From c228a0d5cb89e4fd88f6d81ba1c325e462d1ae42 Mon Sep 17 00:00:00 2001 From: hakril Date: Thu, 2 Aug 2018 18:51:41 +0200 Subject: [PATCH] Added Certificate.distinguished_name and BaseSystemModule.name + some winproxy functions --- windows/crypto/certificate.py | 28 +++++++++++++++++++++++++--- windows/winobject/event_log.py | 2 ++ windows/winobject/system_module.py | 7 +++++++ windows/winobject/task_scheduler.py | 16 ++++++++++++---- windows/winproxy.py | 12 +++++++++++- 5 files changed, 57 insertions(+), 8 deletions(-) diff --git a/windows/crypto/certificate.py b/windows/crypto/certificate.py index 5324ee9..a136c83 100644 --- a/windows/crypto/certificate.py +++ b/windows/crypto/certificate.py @@ -221,22 +221,28 @@ class Certificate(gdef.CERT_CONTEXT): return " ".join("{:02x}".format(x) for x in serial_bytes) - def get_name(self, nametype=gdef.CERT_NAME_SIMPLE_DISPLAY_TYPE, flags=0): + def get_name(self, nametype=gdef.CERT_NAME_SIMPLE_DISPLAY_TYPE, param_type=0, flags=0): """Retrieve the subject or issuer name of the certificate. See `CertGetNameStringA `_ :returns: :class:`str` """ - size = winproxy.CertGetNameStringA(self, nametype, flags, None, None, 0) + if nametype == gdef.CERT_NAME_RDN_TYPE: + param_type = gdef.DWORD(param_type) + param_type = gdef.LPDWORD(param_type) + size = winproxy.CertGetNameStringA(self, nametype, flags, param_type, None, 0) namebuff = ctypes.c_buffer(size) - size = winproxy.CertGetNameStringA(self, nametype, flags, None, namebuff, size) + size = winproxy.CertGetNameStringA(self, nametype, flags, param_type, namebuff, size) return namebuff[:-1] + + name = property(get_name) """The name of the certificate. :type: :class:`str`""" + def raw_hash(self): size = gdef.DWORD(100) buffer = ctypes.c_buffer(size.value) @@ -258,6 +264,21 @@ class Certificate(gdef.CERT_CONTEXT): """ return " ".join("{:02X}".format(x) for x in bytearray(self.raw_hash())) + @property + def distinguished_name(self): + """The distinguished name (DN) of the certificate. + + Example: + + >>> x + + >>> x.distinguished_name + 'C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011' + + :type: :class:`str` + """ + return self.get_name(gdef.CERT_NAME_RDN_TYPE, gdef.CERT_X500_NAME_STR) + @property def issuer(self): """The name of the certificate's issuer. @@ -265,6 +286,7 @@ class Certificate(gdef.CERT_CONTEXT): :type: :class:`str`""" return self.get_name(flags=gdef.CERT_NAME_ISSUER_FLAG) + @property def store(self): """The certificate store that contains the certificate diff --git a/windows/winobject/event_log.py b/windows/winobject/event_log.py index 32dc66e..4ed6b5e 100644 --- a/windows/winobject/event_log.py +++ b/windows/winobject/event_log.py @@ -198,6 +198,8 @@ class EvtEvent(gdef.EVT_HANDLE): :type: :class:`dict` """ + # What about classic channels where there is no event_metadata ? + # Return a dict with [0-1-2-3-4] as key ? raise ? return {k:v for k,v in zip(self.metadata.event_data, self.event_values())} diff --git a/windows/winobject/system_module.py b/windows/winobject/system_module.py index 57725c1..b5c2557 100644 --- a/windows/winobject/system_module.py +++ b/windows/winobject/system_module.py @@ -6,10 +6,17 @@ import windows.generated_def as gdef class BaseSystemModule(object): """[ABSTRACT] A common base class for all system modules""" + + @property + def name(self): + """The name of the system module: alias for ``ImageName``""" + return self.ImageName + def __repr__(self): return """<{0} name="{1}" base={2:#x}>""".format(type(self).