mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Writing samples and doc !
This commit is contained in:
Clement Rouault
+37
-17
@@ -3,42 +3,62 @@ import windows.test
|
||||
|
||||
from windows.generated_def.winstructs import *
|
||||
|
||||
#c = windows.test.pop_calc_64()
|
||||
|
||||
|
||||
c = windows.test.pop_calc_64(dwCreationFlags=CREATE_SUSPENDED)
|
||||
|
||||
|
||||
python_code = """
|
||||
import windows
|
||||
import ctypes
|
||||
import windows
|
||||
from windows.vectored_exception import VectoredException
|
||||
from windows.exception import VectoredException
|
||||
import windows.generated_def.windef as windef
|
||||
from windows.generated_def.winstructs import *
|
||||
|
||||
windows.utils.create_console()
|
||||
|
||||
module_to_trace = "gdi32.dll"
|
||||
nb_repeat = [5]
|
||||
|
||||
@VectoredException
|
||||
def handler(exc):
|
||||
print("POUET EXCEPTION")
|
||||
if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:
|
||||
print("")
|
||||
target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value
|
||||
print("Instr at {0} accessed to addr {1}".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr)))
|
||||
windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_READWRITE)
|
||||
print("Instr at {0} accessed to addr {1} ({2})".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr), module_to_trace))
|
||||
windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_EXECUTE_READWRITE)
|
||||
nb_repeat[0] -= 1
|
||||
if nb_repeat[0]:
|
||||
exc[0].ContextRecord[0].EEFlags.TF = 1
|
||||
else:
|
||||
print("No more tracing !")
|
||||
return windef.EXCEPTION_CONTINUE_EXECUTION
|
||||
else:
|
||||
print("Exception of type {0}".format(exc[0].ExceptionRecord[0].ExceptionCode))
|
||||
print("Resetting page protection to <PAGE_READWRITE>")
|
||||
windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)
|
||||
return windef.EXCEPTION_CONTINUE_EXECUTION
|
||||
return windef.EXCEPTION_CONTINUE_SEARCH
|
||||
|
||||
|
||||
windows.winproxy.AddVectoredExceptionHandler(0, handler)
|
||||
|
||||
target_page = windows.current_process.virtual_alloc(0x1000)
|
||||
print("Protected page is at {0}".format(hex(target_page)))
|
||||
windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_NOACCESS)
|
||||
print("Tracing execution in module: <{0}>".format(module_to_trace))
|
||||
|
||||
print("YOLO <3")
|
||||
print(ctypes.c_uint.from_address(target_page + 0x42).value)
|
||||
module = [x for x in windows.current_process.peb.modules if x.name == module_to_trace][0]
|
||||
target_page = module.baseaddr
|
||||
code_size = module.pe.get_OptionalHeader().SizeOfCode
|
||||
|
||||
print("Protected page is at {0}".format(hex(target_page)))
|
||||
windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)
|
||||
"""
|
||||
|
||||
c = windows.test.pop_calc_64(dwCreationFlags=CREATE_SUSPENDED)
|
||||
x = c.execute_python(python_code)
|
||||
|
||||
c.threads[0].resume()
|
||||
|
||||
import time
|
||||
time.sleep(0.1)
|
||||
|
||||
for t in c.threads:
|
||||
t.suspend()
|
||||
|
||||
time.sleep(1)
|
||||
c.exit()
|
||||
|
||||
x = c.execute_python(python_code)
|
||||
+12
-21
@@ -1,21 +1,23 @@
|
||||
import ctypes
|
||||
import windows
|
||||
from windows.vectored_exception import VectoredException
|
||||
from windows.exception import VectoredException
|
||||
import windows.generated_def.windef as windef
|
||||
from windows.generated_def.winstructs import *
|
||||
|
||||
|
||||
@VectoredException
|
||||
def handler(exc):
|
||||
print("POUET")
|
||||
print("==Entry of VEH handler==")
|
||||
if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:
|
||||
target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value
|
||||
print("Instr at {0} accessed to addr {1}".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr)))
|
||||
print("Resetting page protection to <PAGE_READWRITE>")
|
||||
windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_READWRITE)
|
||||
exc[0].ContextRecord[0].EEFlags.TF = 1
|
||||
return windef.EXCEPTION_CONTINUE_EXECUTION
|
||||
else:
|
||||
print("HAHAH {0}".format(exc[0].ExceptionRecord[0].ExceptionCode))
|
||||
print("Exception of type {0}".format(exc[0].ExceptionRecord[0].ExceptionCode))
|
||||
print("Resetting page protection to <PAGE_NOACCESS>")
|
||||
windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_NOACCESS)
|
||||
return windef.EXCEPTION_CONTINUE_EXECUTION
|
||||
|
||||
@@ -23,25 +25,14 @@ def handler(exc):
|
||||
windows.winproxy.AddVectoredExceptionHandler(0, handler)
|
||||
|
||||
target_page = windows.current_process.virtual_alloc(0x1000)
|
||||
print("Protected page is at {0}".format(hex(target_page)))
|
||||
print("Protected page is at <{0}>".format(hex(target_page)))
|
||||
print("Setting page protection to <PAGE_NOACCESS>")
|
||||
windows.winproxy.VirtualProtect(target_page, 0x1000, windef.PAGE_NOACCESS)
|
||||
|
||||
print("")
|
||||
v = ctypes.c_uint.from_address(target_page).value
|
||||
print("POINT1")
|
||||
print("Value 1 read")
|
||||
|
||||
print("")
|
||||
v = ctypes.c_uint.from_address(target_page + 0x10).value
|
||||
print("POINT2")
|
||||
|
||||
|
||||
|
||||
# (cmd) python.exe samples\veh_segv.py
|
||||
#Protected page is at 0x3f0000
|
||||
#POUET
|
||||
#Instr at 0x1d1ab5f4 accessed to addr 0x3f0000
|
||||
#POUET
|
||||
#HAHAH EXCEPTION_SINGLE_STEP(0x80000004L)
|
||||
#POINT1
|
||||
#POUET
|
||||
#Instr at 0x1d1ab5f4 accessed to addr 0x3f0010
|
||||
#POUET
|
||||
#HAHAH EXCEPTION_SINGLE_STEP(0x80000004L)
|
||||
#POINT2
|
||||
print("Value 2 read")
|
||||
|
||||
Reference in New Issue
Block a user