From ec4862439f02a2abd20e92ab143f10f25f09d882 Mon Sep 17 00:00:00 2001 From: hakril Date: Wed, 27 Jan 2016 12:41:41 +0100 Subject: [PATCH] Add LdrLoadDLL + Fix winproxy.VirtualProtect Commit2 --- ctypes_generation/windef.txt | 48 +++++++++++++++++++++++++++++++ ctypes_generation/winfunc.txt | 8 ++++++ windows/generated_def/windef.py | 47 +++++++++++++++++++++++++++++- windows/generated_def/winfuncs.py | 6 +++- windows/syswow64.py | 6 ++++ windows/winproxy.py | 8 +++++- 6 files changed, 120 insertions(+), 3 deletions(-) diff --git a/ctypes_generation/windef.txt b/ctypes_generation/windef.txt index e9b5633..8d84b5b 100644 --- a/ctypes_generation/windef.txt +++ b/ctypes_generation/windef.txt @@ -557,3 +557,51 @@ #define REG_RESOURCE_REQUIREMENTS_LIST ( 10 ) #define REG_QWORD ( 11 ) #define REG_QWORD_LITTLE_ENDIAN ( 11 ) + + +#define IMAGE_FILE_RELOCS_STRIPPED 0x0001 +#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 +#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 +#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 +#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 +#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 +#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 +#define IMAGE_FILE_32BIT_MACHINE 0x0100 +#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 +#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 +#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 +#define IMAGE_FILE_SYSTEM 0x1000 +#define IMAGE_FILE_DLL 0x2000 +#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 +#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 + +#define IMAGE_FILE_MACHINE_UNKNOWN 0 +#define IMAGE_FILE_MACHINE_I386 0x014c +#define IMAGE_FILE_MACHINE_R3000 0x0162 +#define IMAGE_FILE_MACHINE_R4000 0x0166 +#define IMAGE_FILE_MACHINE_R10000 0x0168 +#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169 +#define IMAGE_FILE_MACHINE_ALPHA 0x0184 +#define IMAGE_FILE_MACHINE_SH3 0x01a2 +#define IMAGE_FILE_MACHINE_SH3DSP 0x01a3 +#define IMAGE_FILE_MACHINE_SH3E 0x01a4 +#define IMAGE_FILE_MACHINE_SH4 0x01a6 +#define IMAGE_FILE_MACHINE_SH5 0x01a8 +#define IMAGE_FILE_MACHINE_ARM 0x01c0 +#define IMAGE_FILE_MACHINE_THUMB 0x01c2 +#define IMAGE_FILE_MACHINE_ARMNT 0x01c4 +#define IMAGE_FILE_MACHINE_AM33 0x01d3 +#define IMAGE_FILE_MACHINE_POWERPC 0x01F0 +#define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1 +#define IMAGE_FILE_MACHINE_IA64 0x0200 +#define IMAGE_FILE_MACHINE_MIPS16 0x0266 +#define IMAGE_FILE_MACHINE_ALPHA64 0x0284 +#define IMAGE_FILE_MACHINE_MIPSFPU 0x0366 +#define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466 +#define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64 +#define IMAGE_FILE_MACHINE_TRICORE 0x0520 +#define IMAGE_FILE_MACHINE_CEF 0x0CEF +#define IMAGE_FILE_MACHINE_EBC 0x0EBC +#define IMAGE_FILE_MACHINE_AMD64 0x8664 +#define IMAGE_FILE_MACHINE_M32R 0x9041 +#define IMAGE_FILE_MACHINE_CEE 0xC0EE diff --git a/ctypes_generation/winfunc.txt b/ctypes_generation/winfunc.txt index 513450c..f549383 100644 --- a/ctypes_generation/winfunc.txt +++ b/ctypes_generation/winfunc.txt @@ -31,6 +31,12 @@ HANDLE WINAPI CreateFileW( __in_opt HANDLE hTemplateFile ); +NTSTATUS WINAPI LdrLoadDll( + __in_opt LPCWSTR PathToFile, + __in_opt ULONG Flags, + _In_ PUNICODE_STRING ModuleFileName, + _Out_ PHANDLE ModuleHandle +); NTSTATUS WINAPI NtQuerySystemInformation( _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, @@ -730,3 +736,5 @@ BOOL WINAPI DebugBreakProcess ( DWORD WINAPI GetProcessId( _In_ HANDLE Process ); + + diff --git a/windows/generated_def/windef.py b/windows/generated_def/windef.py index e06db5e..2272202 100644 --- a/windows/generated_def/windef.py +++ b/windows/generated_def/windef.py @@ -511,4 +511,49 @@ REG_RESOURCE_LIST = Flag("REG_RESOURCE_LIST", ( 8 )) REG_FULL_RESOURCE_DESCRIPTOR = Flag("REG_FULL_RESOURCE_DESCRIPTOR", ( 9 )) REG_RESOURCE_REQUIREMENTS_LIST = Flag("REG_RESOURCE_REQUIREMENTS_LIST", ( 10 )) REG_QWORD = Flag("REG_QWORD", ( 11 )) -REG_QWORD_LITTLE_ENDIAN = Flag("REG_QWORD_LITTLE_ENDIAN", ( 11 )) \ No newline at end of file +REG_QWORD_LITTLE_ENDIAN = Flag("REG_QWORD_LITTLE_ENDIAN", ( 11 )) +IMAGE_FILE_RELOCS_STRIPPED = Flag("IMAGE_FILE_RELOCS_STRIPPED", 0x0001) +IMAGE_FILE_EXECUTABLE_IMAGE = Flag("IMAGE_FILE_EXECUTABLE_IMAGE", 0x0002) +IMAGE_FILE_LINE_NUMS_STRIPPED = Flag("IMAGE_FILE_LINE_NUMS_STRIPPED", 0x0004) +IMAGE_FILE_LOCAL_SYMS_STRIPPED = Flag("IMAGE_FILE_LOCAL_SYMS_STRIPPED", 0x0008) +IMAGE_FILE_AGGRESIVE_WS_TRIM = Flag("IMAGE_FILE_AGGRESIVE_WS_TRIM", 0x0010) +IMAGE_FILE_LARGE_ADDRESS_AWARE = Flag("IMAGE_FILE_LARGE_ADDRESS_AWARE", 0x0020) +IMAGE_FILE_BYTES_REVERSED_LO = Flag("IMAGE_FILE_BYTES_REVERSED_LO", 0x0080) +IMAGE_FILE_32BIT_MACHINE = Flag("IMAGE_FILE_32BIT_MACHINE", 0x0100) +IMAGE_FILE_DEBUG_STRIPPED = Flag("IMAGE_FILE_DEBUG_STRIPPED", 0x0200) +IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = Flag("IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP", 0x0400) +IMAGE_FILE_NET_RUN_FROM_SWAP = Flag("IMAGE_FILE_NET_RUN_FROM_SWAP", 0x0800) +IMAGE_FILE_SYSTEM = Flag("IMAGE_FILE_SYSTEM", 0x1000) +IMAGE_FILE_DLL = Flag("IMAGE_FILE_DLL", 0x2000) +IMAGE_FILE_UP_SYSTEM_ONLY = Flag("IMAGE_FILE_UP_SYSTEM_ONLY", 0x4000) +IMAGE_FILE_BYTES_REVERSED_HI = Flag("IMAGE_FILE_BYTES_REVERSED_HI", 0x8000) +IMAGE_FILE_MACHINE_UNKNOWN = Flag("IMAGE_FILE_MACHINE_UNKNOWN", 