mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Added some definitions for SID/Privilege/others
This commit is contained in:
Clement Rouault
@@ -1034,3 +1034,35 @@
|
||||
#define SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE (0x10)
|
||||
#define SYSTEM_MANDATORY_LABEL_ACE_TYPE (0x11)
|
||||
#define ACCESS_MAX_MS_V5_ACE_TYPE (0x11)
|
||||
|
||||
|
||||
#define LPC_REQUEST 1
|
||||
#define LPC_REPLY 2
|
||||
#define LPC_DATAGRAM 3
|
||||
#define LPC_LOST_REPLY 4
|
||||
#define LPC_PORT_CLOSED 5
|
||||
#define LPC_CLIENT_DIED 6
|
||||
#define LPC_EXCEPTION 7
|
||||
#define LPC_DEBUG_EVENT 8
|
||||
#define LPC_ERROR_EVENT 9
|
||||
#define LPC_CONNECTION_REQUEST 10
|
||||
|
||||
|
||||
#define ALPC_MESSAGE_SECURITY_ATTRIBUTE 0x80000000
|
||||
#define ALPC_MESSAGE_VIEW_ATTRIBUTE 0x40000000
|
||||
#define ALPC_MESSAGE_CONTEXT_ATTRIBUTE 0x20000000
|
||||
#define ALPC_MESSAGE_HANDLE_ATTRIBUTE 0x10000000
|
||||
|
||||
#define ALPC_VIEWFLG_NOT_SECURE 0x40000
|
||||
|
||||
#define ALPC_MSGFLG_REPLY_MESSAGE 0x1
|
||||
#define ALPC_MSGFLG_LPC_MODE 0x2
|
||||
#define ALPC_MSGFLG_RELEASE_MESSAGE 0x10000
|
||||
#define ALPC_MSGFLG_SYNC_REQUEST 0x20000
|
||||
#define ALPC_MSGFLG_WAIT_USER_MODE 0x100000
|
||||
#define ALPC_MSGFLG_WAIT_ALERTABLE 0x200000
|
||||
#define ALPC_MSGFLG_WOW64_CALL 0x80000000
|
||||
|
||||
#define ALPC_CANCELFLG_TRY_CANCEL 0x1
|
||||
#define ALPC_CANCELFLG_NO_CONTEXT_CHECK 0x8
|
||||
#define ALPC_CANCELFLGP_FLUSH 0x10000
|
||||
|
||||
@@ -253,6 +253,35 @@ BOOL WINAPI CreateProcessW(
|
||||
__out LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
BOOL WINAPI CreateProcessAsUserA(
|
||||
_In_opt_ HANDLE hToken,
|
||||
_In_opt_ LPSTR lpApplicationName,
|
||||
_Inout_opt_ LPSTR lpCommandLine,
|
||||
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
_In_ BOOL bInheritHandles,
|
||||
_In_ DWORD dwCreationFlags,
|
||||
_In_opt_ LPVOID lpEnvironment,
|
||||
_In_opt_ LPSTR lpCurrentDirectory,
|
||||
_In_ LPSTARTUPINFOA lpStartupInfo,
|
||||
_Out_ LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI CreateProcessAsUserW(
|
||||
_In_opt_ HANDLE hToken,
|
||||
_In_opt_ LPWSTR lpApplicationName,
|
||||
_Inout_opt_ LPWSTR lpCommandLine,
|
||||
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
_In_ BOOL bInheritHandles,
|
||||
_In_ DWORD dwCreationFlags,
|
||||
_In_opt_ LPVOID lpEnvironment,
|
||||
_In_opt_ LPWSTR lpCurrentDirectory,
|
||||
_In_ LPSTARTUPINFOW lpStartupInfo,
|
||||
_Out_ LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
BOOL WINAPI GetThreadContext(
|
||||
__in HANDLE hThread,
|
||||
__inout LPCONTEXT lpContext
|
||||
@@ -306,6 +335,16 @@ BOOL WINAPI NtWow64ReadVirtualMemory64(
|
||||
_Out_ PULONG64 *lpNumberOfBytesRead
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI NtReadVirtualMemory(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ PVOID lpBaseAddress,
|
||||
_Out_ LPVOID lpBuffer,
|
||||
_In_ ULONG nSize,
|
||||
_Out_ PULONG *lpNumberOfBytesRead
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI WriteProcessMemory(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_ LPVOID lpBaseAddress,
|
||||
@@ -396,6 +435,20 @@ BOOL WINAPI LookupPrivilegeValueW(
|
||||
__out PLUID lpLuid
|
||||
);
|
||||
|
||||
BOOL WINAPI LookupPrivilegeNameA(
|
||||
_In_opt_ LPCSTR lpSystemName,
|
||||
_In_ PLUID lpLuid,
|
||||
_Out_opt_ LPCSTR lpName,
|
||||
_Inout_ LPDWORD cchName
|
||||
);
|
||||
|
||||
BOOL WINAPI LookupPrivilegeNameW(
|
||||
_In_opt_ LPCWSTR lpSystemName,
|
||||
_In_ PLUID lpLuid,
|
||||
_Out_opt_ LPCWSTR lpName,
|
||||
_Inout_ LPDWORD cchName
|
||||
);
|
||||
|
||||
BOOL WINAPI AdjustTokenPrivileges(
|
||||
_In_ HANDLE TokenHandle,
|
||||
_In_ BOOL DisableAllPrivileges,
|
||||
@@ -778,6 +831,17 @@ LPBYTE WINAPI GetSidSubAuthorityCount (
|
||||
__in PSID pSid
|
||||
);
|
||||
|
||||
DWORD WINAPI GetLengthSid(
|
||||
_In_ PSID pSid
|
||||
);
|
||||
|
||||
BOOL WINAPI CreateWellKnownSid(
|
||||
_In_ WELL_KNOWN_SID_TYPE WellKnownSidType,
|
||||
_In_opt_ PSID DomainSid,
|
||||
_Out_opt_ PSID pSid,
|
||||
_Inout_ DWORD *cbSid
|
||||
);
|
||||
|
||||
|
||||
VOID DebugBreak();
|
||||
|
||||
@@ -1182,6 +1246,17 @@ BOOL WINAPI DuplicateHandle(
|
||||
_In_ DWORD dwOptions
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI ZwDuplicateObject(
|
||||
_In_ HANDLE SourceProcessHandle,
