Created sub-directories in samples/

samples/process/current_process.py

@@ -0,0 +1,44 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.native_exec.simple_x86 as x86
+import windows.native_exec.simple_x64 as x64
+# Here is our current process
+cp = windows.current_process
+
+print("current process is {cp}".format(cp=windows.current_process))
+print("current process is a <{cp.bitness}> bits process".format(cp=cp))
+print("current process is a SysWow64 process ? <{cp.is_wow_64}>".format(cp=cp))
+print("current process pid <{cp.pid}>  and ppid <{cp.ppid}>".format(cp=cp))
+print("Here are the current process threads: <{cp.threads}>".format(cp=cp))
+
+print("Let's execute some native code ! (0x41 + 1)")
+
+if windows.current_process.bitness == 32:
+    # Let's generate some native code
+    code =  x86.MultipleInstr()
+    code += x86.Mov("Eax", 0x41)
+    code += x86.Inc("EAX")
+    code += x86.Ret()
+else:
+    code =  x64.MultipleInstr()
+    code += x64.Mov("RAX", 0x41)
+    code += x64.Inc("RAX")
+    code += x64.Ret()
+
+native_code = code.get_code()
+
+v = windows.current_process.execute(native_code)
+print("Native code returned <{0}>".format(hex(v)))
+
+print("Allocating memory in current process")
+addr = cp.virtual_alloc(0x1000) # Default alloc is RWX (so secure !)
+print("Allocated memory is at <{0}>".format(hex(addr)))
+
+print("Writing 'SOME STUFF' in allocation memory")
+cp.write_memory(addr, "SOME STUFF")
+print("Reading memory : <{0}>".format(repr(cp.read_memory(addr, 20))))
+
+

samples/process/iat_hook.py

@@ -0,0 +1,63 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import _winreg
+import windows
+
+# Here is a demo of IAT hooking in python
+# We will hook the 'RegOpenKeyExA' entry of Python27.dll because it is easy to trigger !
+
+# First: let's create our hook
+# windows.hooks.RegOpenKeyExACallback is generated based on windows.generated_def.winfuncs
+@windows.hooks.RegOpenKeyExACallback
+def open_reg_hook(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_function):
+    print("<in hook> Hook called | hKey = {0} | lpSubKey = <{1}>".format(hex(hKey), lpSubKey.value))
+    # Our hook can choose to call the real_function or not
+    if "SECRET" in lpSubKey.value:
+        print("<in hook> Secret key asked, returning magic handle 0x12345678")
+        # We must respect the hooked method return-value interface
+        phkResult[0] = 0x12345678
+        return 0
+    if "FAIL" in lpSubKey.value:
+        print("<in hook> Asked for a failing key: returning 0x2a")
+        return 42
+    print("<in hook> Non-secret key : calling normal function")
+    return real_function()
+
+
+# Get the peb of our process
+peb = windows.current_process.peb
+
+# Get the pythonxx.dll module
+pythondll_module = [m for m in peb.modules if m.name.startswith("python") and m.name.endswith(".dll")][0]
+
+# Get the iat entries for DLL advapi32.dll
+adv_imports = pythondll_module.pe.imports['advapi32.dll']
+
+# Get RegOpenKeyExA iat entry
+RegOpenKeyExA_iat = [n for n in adv_imports if n.name == "RegOpenKeyExA"][0]
+
+# Setup our hook
+RegOpenKeyExA_iat.set_hook(open_reg_hook)
+
+# Use python native module _winreg that call 'RegOpenKeyExA'
+print("Asking for <MY_SECRET_KEY>")
+v = _winreg.OpenKey(1234567, "MY_SECRET_KEY")
+print("Result = " + hex(v.handle))
+
+print("")
+print("Asking for <MY_FAIL_KEY>")
+try:
+    v = _winreg.OpenKey(1234567, "MY_FAIL_KEY")
+    print("Result = " + hex(v.handle))
+except WindowsError as e:
+    print(repr(e))
+
+print("")
+print("Asking for <HKEY_CURRENT_USER/Software>")
+try:
+    v = _winreg.OpenKey(_winreg.HKEY_CURRENT_USER, "Software")
+    print("Result = " + hex(v.handle))
+except WindowsError as e:
+    print(repr(e))

