mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Playing with workingset
This commit is contained in:
Clement Rouault
@@ -149,6 +149,12 @@ BOOL WINAPI QueryWorkingSet(
|
||||
_In_ DWORD cb
|
||||
);
|
||||
|
||||
BOOL WINAPI QueryWorkingSetEx(
|
||||
_In_ HANDLE hProcess,
|
||||
_Inout_ PVOID pv,
|
||||
_In_ DWORD cb
|
||||
);
|
||||
|
||||
|
||||
DWORD WINAPI GetModuleFileNameA(
|
||||
_In_opt_ HMODULE hModule,
|
||||
|
||||
@@ -846,11 +846,29 @@ typedef union _PSAPI_WORKING_SET_EX_BLOCK {
|
||||
PVOID Flags;
|
||||
} PSAPI_WORKING_SET_EX_BLOCK, *PPSAPI_WORKING_SET_EX_BLOCK;
|
||||
|
||||
typedef union _PSAPI_WORKING_SET_EX_BLOCK32 {
|
||||
DWORD Flags;
|
||||
} PSAPI_WORKING_SET_EX_BLOCK32, *PPSAPI_WORKING_SET_EX_BLOCK32;
|
||||
|
||||
typedef union _PSAPI_WORKING_SET_EX_BLOCK64 {
|
||||
ULONG64 Flags;
|
||||
} PSAPI_WORKING_SET_EX_BLOCK64, *PPSAPI_WORKING_SET_EX_BLOCK64;
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_EX_INFORMATION {
|
||||
PVOID VirtualAddress;
|
||||
PSAPI_WORKING_SET_EX_BLOCK VirtualAttributes;
|
||||
} PSAPI_WORKING_SET_EX_INFORMATION, *PPSAPI_WORKING_SET_EX_INFORMATION;
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_EX_INFORMATION32 {
|
||||
DWORD VirtualAddress;
|
||||
PSAPI_WORKING_SET_EX_BLOCK32 VirtualAttributes;
|
||||
} PSAPI_WORKING_SET_EX_INFORMATION32, *PPSAPI_WORKING_SET_EX_INFORMATION32;
|
||||
|
||||
typedef struct _PSAPI_WORKING_SET_EX_INFORMATION64 {
|
||||
ULONG64 VirtualAddress;
|
||||
PSAPI_WORKING_SET_EX_BLOCK64 VirtualAttributes;
|
||||
} PSAPI_WORKING_SET_EX_INFORMATION64, *PPSAPI_WORKING_SET_EX_INFORMATION64;
|
||||
|
||||
typedef struct _STARTUPINFOA {
|
||||
DWORD cb;
|
||||
LPSTR lpReserved;
|
||||
|
||||
@@ -3,7 +3,7 @@ from ctypes import *
|
||||
from ctypes.wintypes import *
|
||||
from .winstructs import *
|
||||
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcConnectPort', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject']
|
||||
functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'QueryWorkingSet', 'QueryWorkingSetEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'NtSetContextThread', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId', 'Wow64SetThreadContext', 'GetMappedFileNameW', 'GetMappedFileNameA', 'RtlInitString', 'RtlInitUnicodeString', 'RtlAnsiStringToUnicodeString', 'OpenEventA', 'OpenEventW', 'NtOpenEvent', 'NtAlpcCreatePort', 'NtAlpcConnectPort', 'NtAlpcAcceptConnectPort', 'AlpcInitializeMessageAttribute', 'AlpcGetMessageAttribute', 'NtAlpcSendWaitReceivePort', 'lstrcmpA', 'lstrcmpW', 'CreateFileMappingA', 'CreateFileMappingW', 'MapViewOfFile', 'OpenSCManagerA', 'OpenSCManagerW', 'EnumServicesStatusExA', 