Created sub-directories in samples/

samples/debug/debug_functionbp.py

@@ -0,0 +1,49 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.test
+import windows.debug
+
+from windows.generated_def.winstructs import *
+
+class MyFunctionBP(windows.debug.FunctionBP):
+    def __init__(self, target, addr=None):
+        super(MyFunctionBP, self).__init__(target, addr)
+        self.target_name = target.target_func
+        self.counter = 3
+
+    def trigger(self, dbg, exc):
+        if not self.counter:
+            print("Exiting process")
+            dbg.current_process.exit()
+            return
+        params = self.extract_arguments(dbg.current_process, dbg.current_thread)
+        filename = params["ObjectAttributes"].contents.ObjectName.contents.Buffer
+        handle_addr = params["FileHandle"].value
+        self.data = (filename, handle_addr)
+        self.break_on_ret(dbg, exc)
+
+    def ret_trigger(self, dbg, exc):
+        filename, handle_addr = self.data
+        ret_value = dbg.current_thread.context.func_result # EAX / RAX depending of bitness
+        handle_value = dbg.current_process.read_ptr(handle_addr)
+        if ret_value:
+            print("NtCreateFile of <{0}> FAILED (result={1:#x})".format(filename, ret_value))
+            return
+        print("NtCreateFile of <{0}>: handle = {1:#x}".format(filename, handle_value))
+        # Manual verification
+        fhandle = [h for h in windows.system.handles if h.dwProcessId == dbg.current_process.pid and h.wValue == handle_value]
+        if not fhandle:
+            raise ValueError("handle not found!")
+        fhandle = fhandle[0]
+        print("Handle manually found! typename=<{0}>, name=<{1}>".format(fhandle.type, fhandle.name))
+        print("")
+        self.counter -= 1
+
+calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
+d = windows.debug.Debugger(calc)
+d.add_bp(MyFunctionBP(windows.winproxy.NtCreateFile))
+d.loop()

samples/debug/debugger_api.py

@@ -0,0 +1,76 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.test
+import windows.debug
+
+from windows.generated_def.winstructs import *
+
+class MyDebugger(windows.debug.Debugger):
+    def __init__(self, *args, **kwargs):
+        super(MyDebugger, self).__init__(*args, **kwargs)
+        self.struct_already_dump = set()
+
+    def dump_struct_once(self, struct, name):
+        if name in self.struct_already_dump:
+            return
+        windows.utils.print_ctypes_struct(struct, name, hexa=True)
+        self.struct_already_dump.add(name)
+
+    def on_exception(self, exception):
+        print("<on_exception> called with {0}".format(exception))
+        self.dump_struct_once(exception, "    exception")
+        print("Single Stepping")
+        return self.single_step()
+
+    def on_single_step(self, exception):
+        print("<on_single_step> called with {0}".format(exception))
+        self.dump_struct_once(exception, "    single_step")
+
+    def on_create_process(self, create_process):
+        print("<on_create_process> called with {0}".format(create_process))
+        self.dump_struct_once(create_process, "    create_process")
+        pass
+
+    def on_exit_process(self, exit_process):
+        print("<on_exit_process> called with {0}".format(exit_process))
+        self.dump_struct_once(exit_process, "    exit_process")
+        pass
+
+    def on_create_thread(self, create_thread):
+        print("<on_create_thread> called with {0}".format(create_thread))
+        self.dump_struct_once(create_thread, "    create_thread")
+        pass
+
+    def on_exit_thread(self, exit_thread):
+        print("<on_exit_thread> called with {0}".format(exit_thread))
+        self.dump_struct_once(exit_thread, "    exit_thread")
+        pass
+
+    def on_load_dll(self, load_dll):
+        print("<on_load_dll> called with {0} ({1})".format(load_dll, self._get_loaded_dll(load_dll)))
+        self.dump_struct_once(load_dll, "    load_dll")
+        pass
+
+    def on_unload_dll(self, unload_dll):
+        print("<on_unload_dll> called with <{0}>".format(unload_dll))
+        self.dump_struct_once(unload_dll, "    unload_dll")
+        pass
+
+    def on_output_debug_string(self, debug_string):
+        print("<on_output_debug_string> called with {0}".format(debug_string))
+        self.dump_struct_once(debug_string, "    debug_string")
+        pass
+
+    def on_rip(self, rip_info):
+        print("<on_rip> called with {0}".format(rip_info))
+        self.dump_struct_once(rip_info, "    rip_info")
+        pass
+
+
+calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
+d = MyDebugger(calc)
+d.loop()