0) +IMAGE_FILE_MACHINE_I386 = Flag("IMAGE_FILE_MACHINE_I386", 0x014c) +IMAGE_FILE_MACHINE_R3000 = Flag("IMAGE_FILE_MACHINE_R3000", 0x0162) +IMAGE_FILE_MACHINE_R4000 = Flag("IMAGE_FILE_MACHINE_R4000", 0x0166) +IMAGE_FILE_MACHINE_R10000 = Flag("IMAGE_FILE_MACHINE_R10000", 0x0168) +IMAGE_FILE_MACHINE_WCEMIPSV2 = Flag("IMAGE_FILE_MACHINE_WCEMIPSV2", 0x0169) +IMAGE_FILE_MACHINE_ALPHA = Flag("IMAGE_FILE_MACHINE_ALPHA", 0x0184) +IMAGE_FILE_MACHINE_SH3 = Flag("IMAGE_FILE_MACHINE_SH3", 0x01a2) +IMAGE_FILE_MACHINE_SH3DSP = Flag("IMAGE_FILE_MACHINE_SH3DSP", 0x01a3) +IMAGE_FILE_MACHINE_SH3E = Flag("IMAGE_FILE_MACHINE_SH3E", 0x01a4) +IMAGE_FILE_MACHINE_SH4 = Flag("IMAGE_FILE_MACHINE_SH4", 0x01a6) +IMAGE_FILE_MACHINE_SH5 = Flag("IMAGE_FILE_MACHINE_SH5", 0x01a8) +IMAGE_FILE_MACHINE_ARM = Flag("IMAGE_FILE_MACHINE_ARM", 0x01c0) +IMAGE_FILE_MACHINE_THUMB = Flag("IMAGE_FILE_MACHINE_THUMB", 0x01c2) +IMAGE_FILE_MACHINE_ARMNT = Flag("IMAGE_FILE_MACHINE_ARMNT", 0x01c4) +IMAGE_FILE_MACHINE_AM33 = Flag("IMAGE_FILE_MACHINE_AM33", 0x01d3) +IMAGE_FILE_MACHINE_POWERPC = Flag("IMAGE_FILE_MACHINE_POWERPC", 0x01F0) +IMAGE_FILE_MACHINE_POWERPCFP = Flag("IMAGE_FILE_MACHINE_POWERPCFP", 0x01f1) +IMAGE_FILE_MACHINE_IA64 = Flag("IMAGE_FILE_MACHINE_IA64", 0x0200) +IMAGE_FILE_MACHINE_MIPS16 = Flag("IMAGE_FILE_MACHINE_MIPS16", 0x0266) +IMAGE_FILE_MACHINE_ALPHA64 = Flag("IMAGE_FILE_MACHINE_ALPHA64", 0x0284) +IMAGE_FILE_MACHINE_MIPSFPU = Flag("IMAGE_FILE_MACHINE_MIPSFPU", 0x0366) +IMAGE_FILE_MACHINE_MIPSFPU16 = Flag("IMAGE_FILE_MACHINE_MIPSFPU16", 0x0466) +IMAGE_FILE_MACHINE_AXP64 = Flag("IMAGE_FILE_MACHINE_AXP64", IMAGE_FILE_MACHINE_ALPHA64) +IMAGE_FILE_MACHINE_TRICORE = Flag("IMAGE_FILE_MACHINE_TRICORE", 0x0520) +IMAGE_FILE_MACHINE_CEF = Flag("IMAGE_FILE_MACHINE_CEF", 0x0CEF) +IMAGE_FILE_MACHINE_EBC = Flag("IMAGE_FILE_MACHINE_EBC", 0x0EBC) +IMAGE_FILE_MACHINE_AMD64 = Flag("IMAGE_FILE_MACHINE_AMD64", 0x8664) +IMAGE_FILE_MACHINE_M32R = Flag("IMAGE_FILE_MACHINE_M32R", 0x9041) +IMAGE_FILE_MACHINE_CEE = Flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE) \ No newline at end of file diff --git a/windows/generated_def/winfuncs.py b/windows/generated_def/winfuncs.py index b5a5267..6a7315e 100644 --- a/windows/generated_def/winfuncs.py +++ b/windows/generated_def/winfuncs.py @@ -3,7 +3,7 @@ from ctypes import * from ctypes.wintypes import * from .winstructs import * -functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId'] +functions = ['ExitProcess', 'TerminateProcess', 'GetLastError', 'GetCurrentProcess', 'CreateFileA', 'CreateFileW', 'LdrLoadDll', 'NtQuerySystemInformation', 'NtQueryInformationProcess', 'NtQueryVirtualMemory', 'NtCreateThreadEx', 