Adding some generated_def related to Section & NtReadFile/NtWriteFile

This commit is contained in:
hakril
2024-06-27 14:34:33 +02:00
parent 53554f45ab
commit cbf456ac4f
12 changed files with 3326 additions and 0 deletions
@@ -0,0 +1 @@
#define MEM_EXTENDED_PARAMETER_TYPE_BITS 8
@@ -367,3 +367,28 @@ NTSTATUS NtTerminateProcess(
HANDLE ProcessHandle,
NTSTATUS ExitStatus
);
NTSTATUS NtReadFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_ PVOID Buffer,
_In_ ULONG Length,
_In_opt_ PLARGE_INTEGER ByteOffset,
_In_opt_ PULONG Key
);
NTSTATUS NtWriteFile(
[in] HANDLE FileHandle,
[in, optional] HANDLE Event,
[in, optional] PIO_APC_ROUTINE ApcRoutine,
[in, optional] PVOID ApcContext,
[out] PIO_STATUS_BLOCK IoStatusBlock,
[in] PVOID Buffer,
[in] ULONG Length,
[in, optional] PLARGE_INTEGER ByteOffset,
[in, optional] PULONG Key
);
@@ -0,0 +1,32 @@
typedef enum MEM_EXTENDED_PARAMETER_TYPE {
MemExtendedParameterInvalidType = 0,
MemExtendedParameterAddressRequirements = 1,
MemExtendedParameterNumaNode = 2,
MemExtendedParameterPartitionHandle = 3,
MemExtendedParameterUserPhysicalHandle = 4,
MemExtendedParameterAttributeFlags = 5,
MemExtendedParameterImageMachine = 6,
MemExtendedParameterMax
} *PMEM_EXTENDED_PARAMETER_TYPE;
typedef struct _MEM_ADDRESS_REQUIREMENTS {
PVOID LowestStartingAddress;
PVOID HighestEndingAddress;
SIZE_T Alignment;
} MEM_ADDRESS_REQUIREMENTS, *PMEM_ADDRESS_REQUIREMENTS;
typedef struct MEM_EXTENDED_PARAMETER {
struct {
ULONG64 Type : 8; // MEM_EXTENDED_PARAMETER_TYPE_BITS -> define not handled in parser here
ULONG64 Reserved : 56; // 64 - MEM_EXTENDED_PARAMETER_TYPE_BITS -> define not handled in parser here
} DUMMYSTRUCTNAME;
union {
ULONG64 ULong64;
PVOID Pointer;
SIZE_T Size;
HANDLE Handle;
ULONG ULong;
} DUMMYUNIONNAME;
} MEM_EXTENDED_PARAMETER, *PMEM_EXTENDED_PARAMETER;
File diff suppressed because it is too large Load Diff
+1
View File
@@ -1127,6 +1127,7 @@ WinDef
.. autodata:: REG_STANDARD_FORMAT
.. autodata:: REG_LATEST_FORMAT
.. autodata:: REG_NO_COMPRESSION
.. autodata:: MEM_EXTENDED_PARAMETER_TYPE_BITS
.. autodata:: ACCESS_MIN_MS_ACE_TYPE
.. autodata:: ACCESS_ALLOWED_ACE_TYPE
.. autodata:: ACCESS_DENIED_ACE_TYPE
File diff suppressed because it is too large Load Diff
+76
View File
@@ -6224,6 +6224,49 @@ _IMAGE_LOAD_CONFIG_DIRECTORY64
:class:`ULONGLONG`
_MEM_ADDRESS_REQUIREMENTS
'''''''''''''''''''''''''
.. class:: MEM_ADDRESS_REQUIREMENTS
Alias for :class:`_MEM_ADDRESS_REQUIREMENTS`
.. class:: PMEM_ADDRESS_REQUIREMENTS
Pointer to :class:`_MEM_ADDRESS_REQUIREMENTS`
.. class:: _MEM_ADDRESS_REQUIREMENTS
.. attribute:: LowestStartingAddress
:class:`PVOID`
.. attribute:: HighestEndingAddress
:class:`PVOID`
.. attribute:: Alignment
:class:`SIZE_T`
MEM_EXTENDED_PARAMETER
''''''''''''''''''''''
.. class:: PMEM_EXTENDED_PARAMETER