samples/debug/debugger_membp_singlestep.py

@@ -0,0 +1,67 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.test
+import windows.debug
+
+import windows.native_exec.simple_x86 as x86
+from windows.generated_def.winstructs import *
+
+
+class MyDebugger(windows.debug.Debugger):
+    def __init__(self, *args, **kwargs):
+        super(MyDebugger, self).__init__(*args, **kwargs)
+        self.single_step_counter = 0
+
+    def on_exception(self, exception):
+        code = exception.ExceptionRecord.ExceptionCode
+        addr = exception.ExceptionRecord.ExceptionAddress
+        print("Got exception {0} at 0x{1:x}".format(code, addr))
+
+    def on_single_step(self, exception):
+        code = exception.ExceptionRecord.ExceptionCode
+        addr = exception.ExceptionRecord.ExceptionAddress
+        print("Got single_step {0} at 0x{1:x}".format(code, addr))
+        self.single_step_counter -= 1
+        if self.single_step_counter > 0:
+            return self.single_step()
+        else:
+            print("No more single step: exiting")
+            self.current_process.exit()
+
+
+class SingleStepOnWrite(windows.debug.MemoryBreakpoint):
+    """Check that BP/dbg can trigger single step and that instruction follows"""
+    def trigger(self, dbg, exc):
+        fault_addr = exc.ExceptionRecord.ExceptionInformation[1]
+        eip = dbg.current_thread.context.pc
+        print("Instruction at <{0:#x}> wrote at <{1:#x}>".format(eip, fault_addr))
+        dbg.single_step_counter = 4
+        return dbg.single_step()
+
+
+calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
+d = MyDebugger(calc)
+
+code = calc.virtual_alloc(0x1000)
+data = calc.virtual_alloc(0x1000)
+
+injected = x86.MultipleInstr()
+injected += x86.Mov("EAX", 0)
+injected += x86.Mov(x86.deref(data), "EAX")
+injected += x86.Add("EAX", 4)
+injected += x86.Mov(x86.deref(data + 4), "EAX")
+injected += x86.Add("EAX", 8)
+injected += x86.Mov(x86.deref(data + 8), "EAX")
+injected += x86.Nop()
+injected += x86.Nop()
+injected += x86.Ret()
+
+calc.write_memory(code, injected.get_code())
+d.add_bp(SingleStepOnWrite(data, size=8, events="W"))
+calc.create_thread(code, 0)
+d.loop()
+

samples/debug/debugger_print_LdrLoaddll.py

@@ -0,0 +1,46 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.test
+import windows.debug
+
+from windows.generated_def.winstructs import *
+
+
+
+class MyDebugger(windows.debug.Debugger):
+    def on_exception(self, exception):
+        code = exception.ExceptionRecord.ExceptionCode
+        addr = exception.ExceptionRecord.ExceptionAddress
+        print("Got exception {0} at 0x{1:x}".format(code, addr))
+
+
+class PrintUnicodeString(windows.debug.Breakpoint):
+    def __init__(self, addr, argument_position):
+        super(PrintUnicodeString, self).__init__(addr)
+        self.arg_pos = argument_position
+
+
+    def trigger(self, dbg, exc):
+        p = dbg.current_process
+        t = dbg.current_thread
+        esp = t.context.Esp
+
+        unicode_string_addr = p.read_ptr(esp + (self.arg_pos + 1) * 4)
+        wstring_addr = p.read_ptr(unicode_string_addr + 4)
+        dll_loaded = p.read_wstring(wstring_addr)
+        print("Loading <{0}>".format(dll_loaded))
+
+        if dll_loaded.endswith("ole32.dll"):
+            print("Ask to load <ole32.dll>: exiting process")
+            dbg.current_process.exit()
+
+
+calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
+d = MyDebugger(calc)
+d.add_bp(PrintUnicodeString("ntdll!LdrLoadDll", argument_position=2))
+d.loop()
+

samples/debug/local_debugger.py

@@ -0,0 +1,43 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+from windows.generated_def.winstructs import *
+import windows.native_exec.simple_x86 as x86
+
+class SingleSteppingDebugger(windows.debug.LocalDebugger):
+    SINGLE_STEP_COUNT = 4
+    def on_exception(self, exc):
+        code = self.get_exception_code()
+        context = self.get_exception_context()
+        print("EXCEPTION !!!! Got a {0} at 0x{1:x}".format(code, context.pc))
+        self.SINGLE_STEP_COUNT -= 1
+        if self.SINGLE_STEP_COUNT:
+            return self.single_step()
+        return EXCEPTION_CONTINUE_EXECUTION
+
+class RewriteBreakpoint(windows.debug.HXBreakpoint):
+    def trigger(self, dbg, exc):
+        context = dbg.get_exception_context()
+        print("GOT AN HXBP at 0x{0:x}".format(context.pc))
+        # Rewrite the infinite loop with 2 nop
+        windows.current_process.write_memory(self.addr, "\x90\x90")
+        # Ask for a single stepping
+        return dbg.single_step()
+
+
+d = SingleSteppingDebugger()
+# Infinite loop + nop + ret
+code = x86.assemble("label :begin; jmp :begin; nop; ret")
+func = windows.native_exec.create_function(code, [PVOID])
+print("Code addr = 0x{0:x}".format(func.code_addr))
+# Create a thread that will infinite loop
+t = windows.current_process.create_thread(func.code_addr, 0)
+# Add a breakpoint on the infitine loop
+d.add_bp(RewriteBreakpoint(func.code_addr))
+t.wait()
+print("Done!")
+
+

samples/debug/local_debugger_remote_process.py

@@ -0,0 +1,44 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import ctypes
+import windows
+import windows.test
+
+from windows.generated_def.winstructs import *
+
+remote_code = """
+import windows
+from windows.generated_def.winstructs import *
+
+windows.utils.create_console()
+
+class YOLOHXBP(windows.debug.HXBreakpoint):
+    def trigger(self, dbg, exc):
+        p = windows.current_process
+        arg_pos = 2
+        context = dbg.get_exception_context()
+        esp = context.Esp
+        unicode_string_addr = p.read_ptr(esp + (arg_pos + 1) * 4)
+        wstring_addr = p.read_ptr(unicode_string_addr + 4)
+        dll_loaded = p.read_wstring(wstring_addr)
+        print("I AM LOADING <{0}>".format(dll_loaded))
+
+d = windows.debug.LocalDebugger()
+
+exp = windows.current_process.peb.modules[1].pe.exports
+#windows.utils.FixedInteractiveConsole(locals()).interact()
+ldr = exp["LdrLoadDll"]
+d.add_bp(YOLOHXBP(ldr))
+
+"""
+
+c = windows.test.pop_calc_32(dwCreationFlags=CREATE_SUSPENDED)
+c.execute_python(remote_code)
+c.threads[0].resume()
+
+import time
+time.sleep(2)
+c.exit()