mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Working on time translation (filetime - unix - datetime) and windows volume objects
This commit is contained in:
hakril
@@ -970,4 +970,14 @@
|
||||
#define WTD_STATEACTION_VERIFY 0x00000001
|
||||
#define WTD_STATEACTION_CLOSE 0x00000002
|
||||
#define WTD_STATEACTION_AUTO_CACHE 0x00000003
|
||||
#define WTD_STATEACTION_AUTO_CACHE_FLUSH 0x00000004
|
||||
#define WTD_STATEACTION_AUTO_CACHE_FLUSH 0x00000004
|
||||
|
||||
|
||||
#define COMPRESSION_FORMAT_NONE (0x0000)
|
||||
#define COMPRESSION_FORMAT_DEFAULT (0x0001)
|
||||
#define COMPRESSION_FORMAT_LZNT1 (0x0002)
|
||||
#define COMPRESSION_FORMAT_XPRESS (0x0003)
|
||||
#define COMPRESSION_FORMAT_XPRESS_HUFF (0x0004)
|
||||
#define COMPRESSION_ENGINE_STANDARD (0x0000)
|
||||
#define COMPRESSION_ENGINE_MAXIMUM (0x0100)
|
||||
#define COMPRESSION_ENGINE_HIBER (0x0200)
|
||||
@@ -78,6 +78,14 @@ NTSTATUS WINAPI NtQueryVirtualMemory(
|
||||
_Out_opt_ PSIZE_T ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryVolumeInformationFile(
|
||||
_In_ HANDLE FileHandle,
|
||||
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
||||
_Out_ PVOID FsInformation,
|
||||
_In_ ULONG Length,
|
||||
_In_ FS_INFORMATION_CLASS FsInformationClass
|
||||
);
|
||||
|
||||
NTSTATUS NtCreateThreadEx(
|
||||
PHANDLE ThreadHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
@@ -931,6 +939,22 @@ NTSTATUS RtlDecompressBuffer(
|
||||
PULONG FinalUncompressedSize
|
||||
);
|
||||
|
||||
NTSTATUS RtlDecompressBufferEx(
|
||||
USHORT CompressionFormat,
|
||||
PUCHAR UncompressedBuffer,
|
||||
ULONG UncompressedBufferSize,
|
||||
PUCHAR CompressedBuffer,
|
||||
ULONG CompressedBufferSize,
|
||||
PULONG FinalUncompressedSize,
|
||||
PVOID WorkSpace
|
||||
);
|
||||
|
||||
NTSTATUS RtlGetCompressionWorkSpaceSize(
|
||||
USHORT CompressionFormatAndEngine,
|
||||
PULONG CompressBufferWorkSpaceSize,
|
||||
PULONG CompressFragmentWorkSpaceSize
|
||||
);
|
||||
|
||||
NTSTATUS NtCreateSection(
|
||||
PHANDLE SectionHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
@@ -1353,6 +1377,29 @@ DWORD WINAPI QueryDosDeviceW(
|
||||
_In_ DWORD ucchMax
|
||||
);
|
||||
|
||||
|
||||
HANDLE WINAPI FindFirstVolumeA(
|
||||
_Out_ LPCSTR lpszVolumeName,
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
HANDLE WINAPI FindFirstVolumeW(
|
||||
_Out_ LPWSTR lpszVolumeName,
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
BOOL WINAPI FindNextVolumeA(
|
||||
_In_ HANDLE hFindVolume,
|
||||
_Out_ LPCSTR lpszVolumeName,
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
BOOL WINAPI FindNextVolumeW(
|
||||
_In_ HANDLE hFindVolume,
|
||||
_Out_ LPWSTR lpszVolumeName,
|
||||
_In_ DWORD cchBufferLength
|
||||
);
|
||||
|
||||
NTSTATUS WINAPI NtQueryObject(
|
||||
_In_opt_ HANDLE Handle,
|
||||
_In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
|
||||
|
||||
@@ -497,6 +497,20 @@ typedef enum _TOKEN_INFORMATION_CLASS {
|
||||
MaxTokenInfoClass,
|
||||
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;
|
||||
|
||||
typedef enum _FS_INFORMATION_CLASS {
|
||||
FileFsVolumeInformation = 1,
|
||||
FileFsLabelInformation = 2,
|
||||
FileFsSizeInformation = 3,
|
||||
FileFsDeviceInformation = 4,
|
||||
FileFsAttributeInformation = 5,
|
||||
FileFsControlInformation = 6,
|
||||
FileFsFullSizeInformation = 7,
|
||||
FileFsObjectIdInformation = 8,
|
||||
FileFsDriverPathInformation = 9,
|
||||
FileFsVolumeFlagsInformation = 10,
|
||||
FileFsSectorSizeInformation = 11
|
||||
} FS_INFORMATION_CLASS;
|
||||
|
||||
|
||||
typedef enum _SECURITY_IMPERSONATION_LEVEL {
|
||||
SecurityAnonymous,
|
||||
@@ -3043,4 +3057,82 @@ typedef struct _RTL_UNLOAD_EVENT_TRACE64 {
|
||||
ULONG CheckSum;
|
||||
WCHAR ImageName[32];
|
||||
ULONG Version[2];
|
||||
} RTL_UNLOAD_EVENT_TRACE64, *PRTL_UNLOAD_EVENT_TRACE64;
|
||||
