n">result_size</span><span class="o">.</span><span class="n">value</span><span class="p">]</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">compress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">):</span>
|
||||
<span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
|
||||
<span class="n">CompressedBufferSize</span> <span class="o">=</span> <span class="n">uncompress_size</span> <span class="o">+</span> <span class="mh">0x1000</span>
|
||||
<span class="n">CompressedBuffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">CompressedBufferSize</span><span class="p">)</span>
|
||||
<span class="n">chunk</span> <span class="o">=</span> <span class="mi">4096</span>
|
||||
<span class="n">final_size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
|
||||
<span class="n">work_space_size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
|
||||
<span class="n">ignore_data</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
|
||||
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlGetCompressionWorkSpaceSize</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">work_space_size</span><span class="p">,</span> <span class="n">ignore_data</span><span class="p">)</span>
|
||||
<span class="n">work_space</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">work_space_size</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlCompressBuffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="p">,</span> <span class="n">CompressedBuffer</span><span class="p">,</span> <span class="n">CompressedBufferSize</span><span class="p">,</span> <span class="n">chunk</span><span class="p">,</span> <span class="n">final_size</span><span class="p">,</span> <span class="n">work_space</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">CompressedBuffer</span><span class="p">[:</span><span class="n">final_size</span><span class="o">.</span><span class="n">value</span><span class="p">]</span>
|
||||
|
||||
|
||||
<span class="c1"># sid.py + real SID type ?</span>
|
||||
|
||||
|
||||
@@ -53,6 +53,7 @@
|
||||
|
||||
<span class="c1"># Helpers</span>
|
||||
|
||||
|
||||
<span class="nd">@contextmanager</span>
|
||||
<span class="k">def</span> <span class="nf">ClosingEvtHandle</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
@@ -225,17 +226,20 @@
|
||||
<span class="c1"># Each value wil return 1 node :)</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="n">nbelt</span><span class="p">,</span> <span class="n">pwstr_rarray</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">system_values</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span> <span class="c1"># POC: use this for all @property based on system data ?</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextSystem</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span>
|
||||
|
||||
<div class="viewcode-block" id="EvtEvent.event_values"><a class="viewcode-back" href="../../../evtlog.html#windows.winobject.event_log.EvtEvent.event_values">[docs]</a> <span class="k">def</span> <span class="nf">event_values</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
||||
<span class="sd">"""The values of the event in a list"""</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextUser</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span></div>
|
||||
|
||||
<span class="k">def</span> <span class="nf">get_raw_values</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">values</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">):</span>
|
||||
@@ -247,6 +251,7 @@
|
||||
<span class="c1"># Each value will return 1 node :)</span>
|
||||
<span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="n">nbelt</span><span class="p">,</span> <span class="n">pwstr_rarray</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">)</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="n">result</span><span class="p">)</span>
|
||||
|
||||
|
||||
@@ -490,6 +495,9 @@
|
||||
<span class="sd"> List all events with an EventID of 2006:</span>
|
||||
<span class="sd"> ``Event/System[EventID=2006]``</span>
|
||||
|
||||
<span class="sd"> List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</span>
|
||||
<span class="sd"> ``Event/System[EventID=3] and Event/EventData/Data[@Name='DestinationIp'] and Event/EventData[Data='10.0.0.2']``</span>
|
||||
|
||||
<span class="sd"> :rtype: :class:`EvtQuery`</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="k">if</span> <span class="n">ids</span> <span class="ow">and</span> <span class="nb">filter</span><span class="p">:</span>
|
||||
|
||||
@@ -228,17 +228,18 @@
|
||||
<span class="k">raise</span> <span class="c1"># Other error -> reraise</span>
|
||||
<span class="k">return</span> <span class="kc">True</span></div>
|
||||
|
||||
<div class="viewcode-block" id="EtwTrace.start"><a class="viewcode-back" href="../../../etw.html#windows.winobject.event_trace.EtwTrace.start">[docs]</a> <span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
|
||||
<div class="viewcode-block" id="EtwTrace.start"><a class="viewcode-back" href="../../../etw.html#windows.winobject.event_trace.EtwTrace.start">[docs]</a> <span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">mode</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
|
||||
<span class="sd">"""Start the tracing"""</span>
|
||||