'EnumServicesStatusExW', 'EnumWindows', 'GetWindowTextA', 'GetWindowTextW', 'GetWindowModuleFileNameA', 'GetWindowModuleFileNameW', 'CryptCATAdminCalcHashFromFileHandle', 'CryptCATAdminEnumCatalogFromHash', 'CryptCATAdminAcquireContext', 'CryptCATCatalogInfoFromContext', 'CryptCATAdminReleaseCatalogContext', 'CryptCATAdminReleaseContext', 'GetLogicalDriveStringsA', 'GetLogicalDriveStringsW', 'GetVolumeInformationA', 'GetVolumeInformationW', 'GetVolumeNameForVolumeMountPointA', 'GetVolumeNameForVolumeMountPointW', 'GetDriveTypeA', 'GetDriveTypeW', 'QueryDosDeviceA', 'QueryDosDeviceW', 'NtQueryObject', 'DuplicateHandle', 'GetModuleBaseNameA', 'GetModuleBaseNameW', 'GetProcessImageFileNameA', 'GetProcessImageFileNameW', 'GetFileVersionInfoA', 'GetFileVersionInfoW', 'GetFileVersionInfoSizeA', 'GetFileVersionInfoSizeW', 'VerQueryValueA', 'VerQueryValueW', 'GetSystemMetrics', 'GetComputerNameA', 'GetComputerNameW', 'LookupAccountSidA', 'LookupAccountSidW', 'CoInitializeEx', 'CoInitializeSecurity', 'CoCreateInstance', 'GetInterfaceInfo', 'GetIfTable', 'GetIpAddrTable', 'NtOpenDirectoryObject', 'NtQueryDirectoryObject', 'NtQuerySymbolicLinkObject', 'NtOpenSymbolicLinkObject']
|
||||
|
||||
#def ExitProcess(uExitCode):
|
||||
# return ExitProcess.ctypes_function(uExitCode)
|
||||
@@ -115,6 +115,11 @@ VirtualQueryExParams = ((1, 'hProcess'), (1, 'lpAddress'), (1, 'lpBuffer'), (1,
|
||||
QueryWorkingSetPrototype = WINFUNCTYPE(BOOL, HANDLE, PVOID, DWORD)
|
||||
QueryWorkingSetParams = ((1, 'hProcess'), (1, 'pv'), (1, 'cb'))
|
||||
|
||||
#def QueryWorkingSetEx(hProcess, pv, cb):
|
||||
# return QueryWorkingSetEx.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSetExPrototype = WINFUNCTYPE(BOOL, HANDLE, PVOID, DWORD)
|
||||
QueryWorkingSetExParams = ((1, 'hProcess'), (1, 'pv'), (1, 'cb'))
|
||||
|
||||
#def GetModuleFileNameA(hModule, lpFilename, nSize):
|
||||
# return GetModuleFileNameA.ctypes_function(hModule, lpFilename, nSize)
|
||||
GetModuleFileNameAPrototype = WINFUNCTYPE(DWORD, HMODULE, LPSTR, DWORD)
|
||||
|
||||
@@ -93,7 +93,7 @@ PALPC_PORT_ATTRIBUTES = PVOID
|
||||
VOID = DWORD
|
||||
ITypeInfo = PVOID
|
||||
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_PSAPI_WORKING_SET_BLOCK', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_BLOCK64', '_PSAPI_WORKING_SET_INFORMATION', '_PSAPI_WORKING_SET_INFORMATION32', '_PSAPI_WORKING_SET_INFORMATION64', '_PSAPI_WORKING_SET_EX_BLOCK', '_PSAPI_WORKING_SET_EX_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_CLIENT_ID', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION']
|
||||