|
||||
_In_ HANDLE SourceHandle,
|
||||
_In_opt_ HANDLE TargetProcessHandle,
|
||||
_Out_opt_ PHANDLE TargetHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ ULONG HandleAttributes,
|
||||
_In_ ULONG Options
|
||||
);
|
||||
|
||||
|
||||
DWORD WINAPI GetModuleBaseNameA(
|
||||
_In_ HANDLE hProcess,
|
||||
_In_opt_ HMODULE hModule,
|
||||
@@ -1504,4 +1579,26 @@ HINSTANCE WINAPI ShellExecuteW(
|
||||
_In_opt_ LPWSTR lpParameters,
|
||||
_In_opt_ LPWSTR lpDirectory,
|
||||
_In_ INT nShowCmd
|
||||
);
|
||||
|
||||
BOOL WINAPI InitializeProcThreadAttributeList(
|
||||
_Out_opt_ LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
|
||||
_In_ DWORD dwAttributeCount,
|
||||
_Reserved_ DWORD dwFlags,
|
||||
_Inout_ PSIZE_T lpSize
|
||||
);
|
||||
|
||||
|
||||
BOOL WINAPI UpdateProcThreadAttribute(
|
||||
_Inout_ LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
|
||||
_In_ DWORD dwFlags,
|
||||
_In_ DWORD_PTR Attribute,
|
||||
_In_ PVOID lpValue,
|
||||
_In_ SIZE_T cbSize,
|
||||
_Out_opt_ PVOID lpPreviousValue,
|
||||
_In_opt_ PSIZE_T lpReturnSize
|
||||
);
|
||||
|
||||
VOID WINAPI DeleteProcThreadAttributeList(
|
||||
_Inout_ LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList
|
||||
);
|
||||
@@ -170,6 +170,104 @@ typedef enum _SYSTEM_INFORMATION_CLASS {
|
||||
MaxSystemInfoClass
|
||||
} SYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _WELL_KNOWN_SID_TYPE{
|
||||
WinNullSid = 0,
|
||||
WinWorldSid = 1,
|
||||
WinLocalSid = 2,
|
||||
WinCreatorOwnerSid = 3,
|
||||
WinCreatorGroupSid = 4,
|
||||
WinCreatorOwnerServerSid = 5,
|
||||
WinCreatorGroupServerSid = 6,
|
||||
WinNtAuthoritySid = 7,
|
||||
WinDialupSid = 8,
|
||||
WinNetworkSid = 9,
|
||||
WinBatchSid = 10,
|
||||
WinInteractiveSid = 11,
|
||||
WinServiceSid = 12,
|
||||
WinAnonymousSid = 13,
|
||||
WinProxySid = 14,
|
||||
WinEnterpriseControllersSid = 15,
|
||||
WinSelfSid = 16,
|
||||
WinAuthenticatedUserSid = 17,
|
||||
WinRestrictedCodeSid = 18,
|
||||
WinTerminalServerSid = 19,
|
||||
WinRemoteLogonIdSid = 20,
|
||||
WinLogonIdsSid = 21,
|
||||
WinLocalSystemSid = 22,
|
||||
WinLocalServiceSid = 23,
|
||||
WinNetworkServiceSid = 24,
|
||||
WinBuiltinDomainSid = 25,
|
||||
WinBuiltinAdministratorsSid = 26,
|
||||
WinBuiltinUsersSid = 27,
|
||||
WinBuiltinGuestsSid = 28,
|
||||
WinBuiltinPowerUsersSid = 29,
|
||||
WinBuiltinAccountOperatorsSid = 30,
|
||||
WinBuiltinSystemOperatorsSid = 31,
|
||||
WinBuiltinPrintOperatorsSid = 32,
|
||||
WinBuiltinBackupOperatorsSid = 33,
|
||||
WinBuiltinReplicatorSid = 34,
|
||||
WinBuiltinPreWindows2000CompatibleAccessSid = 35,
|
||||
WinBuiltinRemoteDesktopUsersSid = 36,
|
||||
WinBuiltinNetworkConfigurationOperatorsSid = 37,
|
||||
WinAccountAdministratorSid = 38,
|
||||
WinAccountGuestSid = 39,
|
||||
WinAccountKrbtgtSid = 40,
|
||||
WinAccountDomainAdminsSid = 41,
|
||||
WinAccountDomainUsersSid = 42,
|
||||
WinAccountDomainGuestsSid = 43,
|
||||
WinAccountComputersSid = 44,
|
||||
WinAccountControllersSid = 45,
|
||||
WinAccountCertAdminsSid = 46,
|
||||
WinAccountSchemaAdminsSid = 47,
|
||||
WinAccountEnterpriseAdminsSid = 48,
|
||||
WinAccountPolicyAdminsSid = 49,
|
||||
WinAccountRasAndIasServersSid = 50,
|
||||
WinNTLMAuthenticationSid = 51,
|
||||
WinDigestAuthenticationSid = 52,
|
||||
WinSChannelAuthenticationSid = 53,
|
||||
WinThisOrganizationSid = 54,
|
||||
WinOtherOrganizationSid = 55,
|
||||
WinBuiltinIncomingForestTrustBuildersSid = 56,
|
||||
WinBuiltinPerfMonitoringUsersSid = 57,
|
||||
WinBuiltinPerfLoggingUsersSid = 58,
|
||||
WinBuiltinAuthorizationAccessSid = 59,
|
||||
WinBuiltinTerminalServerLicenseServersSid = 60,
|
||||
WinBuiltinDCOMUsersSid = 61,
|
||||
WinBuiltinIUsersSid = 62,
|
||||
WinIUserSid = 63,
|
||||
WinBuiltinCryptoOperatorsSid = 64,
|
||||
WinUntrustedLabelSid = 65,
|
||||
WinLowLabelSid = 66,
|
||||
WinMediumLabelSid = 67,
|
||||
WinHighLabelSid = 68,
|
||||
WinSystemLabelSid = 69,
|
||||
WinWriteRestrictedCodeSid = 70,
|
||||
WinCreatorOwnerRightsSid = 71,
|
||||
WinCacheablePrincipalsGroupSid = 72,
|
||||
WinNonCacheablePrincipalsGroupSid = 73,
|
||||
WinEnterpriseReadonlyControllersSid = 74,
|
||||
WinAccountReadonlyControllersSid = 75,
|
||||
WinBuiltinEventLogReadersGroup = 76,
|
||||
WinNewEnterpriseReadonlyControllersSid = 77,
|
||||