} RTL_UNLOAD_EVENT_TRACE64, *PRTL_UNLOAD_EVENT_TRACE64;
|
||||
|
||||
|
||||
typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
|
||||
ULONG FileSystemAttributes;
|
||||
LONG MaximumComponentNameLength;
|
||||
ULONG FileSystemNameLength;
|
||||
WCHAR FileSystemName[1];
|
||||
} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_LABEL_INFORMATION {
|
||||
ULONG VolumeLabelLength;
|
||||
WCHAR VolumeLabel[1];
|
||||
} FILE_FS_LABEL_INFORMATION, *PFILE_FS_LABEL_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_SIZE_INFORMATION {
|
||||
LARGE_INTEGER TotalAllocationUnits;
|
||||
LARGE_INTEGER AvailableAllocationUnits;
|
||||
ULONG SectorsPerAllocationUnit;
|
||||
ULONG BytesPerSector;
|
||||
} FILE_FS_SIZE_INFORMATION, *PFILE_FS_SIZE_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_DEVICE_INFORMATION {
|
||||
DEVICE_TYPE DeviceType;
|
||||
ULONG Characteristics;
|
||||
} FILE_FS_DEVICE_INFORMATION, *PFILE_FS_DEVICE_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_CONTROL_INFORMATION {
|
||||
LARGE_INTEGER FreeSpaceStartFiltering;
|
||||
LARGE_INTEGER FreeSpaceThreshold;
|
||||
LARGE_INTEGER FreeSpaceStopFiltering;
|
||||
LARGE_INTEGER DefaultQuotaThreshold;
|
||||
LARGE_INTEGER DefaultQuotaLimit;
|
||||
ULONG FileSystemControlFlags;
|
||||
} FILE_FS_CONTROL_INFORMATION, *PFILE_FS_CONTROL_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_FULL_SIZE_INFORMATION {
|
||||
LARGE_INTEGER TotalAllocationUnits;
|
||||
LARGE_INTEGER CallerAvailableAllocationUnits;
|
||||
LARGE_INTEGER ActualAvailableAllocationUnits;
|
||||
ULONG SectorsPerAllocationUnit;
|
||||
ULONG BytesPerSector;
|
||||
} FILE_FS_FULL_SIZE_INFORMATION, *PFILE_FS_FULL_SIZE_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_OBJECTID_INFORMATION {
|
||||
UCHAR ObjectId[16];
|
||||
UCHAR ExtendedInfo[48];
|
||||
} FILE_FS_OBJECTID_INFORMATION, *PFILE_FS_OBJECTID_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_DRIVER_PATH_INFORMATION {
|
||||
BOOLEAN DriverInPath;
|
||||
ULONG DriverNameLength;
|
||||
WCHAR DriverName[1];
|
||||
} FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
|
||||
|
||||
|
||||
typedef struct _FILE_FS_DRIVER_PATH_INFORMATION {
|
||||
BOOLEAN DriverInPath;
|
||||
ULONG DriverNameLength;
|
||||
WCHAR DriverName[1];
|
||||
} FILE_FS_DRIVER_PATH_INFORMATION, *PFILE_FS_DRIVER_PATH_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_VOLUME_INFORMATION {
|
||||
LARGE_INTEGER VolumeCreationTime;
|
||||
ULONG VolumeSerialNumber;
|
||||
ULONG VolumeLabelLength;
|
||||
BOOLEAN SupportsObjects;
|
||||
WCHAR VolumeLabel[1];
|
||||
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;
|
||||
|
||||
typedef struct _FILE_FS_SECTOR_SIZE_INFORMATION {
|
||||
ULONG LogicalBytesPerSector;
|
||||
ULONG PhysicalBytesPerSectorForAtomicity;
|
||||
ULONG PhysicalBytesPerSectorForPerformance;
|
||||
ULONG FileSystemEffectivePhysicalBytesPerSectorForAtomicity;
|
||||
ULONG Flags;
|
||||
ULONG ByteOffsetForSectorAlignment;
|
||||
ULONG ByteOffsetForPartitionAlignment;
|
||||
} FILE_FS_SECTOR_SIZE_INFORMATION, *PFILE_FS_SECTOR_SIZE_INFORMATION;
|
||||
@@ -103,6 +103,7 @@ TYPE_EQUIVALENCE = [
|
||||
('LPUNKNOWN', 'POINTER(PVOID)'),
|
||||
('SPC_UUID', 'BYTE * 16'),
|
||||
('PIO_APC_ROUTINE', 'PVOID'),
|
||||
('DEVICE_TYPE', 'DWORD'),
|
||||
#STUFF FOR COM (will be replace at runtime
|
||||
# real def in com_interface_header
|
||||
# ('GUID', 'PVOID'),
|
||||
|
||||
@@ -833,6 +833,14 @@ Windef
|
||||
.. autodata:: WTD_STATEACTION_CLOSE
|
||||
.. autodata:: WTD_STATEACTION_AUTO_CACHE
|
||||
.. autodata:: WTD_STATEACTION_AUTO_CACHE_FLUSH
|
||||
.. autodata:: COMPRESSION_FORMAT_NONE
|
||||
.. autodata:: COMPRESSION_FORMAT_DEFAULT
|
||||
.. autodata:: COMPRESSION_FORMAT_LZNT1
|
||||
.. autodata:: COMPRESSION_FORMAT_XPRESS
|
||||
.. autodata:: COMPRESSION_FORMAT_XPRESS_HUFF
|
||||
.. autodata:: COMPRESSION_ENGINE_STANDARD