Pointer to :class:`MEM_EXTENDED_PARAMETER`
.. class:: MEM_EXTENDED_PARAMETER
.. attribute:: DUMMYSTRUCTNAME
:class:`_ANON_MEM_EXTENDED_PARAMETER_SUB_STRUCTURE_1`
.. attribute:: DUMMYUNIONNAME
:class:`_ANON_MEM_EXTENDED_PARAMETER_SUB_UNION_2`
_SERVICE_STATUS
'''''''''''''''
.. class:: LPSERVICE_STATUS
@@ -27355,6 +27398,39 @@ _KEY_INFORMATION_CLASS
.. attribute:: MaxKeyInfoClass(10)
MEM_EXTENDED_PARAMETER_TYPE
'''''''''''''''''''''''''''
.. class:: PMEM_EXTENDED_PARAMETER_TYPE
Pointer to :class:`MEM_EXTENDED_PARAMETER_TYPE`
.. class:: MEM_EXTENDED_PARAMETER_TYPE
.. attribute:: MemExtendedParameterInvalidType(0)
.. attribute:: MemExtendedParameterAddressRequirements(1)
.. attribute:: MemExtendedParameterNumaNode(2)
.. attribute:: MemExtendedParameterPartitionHandle(3)
.. attribute:: MemExtendedParameterUserPhysicalHandle(4)
.. attribute:: MemExtendedParameterAttributeFlags(5)
.. attribute:: MemExtendedParameterImageMachine(6)
.. attribute:: MemExtendedParameterMax(7)
_SC_STATUS_TYPE
'''''''''''''''
.. class:: SC_STATUS_TYPE
+10
View File
@@ -1900,6 +1900,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
'MEM_4MB_PAGES',
'MEM_COMMIT',
'MEM_DECOMMIT',
'MEM_EXTENDED_PARAMETER_TYPE_BITS',
'MEM_FREE',
'MEM_IMAGE',
'MEM_LARGE_PAGES',
@@ -12619,7 +12620,9 @@ structs = {'ACCESS_ALLOWED_ACE',
'MEMORY_BASIC_INFORMATION',
'MEMORY_BASIC_INFORMATION32',
'MEMORY_BASIC_INFORMATION64',
'MEM_ADDRESS_REQUIREMENTS',
'MEM_DES',
'MEM_EXTENDED_PARAMETER',
'MEM_LARGE_DES',
'MEM_LARGE_RANGE',
'MEM_LARGE_RESOURCE',
@@ -13046,7 +13049,9 @@ structs = {'ACCESS_ALLOWED_ACE',
'PMEMORY_BASIC_INFORMATION',
'PMEMORY_BASIC_INFORMATION32',
'PMEMORY_BASIC_INFORMATION64',
'PMEM_ADDRESS_REQUIREMENTS',
'PMEM_DES',
'PMEM_EXTENDED_PARAMETER',
'PMEM_LARGE_DES',
'PMEM_LARGE_RANGE',
'PMEM_LARGE_RESOURCE',
@@ -13781,6 +13786,7 @@ structs = {'ACCESS_ALLOWED_ACE',
'_MEMORY_BASIC_INFORMATION',
'_MEMORY_BASIC_INFORMATION32',
'_MEMORY_BASIC_INFORMATION64',
'_MEM_ADDRESS_REQUIREMENTS',
'_MIB_IFROW',
'_MIB_IFTABLE',
'_MIB_IPADDRROW_XP',
@@ -14107,6 +14113,7 @@ enums = {'ACCESS_MODE',
'KEY_INFORMATION_CLASS',
'KEY_VALUE_INFORMATION_CLASS',
'MEMORY_INFORMATION_CLASS',
'MEM_EXTENDED_PARAMETER_TYPE',
'MIB_TCP_STATE',
'MSHLFLAGS',
'MULTIPLE_TRUSTEE_OPERATION',
@@ -14128,6 +14135,7 @@ enums = {'ACCESS_MODE',
'PACKAGE_EXECUTION_STATE',
'PALPC_MESSAGE_INFORMATION_CLASS',
'PFILE_INFORMATION_CLASS',
'PMEM_EXTENDED_PARAMETER_TYPE',
'PNT_PRODUCT_TYPE',
'POLICY_INFORMATION_CLASS',
'POLICY_LSA_SERVER_ROLE',
@@ -14826,6 +14834,7 @@ functions = {'AccessCheck',
'NtQueryValueKey',
'NtQueryVirtualMemory',
'NtQueryVolumeInformationFile',
'NtReadFile',
'NtReadVirtualMemory',
'NtSetContextThread',
'NtSetEaFile',
@@ -14836,6 +14845,7 @@ functions = {'AccessCheck',
'NtUnmapViewOfSection',
