From cf6c48b418485cf61e4effa40d1a52ca5c83b367 Mon Sep 17 00:00:00 2001
From: Clement Rouault <project@hakril.net>
Date: Thu, 7 Jul 2016 17:41:57 +0200
Subject: [PATCH] Remove some commented old code + fix read/write of REG_QWORD
 values in registry

---
 windows/native_exec/native_function.py | 179 -------------------------
 windows/syswow64.py                    |  11 --
 windows/winobject/registry.py          |  10 +-
 3 files changed, 7 insertions(+), 193 deletions(-)

diff --git a/windows/native_exec/native_function.py b/windows/native_exec/native_function.py
index 7c017e0..ae34d5a 100644
--- a/windows/native_exec/native_function.py
+++ b/windows/native_exec/native_function.py
@@ -101,185 +101,6 @@ class CustomAllocator(object):
 allocator = CustomAllocator()
 
 
-#def get_functions():
-#    version = sys.version_info
-#    python_dll = "python" + str(version.major) + str(version.minor)
-#
-#    PyGILState_Ensure = windows.utils.get_func_addr(python_dll, 'PyGILState_Ensure'.encode())
-#    PyObject_CallObject = windows.utils.get_func_addr(python_dll, 'PyObject_CallObject'.encode())
-#    PyGILState_Release = windows.utils.get_func_addr(python_dll, 'PyGILState_Release'.encode())
-#    return [PyGILState_Ensure, PyObject_CallObject, PyGILState_Release]
-#
-#
-#def analyse_callback(callback):
-#    if not callable(callback):
-#        raise ValueError("Need a callable object :)")
-#    obj_id = id(callback)
-#    if not hasattr(callback, '_objects'):
-#        raise ValueError("Need a ctypes PyCFuncPtr")
-#    return obj_id
-#
-#
-## For windows 32 bits with stdcall
-#def generate_stub_32(callback):
-#    c_callback = ctypes.cast(callback, ctypes.c_void_p).value
-#
-#    gstate_save_addr = x86.create_displacement(disp=allocator.reserve_int())
-#    return_addr_save_addr = x86.create_displacement(disp=allocator.reserve_int())
-#    save_ebx = x86.create_displacement(disp=allocator.reserve_int())
-#    save_ecx = x86.create_displacement(disp=allocator.reserve_int())
-#    save_edx = x86.create_displacement(disp=allocator.reserve_int())
-#    save_esi = x86.create_displacement(disp=allocator.reserve_int())
-#    save_edi = x86.create_displacement(disp=allocator.reserve_int())
-#
-#    ensure, objcall, release = get_functions()
-#
-#    code = x86.MultipleInstr()
-#    # ## Shellcode ## #
-#    code += x86.Mov(save_ebx, 'EBX')
-#    code += x86.Mov(save_ecx, 'ECX')
-#    code += x86.Mov(save_edx, 'EDX')
-#    code += x86.Mov(save_esi, 'ESI')
-#    code += x86.Mov(save_edi, 'EDI')
-#
-#    code += x86.Mov('EAX', ensure)
-#    code += x86.Call('EAX')
-#    code += x86.Mov(gstate_save_addr, 'EAX')
-#
-#    # Save real return addr (for good argument parsing by the callback)
-#    code += x86.Pop('EAX')
-#    code += x86.Mov(return_addr_save_addr, 'EAX')
-#
-#    code += x86.Mov('EAX', c_callback)
-#    code += x86.Call('EAX')
-#
-#    # Restore real return value
-#    code += x86.Mov('EBX', return_addr_save_addr)
-#    code += x86.Push('EBX')
-#
-#    # Save return value
-#    code += x86.Push('EAX')
-#    code += x86.Mov('EBX', gstate_save_addr)
-#    code += x86.Push('EBX')
-#
-#    code += x86.Mov('EAX', release)
-#    code += x86.Call('EAX')
-#
-#    # Discard `release` argument
-#    code += x86.Pop('EAX')
-#    # Restore return value
-#    code += x86.Pop('EAX')
-#    code += x86.Mov('EBX', save_ebx)
-#    code += x86.Mov('ECX', save_ecx)
-#    code += x86.Mov('EDX', save_edx)
-#    code += x86.Mov('ESI', save_esi)
-#    code += x86.Mov('EDI', save_edi)
-#    code += x86.Ret()
-#    return code
-#
-#
-#def generate_stub_64(callback):
-#    c_callback = ctypes.cast(callback, ctypes.c_void_p).value
-#    REG_LEN = ctypes.sizeof(ctypes.c_void_p)
-#    register_to_save = ("RBX", "RCX", "RDX", "RSI", "RDI", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15")
-#
-#    push_all_save_register = x64.MultipleInstr([x64.Push(reg) for reg in register_to_save])
-#    pop_all_save_register = x64.MultipleInstr([x64.Pop(reg) for reg in reversed(register_to_save)])
