Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)

tests/test_crypto.py

@@ -216,7 +216,7 @@ def test_sign_verify_fail(rawcert, rawpfx):
     assert message_to_sign in signed_blob
     # Tamper the signed mesasge content
     signed_blob = signed_blob.replace("message", "massage")
-    with pytest.raises(windows.winproxy.Kernel32Error) as excinfo:
+    with pytest.raises(windows.winproxy.WinproxyError) as excinfo:
         decoded_blob = windows.crypto.verify_signature(cert, signed_blob)
     assert excinfo.value.winerror == gdef.STATUS_INVALID_SIGNATURE
 

tests/test_process.py

@@ -417,3 +417,20 @@ class TestProcessWithCheckGarbage(object):
         image_path_from_process_params = proc32_64.peb.ProcessParameters.contents.ImagePathName.str.lower()
         image_path_from_module = proc32_64.peb.modules[0].fullname.lower()
         assert image_path_from_process_params == image_path_from_module
+
+    def test_lower_integrity(self, proc32):
+        # Lowering the integrity in remote process
+        # Because we don't want to mess with the token of our testing process
+
+        proc32.execute_python("import windows")
+        # We stock the handle becase lowering the integrity
+        # will mess with token retrieval
+        proc32.execute_python("token = windows.current_process.token")
+        proc32.execute_python("token.integrity = 123")
+        # execute_python will raise this in our own process :)
+        proc32.execute_python("assert token.integrity == 123")
+
+    def test_remote_assertion_error(self, proc32):
+        proc32.execute_python("assert 1 == 1")
+        with pytest.raises(windows.injection.RemotePythonError):
+            proc32.execute_python("assert 1 == 2")

tests/test_winproxy.py

@@ -10,4 +10,9 @@ pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
 
 def test_createfileA_fail():
     with pytest.raises(WindowsError) as ar:
-        windows.winproxy.CreateFileA("NONEXISTFILE.FILE")
+        windows.winproxy.CreateFileA("NONEXISTFILE.FILE")
+
+
+def test_lstrcmpa():
+    assert windows.winproxy.lstrcmpA("LOL", "NO-LOL")
+    assert not windows.winproxy.lstrcmpA("LOL", "LOL")

windows/crypto/certificate.py

@@ -115,7 +115,7 @@ class CertificateStore(gdef.HCERTSTORE):
         while True:
             try:
                 cert = winproxy.CertEnumCertificatesInStore(self, last)
-            except winproxy.Kernel32Error as e:
+            except winproxy.WinproxyError as e:
                 if (e.winerror & 0xffffffff) in (gdef.CRYPT_E_NOT_FOUND,):
                     return tuple(res)
                 raise

windows/crypto/encrypt_decrypt.py

@@ -96,7 +96,7 @@ def encrypt(cert_or_certlist, msg, algo=szOID_NIST_AES256_CBC, initvector=genini
 def decrypt(cert_store, encrypted):
     """Try to decrypt the ``encrypted`` msg with any certificate in ``cert_store``.
 
-        If there is no certificate able to decrypt the message ``Kernel32Error(winerror=0x8009200c)`` is raised.
+        If there is no certificate able to decrypt the message ``WinproxyError(winerror=0x8009200c)`` is raised.
 
         :param cert_store:
         :type cert_store: :class:`CertificateStore`

windows/syswow64.py

@@ -10,7 +10,7 @@ import windows.native_exec.simple_x64 as x64
 from generated_def.winstructs import *
 from windows.winobject import process
 from windows import winproxy
-from winproxy import NeededParameter, NtdllProxy, error_ntstatus
+from winproxy import NeededParameter
 
 # Special code for syswow64 process
 CS_32bits = 0x23
@@ -239,7 +239,7 @@ def ntquerysysteminformation_syswow64_error_check(result, func, args):
     # Ignore STATUS_INFO_LENGTH_MISMATCH if SystemInformation is None
     if result == STATUS_INFO_LENGTH_MISMATCH and not args[1]:
         return args
-    raise Kernel32Error("{0} failed with NTStatus {1}".format(func_name, hex(result)))
+    raise WinproxyError("{0} failed with NTStatus {1}".format(func_name, hex(result)))
 
 @Syswow64ApiProxy(winproxy.NtQuerySystemInformation, errcheck=ntquerysysteminformation_syswow64_error_check)
 # @Syswow64ApiProxy(winproxy.NtQuerySystemInformation)

windows/utils/winutils.py

@@ -37,7 +37,7 @@ def get_remote_func_addr(target, dll_name, func_name):
 def is_wow_64(hProcess):
     try:
         fnIsWow64Process = get_func_addr("kernel32.dll", "IsWow64Process")
-    except winproxy.Kernel32Error:
+    except winproxy.WinproxyError:
         return False
     IsWow64Process = ctypes.WINFUNCTYPE(BOOL, HANDLE, ctypes.POINTER(BOOL))(fnIsWow64Process)
     Wow64Process = BOOL()
@@ -328,7 +328,7 @@ def ntstatus(code):
 def get_long_path(path):
     """Return the long path form for ``path``.
 