'NtWow64ReadVirtualMemory64',
'NtWow64WriteVirtualMemory64',
'NtWriteFile',
'NtWriteVirtualMemory',
'ObjectFromLresult',
'OpenBackupEventLogA',
+1
View File
@@ -1144,6 +1144,7 @@ REG_LEGAL_OPTION = make_flag("REG_LEGAL_OPTION", ( REG_OPTION_RESERVED | REG_OPT
REG_STANDARD_FORMAT = make_flag("REG_STANDARD_FORMAT", 1)
REG_LATEST_FORMAT = make_flag("REG_LATEST_FORMAT", 2)
REG_NO_COMPRESSION = make_flag("REG_NO_COMPRESSION", 4)
MEM_EXTENDED_PARAMETER_TYPE_BITS = make_flag("MEM_EXTENDED_PARAMETER_TYPE_BITS", 8)
ACCESS_MIN_MS_ACE_TYPE = make_flag("ACCESS_MIN_MS_ACE_TYPE", ( 0x0 ))
ACCESS_ALLOWED_ACE_TYPE = make_flag("ACCESS_ALLOWED_ACE_TYPE", ( 0x0 ))
ACCESS_DENIED_ACE_TYPE = make_flag("ACCESS_DENIED_ACE_TYPE", ( 0x1 ))
+10
View File
@@ -2905,6 +2905,16 @@ NtDelayExecutionParams = ((1, 'Alertable'), (1, 'DelayInterval'))
NtTerminateProcessPrototype = WINFUNCTYPE(NTSTATUS, HANDLE, NTSTATUS)
NtTerminateProcessParams = ((1, 'ProcessHandle'), (1, 'ExitStatus'))
#def NtReadFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key):
# return NtReadFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
NtReadFilePrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG)
NtReadFileParams = ((1, 'FileHandle'), (1, 'Event'), (1, 'ApcRoutine'), (1, 'ApcContext'), (1, 'IoStatusBlock'), (1, 'Buffer'), (1, 'Length'), (1, 'ByteOffset'), (1, 'Key'))
#def NtWriteFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key):
# return NtWriteFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
NtWriteFilePrototype = WINFUNCTYPE(NTSTATUS, HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, PLARGE_INTEGER, PULONG)
NtWriteFileParams = ((1, 'FileHandle'), (1, 'Event'), (1, 'ApcRoutine'), (1, 'ApcContext'), (1, 'IoStatusBlock'), (1, 'Buffer'), (1, 'Length'), (1, 'ByteOffset'), (1, 'Key'))
#def GetComputerNameExA(NameType, lpBuffer, nSize):
# return GetComputerNameExA.ctypes_function(NameType, lpBuffer, nSize)
GetComputerNameExAPrototype = WINFUNCTYPE(BOOL, COMPUTER_NAME_FORMAT, LPSTR, LPDWORD)
+47
View File
@@ -2836,6 +2836,53 @@ class _IMAGE_LOAD_CONFIG_DIRECTORY64(Structure):
IMAGE_LOAD_CONFIG_DIRECTORY64 = _IMAGE_LOAD_CONFIG_DIRECTORY64
PIMAGE_LOAD_CONFIG_DIRECTORY64 = POINTER(_IMAGE_LOAD_CONFIG_DIRECTORY64)
MemExtendedParameterInvalidType = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterInvalidType", 0x0)
MemExtendedParameterAddressRequirements = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAddressRequirements", 0x1)
MemExtendedParameterNumaNode = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterNumaNode", 0x2)
MemExtendedParameterPartitionHandle = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterPartitionHandle", 0x3)
MemExtendedParameterUserPhysicalHandle = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterUserPhysicalHandle", 0x4)
