From c12a0c45f9073daf328e601a74f3f938d50daace Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Fri, 6 Oct 2017 15:10:04 +0200 Subject: [PATCH] Add windows.system + ALPC + RPC + winproxy demo to README.md --- README.md | 124 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ TODO | 2 - 2 files changed, 124 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e7f7777..8af7fed 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,8 @@ You can also make some operation on threads (suspend/resume/wait/get(or set) con >>> import windows >>> windows.current_process.bitness 32 +>>> windows.current_process.token.integrity +SECURITY_MANDATORY_MEDIUM_RID(0x2000L) >>> calc = [p for p in windows.system.processes if p.name == "calc.exe"][0] >>> calc @@ -62,6 +64,34 @@ WindowsError: died during e 6961L ``` +### System information + +Information about the Windows computer running the script are available through the `windows.system` object. + +```python +>>> windows.system + +>>> windows.system.bitness +64 +>>> windows.system.computer_name +'DESKTOP-VKUGISR' +>>> windows.system.product_type +VER_NT_WORKSTATION(0x1L) +>>> windows.system.version +(10, 0) +>>> windows.system.version_name +'Windows 10' +>>> windows.system.build_number +'10.0.15063.608' + +# windows.system also contains dynamic lists about processes / threads / handles / ... +>>> windows.system.handles[-2:] +[ in process pid=14360>, in process pid=14360>] +>>> windows.system.processes[:2] +[, ] +>>> windows.system.logicaldrives[0] + +``` ### IAT Hook @@ -74,6 +104,49 @@ So the features is present (See [online documentation][ONLINE_IATHOOK] about IAT A wrapper around some Windows functions. Arguments name and order are the same, but some have default values and the functions raise exception on call error (I don't like 'if' around all my call). +```python +>>> import windows +>>> help(windows.winproxy.VirtualAlloc) +# Help on function VirtualAlloc in module windows.winproxy: +# VirtualAlloc(lpAddress=0, dwSize=NeededParameter, flAllocationType=MEM_COMMIT(0x1000L), flProtect=PAGE_EXECUTE_READWRITE(0x40L)) +# Errcheck: +# raise Kernel32Error if result is 0 + +# Positional arguments +>>> windows.winproxy.VirtualAlloc(0, 0x1000) +34537472 + +# Keyword arguments +>>> windows.winproxy.VirtualAlloc(dwSize=0x1000) +34603008 + +# NeededParameter must be provided +>>> windows.winproxy.VirtualAlloc() +""" +Traceback (most recent call last): +File "", line 1, in +File "windows\winproxy.py", line 264, in VirtualAlloc + return VirtualAlloc.ctypes_function(lpAddress, dwSize, flAllocationType, flProtect) +File "windows\winproxy.py", line 130, in perform_call + raise TypeError("{0}: Missing Mandatory parameter <{1}>".format(self.func_name, param_name)) +TypeError: VirtualAlloc: Missing Mandatory parameter +""" + +# Error raises exception +>>> windows.winproxy.VirtualAlloc(dwSize=0xffffffff) +""" +Traceback (most recent call last): +File "", line 1, in +File "windows\winproxy.py", line 264, in VirtualAlloc + return VirtualAlloc.ctypes_function(lpAddress, dwSize, flAllocationType, flProtect) +File "windows\winproxy.py", line 133, in perform_call + return self._cprototyped(*args) +File "windows\winproxy.py", line 59, in kernel32_error_check + raise Kernel32Error(func_name) +windows.winproxy.Kernel32Error: VirtualAlloc: [Error 8] Not enough storage is available to process this command. +""" +``` + ### Native execution @@ -158,6 +231,55 @@ KeyValue(name='MYQWORD', value=123456789987654321L, type=11) [KeyValue(name='MYQWORD', value=123456789987654321L, type=11), KeyValue(name='VALUE', value=u'a_value_for_my_key', type=1)] ``` +### ALPC-RPC + +#### ALPC + +Classes around **A**dvanced **L**ocal **P**rocedure **C**all (**ALPC**) syscalls allows to simply +write client and server able to send **ALPC** messages. + +```python +>>> import windows.alpc +# Test server juste reply to each message with "REQUEST '{msg_data}' RECEIVED" +>>> client = windows.alpc.AlpcClient(r"\RPC Control\PythonForWindowsTESTPORT") +>>> response = client.send_receive("Hello world !") +>>> response + +>>> response.data +"REQUEST 'Hello world !' RECEIVED" +``` + +Full client/server code for this example is available is the [ALPC samples][ONLINE_SAMPLE_ALPC] along with a more complex example. + + +#### RPC + +An RPC-Client based using **ALPC** communication is also integred + +```python +# Server (port ALPC '\RPC Control\HelloRpc') offers: +# Interface '41414141-4242-4343-4444-45464748494a' version 1.0 +# Method 1 -> int Add(int a, int b) -> return a + b +# This Test server is a real RPC Server using rpcrt4.dll and compiled with VS2015. + +>>> import windows.rpc +>>> from windows.rpc import ndr +>>> client = windows.rpc.RPCClient(r"\RPC Control\HelloRpc") +>>> client + +>>> iid = client.bind("41414141-4242-4343-4444-45464748494a") +>>> ndr_params = ndr.make_parameters([ndr.NdrLong] * 2) +# NDR pack + Make RPC call to method 1. +>>> resp = client.call(iid, 1, ndr_params.pack([41414141, 1010101])) +# Unpack the NDR response +>>> result = ndr.NdrLong.unpack(ndr.NdrStream(resp)) +>>> result +42424242 +``` + +A sample with the **U**ser **A**ccount **C**ontrol (**UAC**) and one with `lsasrv.dll` are available in the [RPC samples][ONLINE_SAMPLE_RPC]. + + ### Debugger PythonForWindows provides a standard debugger to debug other processes. @@ -271,4 +393,6 @@ The local debugger handles [SAMPLE_DIR]: https://github.com/hakril/PythonForWindows/tree/master/samples [ONLINE_DOC]: http://hakril.github.io/PythonForWindows/ [ONLINE_SAMPLE]: http://hakril.github.io/PythonForWindows/build/html/sample.html +[ONLINE_SAMPLE_ALPC]: http://hakril.github.io/PythonForWindows/build/html/sample.html#windows-alpc +[ONLINE_SAMPLE_RPC]: http://hakril.github.io/PythonForWindows/build/html/sample.html#windows-rpc [ONLINE_IATHOOK]: http://hakril.github.io/PythonForWindows/build/html/iat_hook.html \ No newline at end of file diff --git a/TODO b/TODO index c9362f8..24e8e9a 100644 --- a/TODO +++ b/TODO @@ -31,8 +31,6 @@ TODO: - Some test/doc on windows.system.handles - - registry - - test ! - wintrust doc: add : https://blogs.msdn.microsoft.com/winsdk/2016/01/05/why-cryptcatadmincalchashfromfilehandle-fails-with-a-seemingly-unexpected-error-code/