|
||||
.. autodata:: COMPRESSION_ENGINE_MAXIMUM
|
||||
.. autodata:: COMPRESSION_ENGINE_HIBER
|
||||
.. autodata:: CERT_QUERY_OBJECT_FILE
|
||||
.. autodata:: CERT_QUERY_OBJECT_BLOB
|
||||
.. autodata:: CERT_QUERY_CONTENT_CERT
|
||||
|
||||
@@ -9623,6 +9623,342 @@ _RTL_UNLOAD_EVENT_TRACE64
|
||||
|
||||
:class:`ULONG` ``[2]``
|
||||
|
||||
_FILE_FS_ATTRIBUTE_INFORMATION
|
||||
''''''''''''''''''''''''''''''
|
||||
.. class:: PFILE_FS_ATTRIBUTE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_ATTRIBUTE_INFORMATION`
|
||||
|
||||
.. class:: FILE_FS_ATTRIBUTE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_ATTRIBUTE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_ATTRIBUTE_INFORMATION
|
||||
|
||||
.. attribute:: FileSystemAttributes
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: MaximumComponentNameLength
|
||||
|
||||
:class:`LONG`
|
||||
|
||||
|
||||
.. attribute:: FileSystemNameLength
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: FileSystemName
|
||||
|
||||
:class:`WCHAR` ``[1]``
|
||||
|
||||
_FILE_FS_LABEL_INFORMATION
|
||||
''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_LABEL_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_LABEL_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_LABEL_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_LABEL_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_LABEL_INFORMATION
|
||||
|
||||
.. attribute:: VolumeLabelLength
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: VolumeLabel
|
||||
|
||||
:class:`WCHAR` ``[1]``
|
||||
|
||||
_FILE_FS_SIZE_INFORMATION
|
||||
'''''''''''''''''''''''''
|
||||
.. class:: PFILE_FS_SIZE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_SIZE_INFORMATION`
|
||||
|
||||
.. class:: FILE_FS_SIZE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_SIZE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_SIZE_INFORMATION
|
||||
|
||||
.. attribute:: TotalAllocationUnits
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: AvailableAllocationUnits
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: SectorsPerAllocationUnit
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: BytesPerSector
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_FS_DEVICE_INFORMATION
|
||||
'''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_DEVICE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_DEVICE_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_DEVICE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_DEVICE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_DEVICE_INFORMATION
|
||||
|
||||
.. attribute:: DeviceType
|
||||
|
||||
:class:`DEVICE_TYPE`
|
||||
|
||||
|
||||
.. attribute:: Characteristics
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_FS_CONTROL_INFORMATION
|
||||
''''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_CONTROL_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_CONTROL_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_CONTROL_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_CONTROL_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_CONTROL_INFORMATION
|
||||
|
||||
.. attribute:: FreeSpaceStartFiltering
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: FreeSpaceThreshold
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: FreeSpaceStopFiltering
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: DefaultQuotaThreshold
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: DefaultQuotaLimit
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: FileSystemControlFlags
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_FS_FULL_SIZE_INFORMATION
|
||||
''''''''''''''''''''''''''''''
|
||||
.. class:: PFILE_FS_FULL_SIZE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_FULL_SIZE_INFORMATION`
|
||||
|
||||