-#    # Reserve parallel `stack`
-#    save_register_space = allocator.reserve_int(len(register_to_save))
-#    save_register_space_end = save_register_space + (ctypes.sizeof(ctypes.c_void_p) * (len(register_to_save)))
-#
-#    save_rbx = save_register_space_end - REG_LEN
-#    save_rbx  # Fuck the linter :D
-#    save_rcx = save_register_space_end - REG_LEN - REG_LEN
-#    save_rdx = save_register_space_end - REG_LEN - (REG_LEN * 2)
-#    save_rsi = save_register_space_end - REG_LEN - (REG_LEN * 3)
-#    save_rsi  # Fuck the linter :D
-#    save_rdi = save_register_space_end - REG_LEN - (REG_LEN * 4)
-#    save_rdi  # Fuck the linter :D
-#    save_r8 = save_register_space_end - REG_LEN - (REG_LEN * 5)
-#    save_r9 = save_register_space_end - REG_LEN - (REG_LEN * 6)
-#
-#    gstate_save_addr = x64.create_displacement(disp=allocator.reserve_int())
-#    return_addr_save_addr = x64.create_displacement(disp=allocator.reserve_int())
-#    return_value_save_addr = x64.create_displacement(disp=allocator.reserve_int())
-#
-#    Reserve_space_for_call = x64.MultipleInstr([x64.Push('RDI')] * 4)
-#    Clean_space_for_call = x64.MultipleInstr([x64.Pop('RDI')] * 4)
-#    Do_stack_alignement = x64.MultipleInstr([x64.Push('RDI')] * 1)
-#    Remove_stack_alignement = x64.MultipleInstr([x64.Pop('RDI')] * 1)
-#
-#    ensure, objcall, release = get_functions()
-#
-#    # ## Shellcode ## #
-#    code = x64.MultipleInstr()
-#    # Save all registers
-#    code += x64.Mov('RAX', save_register_space_end)
-#    code += x64.Xchg('RAX', 'RSP')
-#    code += push_all_save_register
-#    code += x64.Xchg('RAX', 'RSP')
-#    # GOOO
-#    code += x64.Mov('RAX', ensure)
-#    code += Reserve_space_for_call
-#    code += Do_stack_alignement
-#    code += x64.Call('RAX')
-#    code += Remove_stack_alignement
-#    code += Clean_space_for_call
-#    code += x64.Mov(gstate_save_addr, 'RAX')
-#    # Save real return addr (for good argument parsing by the callback)
-#    code += x64.Pop('RAX')
-#    code += x64.Mov(return_addr_save_addr, 'RAX')
-#    # Restore parameters for real function call
-#    code += x64.Mov('RAX', save_rcx)
-#    code += x64.Mov('RCX', x64.mem('[RAX]'))
-#    code += x64.Mov('RAX', save_rdx)
-#    code += x64.Mov('RDX', x64.mem('[RAX]'))
-#    code += x64.Mov('RAX', save_r9)
-#    code += x64.Mov('R9', x64.mem('[RAX]'))
-#    code += x64.Mov('RAX', save_r8)
-#    code += x64.Mov('R8', x64.mem('[RAX]'))
-#    # Call python code
-#    code += x64.Mov('RAX', c_callback)
-#    # no need for stack alignement here as we poped the return addr
-#    # no need for Reserve_space_for_call as we must use the previous one for correct argument parsing
-#    code += x64.Call('RAX')
-#    # Save return value
-#    code += x64.Mov(return_value_save_addr, 'RAX')
-#    # Repush real return value
-#    code += x64.Mov('RAX', return_addr_save_addr)
-#    code += x64.Push('RAX')
-#    # Call release(gstate_save)
-#    code += x64.Mov('RAX', gstate_save_addr)
-#    code += x64.Mov('RCX', 'RAX')
-#    code += x64.Mov('RAX', release)
-#    code += Reserve_space_for_call
-#    code += Do_stack_alignement
-#    code += x64.Call('RAX')
-#    code += Remove_stack_alignement
-#    code += Clean_space_for_call
-#    # Restore registers
-#    code += x64.Mov('RAX', save_register_space)
-#    code += x64.Xchg('RAX', 'RSP')
-#    code += pop_all_save_register
-#    code += x64.Xchg('RAX', 'RSP')
-#    # Restore return value
-#    code += x64.Mov('RAX', return_value_save_addr)
-#    code += x64.Ret()
-#    return code
-
-
-#def generate_callback_stub(callback, types):
-#    func_type = ctypes.WINFUNCTYPE(*types)
-#    c_callable = func_type(callback)
-#
-#    stub = c_callable
-#    stub_addr = ctypes.cast(c_callable, ctypes.c_void_p).value
-#    generate_callback_stub.l.append((stub, c_callable))
-#    return stub_addr
-#
-#generate_callback_stub.l = []
-
-
 def create_function(code, types):
     """Create a python function that call raw machine code
 
