Add def for NtQuerySystem + fix in CustomAllocator

This commit is contained in:
Clement Rouault
2015-09-16 16:42:21 +02:00
parent 9f70a58170
commit e02bf24e8c
3 changed files with 38 additions and 2 deletions
+4
View File
@@ -15,6 +15,8 @@ if bitness() == 32:
winstructs.EXCEPTION_POINTERS = winstructs.EXCEPTION_POINTERS32
winstructs.PEXCEPTION_POINTERS = winstructs.PEXCEPTION_POINTERS32
winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE32
else:
winstructs.CONTEXT = winstructs.CONTEXT64
winstructs.PCONTEXT = winstructs.PCONTEXT64
@@ -23,6 +25,8 @@ else:
winstructs.EXCEPTION_POINTERS = winstructs.EXCEPTION_POINTERS64
winstructs.PEXCEPTION_POINTERS = winstructs.PEXCEPTION_POINTERS64
winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE64
from . import winfuncs
+33 -1
View File
@@ -32,7 +32,7 @@ REGSAM = ACCESS_MASK
LPCONTEXT = PVOID
VOID = DWORD
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA']
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64']
enums = ['_SYSTEM_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO']
@@ -1146,3 +1146,35 @@ class _MODLOAD_DATA(Structure):
PMODLOAD_DATA = POINTER(_MODLOAD_DATA)
MODLOAD_DATA = _MODLOAD_DATA
# Struct _SYSTEM_MODULE32 definitions
class _SYSTEM_MODULE32(Structure):
_fields_ = [
("Reserved", ULONG * 2),
("Base", ULONG),
("Size", ULONG),
("Flags", ULONG),
("Index", USHORT),
("Unknown", USHORT),
("LoadCount", USHORT),
("ModuleNameOffset", USHORT),
("ImageName", CHAR * 256),
]
SYSTEM_MODULE32 = _SYSTEM_MODULE32
PSYSTEM_MODULE32 = POINTER(_SYSTEM_MODULE32)
# Struct _SYSTEM_MODULE64 definitions
class _SYSTEM_MODULE64(Structure):
_fields_ = [
("Reserved", ULONG * 4),
("Base", ULONG64),
("Size", ULONG),
("Flags", ULONG),
("Index", USHORT),
("Unknown", USHORT),
("LoadCount", USHORT),
("ModuleNameOffset", USHORT),
("ImageName", CHAR * 256),
]
SYSTEM_MODULE64 = _SYSTEM_MODULE64
PSYSTEM_MODULE64 = POINTER(_SYSTEM_MODULE64)
+1 -1
View File
@@ -91,7 +91,7 @@ class CustomAllocator(object):
def write_code(self, code):
size = len(code)
if size + self.cur_offset > self.cur_page_size:
self.get_new_page((payload_size + 0x1000) & ~0xfff)
self.get_new_page((size + 0x1000) & ~0xfff)
self.maps[-1][self.cur_offset: self.cur_offset + size] = code
addr = self.maps[-1].addr + self.cur_offset
self.cur_offset += size