WinBuiltinCertSvcDComAccessGroup = 78,
|
||||
WinMediumPlusLabelSid = 79,
|
||||
WinLocalLogonSid = 80,
|
||||
WinConsoleLogonSid = 81,
|
||||
WinThisOrganizationCertificateSid = 82,
|
||||
WinApplicationPackageAuthoritySid = 83,
|
||||
WinBuiltinAnyPackageSid = 84,
|
||||
WinCapabilityInternetClientSid = 85,
|
||||
WinCapabilityInternetClientServerSid = 86,
|
||||
WinCapabilityPrivateNetworkClientServerSid = 87,
|
||||
WinCapabilityPicturesLibrarySid = 88,
|
||||
WinCapabilityVideosLibrarySid = 89,
|
||||
WinCapabilityMusicLibrarySid = 90,
|
||||
WinCapabilityDocumentsLibrarySid = 91,
|
||||
WinCapabilitySharedUserCertificatesSid = 92,
|
||||
WinCapabilityEnterpriseAuthenticationSid = 93,
|
||||
WinCapabilityRemovableStorageSid = 94
|
||||
} WELL_KNOWN_SID_TYPE;
|
||||
|
||||
|
||||
typedef enum _MEMORY_INFORMATION_CLASS {
|
||||
MemoryBasicInformation,
|
||||
@@ -948,6 +1046,19 @@ typedef struct _STARTUPINFOW {
|
||||
HANDLE hStdError;
|
||||
} STARTUPINFOW, *LPSTARTUPINFOW;
|
||||
|
||||
|
||||
typedef struct _STARTUPINFOEXA {
|
||||
STARTUPINFOA StartupInfo;
|
||||
LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList;
|
||||
} STARTUPINFOEXA, *LPSTARTUPINFOEXA;
|
||||
|
||||
|
||||
typedef struct _STARTUPINFOEXW {
|
||||
STARTUPINFOW StartupInfo;
|
||||
LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList;
|
||||
} STARTUPINFOEXW, *LPSTARTUPINFOEXW;
|
||||
|
||||
|
||||
typedef struct _PROCESS_INFORMATION {
|
||||
HANDLE hProcess;
|
||||
HANDLE hThread;
|
||||
|
||||
@@ -958,6 +958,31 @@ SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE = make_flag("SYSTEM_AUDIT_CALLBACK_OBJECT_
|
||||
SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE = make_flag("SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE", ( 0x10 ))
|
||||
SYSTEM_MANDATORY_LABEL_ACE_TYPE = make_flag("SYSTEM_MANDATORY_LABEL_ACE_TYPE", ( 0x11 ))
|
||||
ACCESS_MAX_MS_V5_ACE_TYPE = make_flag("ACCESS_MAX_MS_V5_ACE_TYPE", ( 0x11 ))
|
||||
LPC_REQUEST = make_flag("LPC_REQUEST", 1)
|
||||
LPC_REPLY = make_flag("LPC_REPLY", 2)
|
||||
LPC_DATAGRAM = make_flag("LPC_DATAGRAM", 3)
|
||||
LPC_LOST_REPLY = make_flag("LPC_LOST_REPLY", 4)
|
||||
LPC_PORT_CLOSED = make_flag("LPC_PORT_CLOSED", 5)
|
||||
LPC_CLIENT_DIED = make_flag("LPC_CLIENT_DIED", 6)
|
||||
LPC_EXCEPTION = make_flag("LPC_EXCEPTION", 7)
|
||||
LPC_DEBUG_EVENT = make_flag("LPC_DEBUG_EVENT", 8)
|
||||
LPC_ERROR_EVENT = make_flag("LPC_ERROR_EVENT", 9)
|
||||
LPC_CONNECTION_REQUEST = make_flag("LPC_CONNECTION_REQUEST", 10)
|
||||
ALPC_MESSAGE_SECURITY_ATTRIBUTE = make_flag("ALPC_MESSAGE_SECURITY_ATTRIBUTE", 0x80000000)
|
||||
ALPC_MESSAGE_VIEW_ATTRIBUTE = make_flag("ALPC_MESSAGE_VIEW_ATTRIBUTE", 0x40000000)
|
||||
ALPC_MESSAGE_CONTEXT_ATTRIBUTE = make_flag("ALPC_MESSAGE_CONTEXT_ATTRIBUTE", 0x20000000)
|
||||
ALPC_MESSAGE_HANDLE_ATTRIBUTE = make_flag("ALPC_MESSAGE_HANDLE_ATTRIBUTE", 0x10000000)
|
||||
ALPC_VIEWFLG_NOT_SECURE = make_flag("ALPC_VIEWFLG_NOT_SECURE", 0x40000)
|
||||
ALPC_MSGFLG_REPLY_MESSAGE = make_flag("ALPC_MSGFLG_REPLY_MESSAGE", 0x1)
|
||||
ALPC_MSGFLG_LPC_MODE = make_flag("ALPC_MSGFLG_LPC_MODE", 0x2)
|
||||
ALPC_MSGFLG_RELEASE_MESSAGE = make_flag("ALPC_MSGFLG_RELEASE_MESSAGE", 0x10000)
|
||||
ALPC_MSGFLG_SYNC_REQUEST = make_flag("ALPC_MSGFLG_SYNC_REQUEST", 0x20000)
|
||||
ALPC_MSGFLG_WAIT_USER_MODE = make_flag("ALPC_MSGFLG_WAIT_USER_MODE", 0x100000)
|
||||
ALPC_MSGFLG_WAIT_ALERTABLE = make_flag("ALPC_MSGFLG_WAIT_ALERTABLE", 0x200000)
|
||||
ALPC_MSGFLG_WOW64_CALL = make_flag("ALPC_MSGFLG_WOW64_CALL", 0x80000000)
|
||||
ALPC_CANCELFLG_TRY_CANCEL = make_flag("ALPC_CANCELFLG_TRY_CANCEL", 0x1)
|
||||
ALPC_CANCELFLG_NO_CONTEXT_CHECK = make_flag("ALPC_CANCELFLG_NO_CONTEXT_CHECK", 0x8)
|
||||
ALPC_CANCELFLGP_FLUSH = make_flag("ALPC_CANCELFLGP_FLUSH", 0x10000)
|
||||
CERT_QUERY_OBJECT_FILE = make_flag("CERT_QUERY_OBJECT_FILE", 0x00000001)
|
||||
CERT_QUERY_OBJECT_BLOB = make_flag("CERT_QUERY_OBJECT_BLOB", 0x00000002)
|
||||
CERT_QUERY_CONTENT_CERT = make_flag("CERT_QUERY_CONTENT_CERT", 1)
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -208,6 +208,107 @@ class _SYSTEM_INFORMATION_CLASS(EnumType):
|
||||
SYSTEM_INFORMATION_CLASS = _SYSTEM_INFORMATION_CLASS
|
||||
|
||||
|
||||
WinNullSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNullSid", 0x0)
|
||||
WinWorldSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinWorldSid", 0x1)
|
||||
WinLocalSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinLocalSid", 0x2)
|
||||
WinCreatorOwnerSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCreatorOwnerSid", 0x3)
|
||||
WinCreatorGroupSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCreatorGroupSid", 0x4)
|
||||
WinCreatorOwnerServerSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCreatorOwnerServerSid", 0x5)
|
||||
WinCreatorGroupServerSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCreatorGroupServerSid", 0x6)
|
||||
WinNtAuthoritySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNtAuthoritySid", 0x7)
|
||||
WinDialupSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinDialupSid", 0x8)
|
||||
WinNetworkSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNetworkSid", 0x9)
|
||||
WinBatchSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBatchSid", 0xa)
|
||||
WinInteractiveSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinInteractiveSid", 0xb)
|
||||
WinServiceSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinServiceSid", 0xc)
|
||||
WinAnonymousSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAnonymousSid", 0xd)
|
||||
WinProxySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinProxySid", 0xe)
|
||||
WinEnterpriseControllersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinEnterpriseControllersSid", 0xf)
|
||||
WinSelfSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinSelfSid", 0x10)
|
||||
WinAuthenticatedUserSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAuthenticatedUserSid", 0x11)
|
||||
WinRestrictedCodeSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinRestrictedCodeSid", 0x12)
|
||||
WinTerminalServerSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinTerminalServerSid", 0x13)
|
||||
WinRemoteLogonIdSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinRemoteLogonIdSid", 0x14)
|
||||
WinLogonIdsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinLogonIdsSid", 0x15)
|
||||
WinLocalSystemSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinLocalSystemSid", 0x16)
|
||||
WinLocalServiceSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinLocalServiceSid", 0x17)
|
||||
WinNetworkServiceSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNetworkServiceSid", 0x18)
|
||||
WinBuiltinDomainSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinDomainSid", 0x19)
|
||||
WinBuiltinAdministratorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinAdministratorsSid", 0x1a)
|
||||
WinBuiltinUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinUsersSid", 0x1b)
|
||||
WinBuiltinGuestsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinGuestsSid", 0x1c)
|
||||
WinBuiltinPowerUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinPowerUsersSid", 0x1d)
|
||||
WinBuiltinAccountOperatorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinAccountOperatorsSid", 0x1e)
|
||||
WinBuiltinSystemOperatorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinSystemOperatorsSid", 0x1f)
|
||||
WinBuiltinPrintOperatorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinPrintOperatorsSid", 0x20)
|
||||
WinBuiltinBackupOperatorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinBackupOperatorsSid", 0x21)
|
||||
WinBuiltinReplicatorSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinReplicatorSid", 0x22)
|
||||
WinBuiltinPreWindows2000CompatibleAccessSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinPreWindows2000CompatibleAccessSid", 0x23)
|
||||
WinBuiltinRemoteDesktopUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinRemoteDesktopUsersSid", 0x24)
|
||||
WinBuiltinNetworkConfigurationOperatorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinNetworkConfigurationOperatorsSid", 0x25)
|
||||
WinAccountAdministratorSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountAdministratorSid", 0x26)
|
||||
WinAccountGuestSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountGuestSid", 0x27)
|
||||
WinAccountKrbtgtSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountKrbtgtSid", 0x28)
|
||||
WinAccountDomainAdminsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountDomainAdminsSid", 0x29)
|
||||
WinAccountDomainUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountDomainUsersSid", 0x2a)
|
||||
WinAccountDomainGuestsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountDomainGuestsSid", 0x2b)
|
||||
WinAccountComputersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountComputersSid", 0x2c)
|
||||
WinAccountControllersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountControllersSid", 0x2d)
|
||||
WinAccountCertAdminsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountCertAdminsSid", 0x2e)
|
||||
WinAccountSchemaAdminsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountSchemaAdminsSid", 0x2f)
|
||||
WinAccountEnterpriseAdminsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountEnterpriseAdminsSid", 0x30)
|
||||
WinAccountPolicyAdminsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountPolicyAdminsSid", 0x31)
|
||||
WinAccountRasAndIasServersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountRasAndIasServersSid", 0x32)
|
||||
WinNTLMAuthenticationSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNTLMAuthenticationSid", 0x33)
|
||||
WinDigestAuthenticationSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinDigestAuthenticationSid", 0x34)
|
||||
WinSChannelAuthenticationSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinSChannelAuthenticationSid", 0x35)
|
||||
WinThisOrganizationSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinThisOrganizationSid", 0x36)
|
||||
WinOtherOrganizationSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinOtherOrganizationSid", 0x37)
|
||||
WinBuiltinIncomingForestTrustBuildersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinIncomingForestTrustBuildersSid", 0x38)
|
||||
WinBuiltinPerfMonitoringUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinPerfMonitoringUsersSid", 0x39)
|
||||
WinBuiltinPerfLoggingUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinPerfLoggingUsersSid", 0x3a)
|
||||
WinBuiltinAuthorizationAccessSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinAuthorizationAccessSid", 0x3b)
|
||||
WinBuiltinTerminalServerLicenseServersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinTerminalServerLicenseServersSid", 0x3c)
|
||||
WinBuiltinDCOMUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinDCOMUsersSid", 0x3d)
|
||||
WinBuiltinIUsersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinIUsersSid", 0x3e)
|
||||
WinIUserSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinIUserSid", 0x3f)
|
||||
WinBuiltinCryptoOperatorsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinCryptoOperatorsSid", 0x40)
|
||||
WinUntrustedLabelSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinUntrustedLabelSid", 0x41)
|
||||
WinLowLabelSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinLowLabelSid", 0x42)
|
||||
WinMediumLabelSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinMediumLabelSid", 0x43)
|
||||
WinHighLabelSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinHighLabelSid", 0x44)
|
||||
WinSystemLabelSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinSystemLabelSid", 0x45)
|
||||
WinWriteRestrictedCodeSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinWriteRestrictedCodeSid", 0x46)
|
||||
WinCreatorOwnerRightsSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCreatorOwnerRightsSid", 0x47)
|
||||
WinCacheablePrincipalsGroupSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCacheablePrincipalsGroupSid", 0x48)
|
||||
WinNonCacheablePrincipalsGroupSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNonCacheablePrincipalsGroupSid", 0x49)
|
||||
WinEnterpriseReadonlyControllersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinEnterpriseReadonlyControllersSid", 0x4a)
|
||||
WinAccountReadonlyControllersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinAccountReadonlyControllersSid", 0x4b)
|
||||
WinBuiltinEventLogReadersGroup = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinEventLogReadersGroup", 0x4c)
|
||||
WinNewEnterpriseReadonlyControllersSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinNewEnterpriseReadonlyControllersSid", 0x4d)
|
||||
WinBuiltinCertSvcDComAccessGroup = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinCertSvcDComAccessGroup", 0x4e)
|
||||
WinMediumPlusLabelSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinMediumPlusLabelSid", 0x4f)
|
||||
WinLocalLogonSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinLocalLogonSid", 0x50)