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_MEMORY_BASIC_INFORMATION32', '_MEMORY_BASIC_INFORMATION64', '_PSAPI_WORKING_SET_BLOCK', '_PSAPI_WORKING_SET_BLOCK32', '_PSAPI_WORKING_SET_BLOCK64', '_PSAPI_WORKING_SET_INFORMATION', '_PSAPI_WORKING_SET_INFORMATION32', '_PSAPI_WORKING_SET_INFORMATION64', '_PSAPI_WORKING_SET_EX_BLOCK', '_PSAPI_WORKING_SET_EX_BLOCK32', '_PSAPI_WORKING_SET_EX_BLOCK64', '_PSAPI_WORKING_SET_EX_INFORMATION', '_PSAPI_WORKING_SET_EX_INFORMATION32', '_PSAPI_WORKING_SET_EX_INFORMATION64', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_WOW64_FLOATING_SAVE_AREA', '_WOW64_CONTEXT', '_M128A', '_XSAVE_FORMAT_64', '_XSAVE_FORMAT_32', '_TMP_DUMMYSTRUCTNAME', '_TMP_CONTEXT64_SUBUNION', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_SID_AND_ATTRIBUTES', '_TOKEN_MANDATORY_LABEL', '_TOKEN_USER', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_IPADDRROW_XP', '_MIB_IPADDRTABLE', '_MIB_IFROW', '_MIB_IFTABLE', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_IP_ADAPTER_INDEX_MAP', '_IP_INTERFACE_INFO', '_EXCEPTION_RECORD', '_EXCEPTION_RECORD32', '_EXCEPTION_RECORD64', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64', '_SYSTEM_MODULE_INFORMATION32', '_SYSTEM_MODULE_INFORMATION64', 'tagSAFEARRAYBOUND', 'tagSAFEARRAY', '_DEBUG_BREAKPOINT_PARAMETERS', '_DEBUG_REGISTER_DESCRIPTION', '_DEBUG_STACK_FRAME', '_DEBUG_LAST_EVENT_INFO_BREAKPOINT', '_DEBUG_LAST_EVENT_INFO_EXCEPTION', '_DEBUG_LAST_EVENT_INFO_EXIT_THREAD', '_DEBUG_LAST_EVENT_INFO_EXIT_PROCESS', '_DEBUG_LAST_EVENT_INFO_LOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_UNLOAD_MODULE', '_DEBUG_LAST_EVENT_INFO_SYSTEM_ERROR', '_DEBUG_SPECIFIC_FILTER_PARAMETERS', '_DEBUG_EXCEPTION_FILTER_PARAMETERS', '_GUID', '_TMP_signscale', '_TMP_lowmid', 'TMP_signscale_union', 'TMP_lowmid_union', 'tagDEC', '__tagBRECORD', 'TMP_variant_sub_union', '__tagVARIANT', 'tagDISPPARAMS', 'tagEXCEPINFO', '_CRYPTOAPI_BLOB', 'WINTRUST_FILE_INFO_', '_CRYPT_ATTRIBUTE', '_CTL_ENTRY', '_CRYPT_ATTRIBUTE', '_CRYPT_ATTRIBUTES', '_CRYPT_ALGORITHM_IDENTIFIER', '_CMSG_SIGNER_INFO', '_CERT_EXTENSION', '_CTL_USAGE', '_CTL_INFO', '_CTL_CONTEXT', 'WINTRUST_CATALOG_INFO_', 'WINTRUST_BLOB_INFO_', '_CRYPT_BIT_BLOB', '_CERT_PUBLIC_KEY_INFO', '_CERT_INFO', '_CERT_CONTEXT', 'WINTRUST_SGNR_INFO_', '_FILETIME', 'WINTRUST_CERT_INFO_', '_TMP_WINTRUST_UNION_TYPE', '_WINTRUST_DATA', '_PROCESS_BASIC_INFORMATION', '_JIT_DEBUG_INFO', '_SID_IDENTIFIER_AUTHORITY', '_EXCEPTION_DEBUG_INFO', '_CREATE_THREAD_DEBUG_INFO', '_CREATE_PROCESS_DEBUG_INFO', '_EXIT_THREAD_DEBUG_INFO', '_EXIT_PROCESS_DEBUG_INFO', '_LOAD_DLL_DEBUG_INFO', '_UNLOAD_DLL_DEBUG_INFO', '_OUTPUT_DEBUG_STRING_INFO', '_RIP_INFO', '_TMP_UNION_DEBUG_INFO', '_DEBUG_EVENT', '_STRING', '_OBJECT_ATTRIBUTES', '_SECURITY_QUALITY_OF_SERVICE', '_ALPC_PORT_ATTRIBUTES32', '_ALPC_PORT_ATTRIBUTES64', '_ALPC_MESSAGE_ATTRIBUTES', '_PORT_MESSAGE_TMP_UNION', '_PORT_MESSAGE_TMP_SUBSTRUCT_S1', '_PORT_MESSAGE_TMP_UNION_U1', '_PORT_MESSAGE_TMP_SUBSTRUCT_S2', '_PORT_MESSAGE_TMP_UNION_U2', '_CLIENT_ID', '_PORT_MESSAGE', '_SERVICE_STATUS', '_SERVICE_STATUS_PROCESS', '_ENUM_SERVICE_STATUS_PROCESSA', '_ENUM_SERVICE_STATUS_PROCESSW', 'CATALOG_INFO_', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE_INFORMATION', '__PUBLIC_OBJECT_TYPE_INFORMATION', '_PUBLIC_OBJECT_BASIC_INFORMATION', '_EVENTLOGRECORD', 'tagSOLE_AUTHENTICATION_SERVICE', '_OBJECT_DIRECTORY_INFORMATION']
|
||||
|
||||
enums = ['_SYSTEM_INFORMATION_CLASS', '_MEMORY_INFORMATION_CLASS', '_THREAD_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_VARENUM', '_UDP_TABLE_CLASS', 'NET_FW_RULE_DIRECTION_', 'NET_FW_PROFILE_TYPE2_', '_MIB_TCP_STATE', 'NET_FW_IP_PROTOCOL_', '_TOKEN_INFORMATION_CLASS', '_SECURITY_IMPERSONATION_LEVEL', '_SC_ENUM_TYPE', '_SC_STATUS_TYPE', '_OBJECT_INFORMATION_CLASS', '_SID_NAME_USE', 'NET_FW_PROFILE_TYPE2_', 'NET_FW_ACTION_', 'NET_FW_MODIFY_STATE_', 'NET_FW_RULE_DIRECTION_', 'tag_WBEMSTATUS', 'tagCLSCTX', '_INTERNAL_IF_OPER_STATUS', '_IMAGEHLP_SYMBOL_TYPE_INFO', '_PROCESSINFOCLASS', 'tagCOINIT', 'tagTYPEKIND']
|
||||
|
||||
@@ -1225,6 +1225,22 @@ class _PSAPI_WORKING_SET_EX_BLOCK(Union):
|
||||
PSAPI_WORKING_SET_EX_BLOCK = _PSAPI_WORKING_SET_EX_BLOCK
|
||||
PPSAPI_WORKING_SET_EX_BLOCK = POINTER(_PSAPI_WORKING_SET_EX_BLOCK)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_BLOCK32 definitions
|
||||
class _PSAPI_WORKING_SET_EX_BLOCK32(Union):
|
||||
_fields_ = [
|
||||
("Flags", DWORD),
|
||||
]
|
||||
PPSAPI_WORKING_SET_EX_BLOCK32 = POINTER(_PSAPI_WORKING_SET_EX_BLOCK32)
|
||||
PSAPI_WORKING_SET_EX_BLOCK32 = _PSAPI_WORKING_SET_EX_BLOCK32
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_BLOCK64 definitions
|
||||
class _PSAPI_WORKING_SET_EX_BLOCK64(Union):
|
||||
_fields_ = [
|
||||
("Flags", ULONG64),
|
||||
]
|
||||
PSAPI_WORKING_SET_EX_BLOCK64 = _PSAPI_WORKING_SET_EX_BLOCK64
|
||||
PPSAPI_WORKING_SET_EX_BLOCK64 = POINTER(_PSAPI_WORKING_SET_EX_BLOCK64)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_INFORMATION definitions
|
||||
class _PSAPI_WORKING_SET_EX_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
@@ -1234,6 +1250,24 @@ class _PSAPI_WORKING_SET_EX_INFORMATION(Structure):
|
||||
PPSAPI_WORKING_SET_EX_INFORMATION = POINTER(_PSAPI_WORKING_SET_EX_INFORMATION)
|
||||
PSAPI_WORKING_SET_EX_INFORMATION = _PSAPI_WORKING_SET_EX_INFORMATION
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_INFORMATION32 definitions