samples/process/peb.py

@@ -0,0 +1,40 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+
+print("Exploring the current process PEB")
+peb = windows.current_process.peb
+print("PEB is <{0}>".format(peb))
+commandline = peb.commandline
+print("Commandline object is {0}".format(commandline))
+print("Commandline string is {0}".format(repr(commandline.Buffer)))
+
+imagepath = peb.imagepath
+print("Imagepath  {0}".format(imagepath))
+
+modules = peb.modules
+print("Printing some modules: {0}".format("\n".join(str(m) for m in modules[:6])))
+
+print("=== K32  ===")
+print("Looking for kernel32.dll")
+k32 = [m for m in modules if m.name == "kernel32.dll"][0]
+print("Kernel32 module: {0}".format(k32))
+
+print("Module name = <{0}> | Fullname = <{1}>".format(k32.name, k32.fullname))
+print("Kernel32 is loaded at address {0}".format(hex(k32.baseaddr)))
+
+print("=== K32 PE ===")
+k32pe = k32.pe
+print("PE Representation of k32: {0}".format(k32pe))
+exports = k32pe.exports
+some_exports = dict((k,v) for k,v in exports.items() if k in [0, 42, "VirtualAlloc", "CreateFileA"])
+print("Here are some exports {0}".format(some_exports))
+
+imports = k32pe.imports
+print("Import DLL dependancies are (without api-*): {0}".format([x for x in imports.keys() if not x.startswith("api-")]))
+
+NtCreateFile_iat = [x for x in imports["ntdll.dll"] if x.name == "NtCreateFile"][0]
+print("IAT Entry for ntdll!NtCreateFile = {0} | addr = {1}".format(NtCreateFile_iat, hex(NtCreateFile_iat.addr)))
+print("Sections: {0}".format(k32pe.sections))

samples/process/remote_process.py

@@ -0,0 +1,92 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.native_exec.simple_x86 as x86
+import windows.native_exec.simple_x64 as x64
+
+print("Creating a notepad") ## Replaced calc.exe by notepad.exe cause of windows 10.
+notepad = windows.utils.create_process(r"C:\windows\system32\notepad.exe")
+# You don't need to do that in our case, but it's useful to now
+print("Looking for notepads in the processes")
+all_notepads = [proc for proc in windows.system.processes if proc.name == "notepad.exe"]
+print("They are currently <{0}> notepads running on the system".format(len(all_notepads)))
+
+print("Let's play with our notepad: <{notepad}>".format(notepad=notepad))
+print("Our notepad pid is {notepad.pid}".format(notepad=notepad))
+print("Our notepad is a <{notepad.bitness}> bits process".format(notepad=notepad))
+print("Our notepad is a SysWow64 process ? <{notepad.is_wow_64}>".format(notepad=notepad))
+print("Our notepad have threads ! <{notepad.threads}>".format(notepad=notepad))
+
+# PEB STUFF
+peb = notepad.peb
+print("Exploring our notepad PEB ! {peb}".format(peb=peb))
+print("Command line is {peb.commandline}".format(peb=peb))
+modules = peb.modules
+print("Here are 3 loaded modules: {0}".format(modules[:3]))
+# See iat_hook.py for module exploration
+
+
+# Remote alloc / read / write
+
+print("Allocating memory in our notepad")
+addr = notepad.virtual_alloc(0x1000)
+print("Allocated memory is at <{0}>".format(hex(addr)))
+print("Writing 'SOME STUFF' in allocated memory")
+notepad.write_memory(addr, "SOME STUFF")
+print("Reading allocated memory : <{0}>".format(repr(notepad.read_memory(addr, 20))))
+
+
+# Remote Execution
+
+print("Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)")
+
+if notepad.bitness == 32:
+    # Let's generate some native code
+    code =  x86.MultipleInstr()
+    code += x86.Mov(x86.deref(addr), 0x42424242)
+    code += x86.Mov("EAX", 0x1337)
+    code += x86.Ret()
+else:
+    code =  x64.MultipleInstr()
+    code += x64.Mov('RAX', addr)
+    code += x64.Mov(x64.mem("[RAX]"), 0x42424242)
+    code += x64.Mov("RAX", 0x1337)
+    code += x64.Ret()
+
+print("Executing native code !")
+t = notepad.execute(code.get_code())
+t.wait()
+print("Return code = {0}".format(hex(t.exit_code)))
+print("Reading allocated memory : <{0}>".format(repr(notepad.read_memory(addr, 20))))
+
+print("Executing python code !")
+# Make 'windows' importable in remote python
+notepad.execute_python("import sys; sys.path.append(r'{0}')".format(sys.path[-1]))
+
+notepad.execute_python("import windows")
+# Let's write in the notepad 'current_process' memory :)
+notepad.execute_python("addr = {addr}; windows.current_process.write_memory(addr, 'HELLO FROM notepad')".format(addr=addr))
+print("Reading allocated memory : <{0}>".format(repr(notepad.read_memory(addr, 20))))
+
+# python_execute is 'safe':
+# - it waits for the thread completion
+# - it raise an error if remote code raised some
+
+try:
+    print("Trying to import in remote module 'FAKE_MODULE'")
+    notepad.execute_python("def func():\n   import FAKE_MODULE\nfunc()")
+except windows.injection.RemotePythonError as e:
+    print("Remote ERROR !")
+    print(e)
+
+print("That's all ! killing the notepad")
+notepad.exit()
+
+
+
+
+
+
+