|
||||
WinConsoleLogonSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinConsoleLogonSid", 0x51)
|
||||
WinThisOrganizationCertificateSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinThisOrganizationCertificateSid", 0x52)
|
||||
WinApplicationPackageAuthoritySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinApplicationPackageAuthoritySid", 0x53)
|
||||
WinBuiltinAnyPackageSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinBuiltinAnyPackageSid", 0x54)
|
||||
WinCapabilityInternetClientSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityInternetClientSid", 0x55)
|
||||
WinCapabilityInternetClientServerSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityInternetClientServerSid", 0x56)
|
||||
WinCapabilityPrivateNetworkClientServerSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityPrivateNetworkClientServerSid", 0x57)
|
||||
WinCapabilityPicturesLibrarySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityPicturesLibrarySid", 0x58)
|
||||
WinCapabilityVideosLibrarySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityVideosLibrarySid", 0x59)
|
||||
WinCapabilityMusicLibrarySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityMusicLibrarySid", 0x5a)
|
||||
WinCapabilityDocumentsLibrarySid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityDocumentsLibrarySid", 0x5b)
|
||||
WinCapabilitySharedUserCertificatesSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilitySharedUserCertificatesSid", 0x5c)
|
||||
WinCapabilityEnterpriseAuthenticationSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityEnterpriseAuthenticationSid", 0x5d)
|
||||
WinCapabilityRemovableStorageSid = EnumValue("_WELL_KNOWN_SID_TYPE", "WinCapabilityRemovableStorageSid", 0x5e)
|
||||
class _WELL_KNOWN_SID_TYPE(EnumType):
|
||||
values = [WinNullSid, WinWorldSid, WinLocalSid, WinCreatorOwnerSid, WinCreatorGroupSid, WinCreatorOwnerServerSid, WinCreatorGroupServerSid, WinNtAuthoritySid, WinDialupSid, WinNetworkSid, WinBatchSid, WinInteractiveSid, WinServiceSid, WinAnonymousSid, WinProxySid, WinEnterpriseControllersSid, WinSelfSid, WinAuthenticatedUserSid, WinRestrictedCodeSid, WinTerminalServerSid, WinRemoteLogonIdSid, WinLogonIdsSid, WinLocalSystemSid, WinLocalServiceSid, WinNetworkServiceSid, WinBuiltinDomainSid, WinBuiltinAdministratorsSid, WinBuiltinUsersSid, WinBuiltinGuestsSid, WinBuiltinPowerUsersSid, WinBuiltinAccountOperatorsSid, WinBuiltinSystemOperatorsSid, WinBuiltinPrintOperatorsSid, WinBuiltinBackupOperatorsSid, WinBuiltinReplicatorSid, WinBuiltinPreWindows2000CompatibleAccessSid, WinBuiltinRemoteDesktopUsersSid, WinBuiltinNetworkConfigurationOperatorsSid, WinAccountAdministratorSid, WinAccountGuestSid, WinAccountKrbtgtSid, WinAccountDomainAdminsSid, WinAccountDomainUsersSid, WinAccountDomainGuestsSid, WinAccountComputersSid, WinAccountControllersSid, WinAccountCertAdminsSid, WinAccountSchemaAdminsSid, WinAccountEnterpriseAdminsSid, WinAccountPolicyAdminsSid, WinAccountRasAndIasServersSid, WinNTLMAuthenticationSid, WinDigestAuthenticationSid, WinSChannelAuthenticationSid, WinThisOrganizationSid, WinOtherOrganizationSid, WinBuiltinIncomingForestTrustBuildersSid, WinBuiltinPerfMonitoringUsersSid, WinBuiltinPerfLoggingUsersSid, WinBuiltinAuthorizationAccessSid, WinBuiltinTerminalServerLicenseServersSid, WinBuiltinDCOMUsersSid, WinBuiltinIUsersSid, WinIUserSid, WinBuiltinCryptoOperatorsSid, WinUntrustedLabelSid, WinLowLabelSid, WinMediumLabelSid, WinHighLabelSid, WinSystemLabelSid, WinWriteRestrictedCodeSid, WinCreatorOwnerRightsSid, WinCacheablePrincipalsGroupSid, WinNonCacheablePrincipalsGroupSid, WinEnterpriseReadonlyControllersSid, WinAccountReadonlyControllersSid, WinBuiltinEventLogReadersGroup, WinNewEnterpriseReadonlyControllersSid, WinBuiltinCertSvcDComAccessGroup, WinMediumPlusLabelSid, WinLocalLogonSid, WinConsoleLogonSid, WinThisOrganizationCertificateSid, WinApplicationPackageAuthoritySid, WinBuiltinAnyPackageSid, WinCapabilityInternetClientSid, WinCapabilityInternetClientServerSid, WinCapabilityPrivateNetworkClientServerSid, WinCapabilityPicturesLibrarySid, WinCapabilityVideosLibrarySid, WinCapabilityMusicLibrarySid, WinCapabilityDocumentsLibrarySid, WinCapabilitySharedUserCertificatesSid, WinCapabilityEnterpriseAuthenticationSid, WinCapabilityRemovableStorageSid]
|
||||