.. class:: FILE_FS_FULL_SIZE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_FULL_SIZE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_FULL_SIZE_INFORMATION
|
||||
|
||||
.. attribute:: TotalAllocationUnits
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: CallerAvailableAllocationUnits
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: ActualAvailableAllocationUnits
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: SectorsPerAllocationUnit
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: BytesPerSector
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
_FILE_FS_OBJECTID_INFORMATION
|
||||
'''''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_OBJECTID_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_OBJECTID_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_OBJECTID_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_OBJECTID_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_OBJECTID_INFORMATION
|
||||
|
||||
.. attribute:: ObjectId
|
||||
|
||||
:class:`UCHAR` ``[16]``
|
||||
|
||||
|
||||
.. attribute:: ExtendedInfo
|
||||
|
||||
:class:`UCHAR` ``[48]``
|
||||
|
||||
_FILE_FS_DRIVER_PATH_INFORMATION
|
||||
''''''''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_DRIVER_PATH_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_DRIVER_PATH_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_DRIVER_PATH_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_DRIVER_PATH_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_DRIVER_PATH_INFORMATION
|
||||
|
||||
.. attribute:: DriverInPath
|
||||
|
||||
:class:`BOOLEAN`
|
||||
|
||||
|
||||
.. attribute:: DriverNameLength
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: DriverName
|
||||
|
||||
:class:`WCHAR` ``[1]``
|
||||
|
||||
_FILE_FS_DRIVER_PATH_INFORMATION
|
||||
''''''''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_DRIVER_PATH_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_DRIVER_PATH_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_DRIVER_PATH_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_DRIVER_PATH_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_DRIVER_PATH_INFORMATION
|
||||
|
||||
.. attribute:: DriverInPath
|
||||
|
||||
:class:`BOOLEAN`
|
||||
|
||||
|
||||
.. attribute:: DriverNameLength
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: DriverName
|
||||
|
||||
:class:`WCHAR` ``[1]``
|
||||
|
||||
_FILE_FS_VOLUME_INFORMATION
|
||||
'''''''''''''''''''''''''''
|
||||
.. class:: FILE_FS_VOLUME_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_VOLUME_INFORMATION`
|
||||
|
||||
.. class:: PFILE_FS_VOLUME_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_VOLUME_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_VOLUME_INFORMATION
|
||||
|
||||
.. attribute:: VolumeCreationTime
|
||||
|
||||
:class:`LARGE_INTEGER`
|
||||
|
||||
|
||||
.. attribute:: VolumeSerialNumber
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: VolumeLabelLength
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: SupportsObjects
|
||||
|
||||
:class:`BOOLEAN`
|
||||
|
||||
|
||||
.. attribute:: VolumeLabel
|
||||
|
||||
:class:`WCHAR` ``[1]``
|
||||
|
||||
_FILE_FS_SECTOR_SIZE_INFORMATION
|
||||
''''''''''''''''''''''''''''''''
|
||||
.. class:: PFILE_FS_SECTOR_SIZE_INFORMATION
|
||||
|
||||
Pointer to :class:`_FILE_FS_SECTOR_SIZE_INFORMATION`
|
||||
|
||||
.. class:: FILE_FS_SECTOR_SIZE_INFORMATION
|
||||
|
||||
Alias for :class:`_FILE_FS_SECTOR_SIZE_INFORMATION`
|
||||
|
||||
.. class:: _FILE_FS_SECTOR_SIZE_INFORMATION
|
||||
|
||||
.. attribute:: LogicalBytesPerSector
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: PhysicalBytesPerSectorForAtomicity
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: PhysicalBytesPerSectorForPerformance
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: FileSystemEffectivePhysicalBytesPerSectorForAtomicity
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: Flags
