diff --git a/windows/test/__init__.py b/windows/test/__init__.py index 6d5d257..6e1b5fa 100644 --- a/windows/test/__init__.py +++ b/windows/test/__init__.py @@ -4,6 +4,8 @@ from test_utils import * from mytest import WindowsTestCase, WindowsAPITestCase, NativeUtilsTestCase, SystemTestCase from test_hooks import HookTestCase from test_debugger import DebuggerTestCase +from test_syswow import SyswowTestCase -__all__ = ["SystemTestCase", "WindowsTestCase", "WindowsAPITestCase", "DebuggerTestCase", "NativeUtilsTestCase", "HookTestCase"] +__all__ = ["SystemTestCase", "WindowsTestCase", "WindowsAPITestCase", + "DebuggerTestCase", "NativeUtilsTestCase", "HookTestCase", "SyswowTestCase"] diff --git a/windows/test/test_debugger.py b/windows/test/test_debugger.py index 0ba8386..ba64892 100644 --- a/windows/test/test_debugger.py +++ b/windows/test/test_debugger.py @@ -214,7 +214,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - d.add_bp(TSTBP("ntdll.dll!LdrLoadDll")) + d.add_bp(TSTBP("ntdll!LdrLoadDll")) d.loop() TEST_CASE.assertEqual(data[0], 1) @@ -237,7 +237,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - d.add_bp(TSTBP("ntdll.dll!LdrLoadDll")) + d.add_bp(TSTBP("ntdll!LdrLoadDll")) d.loop() TEST_CASE.assertEqual(data[0], 1) @@ -297,7 +297,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - d.add_bp(TSTBP("ntdll.dll!LdrLoadDll")) + d.add_bp(TSTBP("ntdll!LdrLoadDll")) # Code that will load wintrust ! d.loop() #TEST_CASE.assertEqual(data[0], 1) @@ -465,7 +465,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - d.add_bp(TSTBP("kernel32.dll!CreateFileW")) + d.add_bp(TSTBP("kernel32!CreateFileW")) threading.Thread(target=do_check).start() d.loop() TEST_CASE.assertEqual(data, [u"FILENAME1", u"FILENAME2"]) @@ -490,7 +490,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - the_bp = TSTBP("kernel32.dll!CreateFileW") + the_bp = TSTBP("kernel32!CreateFileW") d.add_bp(the_bp) threading.Thread(target=do_check).start() d.loop() @@ -516,7 +516,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - the_bp = TSTBP("kernel32.dll!CreateFileW") + the_bp = TSTBP("kernel32!CreateFileW") d.add_bp(the_bp) threading.Thread(target=do_check).start() d.loop() @@ -544,7 +544,7 @@ class DebuggerTestCase(unittest.TestCase): calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) d = windows.debug.Debugger(calc) - d.add_bp(TSTBP("kernel32.dll!CreateFileW")) + d.add_bp(TSTBP("kernel32!CreateFileW")) threading.Thread(target=do_check).start() d.loop() TEST_CASE.assertEqual(data, [u"FILENAME1", u"FILENAME2"]) diff --git a/windows/test/test_syswow.py b/windows/test/test_syswow.py new file mode 100644 index 0000000..4e6d280 --- /dev/null +++ b/windows/test/test_syswow.py @@ -0,0 +1,68 @@ +import windows +import time +import textwrap +from test_utils import * +from windows.generated_def.winstructs import * + + +class SyswowTestCase(unittest.TestCase): + @windows_64bit_only + @process_32bit_only + def test_exec_syswow(self): + x64_code = x64.assemble("mov rax, 0x4040404040404040; mov r11, 0x0202020202020202; add rax, r11; ret") + res = windows.syswow64.execute_64bits_code_from_syswow(x64_code) + self.assertEqual(res, 0x4242424242424242) + + @windows_64bit_only + @process_32bit_only + def test_self_pebsyswow(self): + peb64 = windows.current_process.peb_syswow + modules_names = [m.name for m in peb64.modules] + self.assertIn("wow64.dll", modules_names) + # Parsing + wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0] + self.assertIn("Wow64LdrpInitialize", wow64.pe.exports) + + @windows_64bit_only + def test_remote_pebsyswow(self): + with Calc32() as calc: + peb64 = calc.peb_syswow + modules_names = [m.name for m in peb64.modules] + self.assertIn("wow64.dll", modules_names) + # Parsing + wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0] + self.assertIn("Wow64LdrpInitialize", wow64.pe.exports) + + @windows_64bit_only + def test_getset_syswow_context(self): + with Calc32() as calc: + addr = calc.virtual_alloc(0x1000) + + remote_python_code = """ + import windows + import windows.native_exec.simple_x64 as x64 + windows.utils.create_console() + x64_code = x64.assemble("mov r11, 0x1122334455667788; label :loop; jmp :loop; nop; nop; ret") + res = windows.syswow64.execute_64bits_code_from_syswow(x64_code) + print("res = {{0}}".format(hex(res))) + windows.current_process.write_qword({0}, res) + import time + time.sleep(10) + """.format(addr) + + t = calc.execute_python_unsafe(textwrap.dedent(remote_python_code)) + ctx = t.context_syswow + # Check the get context + self.assertEqual(ctx.R11, 0x1122334455667788) + self.assertEqual(calc.read_memory(ctx.Rip, 2), x64.assemble("label :loop; jmp :loop")) + t.suspend() + calc.write_memory(ctx.Rip, "\x90\x90") + # Check the set context + RETURN_VALUE = 0x4041424344454647 + ctx.Rax = RETURN_VALUE + ctx.Rip += 2 + t.set_syswow_context(ctx) + t.resume() + time.sleep(0.1) + self.assertEqual(RETURN_VALUE, calc.read_qword(addr)) +