Add Process.virtual_protect default value for 'old_protect' + add test for Improved LSA_UNICODE_STRING used in PEB.ProcessParameters + find_value now search in ntstatus values

samples/find_value.py

@@ -44,6 +44,7 @@ def search_name_in_interface(target):
             if match(target, mname):
                 print("Method <{0}> of <{1}>: {2}".format(mname, name, mvalue))
 
+
 def search_name(target):
     print("== Functions ==")
     search_name_in_function(target)
@@ -61,6 +62,10 @@ def search_value(target):
         if target == windef:
             print(windef)
 
+    for status in gdef.ntstatus.NtStatusException.ALL_STATUS.values():
+        if target == status[0]:
+            print(status)
+
 parser = argparse.ArgumentParser(prog=__file__)
 parser.add_argument('target', help='The name or value to research in PythonForWindows generated definition')
 res = parser.parse_args()

tests/test_process.py

@@ -63,6 +63,10 @@ class TestCurrentProcessWithCheckGarbage(object):
         assert isinstance(token.integrity, (int, long))
         assert isinstance(token.is_elevated, (bool))
 
+    def test_local_ProcessParameters_LSA_UNICODE_STRING(self):
+        image_path_from_process_params = windows.current_process.peb.ProcessParameters.contents.ImagePathName.str.lower()
+        image_path_from_module = windows.current_process.peb.modules[0].fullname.lower()
+        assert image_path_from_process_params == image_path_from_module
 
 @check_for_gc_garbage
 class TestProcessWithCheckGarbage(object):
@@ -362,4 +366,9 @@ class TestProcessWithCheckGarbage(object):
         thread = proc32_64.threads[0]
         tst_thread = windows.winobject.process.WinThread(tid=thread.tid)
         assert thread.owner_pid == tst_thread.owner_pid
-        assert thread.owner.name == tst_thread.owner.name
+        assert thread.owner.name == tst_thread.owner.name
+
+    def test_ProcessParameters_LSA_UNICODE_STRING(self, proc32_64):
+        image_path_from_process_params = proc32_64.peb.ProcessParameters.contents.ImagePathName.str.lower()
+        image_path_from_module = proc32_64.peb.modules[0].fullname.lower()
+        assert image_path_from_process_params == image_path_from_module

windows/winobject/process.py

@@ -428,20 +428,19 @@ class Process(AutoHandle):
         finally:
              self.virtual_protect(addr, size, old_protect.value, old_protect)
 
-    def virtual_protect(self, addr, size, protect, old_protect):
+    def virtual_protect(self, addr, size, protect, old_protect=None):
         """Change the access right of one or more page of the process"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
-            #addr = (addr >> 12) << 12
-            #addr = ULONG64(addr)
             if size & 0x0fff:
                 size = ((size >> 12) + 1) << 12
-            #ssize = ULONG(size)
-            old_protect = ctypes.addressof(old_protect)
+            if old_protect is None:
+                old_protect = gdef.DWORD()
+            xold_protect = ctypes.addressof(old_protect)
             xaddr = ULONG64(addr)
             addr = ctypes.addressof(xaddr)
             xsize = ULONG(size)
             size = ctypes.addressof(xsize)
-            return windows.syswow64.NtProtectVirtualMemory_32_to_64(self.handle, addr, size, protect, old_protect)
+            return windows.syswow64.NtProtectVirtualMemory_32_to_64(self.handle, addr, size, protect, xold_protect)
         else:
             winproxy.VirtualProtectEx(self.handle, addr, size, protect, old_protect)