Add sample iat_hook

README.md

@@ -9,7 +9,7 @@ There is no external dependencies but it relies heavily on the ctypes modules.
 Some of this code is clean (IMHO) and some parts are just a wreck that work for now.
 Let say that the codebase evolves with my needs and my curiosity.
 
-You can find some examples of code in the `sample/` directory.
+You can find some examples of code in the `samples/` directory.
 
 ## Overview
 
@@ -31,7 +31,7 @@ You can also make some operation of threads (suspend/resume/wait/get( or set) co
 ### IAT Hook
 
 This codebase is born from my need to have IAT hooks implemented in Python.
-So the features is present (see `sample`)
+So the features is present (see `samples/`)
 
 
 ### Winproxy

TODO

@@ -1,4 +1,5 @@
 TODO:
+    - Documentation
     - ProcessMemory object ? (metasm like)
 
 FIXME:

samples/iat_hook.py

@@ -0,0 +1,63 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import _winreg
+import windows
+
+# Here is a demo of IAT hooking in python
+# We will hook the 'RegOpenKeyExA' entry of Python27.dll because it is easy to trigger !
+
+# First: let's create our hook
+# windows.hooks.RegOpenKeyExACallback is generated based on windows.generated_def.winfuncs
+@windows.hooks.RegOpenKeyExACallback
+def open_reg_hook(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_function):
+    print("<in hook> Hook called | hKey = {0} | lpSubKey = <{1}>".format(hex(hKey), lpSubKey.value))
+    # Out hook can choose to call the real_function or not
+    if "SECRET" in lpSubKey.value:
+        print("<in hook> Secret key asked, returning magic handle 0x12345678")
+        # We must respect the hooked method return-value interface
+        phkResult[0] = 0x12345678
+        return 0
+    if "FAIL" in lpSubKey.value:
+        print("<in hook> Asked for a failing key: returning 0x2a")
+        return 42
+    print("<in hook> Non-secret key : calling normal function")
+    return real_function()
+    
+    
+# Get the peb of our process
+peb = windows.current_process.peb
+
+# Get the pythonxx.dll module
+pythondll_module = [m for m in peb.modules if m.name.startswith("python") and m.name.endswith(".dll")][0]
+
+# Get the iat entries for DLL advapi32.dll
+adv_imports = pythondll_module.pe.imports['advapi32.dll']
+
+# Get RegOpenKeyExA iat entry
+RegOpenKeyExA_iat = [n for n in adv_imports if n.name == "RegOpenKeyExA"][0]
+
+# Setup our hook 
+
+RegOpenKeyExA_iat.set_hook(open_reg_hook)
+
+# Use python native module _winreg that call 'RegOpenKeyExA'
+
+print("Asking for <MY_SECRET_KEY>")
+v = _winreg.OpenKey(1234567, "MY_SECRET_KEY")
+print("Result = " + hex(v.handle))
+
+print("Asking for <MY_FAIL_KEY>")
+try:
+    v = _winreg.OpenKey(1234567, "MY_FAIL_KEY")
+    print("Result = " + hex(v.handle))
+except WindowsError as e:
+    print(repr(e))
+
+print("Asking for <HKEY_CURRENT_USER/Software>")
+try:
+    v = _winreg.OpenKey(_winreg.HKEY_CURRENT_USER, "Software")
+    print("Result = " + hex(v.handle))
+except WindowsError as e:
+    print(repr(e))