samples/process/remote_veh_segv.py

@@ -0,0 +1,69 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.test
+
+from windows.generated_def.winstructs import *
+
+python_code = """
+import windows
+import ctypes
+import windows
+from windows.winobject.exception import VectoredException
+import windows.generated_def.windef as windef
+from windows.generated_def.winstructs import *
+
+windows.utils.create_console()
+
+module_to_trace = "gdi32.dll"
+nb_repeat = [5]
+
+@VectoredException
+def handler(exc):
+    if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:
+        print("")
+        target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value
+        print("Instr at {0} accessed to addr {1} ({2})".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr), module_to_trace))
+        windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_EXECUTE_READWRITE)
+        nb_repeat[0] -= 1
+        if nb_repeat[0]:
+            exc[0].ContextRecord[0].EEFlags.TF = 1
+        else:
+            print("No more tracing !")
+        return windef.EXCEPTION_CONTINUE_EXECUTION
+    else:
+        print("Exception of type {0}".format(exc[0].ExceptionRecord[0].ExceptionCode))
+        print("Resetting page protection to <PAGE_READWRITE>")
+        windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)
+        return windef.EXCEPTION_CONTINUE_EXECUTION
+
+
+windows.winproxy.AddVectoredExceptionHandler(0, handler)
+
+print("Tracing execution in module: <{0}>".format(module_to_trace))
+
+module = [x for x in windows.current_process.peb.modules if x.name == module_to_trace][0]
+target_page = module.baseaddr
+code_size = module.pe.get_OptionalHeader().SizeOfCode
+
+print("Protected page is at {0}".format(hex(target_page)))
+windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)
+"""
+
+c = windows.test.pop_calc_64(dwCreationFlags=CREATE_SUSPENDED)
+x = c.execute_python(python_code)
+
+c.threads[0].resume()
+
+import time
+time.sleep(0.1)
+
+for t in c.threads:
+    t.suspend()
+
+time.sleep(1)
+c.exit()
+

samples/process/veh_segv.py

@@ -0,0 +1,43 @@
+import sys
+import os.path
+import pprint
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import ctypes
+import windows
+from windows.winobject.exception import VectoredException
+import windows.generated_def.windef as windef
+from windows.generated_def.winstructs import *
+
+
+@VectoredException
+def handler(exc):
+    print("==Entry of VEH handler==")
+    if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:
+        target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value
+        print("Instr at {0} accessed to addr {1}".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr)))
+        print("Resetting page protection to <PAGE_READWRITE>")
+        windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_READWRITE)
+        exc[0].ContextRecord[0].EEFlags.TF = 1
+        return windef.EXCEPTION_CONTINUE_EXECUTION
+    else:
+        print("Exception of type {0}".format(exc[0].ExceptionRecord[0].ExceptionCode))
+        print("Resetting page protection to <PAGE_NOACCESS>")
+        windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_NOACCESS)
+        return windef.EXCEPTION_CONTINUE_EXECUTION
+
+
+windows.winproxy.AddVectoredExceptionHandler(0, handler)
+
+target_page = windows.current_process.virtual_alloc(0x1000)
+print("Protected page is at <{0}>".format(hex(target_page)))
+print("Setting page protection to <PAGE_NOACCESS>")
+windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_NOACCESS)
+
+print("")
+v = ctypes.c_uint.from_address(target_page).value
+print("Value 1 read")
+
+print("")
+v = ctypes.c_uint.from_address(target_page + 0x10).value
+print("Value 2 read")