diff --git a/generated_def/__init__.py b/generated_def/__init__.py index a0e9508..06dbff2 100644 --- a/generated_def/__init__.py +++ b/generated_def/__init__.py @@ -15,6 +15,8 @@ if bitness() == 32: winstructs.EXCEPTION_POINTERS = winstructs.EXCEPTION_POINTERS32 winstructs.PEXCEPTION_POINTERS = winstructs.PEXCEPTION_POINTERS32 + + winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE32 else: winstructs.CONTEXT = winstructs.CONTEXT64 winstructs.PCONTEXT = winstructs.PCONTEXT64 @@ -23,6 +25,8 @@ else: winstructs.EXCEPTION_POINTERS = winstructs.EXCEPTION_POINTERS64 winstructs.PEXCEPTION_POINTERS = winstructs.PEXCEPTION_POINTERS64 + winstructs.SYSTEM_MODULE = winstructs.SYSTEM_MODULE64 + from . import winfuncs diff --git a/generated_def/winstructs.py b/generated_def/winstructs.py index 50a6460..b8ce3f7 100644 --- a/generated_def/winstructs.py +++ b/generated_def/winstructs.py @@ -32,7 +32,7 @@ REGSAM = ACCESS_MASK LPCONTEXT = PVOID VOID = DWORD -structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA'] +structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64'] enums = ['_SYSTEM_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO'] @@ -1146,3 +1146,35 @@ class _MODLOAD_DATA(Structure): PMODLOAD_DATA = POINTER(_MODLOAD_DATA) MODLOAD_DATA = _MODLOAD_DATA +# Struct _SYSTEM_MODULE32 definitions +class _SYSTEM_MODULE32(Structure): + _fields_ = [ + ("Reserved", ULONG * 2), + ("Base", ULONG), + ("Size", ULONG), + ("Flags", ULONG), + ("Index", USHORT), + ("Unknown", USHORT), + ("LoadCount", USHORT), + ("ModuleNameOffset", USHORT), + ("ImageName", CHAR * 256), + ] +SYSTEM_MODULE32 = _SYSTEM_MODULE32 +PSYSTEM_MODULE32 = POINTER(_SYSTEM_MODULE32) + +# Struct _SYSTEM_MODULE64 definitions +class _SYSTEM_MODULE64(Structure): + _fields_ = [ + ("Reserved", ULONG * 4), + ("Base", ULONG64), + ("Size", ULONG), + ("Flags", ULONG), + ("Index", USHORT), + ("Unknown", USHORT), + ("LoadCount", USHORT), + ("ModuleNameOffset", USHORT), + ("ImageName", CHAR * 256), + ] +SYSTEM_MODULE64 = _SYSTEM_MODULE64 +PSYSTEM_MODULE64 = POINTER(_SYSTEM_MODULE64) + diff --git a/native_exec/native_function.py b/native_exec/native_function.py index e228636..366e253 100644 --- a/native_exec/native_function.py +++ b/native_exec/native_function.py @@ -91,7 +91,7 @@ class CustomAllocator(object): def write_code(self, code): size = len(code) if size + self.cur_offset > self.cur_page_size: - self.get_new_page((payload_size + 0x1000) & ~0xfff) + self.get_new_page((size + 0x1000) & ~0xfff) self.maps[-1][self.cur_offset: self.cur_offset + size] = code addr = self.maps[-1].addr + self.cur_offset self.cur_offset += size