'NtQueryInformationThread', 'GetExitCodeThread', 'GetExitCodeProcess', 'VirtualAlloc', 'VirtualAllocEx', 'VirtualFree', 'VirtualFreeEx', 'VirtualProtect', 'VirtualQuery', 'VirtualQueryEx', 'GetModuleFileNameA', 'GetModuleFileNameW', 'CreateThread', 'CreateRemoteThread', 'VirtualProtect', 'CreateProcessA', 'CreateProcessW', 'GetThreadContext', 'NtGetContextThread', 'SetThreadContext', 'OpenThread', 'OpenProcess', 'CloseHandle', 'ReadProcessMemory', 'NtWow64ReadVirtualMemory64', 'WriteProcessMemory', 'CreateToolhelp32Snapshot', 'Thread32First', 'Thread32Next', 'Process32First', 'Process32Next', 'Process32FirstW', 'Process32NextW', 'GetProcAddress', 'LoadLibraryA', 'LoadLibraryW', 'OpenProcessToken', 'LookupPrivilegeValueA', 'LookupPrivilegeValueW', 'AdjustTokenPrivileges', 'FindResourceA', 'FindResourceW', 'SizeofResource', 'LoadResource', 'LockResource', 'GetVersionExA', 'GetVersionExW', 'GetVersion', 'GetCurrentThread', 'GetCurrentThreadId', 'GetCurrentProcessorNumber', 'AllocConsole', 'FreeConsole', 'GetStdHandle', 'SetStdHandle', 'SetThreadAffinityMask', 'WriteFile', 'GetExtendedTcpTable', 'GetExtendedUdpTable', 'SetTcpEntry', 'AddVectoredContinueHandler', 'AddVectoredExceptionHandler', 'TerminateThread', 'ExitThread', 'RemoveVectoredExceptionHandler', 'ResumeThread', 'SuspendThread', 'WaitForSingleObject', 'GetThreadId', 'LoadLibraryExA', 'LoadLibraryExW', 'SymInitialize', 'SymFromName', 'SymLoadModuleEx', 'SymSetOptions', 'SymGetTypeInfo', 'DeviceIoControl', 'GetTokenInformation', 'RegOpenKeyExA', 'RegOpenKeyExW', 'RegGetValueA', 'RegGetValueW', 'RegCloseKey', 'Wow64DisableWow64FsRedirection', 'Wow64RevertWow64FsRedirection', 'Wow64EnableWow64FsRedirection', 'Wow64GetThreadContext', 'SetConsoleCtrlHandler', 'WinVerifyTrust', 'GlobalAlloc', 'GlobalFree', 'GlobalUnlock', 'GlobalLock', 'OpenClipboard', 'EmptyClipboard', 'CloseClipboard', 'SetClipboardData', 'GetClipboardData', 'EnumClipboardFormats', 'GetClipboardFormatNameA', 'GetClipboardFormatNameW', 'WinVerifyTrust', 'OpenProcessToken', 'OpenThreadToken', 'GetTokenInformation', 'SetTokenInformation', 'GetSidIdentifierAuthority', 'GetSidSubAuthority', 'GetSidSubAuthorityCount', 'DebugBreak', 'WaitForDebugEvent', 'ContinueDebugEvent', 'DebugActiveProcess', 'DebugActiveProcessStop', 'DebugSetProcessKillOnExit', 'DebugBreakProcess', 'GetProcessId'] # ExitProcess(uExitCode): ExitProcessPrototype = WINFUNCTYPE(VOID, UINT) @@ -29,6 +29,10 @@ CreateFileAParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode CreateFileWPrototype = WINFUNCTYPE(HANDLE, LPCWSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE) CreateFileWParams = ((1, 'lpFileName'), (1, 'dwDesiredAccess'), (1, 