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: ByteOffsetForSectorAlignment
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
|
||||
.. attribute:: ByteOffsetForPartitionAlignment
|
||||
|
||||
:class:`ULONG`
|
||||
|
||||
tagRECT
|
||||
'''''''
|
||||
.. class:: LPRECT
|
||||
@@ -12470,6 +12806,47 @@ _TOKEN_INFORMATION_CLASS
|
||||
|
||||
.. attribute:: MaxTokenInfoClass(41)
|
||||
|
||||
_FS_INFORMATION_CLASS
|
||||
'''''''''''''''''''''
|
||||
.. class:: FS_INFORMATION_CLASS
|
||||
|
||||
Alias for :class:`_FS_INFORMATION_CLASS`
|
||||
|
||||
.. class:: _FS_INFORMATION_CLASS
|
||||
|
||||
|
||||
.. attribute:: FileFsVolumeInformation(1)
|
||||
|
||||
|
||||
.. attribute:: FileFsLabelInformation(2)
|
||||
|
||||
|
||||
.. attribute:: FileFsSizeInformation(3)
|
||||
|
||||
|
||||
.. attribute:: FileFsDeviceInformation(4)
|
||||
|
||||
|
||||
.. attribute:: FileFsAttributeInformation(5)
|
||||
|
||||
|
||||
.. attribute:: FileFsControlInformation(6)
|
||||
|
||||
|
||||
.. attribute:: FileFsFullSizeInformation(7)
|
||||
|
||||
|
||||
.. attribute:: FileFsObjectIdInformation(8)
|
||||
|
||||
|
||||
.. attribute:: FileFsDriverPathInformation(9)
|
||||
|
||||
|
||||
.. attribute:: FileFsVolumeFlagsInformation(10)
|
||||
|
||||
|
||||
.. attribute:: FileFsSectorSizeInformation(11)
|
||||
|
||||
_SECURITY_IMPERSONATION_LEVEL
|
||||
'''''''''''''''''''''''''''''
|
||||
.. class:: SECURITY_IMPERSONATION_LEVEL
|
||||
|
||||
@@ -0,0 +1,119 @@
|
||||
import pytest
|
||||
import os
|
||||
from datetime import datetime, timedelta
|
||||
import windows.utils
|
||||
import windows.generated_def as gdef
|
||||
|
||||
from pfwtest import *
|
||||
|
||||
pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
|
||||
|
||||
|
||||
ntqueryinformationfile_info_structs = {
|
||||
gdef.FileAccessInformation: gdef.FILE_ACCESS_INFORMATION,
|
||||
gdef.FileAlignmentInformation: gdef.FILE_ALIGNMENT_INFORMATION,
|
||||
gdef.FileAllInformation: gdef.FILE_ALL_INFORMATION,
|
||||
gdef.FileAttributeTagInformation: gdef.FILE_ATTRIBUTE_TAG_INFORMATION,
|
||||
gdef.FileBasicInformation: gdef.FILE_BASIC_INFORMATION,
|
||||
gdef.FileEaInformation: gdef.FILE_EA_INFORMATION ,
|
||||
gdef.FileInternalInformation: gdef.FILE_INTERNAL_INFORMATION,
|
||||
gdef.FileIoPriorityHintInformation: gdef.FILE_IO_PRIORITY_HINT_INFORMATION,
|
||||
gdef.FileModeInformation: gdef.FILE_MODE_INFORMATION,
|
||||
gdef.FileNetworkOpenInformation: gdef.FILE_NETWORK_OPEN_INFORMATION,
|
||||
gdef.FileNameInformation: gdef.FILE_NAME_INFORMATION,
|
||||
gdef.FilePositionInformation: gdef.FILE_POSITION_INFORMATION,
|
||||
gdef.FileStandardInformation: gdef.FILE_STANDARD_INFORMATION,
|
||||
gdef.FileIsRemoteDeviceInformation: gdef.FILE_IS_REMOTE_DEVICE_INFORMATION,
|
||||
}
|
||||
|
||||
def test_query_file_information():
|
||||
f = open(r"C:\windows\system32\ntdll.dll")
|
||||
handle = windows.utils.get_handle_from_file(f)
|
||||
for info_class, info_struct in ntqueryinformationfile_info_structs.items():
|
||||
res = windows.utils.query_file_information(handle, info_class) # Fail should raise
|
||||
resf = windows.utils.query_file_information(f, info_class) # Try with the file directly
|
||||
# Check return type
|
||||
assert isinstance(res, info_struct)
|
||||
assert isinstance(resf, info_struct)
|
||||
|
||||
|
||||
ntqueryvolumeinformationfile_info_structs = {
|
||||
gdef.FileFsAttributeInformation: gdef.FILE_FS_ATTRIBUTE_INFORMATION,
|
||||
gdef.FileFsControlInformation: gdef.FILE_FS_CONTROL_INFORMATION,
|
||||
gdef.FileFsDeviceInformation: gdef.FILE_FS_DEVICE_INFORMATION,
|
||||
# gdef.FileFsDriverPathInformation: gdef.FILE_FS_DRIVER_PATH_INFORMATION, # Not handled for now
|
||||
gdef.FileFsFullSizeInformation: gdef.FILE_FS_FULL_SIZE_INFORMATION,
|
||||
gdef.FileFsObjectIdInformation: gdef.FILE_FS_OBJECTID_INFORMATION,