mapper = {x:x for x in values}
|
||||
WELL_KNOWN_SID_TYPE = _WELL_KNOWN_SID_TYPE
|
||||
|
||||
|
||||
MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
|
||||
MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
|
||||
MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)
|
||||
@@ -1379,6 +1480,22 @@ class _STARTUPINFOW(Structure):
|
||||
STARTUPINFOW = _STARTUPINFOW
|
||||
LPSTARTUPINFOW = POINTER(_STARTUPINFOW)
|
||||
|
||||
class _STARTUPINFOEXA(Structure):
|
||||
_fields_ = [
|
||||
("StartupInfo", STARTUPINFOA),
|
||||
("lpAttributeList", LPPROC_THREAD_ATTRIBUTE_LIST),
|
||||
]
|
||||
LPSTARTUPINFOEXA = POINTER(_STARTUPINFOEXA)
|
||||
STARTUPINFOEXA = _STARTUPINFOEXA
|
||||
|
||||
class _STARTUPINFOEXW(Structure):
|
||||
_fields_ = [
|
||||
("StartupInfo", STARTUPINFOW),
|
||||
("lpAttributeList", LPPROC_THREAD_ATTRIBUTE_LIST),
|
||||
]
|
||||
STARTUPINFOEXW = _STARTUPINFOEXW
|
||||
LPSTARTUPINFOEXW = POINTER(_STARTUPINFOEXW)
|
||||
|
||||
class _PROCESS_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("hProcess", HANDLE),
|
||||
@@ -2706,17 +2823,6 @@ class _WINTRUST_DATA(Structure):
|
||||
PWINTRUST_DATA = POINTER(_WINTRUST_DATA)
|
||||
WINTRUST_DATA = _WINTRUST_DATA
|
||||
|
||||
class _PROCESS_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("Reserved1", PVOID),
|
||||
("PebBaseAddress", PPEB),
|
||||
("Reserved2", PVOID * 2),
|
||||
("UniqueProcessId", ULONG_PTR),
|
||||
("Reserved3", PVOID),
|
||||
]
|
||||
PPROCESS_BASIC_INFORMATION = POINTER(_PROCESS_BASIC_INFORMATION)
|
||||
PROCESS_BASIC_INFORMATION = _PROCESS_BASIC_INFORMATION
|
||||
|
||||
class _PROCESS_BASIC_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("ExitStatus", NTSTATUS),
|
||||
|
||||
@@ -92,6 +92,8 @@ class RemoteCCharP(RemotePtr, ctypes.c_char_p):
|
||||
@property
|
||||
def value(self):
|
||||
base = self.raw_value
|
||||
if not base:
|
||||
return None
|
||||
res = []
|
||||
for i in itertools.count():
|
||||
x = self.target.read_memory(base + (i * 0x100), 0x100)
|
||||
@@ -106,6 +108,8 @@ class RemoteWCharP(RemotePtr, ctypes.c_char_p):
|
||||
@property
|
||||
def value(self):
|
||||
base = self.raw_value
|
||||
if not base:
|
||||
return None
|
||||
# Simple case where target in a WinProcess
|
||||
try:
|
||||
return self.target.read_wstring(base)
|
||||
|
||||
@@ -51,5 +51,9 @@ def print_ctypes_struct(struct, name="", ident=0, hexa=False):
|
||||
return
|
||||
|
||||
for fname, ftype in struct._fields_:
|
||||
value = getattr(struct, fname)
|
||||
try:
|
||||
value = getattr(struct, fname)
|
||||
except Exception as e:
|
||||
print("Error while printing <{0}> : {1}".format(fname, e))
|
||||
continue
|
||||
print_ctypes_struct(value, "{0}.{1}".format(name, fname), hexa=hexa)
|
||||
@@ -92,6 +92,20 @@ def create_process(path, args=None, dwCreationFlags=0, show_windows=True):
|
||||
return windows.winobject.process.WinProcess(pid=proc_info.dwProcessId, handle=proc_info.hProcess)
|
||||
|
||||
|
||||
def lookup_privilege_value(privilege_name):
|
||||
luid = LUID()
|
||||
winproxy.LookupPrivilegeValueA(None, privilege_name, byref(luid))
|
||||
return luid
|
||||
|
||||
def lookup_privilege_name(privilege_value):
|
||||
if isinstance(privilege_value, tuple):
|
||||
luid = LUID(privilege_value[1], privilege_value[0])
|
||||
privilege_value = luid
|
||||
size = DWORD(0x100)
|
||||
buff = ctypes.c_buffer(size.value)
|
||||
winproxy.LookupPrivilegeNameA(None, privilege_value, buff, size)
|
||||
return buff[:size.value]
|
||||
|
||||
def enable_privilege(lpszPrivilege, bEnablePrivilege):
|
||||
"""
|
||||
Enable or disable a privilege::
|
||||
@@ -169,10 +183,12 @@ class FixedInteractiveConsole(code.InteractiveConsole):
|
||||
return raw_input("")
|
||||
|
||||
|
||||
def pop_shell():
|
||||
def pop_shell(locs=None):
|
||||
"""Pop a console with an InterativeConsole"""
|
||||
if locs is None:
|
||||
locs = globals()
|
||||
create_console()
|
||||
FixedInteractiveConsole(locals()).interact()
|
||||
FixedInteractiveConsole(locs).interact()
|
||||
|
||||
|
||||
def get_kernel_modules():
|
||||
@@ -231,6 +247,19 @@ def decompress_buffer(comptype, buffer, uncompress_size=None):
|
||||
windows.winproxy.RtlDecompressBuffer(comptype, uncompressed, uncompress_size, buffer, len(buffer), result_size)
|
||||
return uncompressed[:result_size.value]