__name__, self.ImageName, self.Base) + class SystemModule(BaseSystemModule, gdef.SYSTEM_MODULE): """A system module. diff --git a/windows/winobject/task_scheduler.py b/windows/winobject/task_scheduler.py index bbd50b3..b70d3b0 100644 --- a/windows/winobject/task_scheduler.py +++ b/windows/winobject/task_scheduler.py @@ -82,10 +82,7 @@ class AbstractAction(object): class Action(gdef.IAction, AbstractAction): """Describe an action performed by a task""" - ACTION_SUBTYPE = { - gdef.TASK_ACTION_SEND_EMAIL: gdef.IEmailAction, - gdef.TASK_ACTION_SHOW_MESSAGE: gdef.IShowMessageAction - } + ACTION_SUBTYPE = {} @property @@ -133,6 +130,17 @@ class ComHandlerAction(gdef.IComHandlerAction, AbstractAction): Action.ACTION_SUBTYPE[gdef.TASK_ACTION_COM_HANDLER] = ComHandlerAction +class EmailAction(gdef.IEmailAction, AbstractAction): + pass + + +Action.ACTION_SUBTYPE[gdef.TASK_ACTION_SEND_EMAIL] = EmailAction + +class ShowMessageAction(gdef.IShowMessageAction, AbstractAction): + pass + +Action.ACTION_SUBTYPE[gdef.TASK_ACTION_SHOW_MESSAGE] = ShowMessageAction + class Trigger(gdef.ITrigger): """A task trigger""" type = generate_simple_getter("get_Type", gdef.TASK_TRIGGER_TYPE2) diff --git a/windows/winproxy.py b/windows/winproxy.py index be3c24e..3b82bd9 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -988,6 +988,10 @@ def NtSetContextThread(hThread, lpContext): def NtOpenEvent(EventHandle, DesiredAccess, ObjectAttributes): return NtOpenEvent.ctypes_function(EventHandle, DesiredAccess, ObjectAttributes) +@NtdllProxy("NtSetInformationFile", error_ntstatus) +def NtSetInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass): + return NtSetInformationFile.ctypes_function(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass) + @NtdllProxy("NtAlpcCreatePort", error_ntstatus) def NtAlpcCreatePort(PortHandle, ObjectAttributes, PortAttributes): @@ -1483,16 +1487,22 @@ def WinVerifyTrust(hwnd, pgActionID, pWVTData): def CryptCATAdminCalcHashFromFileHandle(hFile, pcbHash, pbHash, dwFlags): return CryptCATAdminCalcHashFromFileHandle.ctypes_function(hFile, pcbHash, pbHash, dwFlags) +@WinTrustProxy('CryptCATAdminCalcHashFromFileHandle2', error_check=zero_is_fail_error_check) +def CryptCATAdminCalcHashFromFileHandle2(hCatAdmin, hFile, pcbHash, pbHash, dwFlags): + return CryptCATAdminCalcHashFromFileHandle2.ctypes_function(hCatAdmin, hFile, pcbHash, pbHash, dwFlags) @WinTrustProxy('CryptCATAdminEnumCatalogFromHash') def CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo): return CryptCATAdminEnumCatalogFromHash.ctypes_function(hCatAdmin, pbHash, cbHash, dwFlags, phPrevCatInfo) - @WinTrustProxy('CryptCATAdminAcquireContext', error_check=zero_is_fail_error_check) def CryptCATAdminAcquireContext(phCatAdmin, pgSubsystem, dwFlags): return CryptCATAdminAcquireContext.ctypes_function(phCatAdmin, pgSubsystem, dwFlags) +@WinTrustProxy('CryptCATAdminAcquireContext2', error_check=zero_is_fail_error_check) +def CryptCATAdminAcquireContext2(phCatAdmin, pgSubsystem, pwszHashAlgorithm, pStrongHashPolicy, dwFlags): + return CryptCATAdminAcquireContext2.ctypes_function(phCatAdmin, pgSubsystem, pwszHashAlgorithm, pStrongHashPolicy, dwFlags) + @WinTrustProxy('CryptCATCatalogInfoFromContext', error_check=zero_is_fail_error_check) def CryptCATCatalogInfoFromContext(hCatInfo, psCatInfo, dwFlags):