<span class="n">prop</span> <span class="o">=</span> <span class="n">EventTraceProperties</span><span class="o">.</span><span class="n">create</span><span class="p">()</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">NumberOfBuffers</span> <span class="o">=</span> <span class="mi">42</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">EnableFlags</span> <span class="o">=</span> <span class="n">flags</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">=</span> <span class="n">mode</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span><span class="p">:</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">Wnode</span><span class="o">.</span><span class="n">Guid</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">logfile</span><span class="p">:</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">logfile</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">logfile</span>
|
||||
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">:</span> <span class="c1"># Base REAL_TIME on option ? name presence ? logfile presence ?</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EVENT_TRACE_REAL_TIME_MODE</span>
|
||||
<span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EVENT_TRACE_REAL_TIME_MODE</span>
|
||||
<span class="n">handle</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">TRACEHANDLE</span><span class="p">()</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">StartTraceA</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">prop</span><span class="p">)</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span><span class="p">:</span>
|
||||
|
||||
+17
-11
@@ -145,13 +145,13 @@
|
||||
<span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
|
||||
<span class="c1"># Fuck-it <3</span>
|
||||
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
|
||||
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
|
||||
<span class="c1"># Map a remote64bits(PROCESS_BASIC_INFORMATION) at the address of 'data'</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="n">xtype</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">x</span><span class="o">.</span><span class="n">InheritedFromUniqueProcessId</span>
|
||||
|
||||
<span class="nd">@property</span>
|
||||
@@ -390,13 +390,13 @@
|
||||
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">itertools</span><span class="o">.</span><span class="n">count</span><span class="p">():</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
|
||||
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="c1"># handle read_wstring at end of page</span>
|
||||
<span class="c1"># Of read failed: read only the half of size</span>
|
||||
<span class="c1"># read_size must remain a multiple of 2</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
|
||||
<span class="k">continue</span>
|
||||
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
|
||||
<span class="k">if</span> <span class="sa">b</span><span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
|
||||
@@ -414,13 +414,13 @@
|
||||
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
|
||||
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="c1"># handle read_wstring at end of page</span>
|
||||
<span class="c1"># Of read failed: read only the half of size</span>
|
||||
<span class="c1"># read_size must remain a multiple of 2</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span><span class="p">)</span>
|
||||
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
|
||||
<span class="k">continue</span>
|
||||
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
|
||||
<span class="c1"># Bytearray will work on py2 & py3</span>
|
||||
@@ -429,10 +429,10 @@
|
||||
<span class="n">utf16_chars</span> <span class="o">=</span> <span class="p">[</span><span class="nb">bytearray</span><span class="p">(</span><span class="n">c</span><span class="p">)</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="o">*</span><span class="p">[</span><span class="nb">iter</span><span class="p">(</span><span class="n">x</span><span class="p">)]</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)]</span>
|
||||
<span class="k">if</span> <span class="sa">b</span><span class="s2">"</span><span class="se">\x00\x00</span><span class="s2">"</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">:</span>
|
||||
<span class="c1"># Translate bytearray to str/bytes for both py2 & py3</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="nb">bytes</span><span class="p">(</span><span class="n">x</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">"</span><span class="se">\x00\x00</span><span class="s2">"</span><span class="p">)])</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">"</span><span class="se">\x00\x00</span><span class="s2">"</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">])</span>
|
||||
<span class="k">break</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="sa">b</span><span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'utf16'</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="nb">bytearray</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">"utf-16"</span><span class="p">)</span>
|
||||
|
||||
<span class="k">def</span> <span class="nf">write_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">byte</span><span class="p">):</span>
|
||||
<span class="sd">"""write a byte at ``addr``"""</span>
|
||||
@@ -770,9 +770,15 @@
|
||||
<span class="sd"> """</span>
|
||||
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Not a syswow process"</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span></div>
|
||||