'dwShareMode'), (1, 'lpSecurityAttributes'), (1, 'dwCreationDisposition'), (1, 'dwFlagsAndAttributes'), (1, 'hTemplateFile')) +# LdrLoadDll(PathToFile, Flags, ModuleFileName, ModuleHandle): +LdrLoadDllPrototype = WINFUNCTYPE(NTSTATUS, LPCWSTR, ULONG, PUNICODE_STRING, PHANDLE) +LdrLoadDllParams = ((1, 'PathToFile'), (1, 'Flags'), (1, 'ModuleFileName'), (1, 'ModuleHandle')) + # NtQuerySystemInformation(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength): NtQuerySystemInformationPrototype = WINFUNCTYPE(NTSTATUS, SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG) NtQuerySystemInformationParams = ((1, 'SystemInformationClass'), (1, 'SystemInformation'), (1, 'SystemInformationLength'), (1, 'ReturnLength')) diff --git a/windows/syswow64.py b/windows/syswow64.py index 194a416..208f0f3 100644 --- a/windows/syswow64.py +++ b/windows/syswow64.py @@ -187,6 +187,8 @@ def get_current_process_syswow_peb(): return windows.winobject.RemotePEB64(peb_addr, CurrentProcessReadSyswow()) + + class ReadSyswow64Process(object): def __init__(self, target): self.target = target @@ -284,4 +286,8 @@ def NtGetContextThread_32_to_64(hThread, lpContext): lpContext = byref(lpContext) return NtGetContextThread_32_to_64.ctypes_function(hThread, lpContext) +@Syswow64ApiProxy(windows.winproxy.LdrLoadDll) +def LdrLoadDll_32_to_64(PathToFile, Flags, ModuleFileName, ModuleHandle): + return LdrLoadDll_32_to_64.ctypes_function(PathToFile, Flags, ModuleFileName, ModuleHandle) + diff --git a/windows/winproxy.py b/windows/winproxy.py index d39abae..d730ec0 100644 --- a/windows/winproxy.py +++ b/windows/winproxy.py @@ -307,7 +307,9 @@ def CreateRemoteThread(hProcess=NeededParameter, lpThreadAttributes=None, dwStac @Kernel32Proxy("VirtualProtect") -def VirtualProtect(lpAddress, dwSize, flNewProtect, lpflOldProtect=0): +def VirtualProtect(lpAddress, dwSize, flNewProtect, lpflOldProtect=None): + if lpflOldProtect is None: + lpflOldProtect = ctypes.byref(DWORD()) return VirtualProtect.ctypes_function(lpAddress, dwSize, flNewProtect, lpflOldProtect) @@ -502,6 +504,10 @@ def ntquerysysteminformation_error_check(func_name, result, func, args): def NtGetContextThread(hThread, lpContext): return NtGetContextThread.ctypes_function(hThread, lpContext) +@NtdllProxy("LdrLoadDll", error_ntstatus) +def LdrLoadDll(PathToFile, Flags, ModuleFileName, ModuleHandle): + return LdrLoadDll.ctypes_function(PathToFile, Flags, ModuleFileName, ModuleHandle) + @NtdllProxy('NtQuerySystemInformation', ntquerysysteminformation_error_check) def NtQuerySystemInformation(SystemInformationClass, SystemInformation=None, SystemInformationLength=0, ReturnLength=NeededParameter):