mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Remove some commented old code + fix read/write of REG_QWORD values in registry
This commit is contained in:
Clement Rouault
@@ -101,185 +101,6 @@ class CustomAllocator(object):
|
||||
allocator = CustomAllocator()
|
||||
|
||||
|
||||
#def get_functions():
|
||||
# version = sys.version_info
|
||||
# python_dll = "python" + str(version.major) + str(version.minor)
|
||||
#
|
||||
# PyGILState_Ensure = windows.utils.get_func_addr(python_dll, 'PyGILState_Ensure'.encode())
|
||||
# PyObject_CallObject = windows.utils.get_func_addr(python_dll, 'PyObject_CallObject'.encode())
|
||||
# PyGILState_Release = windows.utils.get_func_addr(python_dll, 'PyGILState_Release'.encode())
|
||||
# return [PyGILState_Ensure, PyObject_CallObject, PyGILState_Release]
|
||||
#
|
||||
#
|
||||
#def analyse_callback(callback):
|
||||
# if not callable(callback):
|
||||
# raise ValueError("Need a callable object :)")
|
||||
# obj_id = id(callback)
|
||||
# if not hasattr(callback, '_objects'):
|
||||
# raise ValueError("Need a ctypes PyCFuncPtr")
|
||||
# return obj_id
|
||||
#
|
||||
#
|
||||
## For windows 32 bits with stdcall
|
||||
#def generate_stub_32(callback):
|
||||
# c_callback = ctypes.cast(callback, ctypes.c_void_p).value
|
||||
#
|
||||
# gstate_save_addr = x86.create_displacement(disp=allocator.reserve_int())
|
||||
# return_addr_save_addr = x86.create_displacement(disp=allocator.reserve_int())
|
||||
# save_ebx = x86.create_displacement(disp=allocator.reserve_int())
|
||||
# save_ecx = x86.create_displacement(disp=allocator.reserve_int())
|
||||
# save_edx = x86.create_displacement(disp=allocator.reserve_int())
|
||||
# save_esi = x86.create_displacement(disp=allocator.reserve_int())
|
||||
# save_edi = x86.create_displacement(disp=allocator.reserve_int())
|
||||
#
|
||||
# ensure, objcall, release = get_functions()
|
||||
#
|
||||
# code = x86.MultipleInstr()
|
||||
# # ## Shellcode ## #
|
||||
# code += x86.Mov(save_ebx, 'EBX')
|
||||
# code += x86.Mov(save_ecx, 'ECX')
|
||||
# code += x86.Mov(save_edx, 'EDX')
|
||||
# code += x86.Mov(save_esi, 'ESI')
|
||||
# code += x86.Mov(save_edi, 'EDI')
|
||||
#
|
||||
# code += x86.Mov('EAX', ensure)
|
||||
# code += x86.Call('EAX')
|
||||
# code += x86.Mov(gstate_save_addr, 'EAX')
|
||||
#
|
||||
# # Save real return addr (for good argument parsing by the callback)
|
||||
# code += x86.Pop('EAX')
|
||||
# code += x86.Mov(return_addr_save_addr, 'EAX')
|
||||
#
|
||||
# code += x86.Mov('EAX', c_callback)
|
||||
# code += x86.Call('EAX')
|
||||
#
|
||||
# # Restore real return value
|
||||
# code += x86.Mov('EBX', return_addr_save_addr)
|
||||
# code += x86.Push('EBX')
|
||||
#
|
||||
# # Save return value
|
||||
# code += x86.Push('EAX')
|
||||
# code += x86.Mov('EBX', gstate_save_addr)
|
||||
# code += x86.Push('EBX')
|
||||
#
|
||||
# code += x86.Mov('EAX', release)
|
||||
# code += x86.Call('EAX')
|
||||
#
|
||||
# # Discard `release` argument
|
||||
# code += x86.Pop('EAX')
|
||||
# # Restore return value
|
||||
# code += x86.Pop('EAX')
|
||||
# code += x86.Mov('EBX', save_ebx)
|
||||
# code += x86.Mov('ECX', save_ecx)
|
||||
# code += x86.Mov('EDX', save_edx)
|
||||
# code += x86.Mov('ESI', save_esi)
|
||||
# code += x86.Mov('EDI', save_edi)
|
||||
# code += x86.Ret()
|
||||
# return code
|
||||
#
|
||||
#
|
||||