diff --git a/windows/syswow64.py b/windows/syswow64.py
index 9aef214..3a3626b 100644
--- a/windows/syswow64.py
+++ b/windows/syswow64.py
@@ -16,17 +16,6 @@ from winproxy import NeededParameter, NtdllProxy, error_ntstatus
 CS_32bits = 0x23
 CS_64bits = 0x33
 
-#dummy_jump = "\xea" + struct.pack("<I", 0) + struct.pack("<H",  CS_64bits)
-#def genere_return_32bits_stub(ret_addr):
-#    ret_32b = x64.MultipleInstr()
-#    # Transform 64b return value to ULONG64 return value
-#    # EDX:EAX
-#    ret_32b += x64.Mov("RDX", "RAX")
-#    ret_32b += x64.Shr("RDX", 32)
-#    ret_32b += x64.Mov('RCX', (CS_32bits << 32) + ret_addr)
-#    ret_32b += x64.Push('RCX')
-#    ret_32b += x64.Retf32()  # 32 bits return addr
-#    return ret_32b.get_code()
 
 def generate_64bits_execution_stub_from_syswow(x64shellcode):
     """shellcode must NOT end by a ret"""
diff --git a/windows/winobject/registry.py b/windows/winobject/registry.py
index b9a5db1..be53f30 100644
--- a/windows/winobject/registry.py
+++ b/windows/winobject/registry.py
@@ -90,13 +90,15 @@ class PyHKey(object):
 
         :rtype: :class:`KeyValue`
         """
-        data = _winreg.QueryValueEx(self.phkey, value_name)
-        return KeyValue(value_name, data[0], data[1])
+        value, type = _winreg.QueryValueEx(self.phkey, value_name)
+        if type == REG_QWORD:
+            value = struct.unpack("<Q", value)[0]
+        return KeyValue(value_name, value, type)
 
     def _guess_value_type(self, value):
         if isinstance(value, basestring):
             return _winreg.REG_SZ
-        elif isinstance(value, [int, long]):
+        elif isinstance(value, (int, long)):
             return _winreg.REG_DWORD
         raise ValueError("Cannot guest registry type of value to set <{0}>".format(value))
 
@@ -105,6 +107,8 @@ class PyHKey(object):
         """Set the value for ``name`` to ``value``. if ``type`` is None try to guess items"""
         if type is None:
             type = self._guess_value_type(value)
+        if type == REG_QWORD:
+            value = struct.pack("<Q", value)
         return _winreg.SetValueEx(self.phkey, name, 0, type, value)