MemExtendedParameterAttributeFlags = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAttributeFlags", 0x5)
MemExtendedParameterImageMachine = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterImageMachine", 0x6)
MemExtendedParameterMax = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterMax", 0x7)
class MEM_EXTENDED_PARAMETER_TYPE(EnumType):
values = [MemExtendedParameterInvalidType, MemExtendedParameterAddressRequirements, MemExtendedParameterNumaNode, MemExtendedParameterPartitionHandle, MemExtendedParameterUserPhysicalHandle, MemExtendedParameterAttributeFlags, MemExtendedParameterImageMachine, MemExtendedParameterMax]
mapper = FlagMapper(*values)
PMEM_EXTENDED_PARAMETER_TYPE = POINTER(MEM_EXTENDED_PARAMETER_TYPE)
class _MEM_ADDRESS_REQUIREMENTS(Structure):
_fields_ = [
("LowestStartingAddress", PVOID),
("HighestEndingAddress", PVOID),
("Alignment", SIZE_T),
]
MEM_ADDRESS_REQUIREMENTS = _MEM_ADDRESS_REQUIREMENTS
PMEM_ADDRESS_REQUIREMENTS = POINTER(_MEM_ADDRESS_REQUIREMENTS)
class _ANON_MEM_EXTENDED_PARAMETER_SUB_STRUCTURE_1(Structure):
_fields_ = [
("Type", ULONG64, 8),
("Reserved", ULONG64, 56),
]
class _ANON_MEM_EXTENDED_PARAMETER_SUB_UNION_2(Union):
_fields_ = [
("ULong64", ULONG64),
("Pointer", PVOID),
("Size", SIZE_T),
("Handle", HANDLE),
("ULong", ULONG),
]
class MEM_EXTENDED_PARAMETER(Structure):
_anonymous_ = ("DUMMYSTRUCTNAME","DUMMYUNIONNAME")
_fields_ = [
("DUMMYSTRUCTNAME", _ANON_MEM_EXTENDED_PARAMETER_SUB_STRUCTURE_1),
("DUMMYUNIONNAME", _ANON_MEM_EXTENDED_PARAMETER_SUB_UNION_2),
]
PMEM_EXTENDED_PARAMETER = POINTER(MEM_EXTENDED_PARAMETER)
SC_STATUS_PROCESS_INFO = EnumValue("_SC_STATUS_TYPE", "SC_STATUS_PROCESS_INFO", 0x0)
class _SC_STATUS_TYPE(EnumType):
values = [SC_STATUS_PROCESS_INFO]
+16
View File
@@ -80,6 +80,22 @@ def NtQueryEaFile(FileHandle, IoStatusBlock, Buffer, Length, ReturnSingleEntry,
def NtSetEaFile(FileHandle, IoStatusBlock, Buffer, Length):
return NtSetEaFile.ctypes_function(FileHandle, IoStatusBlock, Buffer, Length)
@NtdllProxy()
def NtReadFile(FileHandle, Event=None, ApcRoutine=None, ApcContext=None, IoStatusBlock=None, Buffer=NeededParameter, Length=None, ByteOffset=None, Key=None):
if Length is None:
Length = ctypes.sizeof(Buffer)
if IoStatusBlock is None:
IoStatusBlock = gdef.IO_STATUS_BLOCK()
return NtReadFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
@NtdllProxy()
def NtWriteFile(FileHandle, Event=None, ApcRoutine=None, ApcContext=None, IoStatusBlock=None, Buffer=NeededParameter, Length=None, ByteOffset=None, Key=None):
if Length is None:
Length = ctypes.sizeof(Buffer)
if IoStatusBlock is None:
IoStatusBlock = gdef.IO_STATUS_BLOCK()
return NtWriteFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, Buffer, Length, ByteOffset, Key)
# Process