diff --git a/k32testing.py b/k32testing.py index 3d5c72b..7f4aaab 100644 --- a/k32testing.py +++ b/k32testing.py @@ -292,7 +292,7 @@ def AddVectoredExceptionHandler(FirstHandler=1, VectoredHandler=NeededParameter) def RemoveVectoredExceptionHandler(Handler): return RemoveVectoredExceptionHandler.ctypes_function(Handler) -@Kernel32Proxy("WaitForSingleObject") +@Kernel32Proxy("WaitForSingleObject", no_error_check) def WaitForSingleObject(hHandle, dwMilliseconds=INFINITE): return WaitForSingleObject.ctypes_function(hHandle, dwMilliseconds) diff --git a/native_exec/native_function.py b/native_exec/native_function.py index 4484f1b..437132e 100644 --- a/native_exec/native_function.py +++ b/native_exec/native_function.py @@ -94,9 +94,6 @@ class CustomAllocator(object): self.cur_offset += size return addr -allocator = CustomAllocator() - - def get_functions(): # Windows only with python27.dll | improve this ? import sys @@ -120,6 +117,7 @@ def analyse_callback(callback): # For windows 32 bits with stdcall def generate_stub_32(callback): from simple_x86 import * + allocator = windows.current_process.allocator obj_id = analyse_callback(callback) c_callback = ctypes.c_ulong.from_address(id(callback._objects['0']) + 3 * ctypes.sizeof(ctypes.c_void_p)).value @@ -185,6 +183,7 @@ def generate_stub_32(callback): def generate_stub_64(callback): import simple_x64 as x64 from simple_x64 import * + allocator = windows.current_process.allocator obj_id = analyse_callback(callback) REG_LEN = ctypes.sizeof(ctypes.c_void_p) @@ -307,7 +306,7 @@ def generate_callback_stub(callback, types): stub = generate_stub_32(c_callable) else: stub = generate_stub_64(c_callable) - stub_addr = allocator.write_code(stub.get_code()) + stub_addr = windows.current_process.allocator.write_code(stub.get_code()) generate_callback_stub.l.append((stub, c_callable)) return stub_addr @@ -322,5 +321,5 @@ def create_function(code, types): :rtype: function """ func_type = ctypes.CFUNCTYPE(*types) - addr = allocator.write_code(code) + addr = windows.current_process.allocator.write_code(code) return func_type(addr) diff --git a/vectored_exception.py b/vectored_exception.py index de64c71..10cdd4e 100644 --- a/vectored_exception.py +++ b/vectored_exception.py @@ -47,8 +47,16 @@ class EnhancedEXCEPTION_RECORD(EXCEPTION_RECORD): real_code = super(EnhancedEXCEPTION_RECORD, self).ExceptionCode return exception_name_by_value.get(real_code, 'UNKNOW_EXCEPTION({0})'.format(hex(real_code))) + @property + def ExceptionAddress(self): + x = super(EnhancedEXCEPTION_RECORD, self).ExceptionAddress + if x is None: + return 0x0 + return x + class EnhancedCONTEXTBase(CONTEXT): default_dump = () + pc_reg = '' def regs(self, to_dump=None): res = [] @@ -63,12 +71,18 @@ class EnhancedCONTEXTBase(CONTEXT): for name, value in regs: print("{0} -> {1}".format(name, hex(value))) + @property + def pc(self): + return getattr(self, self.pc_reg) + class EnhancedCONTEXT32(EnhancedCONTEXTBase): - default_dump = ('Eip', 'Esp', 'Eax', 'Ebx', 'Ecx', 'Ebp', 'Edi', 'Esi') + default_dump = ('Eip', 'Esp', 'Eax', 'Ebx', 'Ecx', 'Edx', 'Ebp', 'Edi', 'Esi') + pc_reg = 'Eip' class EnhancedCONTEXT64(EnhancedCONTEXTBase): - default_dump = ('Rip', 'Rsp', 'Rax', 'Rbx', 'Rcx', 'Rbp', 'Rdi', 'Rsi', + default_dump = ('Rip', 'Rsp', 'Rax', 'Rbx', 'Rcx', 'Rdx', 'Rbp', 'Rdi', 'Rsi', 'R9', 'R10', 'R11', 'R12', 'R13', 'R14', 'R15') + pc_reg = 'Rip' if windows.current_process.bitness == 32: EnhancedCONTEXT = EnhancedCONTEXT32 @@ -93,7 +107,7 @@ class EnhancedEXCEPTION_POINTERS(ctypes.Structure): class VectoredException(object): func_type = ctypes.WINFUNCTYPE(ctypes.c_uint, ctypes.POINTER(EnhancedEXCEPTION_POINTERS)) - def __init__(self): + def __init__(self, quit_if_fail=False): pass def __call__(self, func): @@ -101,13 +115,12 @@ class VectoredException(object): return self.func_type(self.decorator) def decorator(self, exception_pointers): - print("IN DAT DECORATOR") try: - x = self.func(exception_pointers) - print("PROUT") - return x + return self.func(exception_pointers) except BaseException as e: print("Ignored Python Exception in Vectored Exception: {0}".format(e)) + if quit_if_fail: + return windows.current_thread.quit() return windef.EXCEPTION_CONTINUE_SEARCH diff --git a/winobject.py b/winobject.py index b4610a2..0d7ca7c 100644 --- a/winobject.py +++ b/winobject.py @@ -69,8 +69,6 @@ class System(object): return 32 -# May have a common class with WinProcess for is_wow_64 and stuff - class WinThread(THREADENTRY32, AutoHandle): """Represent a thread """ @property @@ -168,6 +166,9 @@ class CurrentProcess(Process): # ret get_peb_64_code = "65488B042560000000C3".decode('hex') + allocator = native_exec.native_function.CustomAllocator() + + def get_peb_builtin(self): if self.get_peb is not None: return self.get_peb