|
||||
gdef.FileFsSizeInformation: gdef.FILE_FS_SIZE_INFORMATION,
|
||||
gdef.FileFsVolumeInformation: gdef.FILE_FS_VOLUME_INFORMATION,
|
||||
gdef.FileFsSectorSizeInformation: gdef.FILE_FS_SECTOR_SIZE_INFORMATION,
|
||||
}
|
||||
|
||||
def test_query_volume_information():
|
||||
f = open(r"C:\windows\system32\ntdll.dll")
|
||||
handle = windows.utils.get_handle_from_file(f)
|
||||
|
||||
for info_class, info_struct in ntqueryvolumeinformationfile_info_structs.items():
|
||||
res = windows.utils.query_volume_information(handle, info_class) # Fail should raise
|
||||
resf = windows.utils.query_volume_information(f, info_class) # Try with the file directly
|
||||
# Check return type
|
||||
assert isinstance(res, info_struct)
|
||||
assert isinstance(resf, info_struct)
|
||||
|
||||
def date_equals(d1, d2, acceptable_delta=timedelta(microseconds=1)):
|
||||
if d2 > d1:
|
||||
delta = d2 - d1
|
||||
else:
|
||||
delta = d1 - d2
|
||||
return delta <= acceptable_delta
|
||||
|
||||
def test_datetime_from_filetime():
|
||||
FILENAME = "C:\\windows\\system32\\ntdll.dll"
|
||||
f = open(FILENAME)
|
||||
|
||||
datetime_from_filetime = windows.utils.datetime_from_filetime
|
||||
|
||||
# Compare to os.stat
|
||||
stats = os.stat(FILENAME)
|
||||
utc_satime = datetime.utcfromtimestamp(stats.st_atime)
|
||||
utc_smtime = datetime.utcfromtimestamp(stats.st_mtime)
|
||||
utc_sctime = datetime.utcfromtimestamp(stats.st_ctime)
|
||||
|
||||
# Compare to NtQueryInformationFile
|
||||
fileinfo = windows.utils.query_file_information(f, gdef.FileBasicInformation)
|
||||
|
||||
utc_watime = datetime_from_filetime(fileinfo.LastAccessTime)
|
||||
utc_wmtime = datetime_from_filetime(fileinfo.LastWriteTime)
|
||||
utc_wctime = datetime_from_filetime(fileinfo.CreationTime)
|
||||
|
||||
assert date_equals(utc_satime, utc_watime)
|
||||
assert date_equals(utc_smtime, utc_wmtime)
|
||||
assert date_equals(utc_sctime, utc_wctime)
|
||||
|
||||
# Test rounding
|
||||
## Round-down
|
||||
|
||||
|
||||
assert date_equals(datetime_from_filetime(131492395680727300), datetime(2017, 9, 7, 6, 32, 48, 72730))
|
||||
assert date_equals(datetime_from_filetime(131492395680727304), datetime(2017, 9, 7, 6, 32, 48, 72730))
|
||||
|
||||
assert date_equals(datetime_from_filetime(131492395680727305), datetime(2017, 9, 7, 6, 32, 48, 72731))
|
||||
assert date_equals(datetime_from_filetime(131492395680727309), datetime(2017, 9, 7, 6, 32, 48, 72731))
|
||||
|
||||
assert date_equals(datetime.utcfromtimestamp(1504764215.5896280), datetime_from_filetime(131492378155896280))
|
||||
assert date_equals(datetime.utcfromtimestamp(1504764215.5896284), datetime_from_filetime(131492378155896284))
|
||||
assert date_equals(datetime.utcfromtimestamp(1504764215.5896285), datetime_from_filetime(131492378155896285))
|
||||
assert date_equals(datetime.utcfromtimestamp(1504764215.5896289), datetime_from_filetime(131492378155896289))
|
||||
|
||||
|
||||
|
||||
|
||||
def test_unix_timestamp_from_filetime():
|
||||
# Check date vs timestamps to be sure
|
||||
assert datetime.utcfromtimestamp(1504765968.072730) == datetime(2017, 9, 7, 6, 32, 48, 72730)
|
||||
assert windows.utils.unix_timestamp_from_filetime(131492395680727300) == 1504765968.072730
|
||||
assert windows.utils.unix_timestamp_from_filetime(131492395680727304) == 1504765968.072730
|
||||
|
||||
assert datetime.utcfromtimestamp(1504765968.072731) == datetime(2017, 9, 7, 6, 32, 48, 72731)
|
||||
assert windows.utils.unix_timestamp_from_filetime(131492395680727309) == 1504765968.072731
|
||||
assert windows.utils.unix_timestamp_from_filetime(131492395680727305) == 1504765968.072731
|
||||
File diff suppressed because one or more lines are too long
@@ -889,6 +889,14 @@ WTD_STATEACTION_VERIFY = make_flag("WTD_STATEACTION_VERIFY", 0x00000001)
|
||||