#def generate_stub_64(callback):
|
||||
# c_callback = ctypes.cast(callback, ctypes.c_void_p).value
|
||||
# REG_LEN = ctypes.sizeof(ctypes.c_void_p)
|
||||
# register_to_save = ("RBX", "RCX", "RDX", "RSI", "RDI", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15")
|
||||
#
|
||||
# push_all_save_register = x64.MultipleInstr([x64.Push(reg) for reg in register_to_save])
|
||||
# pop_all_save_register = x64.MultipleInstr([x64.Pop(reg) for reg in reversed(register_to_save)])
|
||||
# # Reserve parallel `stack`
|
||||
# save_register_space = allocator.reserve_int(len(register_to_save))
|
||||
# save_register_space_end = save_register_space + (ctypes.sizeof(ctypes.c_void_p) * (len(register_to_save)))
|
||||
#
|
||||
# save_rbx = save_register_space_end - REG_LEN
|
||||
# save_rbx # Fuck the linter :D
|
||||
# save_rcx = save_register_space_end - REG_LEN - REG_LEN
|
||||
# save_rdx = save_register_space_end - REG_LEN - (REG_LEN * 2)
|
||||
# save_rsi = save_register_space_end - REG_LEN - (REG_LEN * 3)
|
||||
# save_rsi # Fuck the linter :D
|
||||
# save_rdi = save_register_space_end - REG_LEN - (REG_LEN * 4)
|
||||
# save_rdi # Fuck the linter :D
|
||||
# save_r8 = save_register_space_end - REG_LEN - (REG_LEN * 5)
|
||||
# save_r9 = save_register_space_end - REG_LEN - (REG_LEN * 6)
|
||||
#
|
||||
# gstate_save_addr = x64.create_displacement(disp=allocator.reserve_int())
|
||||
# return_addr_save_addr = x64.create_displacement(disp=allocator.reserve_int())
|
||||
# return_value_save_addr = x64.create_displacement(disp=allocator.reserve_int())
|
||||
#
|
||||
# Reserve_space_for_call = x64.MultipleInstr([x64.Push('RDI')] * 4)
|
||||
# Clean_space_for_call = x64.MultipleInstr([x64.Pop('RDI')] * 4)
|
||||
# Do_stack_alignement = x64.MultipleInstr([x64.Push('RDI')] * 1)
|
||||
# Remove_stack_alignement = x64.MultipleInstr([x64.Pop('RDI')] * 1)
|
||||
#
|
||||
# ensure, objcall, release = get_functions()
|
||||
#
|
||||
# # ## Shellcode ## #
|
||||
# code = x64.MultipleInstr()
|
||||
# # Save all registers
|
||||
# code += x64.Mov('RAX', save_register_space_end)
|
||||
# code += x64.Xchg('RAX', 'RSP')
|
||||
# code += push_all_save_register
|
||||
# code += x64.Xchg('RAX', 'RSP')
|
||||
# # GOOO
|
||||
# code += x64.Mov('RAX', ensure)
|
||||
# code += Reserve_space_for_call
|
||||
# code += Do_stack_alignement
|
||||
# code += x64.Call('RAX')
|
||||
# code += Remove_stack_alignement
|
||||
# code += Clean_space_for_call
|
||||
# code += x64.Mov(gstate_save_addr, 'RAX')
|
||||
# # Save real return addr (for good argument parsing by the callback)
|
||||
# code += x64.Pop('RAX')
|
||||
# code += x64.Mov(return_addr_save_addr, 'RAX')
|
||||
# # Restore parameters for real function call
|
||||
# code += x64.Mov('RAX', save_rcx)
|
||||
# code += x64.Mov('RCX', x64.mem('[RAX]'))
|
||||
# code += x64.Mov('RAX', save_rdx)
|
||||
# code += x64.Mov('RDX', x64.mem('[RAX]'))
|
||||
# code += x64.Mov('RAX', save_r9)
|
||||
# code += x64.Mov('R9', x64.mem('[RAX]'))
|
||||
# code += x64.Mov('RAX', save_r8)
|
||||
# code += x64.Mov('R8', x64.mem('[RAX]'))
|
||||
# # Call python code
|
||||
# code += x64.Mov('RAX', c_callback)
|
||||
# # no need for stack alignement here as we poped the return addr
|
||||
# # no need for Reserve_space_for_call as we must use the previous one for correct argument parsing
|
||||
# code += x64.Call('RAX')
|