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
|
||||
|
||||
<span class="c1"># TODO: use ctypes.string_ad / ctypes.wstring_at for read_string / read_wstring ?</span>
|
||||
<span class="c1"># TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?</span>
|
||||
|
||||
<div class="viewcode-block" id="CurrentProcess.read_string"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_string">[docs]</a> <span class="k">def</span> <span class="nf">read_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">string_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div>
|
||||
|
||||
<div class="viewcode-block" id="CurrentProcess.read_wstring"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_wstring">[docs]</a> <span class="k">def</span> <span class="nf">read_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
|
||||
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">wstring_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div></div>
|
||||
|
||||
<div class="viewcode-block" id="WinThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a><span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
|
||||
<span class="sd">"""Represent a thread """</span>
|
||||
@@ -1023,7 +1029,7 @@
|
||||
<span class="sd"> :type: :class:`str`</span>
|
||||
<span class="sd"> """</span>
|
||||
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
|
||||
<span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
|
||||
<span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span> <span class="c1"># Use a syscall and not some remote process reading</span>
|
||||
<span class="c1"># GetProcessImageFileNameA returns the fullpath</span>
|
||||
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"</span><span class="se">\\</span><span class="s2">"</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
|
||||
|
||||
|
||||
+19
-4
@@ -200,7 +200,7 @@
|
||||
|
||||
<span class="k">def</span> <span class="nf">_open_key</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">sam</span><span class="p">):</span>
|
||||
<span class="n">result</span> <span class="o">=</span> <span class="n">WinRegistryKey</span><span class="p">()</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExW</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">sam</span><span class="p">,</span> <span class="n">result</span><span class="p">)</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExW</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">sam</span><span class="p">,</span> <span class="n">result</span><span class="p">)</span> <span class="c1"># TODO: options REG_OPTION_OPEN_LINK</span>
|
||||
<span class="n">dbgprint</span><span class="p">(</span><span class="sa">u</span><span class="s2">"Opening registry key <</span><span class="si">{0}</span><span class="s2">> (handle=</span><span class="si">{1:#x}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">result</span><span class="o">.</span><span class="n">value</span><span class="p">),</span> <span class="s2">"REGISTRY"</span><span class="p">)</span>
|
||||
<span class="k">return</span> <span class="n">result</span>
|
||||
|
||||
@@ -283,21 +283,36 @@
|
||||
<span class="n">databuffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">,</span> <span class="n">nbelt</span><span class="o">=</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
|
||||
<span class="c1"># A value can have been added in-between.</span>
|
||||
<span class="c1"># So recheck the size given by get_key_size_info :)</span>
|
||||
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
|
||||
<span class="c1"># But check 10 times max as RegEnumValueW may bug (seen) and always return ERROR_MORE_DATA even with enought size</span>
|
||||
<span class="k">for</span> <span class="n">_</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">10</span><span class="p">):</span>
|
||||
<span class="k">try</span><span class="p">:</span>
|
||||
<span class="n">winproxy</span><span class="o">.</span><span class="n">RegEnumValueW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">phkey</span><span class="p">,</span> <span class="n">i</span><span class="p">,</span> <span class="n">keyname</span><span class="p">,</span> <span class="n">namesize</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">value_type</span><span class="p">,</span> <span class="n">databuffer</span><span class="p">,</span> <span class="n">datasize</span><span class="p">)</span>
|
||||
<span class="k">break</span>
|
||||
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
||||
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_MORE_DATA</span><span class="p">:</span>
|
||||
<span class="k">raise</span>
|
||||
<span class="c1"># I found some strange Windows where even with a big enought buffer:</span>
|
||||
<span class="c1"># - the data was filled</span>
|
||||
<span class="c1"># - ERROR_MORE_DATA was returned</span>
|
||||
<span class="c1">## To prevent such bug to trigger and infinite loop, two things</span>
|
||||
<span class="c1"># - If the retuned namesize <= the passed keysize and keyname is not empty -> return the data`</span>
|
||||
<span class="c1"># - Max 10 test to prevent Infinite loop</span>
|
||||
<span class="k">if</span> <span class="p">((</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span> <span class="o"><=</span> <span class="n">max_name_size</span><span class="p">)</span> <span class="ow">and</span> <span class="p">(</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span> <span class="o"><=</span> <span class="n">max_data_size</span><span class="p">)</span> <span class="ow">and</span>