WTD_STATEACTION_CLOSE = make_flag("WTD_STATEACTION_CLOSE", 0x00000002)
|
||||
WTD_STATEACTION_AUTO_CACHE = make_flag("WTD_STATEACTION_AUTO_CACHE", 0x00000003)
|
||||
WTD_STATEACTION_AUTO_CACHE_FLUSH = make_flag("WTD_STATEACTION_AUTO_CACHE_FLUSH", 0x00000004)
|
||||
COMPRESSION_FORMAT_NONE = make_flag("COMPRESSION_FORMAT_NONE", ( 0x0000 ))
|
||||
COMPRESSION_FORMAT_DEFAULT = make_flag("COMPRESSION_FORMAT_DEFAULT", ( 0x0001 ))
|
||||
COMPRESSION_FORMAT_LZNT1 = make_flag("COMPRESSION_FORMAT_LZNT1", ( 0x0002 ))
|
||||
COMPRESSION_FORMAT_XPRESS = make_flag("COMPRESSION_FORMAT_XPRESS", ( 0x0003 ))
|
||||
COMPRESSION_FORMAT_XPRESS_HUFF = make_flag("COMPRESSION_FORMAT_XPRESS_HUFF", ( 0x0004 ))
|
||||
COMPRESSION_ENGINE_STANDARD = make_flag("COMPRESSION_ENGINE_STANDARD", ( 0x0000 ))
|
||||
COMPRESSION_ENGINE_MAXIMUM = make_flag("COMPRESSION_ENGINE_MAXIMUM", ( 0x0100 ))
|
||||
COMPRESSION_ENGINE_HIBER = make_flag("COMPRESSION_ENGINE_HIBER", ( 0x0200 ))
|
||||
CERT_QUERY_OBJECT_FILE = make_flag("CERT_QUERY_OBJECT_FILE", 0x00000001)
|
||||
CERT_QUERY_OBJECT_BLOB = make_flag("CERT_QUERY_OBJECT_BLOB", 0x00000002)
|
||||
CERT_QUERY_CONTENT_CERT = make_flag("CERT_QUERY_CONTENT_CERT", 1)
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -86,6 +86,7 @@ LPPROC_THREAD_ATTRIBUTE_LIST = PVOID
|
||||
LPUNKNOWN = POINTER(PVOID)
|
||||
SPC_UUID = BYTE * 16
|
||||
PIO_APC_ROUTINE = PVOID
|
||||
DEVICE_TYPE = DWORD
|
||||
PWINDBG_EXTENSION_APIS32 = PVOID
|
||||
PWINDBG_EXTENSION_APIS64 = PVOID
|
||||
LPCONTEXT = PVOID
|
||||
@@ -537,6 +538,23 @@ TOKEN_INFORMATION_CLASS = _TOKEN_INFORMATION_CLASS
|
||||
PTOKEN_INFORMATION_CLASS = POINTER(_TOKEN_INFORMATION_CLASS)
|
||||
|
||||
|
||||
FileFsVolumeInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsVolumeInformation", 0x1)
|
||||
FileFsLabelInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsLabelInformation", 0x2)
|
||||
FileFsSizeInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsSizeInformation", 0x3)
|
||||
FileFsDeviceInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsDeviceInformation", 0x4)
|
||||
FileFsAttributeInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsAttributeInformation", 0x5)
|
||||
FileFsControlInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsControlInformation", 0x6)
|
||||
FileFsFullSizeInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsFullSizeInformation", 0x7)
|
||||
FileFsObjectIdInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsObjectIdInformation", 0x8)
|
||||
FileFsDriverPathInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsDriverPathInformation", 0x9)
|
||||
FileFsVolumeFlagsInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsVolumeFlagsInformation", 0xa)
|
||||
FileFsSectorSizeInformation = EnumValue("_FS_INFORMATION_CLASS", "FileFsSectorSizeInformation", 0xb)
|
||||
class _FS_INFORMATION_CLASS(EnumType):
|
||||
values = [FileFsVolumeInformation, FileFsLabelInformation, FileFsSizeInformation, FileFsDeviceInformation, FileFsAttributeInformation, FileFsControlInformation, FileFsFullSizeInformation, FileFsObjectIdInformation, FileFsDriverPathInformation, FileFsVolumeFlagsInformation, FileFsSectorSizeInformation]
|
||||
mapper = {x:x for x in values}
|
||||
FS_INFORMATION_CLASS = _FS_INFORMATION_CLASS
|
||||
|
||||
|
||||
SecurityAnonymous = EnumValue("_SECURITY_IMPERSONATION_LEVEL", "SecurityAnonymous", 0x0)
|
||||
SecurityIdentification = EnumValue("_SECURITY_IMPERSONATION_LEVEL", "SecurityIdentification", 0x1)
|
||||
SecurityImpersonation = EnumValue("_SECURITY_IMPERSONATION_LEVEL", "SecurityImpersonation", 0x2)
|
||||
@@ -4140,6 +4158,115 @@ class _RTL_UNLOAD_EVENT_TRACE64(Structure):
|
||||
PRTL_UNLOAD_EVENT_TRACE64 = POINTER(_RTL_UNLOAD_EVENT_TRACE64)
|
||||
RTL_UNLOAD_EVENT_TRACE64 = _RTL_UNLOAD_EVENT_TRACE64
|
||||
|
||||
class _FILE_FS_ATTRIBUTE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("FileSystemAttributes", ULONG),