||||
# # Save return value
|
||||
# code += x64.Mov(return_value_save_addr, 'RAX')
|
||||
# # Repush real return value
|
||||
# code += x64.Mov('RAX', return_addr_save_addr)
|
||||
# code += x64.Push('RAX')
|
||||
# # Call release(gstate_save)
|
||||
# code += x64.Mov('RAX', gstate_save_addr)
|
||||
# code += x64.Mov('RCX', 'RAX')
|
||||
# code += x64.Mov('RAX', release)
|
||||
# code += Reserve_space_for_call
|
||||
# code += Do_stack_alignement
|
||||
# code += x64.Call('RAX')
|
||||
# code += Remove_stack_alignement
|
||||
# code += Clean_space_for_call
|
||||
# # Restore registers
|
||||
# code += x64.Mov('RAX', save_register_space)
|
||||
# code += x64.Xchg('RAX', 'RSP')
|
||||
# code += pop_all_save_register
|
||||
# code += x64.Xchg('RAX', 'RSP')
|
||||
# # Restore return value
|
||||
# code += x64.Mov('RAX', return_value_save_addr)
|
||||
# code += x64.Ret()
|
||||
# return code
|
||||
|
||||
|
||||
#def generate_callback_stub(callback, types):
|
||||
# func_type = ctypes.WINFUNCTYPE(*types)
|
||||
# c_callable = func_type(callback)
|
||||
#
|
||||
# stub = c_callable
|
||||
# stub_addr = ctypes.cast(c_callable, ctypes.c_void_p).value
|
||||
# generate_callback_stub.l.append((stub, c_callable))
|
||||
# return stub_addr
|
||||
#
|
||||
#generate_callback_stub.l = []
|
||||
|
||||
|
||||
def create_function(code, types):
|
||||
"""Create a python function that call raw machine code
|
||||
|
||||
|
||||
@@ -16,17 +16,6 @@ from winproxy import NeededParameter, NtdllProxy, error_ntstatus
|
||||
CS_32bits = 0x23
|
||||
CS_64bits = 0x33
|
||||
|
||||
#dummy_jump = "\xea" + struct.pack("<I", 0) + struct.pack("<H", CS_64bits)
|
||||
#def genere_return_32bits_stub(ret_addr):
|
||||
# ret_32b = x64.MultipleInstr()
|
||||
# # Transform 64b return value to ULONG64 return value
|
||||
# # EDX:EAX
|
||||
# ret_32b += x64.Mov("RDX", "RAX")
|
||||
# ret_32b += x64.Shr("RDX", 32)
|
||||
# ret_32b += x64.Mov('RCX', (CS_32bits << 32) + ret_addr)
|
||||
# ret_32b += x64.Push('RCX')
|
||||
# ret_32b += x64.Retf32() # 32 bits return addr
|
||||
# return ret_32b.get_code()
|
||||
|
||||
def generate_64bits_execution_stub_from_syswow(x64shellcode):
|
||||
"""shellcode must NOT end by a ret"""
|
||||
|
||||
@@ -90,13 +90,15 @@ class PyHKey(object):
|
||||
|
||||
:rtype: :class:`KeyValue`
|
||||
"""
|
||||
data = _winreg.QueryValueEx(self.phkey, value_name)
|
||||
return KeyValue(value_name, data[0], data[1])
|
||||
value, type = _winreg.QueryValueEx(self.phkey, value_name)
|
||||
if type == REG_QWORD:
|
||||
value = struct.unpack("<Q", value)[0]
|
||||
return KeyValue(value_name, value, type)
|
||||
|
||||
def _guess_value_type(self, value):
|
||||
if isinstance(value, basestring):
|
||||
return _winreg.REG_SZ
|
||||
elif isinstance(value, [int, long]):
|
||||
elif isinstance(value, (int, long)):
|
||||
return _winreg.REG_DWORD
|
||||
raise ValueError("Cannot guest registry type of value to set <{0}>".format(value))
|
||||
|
||||
@@ -105,6 +107,8 @@ class PyHKey(object):
|
||||
"""Set the value for ``name`` to ``value``. if ``type`` is None try to guess items"""
|
||||
if type is None:
|
||||
type = self._guess_value_type(value)
|
||||
if type == REG_QWORD:
|
||||
value = struct.pack("<Q", value)
|
||||
return _winreg.SetValueEx(self.phkey, name, 0, type, value)
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user