|
||||
|
||||
|
||||
# sid.py + real SID type ?
|
||||
|
||||
def get_known_sid(sid_type):
|
||||
size = DWORD()
|
||||
try:
|
||||
windows.winproxy.CreateWellKnownSid(sid_type, None, None, size)
|
||||
except WindowsError:
|
||||
pass
|
||||
buffer = ctypes.c_buffer(size.value)
|
||||
windows.winproxy.CreateWellKnownSid(sid_type, None, buffer, size)
|
||||
return ctypes.cast(buffer, PSID)
|
||||
|
||||
class VirtualProtected(object):
|
||||
"""
|
||||
A context manager usable like `VirtualProtect` that will restore the old protection at exit ::
|
||||
|
||||
@@ -389,6 +389,7 @@ def CreateProcessW(lpApplicationName, lpCommandLine=None, lpProcessAttributes=No
|
||||
return CreateProcessW.ctypes_function(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
|
||||
|
||||
|
||||
|
||||
@Kernel32Proxy("GetThreadContext")
|
||||
def GetThreadContext(hThread, lpContext=None):
|
||||
if lpContext is None:
|
||||
@@ -680,8 +681,36 @@ def SetConsoleCtrlHandler(HandlerRoutine, Add):
|
||||
def GetProcessDEPPolicy(hProcess, lpFlags, lpPermanent):
|
||||
return GetProcessDEPPolicy.ctypes_function(hProcess, lpFlags, lpPermanent)
|
||||
|
||||
|
||||
# ProcThreadAttributeList
|
||||
def initializeprocthreadattributelist_error_check(func_name, result, func, args):
|
||||
if result:
|
||||
return args
|
||||
error = GetLastError()
|
||||
if error == ERROR_INSUFFICIENT_BUFFER and args[0] is None:
|
||||
return args
|
||||
raise Kernel32Error(func_name)
|
||||
|
||||
@Kernel32Proxy("InitializeProcThreadAttributeList", initializeprocthreadattributelist_error_check)
|
||||
def InitializeProcThreadAttributeList(lpAttributeList=None, dwAttributeCount=NeededParameter, dwFlags=0, lpSize=NeededParameter):
|
||||
return InitializeProcThreadAttributeList.ctypes_function(lpAttributeList, dwAttributeCount, dwFlags, lpSize)
|
||||
|
||||
|
||||
@Kernel32Proxy("UpdateProcThreadAttribute")
|
||||
def UpdateProcThreadAttribute(lpAttributeList, dwFlags=0, Attribute=NeededParameter, lpValue=NeededParameter, cbSize=NeededParameter, lpPreviousValue=None, lpReturnSize=None):
|
||||
return UpdateProcThreadAttribute.ctypes_function(lpAttributeList, dwFlags, Attribute, lpValue, cbSize, lpPreviousValue, lpReturnSize)
|
||||
|
||||
|
||||
@Kernel32Proxy("DeleteProcThreadAttributeList")
|
||||
def DeleteProcThreadAttributeList(lpAttributeList):
|
||||
return DeleteProcThreadAttributeList.ctypes_function(lpAttributeList)
|
||||
|
||||
# ### NTDLL #### #
|
||||
|
||||
@NtdllProxy('NtReadVirtualMemory', error_ntstatus)
|
||||
def NtReadVirtualMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
|
||||
return NtReadVirtualMemory.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
|
||||
|
||||
@NtdllProxy('NtWow64ReadVirtualMemory64', error_ntstatus)
|
||||
def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead=None):
|
||||
return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
|
||||
@@ -858,6 +887,14 @@ def LookupPrivilegeValueA(lpSystemName=None, lpName=NeededParameter, lpLuid=Need
|
||||
def LookupPrivilegeValueW(lpSystemName=None, lpName=NeededParameter, lpLuid=NeededParameter):
|
||||
return LookupPrivilegeValueW.ctypes_function(lpSystemName, lpName, lpLuid)
|
||||
|
||||
@Advapi32Proxy('LookupPrivilegeNameA')
|
||||
def LookupPrivilegeNameA(lpSystemName, lpLuid, lpName, cchName):
|
||||
return LookupPrivilegeNameA.ctypes_function(lpSystemName, lpLuid, lpName, cchName)
|
||||
|
||||
@Advapi32Proxy('LookupPrivilegeNameW')
|
||||
def LookupPrivilegeNameW(lpSystemName, lpLuid, lpName, cchName):
|
||||
return LookupPrivilegeNameW.ctypes_function(lpSystemName, lpLuid, lpName, cchName)
|
||||
|
||||
|
||||
@Advapi32Proxy('AdjustTokenPrivileges')
|
||||
def AdjustTokenPrivileges(TokenHandle, DisableAllPrivileges=False, NewState=NeededParameter, BufferLength=None, PreviousState=None, ReturnLength=None):
|
||||
@@ -875,10 +912,15 @@ def LookupAccountSidA(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainNa
|
||||
def LookupAccountSidW(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainName, cchReferencedDomainName, peUse):
|
||||
return LookupAccountSidW.ctypes_function(lpSystemName, lpSid, lpName, cchName, lpReferencedDomainName, cchReferencedDomainName, peUse)
|
||||
|
||||
@Advapi32Proxy('CreateWellKnownSid')
|
||||
def CreateWellKnownSid(WellKnownSidType, DomainSid=None, pSid=None, cbSid=NeededParameter):
|
||||
return CreateWellKnownSid.ctypes_function(WellKnownSidType, DomainSid, pSid, cbSid)
|
||||
|
||||
# Token stuff
|
||||
|
||||
GetSidSubAuthorityCount = TransparentAdvapi32Proxy("GetSidSubAuthorityCount")
|
||||
GetSidSubAuthority = TransparentAdvapi32Proxy("GetSidSubAuthority")
|
||||
GetLengthSid = TransparentAdvapi32Proxy("GetLengthSid")
|
||||
|
||||
@Advapi32Proxy('GetTokenInformation')
|
||||
def GetTokenInformation(TokenHandle=NeededParameter, TokenInformationClass=NeededParameter, TokenInformation=None, TokenInformationLength=0, ReturnLength=None):
|
||||
@@ -981,6 +1023,15 @@ def EnumServicesStatusExA(hSCManager, InfoLevel, dwServiceType, dwServiceState,
|
||||
def EnumServicesStatusExW(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName):
|
||||
return EnumServicesStatusExW.ctypes_function(hSCManager, InfoLevel, dwServiceType, dwServiceState, lpServices, cbBufSize, pcbBytesNeeded, lpServicesReturned, lpResumeHandle, pszGroupName)
|
||||
|
||||
# Create process stuff
|
||||
|
||||
@Advapi32Proxy('CreateProcessAsUserA')
|
||||
def CreateProcessAsUserA(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation):
|
||||
return CreateProcessAsUserA.ctypes_function(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
|
||||
|
||||
@Advapi32Proxy('CreateProcessAsUserW')
|
||||
def CreateProcessAsUserW(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation):
|
||||
return CreateProcessAsUserW.ctypes_function(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
|
||||
|
||||
|
||||
# ##### Iphlpapi (network list and stuff) ###### #
|
||||
|
||||
Reference in New Issue
Block a user