|
||||
<span class="p">(</span><span class="n">keyname</span><span class="p">[:</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">]</span><span class="o">.</span><span class="n">count</span><span class="p">(</span><span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span><span class="p">)</span> <span class="o"><</span> <span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">)):</span> <span class="c1"># Not just 0 Zero ?</span>
|
||||
<span class="k">break</span>
|
||||
|
||||
<span class="c1"># Update the sizes / buffers & try again :)</span>
|
||||
<span class="n">max_name_size</span><span class="p">,</span> <span class="n">max_data_size</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_key_size_info</span><span class="p">()</span>
|
||||
<span class="n">max_name_size</span> <span class="o">+=</span> <span class="mi">1</span>
|
||||
<span class="n">max_data_size</span> <span class="o">+=</span> <span class="mi">2</span>
|
||||
<span class="n">max_name_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">max_name_size</span> <span class="o">+</span> <span class="mi">1</span><span class="p">,</span> <span class="n">namesize</span><span class="o">.</span><span class="n">value</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="c1"># namesize.value may be > to max_name_size apparently (guessed)</span>
|
||||
<span class="n">max_data_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">max_data_size</span> <span class="o">+</span> <span class="mi">2</span><span class="p">,</span> <span class="n">datasize</span><span class="o">.</span><span class="n">value</span> <span class="o">+</span> <span class="mi">2</span><span class="p">)</span> <span class="c1"># datasize.value may be > to max_data_size apparently (seen)</span>
|
||||
<span class="n">namesize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">(</span><span class="n">max_name_size</span><span class="p">)</span>
|
||||
<span class="n">keyname</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
|
||||
<span class="n">datasize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">(</span><span class="n">max_data_size</span><span class="p">)</span>
|
||||
<span class="n">databuffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">,</span> <span class="n">nbelt</span><span class="o">=</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
|
||||
<span class="k">else</span><span class="p">:</span>
|
||||
<span class="c1"># Probably a windows bug that prevent us from retrieving the data</span>
|
||||
<span class="c1"># Raise something (thus preventing getting the other values..) ? ignore it ?</span>
|
||||
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Could not extract registry key values, problably a Windows/hook bug"</span><span class="p">)</span>
|
||||
<span class="n">vobj</span> <span class="o">=</span> <span class="n">decode_registry_buffer</span><span class="p">(</span><span class="n">value_type</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">databuffer</span><span class="p">,</span> <span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
|
||||
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">keyname</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">vobj</span><span class="p">,</span> <span class="n">value_type</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
||||
<span class="k">return</span> <span class="n">res</span>
|
||||
|
||||
@@ -254,12 +254,16 @@
|
||||
<span class="sd"> """</span>
|
||||
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_DisplayName"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="n">name</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="s2">"put_DisplayName"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""The name of the principal"""</span>
|
||||
<span class="nb">id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_Id"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="nb">id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="nb">id</span><span class="p">,</span> <span class="s2">"put_Id"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""the identifier of the principal."""</span>
|
||||
<span class="n">user_id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_UserId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="n">user_id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">user_id</span><span class="p">,</span> <span class="s2">"put_UserId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""the user identifier that is required to run the task"""</span>
|
||||
<span class="n">group_id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_GroupId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="n">group_id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">group_id</span><span class="p">,</span> <span class="s2">"put_GroupId"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
|
||||
<span class="sd">"""the user group that is required to run the task"""</span>
|
||||
<span class="n">run_level</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">"get_RunLevel"</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">TASK_RUNLEVEL_TYPE</span><span class="p">)</span>
|
||||
<span class="sd">"""the privilege level that is required to run the tasks</span>
|
||||
|
||||
Reference in New Issue
Block a user