diff --git a/samples/native_utils.py b/samples/native_utils.py index 493d23f..bcddfcc 100644 --- a/samples/native_utils.py +++ b/samples/native_utils.py @@ -36,8 +36,7 @@ c += x64.Ret() RemoteManualLoadLibray += GetProcAddress64 -calc= windows.test.pop_proc_64(dwCreationFlags=CREATE_SUSPENDED) - +calc = windows.test.pop_proc_64(dwCreationFlags=CREATE_SUSPENDED) addr = calc.virtual_alloc(0x1000) addr2 = addr + len(dll) addr3 = addr2 + len(api) diff --git a/windows/utils/winutils.py b/windows/utils/winutils.py index 46dac98..b6be48d 100644 --- a/windows/utils/winutils.py +++ b/windows/utils/winutils.py @@ -447,7 +447,8 @@ def query_volume_information(file_or_handle, volume_info_class): if volume_info_class == gdef.FileFsAttributeInformation: file_name_length = pinfo[0].FileSystemNameLength elif volume_info_class == gdef.FileFsVolumeInformation: - file_name_length = pinfo[0].VolumeLabelLength + 0x8 # I have seen cases where the VolumeLabelLength is not even enough.. + # Well VolumeLabelLength is clearly broken (after testing..) so we are adding some bytes to it.. + file_name_length = pinfo[0].VolumeLabelLength + 0x100 # I have seen cases where the VolumeLabelLength is not even enough.. else: raise full_size = ctypes.sizeof(info) + file_name_length # We add a little too much size for the sake of simplicity @@ -524,7 +525,7 @@ def create_file(name, access=gdef.GENERIC_READ, share=gdef.FILE_SHARE_READ, secu # addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1) # return addr -def decompress_buffer(comptype, buffer, uncompress_size=None): +def decompress_buffer(buffer, comptype=gdef.COMPRESSION_FORMAT_LZNT1, uncompress_size=None): if uncompress_size is None: uncompress_size = len(buffer) * 10 result_size = DWORD() @@ -532,6 +533,20 @@ def decompress_buffer(comptype, buffer, uncompress_size=None): windows.winproxy.RtlDecompressBuffer(comptype, uncompressed, uncompress_size, buffer, len(buffer), result_size) return uncompressed[:result_size.value] +def compress_buffer(buffer, comptype=gdef.COMPRESSION_FORMAT_LZNT1): + uncompress_size = len(buffer) + CompressedBufferSize = uncompress_size + 0x1000 + CompressedBuffer = ctypes.c_buffer(CompressedBufferSize) + chunk = 4096 + final_size = gdef.DWORD() + work_space_size = gdef.ULONG() + ignore_data = gdef.ULONG() + + windows.winproxy.RtlGetCompressionWorkSpaceSize(comptype, work_space_size, ignore_data) + work_space = ctypes.c_buffer(work_space_size.value) + windows.winproxy.RtlCompressBuffer(comptype, buffer, uncompress_size, CompressedBuffer, CompressedBufferSize, chunk, final_size, work_space) + return CompressedBuffer[:final_size.value] + # sid.py + real SID type ?