|
||||
class _PSAPI_WORKING_SET_EX_INFORMATION32(Structure):
|
||||
_fields_ = [
|
||||
("VirtualAddress", DWORD),
|
||||
("VirtualAttributes", PSAPI_WORKING_SET_EX_BLOCK32),
|
||||
]
|
||||
PSAPI_WORKING_SET_EX_INFORMATION32 = _PSAPI_WORKING_SET_EX_INFORMATION32
|
||||
PPSAPI_WORKING_SET_EX_INFORMATION32 = POINTER(_PSAPI_WORKING_SET_EX_INFORMATION32)
|
||||
|
||||
# Struct _PSAPI_WORKING_SET_EX_INFORMATION64 definitions
|
||||
class _PSAPI_WORKING_SET_EX_INFORMATION64(Structure):
|
||||
_fields_ = [
|
||||
("VirtualAddress", ULONG64),
|
||||
("VirtualAttributes", PSAPI_WORKING_SET_EX_BLOCK64),
|
||||
]
|
||||
PPSAPI_WORKING_SET_EX_INFORMATION64 = POINTER(_PSAPI_WORKING_SET_EX_INFORMATION64)
|
||||
PSAPI_WORKING_SET_EX_INFORMATION64 = _PSAPI_WORKING_SET_EX_INFORMATION64
|
||||
|
||||
# Struct _STARTUPINFOA definitions
|
||||
class _STARTUPINFOA(Structure):
|
||||
_fields_ = [
|
||||
|
||||
@@ -365,7 +365,19 @@ class Process(AutoHandle):
|
||||
return res.WorkingSetInfo
|
||||
return None
|
||||
|
||||
def mapped_filename(self, addr):
|
||||
def query_working_set_ex(self, addresses):
|
||||
if self.bitness == 64 or windows.current_process.bitness == 64:
|
||||
info_type = EPSAPI_WORKING_SET_EX_INFORMATION64
|
||||
else:
|
||||
info_type = EPSAPI_WORKING_SET_EX_INFORMATION32
|
||||
info_array = (info_type * len(addresses))()
|
||||
for i, data in enumerate(info_array):
|
||||
info_array[i].VirtualAddress = addresses[i]
|
||||
winproxy.QueryWorkingSetEx(self.handle, ctypes.byref(info_array), ctypes.sizeof(info_array))
|
||||
return info_array
|
||||
|
||||
|
||||
def get_mapped_filename(self, addr):
|
||||
"""The filename mapped at address ``addr`` or ``None``
|
||||
|
||||
:rtype: :class:`str` or ``None``
|
||||
@@ -1023,7 +1035,6 @@ class PEB(Structure):
|
||||
return [LoadedModule.from_address(addressof(LDR)) for LDR in res]
|
||||
|
||||
|
||||
|
||||
# Memory stuff
|
||||
|
||||
class EPSAPI_WORKING_SET_BLOCK_BASE(object):
|
||||
@@ -1043,6 +1054,7 @@ class EPSAPI_WORKING_SET_BLOCK_BASE(object):
|
||||
def virtualpage(self):
|
||||
return (self.Flags >> 12)
|
||||
|
||||
|
||||
class EPSAPI_WORKING_SET_BLOCK(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK):
|
||||
pass
|
||||
|
||||
@@ -1052,6 +1064,39 @@ class EPSAPI_WORKING_SET_BLOCK32(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SE
|
||||
class EPSAPI_WORKING_SET_BLOCK64(EPSAPI_WORKING_SET_BLOCK_BASE, PSAPI_WORKING_SET_BLOCK64):
|
||||
pass
|
||||
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_BLOCK_BASE(object):
|
||||
@property
|
||||
def valid(self):
|
||||
return self.Flags & 0b1
|
||||
|
||||
@property
|
||||
def sharecount(self):
