admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix test_debugger with new dll format in _resolve + some test of syswow peb/context

Browse Source
This commit is contained in:
Clement Rouault
2016-07-21 18:40:49 +02:00
parent f54a64670e
commit bc4952d513
3 changed files with 78 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/test/__init__.py
+3 -1
View File
@@ -4,6 +4,8 @@ from test_utils import *
from mytest import WindowsTestCase, WindowsAPITestCase, NativeUtilsTestCase, SystemTestCase
from test_hooks import HookTestCase
from test_debugger import DebuggerTestCase
from test_syswow import SyswowTestCase
__all__ = ["SystemTestCase", "WindowsTestCase", "WindowsAPITestCase", "DebuggerTestCase", "NativeUtilsTestCase", "HookTestCase"]
__all__ = ["SystemTestCase", "WindowsTestCase", "WindowsAPITestCase",
"DebuggerTestCase", "NativeUtilsTestCase", "HookTestCase", "SyswowTestCase"]
windows/test/test_debugger.py
+7 -7
View File
@@ -214,7 +214,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
d.add_bp(TSTBP("ntdll.dll!LdrLoadDll"))
d.add_bp(TSTBP("ntdll!LdrLoadDll"))
d.loop()
TEST_CASE.assertEqual(data[0], 1)
@@ -237,7 +237,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
d.add_bp(TSTBP("ntdll.dll!LdrLoadDll"))
d.add_bp(TSTBP("ntdll!LdrLoadDll"))
d.loop()
TEST_CASE.assertEqual(data[0], 1)
@@ -297,7 +297,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
d.add_bp(TSTBP("ntdll.dll!LdrLoadDll"))
d.add_bp(TSTBP("ntdll!LdrLoadDll"))
# Code that will load wintrust !
d.loop()
#TEST_CASE.assertEqual(data[0], 1)
@@ -465,7 +465,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
d.add_bp(TSTBP("kernel32.dll!CreateFileW"))
d.add_bp(TSTBP("kernel32!CreateFileW"))
threading.Thread(target=do_check).start()
d.loop()
TEST_CASE.assertEqual(data, [u"FILENAME1", u"FILENAME2"])
@@ -490,7 +490,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
the_bp = TSTBP("kernel32.dll!CreateFileW")
the_bp = TSTBP("kernel32!CreateFileW")
d.add_bp(the_bp)
threading.Thread(target=do_check).start()
d.loop()
@@ -516,7 +516,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
the_bp = TSTBP("kernel32.dll!CreateFileW")
the_bp = TSTBP("kernel32!CreateFileW")
d.add_bp(the_bp)
threading.Thread(target=do_check).start()
d.loop()
@@ -544,7 +544,7 @@ class DebuggerTestCase(unittest.TestCase):
calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
d = windows.debug.Debugger(calc)
d.add_bp(TSTBP("kernel32.dll!CreateFileW"))
d.add_bp(TSTBP("kernel32!CreateFileW"))
threading.Thread(target=do_check).start()
d.loop()
TEST_CASE.assertEqual(data, [u"FILENAME1", u"FILENAME2"])
windows/test/test_syswow.py
+68
View File
@@ -0,0 +1,68 @@
import windows
import time
import textwrap
from test_utils import *
from windows.generated_def.winstructs import *
class SyswowTestCase(unittest.TestCase):
@windows_64bit_only
@process_32bit_only
def test_exec_syswow(self):
x64_code = x64.assemble("mov rax, 0x4040404040404040; mov r11, 0x0202020202020202; add rax, r11; ret")
res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
self.assertEqual(res, 0x4242424242424242)
@windows_64bit_only
@process_32bit_only
def test_self_pebsyswow(self):
peb64 = windows.current_process.peb_syswow
modules_names = [m.name for m in peb64.modules]
self.assertIn("wow64.dll", modules_names)
# Parsing
wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0]
self.assertIn("Wow64LdrpInitialize", wow64.pe.exports)
@windows_64bit_only
def test_remote_pebsyswow(self):
with Calc32() as calc:
peb64 = calc.peb_syswow
modules_names = [m.name for m in peb64.modules]
self.assertIn("wow64.dll", modules_names)
# Parsing
wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0]
self.assertIn("Wow64LdrpInitialize", wow64.pe.exports)
@windows_64bit_only
def test_getset_syswow_context(self):
with Calc32() as calc:
addr = calc.virtual_alloc(0x1000)
remote_python_code = """
import windows
import windows.native_exec.simple_x64 as x64
windows.utils.create_console()
x64_code = x64.assemble("mov r11, 0x1122334455667788; label :loop; jmp :loop; nop; nop; ret")
res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
print("res = {{0}}".format(hex(res)))
windows.current_process.write_qword({0}, res)
import time
time.sleep(10)
""".format(addr)
t = calc.execute_python_unsafe(textwrap.dedent(remote_python_code))
ctx = t.context_syswow
# Check the get context
self.assertEqual(ctx.R11, 0x1122334455667788)
self.assertEqual(calc.read_memory(ctx.Rip, 2), x64.assemble("label :loop; jmp :loop"))
t.suspend()
calc.write_memory(ctx.Rip, "\x90\x90")
# Check the set context
RETURN_VALUE = 0x4041424344454647
ctx.Rax = RETURN_VALUE
ctx.Rip += 2
t.set_syswow_context(ctx)
t.resume()
time.sleep(0.1)
self.assertEqual(RETURN_VALUE, calc.read_qword(addr))