-        :raise: :class:`~windows.winproxy.Kernel32Error` if ``path`` does not exists
+        :raise: :class:`~windows.winproxy.WinproxyError` if ``path`` does not exists
         :param path: a valid Windows path
         :type path: :class:`str` | :obj:`unicode`
         :returns: :class:`str` | :obj:`unicode` -- same type as ``path`` parameter
@@ -346,7 +346,7 @@ def get_long_path(path):
 def get_short_path(path):
     """Return the short path form for ``path``
 
-        :raise: :class:`~windows.winproxy.Kernel32Error` if ``path`` does not exists
+        :raise: :class:`~windows.winproxy.WinproxyError` if ``path`` does not exists
         :param path: a valid Windows path
         :type path: :class:`str` | :obj:`unicode`
         :returns: :class:`str` | :obj:`unicode` -- same type as ``path`` parameter

windows/winobject/network.py

@@ -415,7 +415,7 @@ class Network(object):
         size = ctypes.c_uint(0)
         try:
             winproxy.GetExtendedTcpTable(None, ctypes.byref(size), ulAf=AF_INET)
-        except winproxy.IphlpapiError:
+        except winproxy.WinproxyError:
             pass  # Allow us to set size to the needed value
         buffer = (ctypes.c_char * size.value)()
         winproxy.GetExtendedTcpTable(buffer, ctypes.byref(size), ulAf=AF_INET)
@@ -427,7 +427,7 @@ class Network(object):
         size = ctypes.c_uint(0)
         try:
             winproxy.GetExtendedTcpTable(None, ctypes.byref(size), ulAf=AF_INET6)
-        except winproxy.IphlpapiError:
+        except winproxy.WinproxyError:
             pass  # Allow us to set size to the needed value
         buffer = (ctypes.c_char * size.value)()
         winproxy.GetExtendedTcpTable(buffer, ctypes.byref(size), ulAf=AF_INET6)

windows/winobject/process.py

@@ -25,7 +25,6 @@ from windows.generated_def.winstructs import *
 from windows.generated_def.ntstatus import NtStatusException
 
 from windows.winobject import exception
-from windows.winobject import sid
 from windows.winobject import apisetmap
 
 
@@ -430,7 +429,7 @@ class Process(utils.AutoHandle):
                 v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res)
             except NtStatusException as e:
                 if e.code & 0xffffffff == 0XC000000D:
-                    raise winproxy.Kernel32Error("NtQueryVirtualMemory_32_to_64")
+                    raise winproxy.WinproxyError("NtQueryVirtualMemory_32_to_64")
                 raise
             return res
 
@@ -451,7 +450,7 @@ class Process(utils.AutoHandle):
             try:
                 x = self.query_memory(addr)
                 yield x
-            except winproxy.Kernel32Error:
+            except winproxy.WinproxyError:
                 return
             addr += x.RegionSize
 
@@ -533,7 +532,7 @@ class Process(utils.AutoHandle):
 
         try:
                 size = winproxy.GetMappedFileNameW(self.handle, addr, buffer, buffer_size)
-        except winproxy.Kernel32Error as e:
+        except winproxy.WinproxyError as e:
             if e.winerror not in (gdef.ERROR_UNEXP_NET_ERR, gdef.ERROR_FILE_INVALID):
                 raise # Raise if error type is not expected: detect mapped aborted transaction
             return None
@@ -573,7 +572,7 @@ class Process(utils.AutoHandle):
         for i in itertools.count():
             try:
                 x = self.read_memory(addr + readden, read_size)
-            except winproxy.Kernel32Error as e:
+            except winproxy.WinproxyError as e:
                 if read_size == 2:
                     raise
                 # handle read_wstring at end of page
@@ -597,7 +596,7 @@ class Process(utils.AutoHandle):
         while True:
             try:
                 x = self.read_memory(addr + readden, read_size)
-            except winproxy.Kernel32Error as e:
+            except winproxy.WinproxyError as e:
                 if read_size == 2:
                     raise
                 # handle read_wstring at end of page
@@ -1177,7 +1176,7 @@ class Token(utils.AutoHandle):
 		"""
         mandatory_label = TOKEN_MANDATORY_LABEL()
         mandatory_label.Label.Attributes = 0x60
-        mandatory_label.Label.Sid = sid.EPSID.from_string("S-1-16-{0}".format(integrity))
+        mandatory_label.Label.Sid = PSID.from_string("S-1-16-{0}".format(integrity))
         self.set_informations(TokenIntegrityLevel, mandatory_label)
 
     integrity = property(get_integrity, set_integrity)