|
||||
return (self.Flags >> 1) & 0b111
|
||||
|
||||
@property
|
||||
def shared(self):
|
||||
return (self.Flags >> 15) & 1
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_BLOCK(EPSAPI_WORKING_SET_EX_BLOCK_BASE, PSAPI_WORKING_SET_EX_BLOCK):
|
||||
pass
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_BLOCK32(EPSAPI_WORKING_SET_EX_BLOCK_BASE, PSAPI_WORKING_SET_EX_BLOCK32):
|
||||
pass
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_BLOCK64(EPSAPI_WORKING_SET_EX_BLOCK_BASE, PSAPI_WORKING_SET_EX_BLOCK64):
|
||||
pass
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_INFORMATION(ctypes.Structure):
|
||||
_fields_ = windows.utils.transform_ctypes_fields(PSAPI_WORKING_SET_EX_INFORMATION, {"VirtualAttributes": EPSAPI_WORKING_SET_EX_BLOCK})
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_INFORMATION32(ctypes.Structure):
|
||||
_fields_ = windows.utils.transform_ctypes_fields(PSAPI_WORKING_SET_EX_INFORMATION32, {"VirtualAttributes": EPSAPI_WORKING_SET_EX_BLOCK32})
|
||||
|
||||
class EPSAPI_WORKING_SET_EX_INFORMATION64(ctypes.Structure):
|
||||
_fields_ = windows.utils.transform_ctypes_fields(PSAPI_WORKING_SET_EX_INFORMATION64, {"VirtualAttributes": EPSAPI_WORKING_SET_EX_BLOCK64})
|
||||
|
||||
|
||||
import windows.remotectypes as rctypes
|
||||
|
||||
|
||||
|
||||
+5
-1
@@ -520,7 +520,6 @@ def DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, l
|
||||
# TODO: might be in another DLL depending of version
|
||||
# Should handle this..
|
||||
|
||||
|
||||
def GetMappedFileNameWWrapper(hProcess, lpv, lpFilename, nSize=None):
|
||||
if nSize is None:
|
||||
nSize = ctypes.sizeof(lpFilename)
|
||||
@@ -538,10 +537,15 @@ def QueryWorkingSetWrapper(hProcess, pv, cb):
|
||||
return QueryWorkingSet.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSet = OptionalExport(Kernel32Proxy("QueryWorkingSet"))(QueryWorkingSetWrapper)
|
||||
|
||||
def QueryWorkingSetExWrapper(hProcess, pv, cb):
|
||||
return QueryWorkingSet.ctypes_function(hProcess, pv, cb)
|
||||
QueryWorkingSetEx = OptionalExport(Kernel32Proxy("QueryWorkingSetEx"))(QueryWorkingSetWrapper)
|
||||
|
||||
if GetMappedFileNameA is None:
|
||||
GetMappedFileNameW = PsapiProxy("GetMappedFileNameW")(GetMappedFileNameWWrapper)
|
||||
GetMappedFileNameA = PsapiProxy("GetMappedFileNameA")(GetMappedFileNameAWrapper)
|
||||
QueryWorkingSet = PsapiProxy("QueryWorkingSet")(QueryWorkingSetWrapper)
|
||||
QueryWorkingSetEx = PsapiProxy("QueryWorkingSetEx")(QueryWorkingSetWrapper)
|
||||
|
||||
def GetModuleBaseNameAWrapper(hProcess, hModule, lpBaseName, nSize=None):
|
||||
if nSize is None:
|
||||
|
||||
Reference in New Issue
Block a user