|
||||
("MaximumComponentNameLength", LONG),
|
||||
("FileSystemNameLength", ULONG),
|
||||
("FileSystemName", WCHAR * 1),
|
||||
]
|
||||
PFILE_FS_ATTRIBUTE_INFORMATION = POINTER(_FILE_FS_ATTRIBUTE_INFORMATION)
|
||||
FILE_FS_ATTRIBUTE_INFORMATION = _FILE_FS_ATTRIBUTE_INFORMATION
|
||||
|
||||
class _FILE_FS_LABEL_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("VolumeLabelLength", ULONG),
|
||||
("VolumeLabel", WCHAR * 1),
|
||||
]
|
||||
FILE_FS_LABEL_INFORMATION = _FILE_FS_LABEL_INFORMATION
|
||||
PFILE_FS_LABEL_INFORMATION = POINTER(_FILE_FS_LABEL_INFORMATION)
|
||||
|
||||
class _FILE_FS_SIZE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("TotalAllocationUnits", LARGE_INTEGER),
|
||||
("AvailableAllocationUnits", LARGE_INTEGER),
|
||||
("SectorsPerAllocationUnit", ULONG),
|
||||
("BytesPerSector", ULONG),
|
||||
]
|
||||
PFILE_FS_SIZE_INFORMATION = POINTER(_FILE_FS_SIZE_INFORMATION)
|
||||
FILE_FS_SIZE_INFORMATION = _FILE_FS_SIZE_INFORMATION
|
||||
|
||||
class _FILE_FS_DEVICE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("DeviceType", DEVICE_TYPE),
|
||||
("Characteristics", ULONG),
|
||||
]
|
||||
FILE_FS_DEVICE_INFORMATION = _FILE_FS_DEVICE_INFORMATION
|
||||
PFILE_FS_DEVICE_INFORMATION = POINTER(_FILE_FS_DEVICE_INFORMATION)
|
||||
|
||||
class _FILE_FS_CONTROL_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("FreeSpaceStartFiltering", LARGE_INTEGER),
|
||||
("FreeSpaceThreshold", LARGE_INTEGER),
|
||||
("FreeSpaceStopFiltering", LARGE_INTEGER),
|
||||
("DefaultQuotaThreshold", LARGE_INTEGER),
|
||||
("DefaultQuotaLimit", LARGE_INTEGER),
|
||||
("FileSystemControlFlags", ULONG),
|
||||
]
|
||||
FILE_FS_CONTROL_INFORMATION = _FILE_FS_CONTROL_INFORMATION
|
||||
PFILE_FS_CONTROL_INFORMATION = POINTER(_FILE_FS_CONTROL_INFORMATION)
|
||||
|
||||
class _FILE_FS_FULL_SIZE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("TotalAllocationUnits", LARGE_INTEGER),
|
||||
("CallerAvailableAllocationUnits", LARGE_INTEGER),
|
||||
("ActualAvailableAllocationUnits", LARGE_INTEGER),
|
||||
("SectorsPerAllocationUnit", ULONG),
|
||||
("BytesPerSector", ULONG),
|
||||
]
|
||||
PFILE_FS_FULL_SIZE_INFORMATION = POINTER(_FILE_FS_FULL_SIZE_INFORMATION)
|
||||
FILE_FS_FULL_SIZE_INFORMATION = _FILE_FS_FULL_SIZE_INFORMATION
|
||||
|
||||
class _FILE_FS_OBJECTID_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("ObjectId", UCHAR * 16),
|
||||
("ExtendedInfo", UCHAR * 48),
|
||||
]
|
||||
FILE_FS_OBJECTID_INFORMATION = _FILE_FS_OBJECTID_INFORMATION
|
||||
PFILE_FS_OBJECTID_INFORMATION = POINTER(_FILE_FS_OBJECTID_INFORMATION)
|
||||
|
||||
class _FILE_FS_DRIVER_PATH_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("DriverInPath", BOOLEAN),
|
||||
("DriverNameLength", ULONG),
|
||||
("DriverName", WCHAR * 1),
|
||||
]
|
||||
FILE_FS_DRIVER_PATH_INFORMATION = _FILE_FS_DRIVER_PATH_INFORMATION
|
||||
PFILE_FS_DRIVER_PATH_INFORMATION = POINTER(_FILE_FS_DRIVER_PATH_INFORMATION)
|
||||
|
||||
class _FILE_FS_DRIVER_PATH_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("DriverInPath", BOOLEAN),
|
||||
("DriverNameLength", ULONG),
|
||||
("DriverName", WCHAR * 1),
|
||||
]
|
||||
FILE_FS_DRIVER_PATH_INFORMATION = _FILE_FS_DRIVER_PATH_INFORMATION
|
||||
PFILE_FS_DRIVER_PATH_INFORMATION = POINTER(_FILE_FS_DRIVER_PATH_INFORMATION)
|
||||
|
||||
class _FILE_FS_VOLUME_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("VolumeCreationTime", LARGE_INTEGER),
|
||||
("VolumeSerialNumber", ULONG),
|
||||
("VolumeLabelLength", ULONG),
|
||||
("SupportsObjects", BOOLEAN),
|
||||
("VolumeLabel", WCHAR * 1),
|
||||
]
|
||||
FILE_FS_VOLUME_INFORMATION = _FILE_FS_VOLUME_INFORMATION
|
||||
PFILE_FS_VOLUME_INFORMATION = POINTER(_FILE_FS_VOLUME_INFORMATION)
|
||||
|
||||
class _FILE_FS_SECTOR_SIZE_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("LogicalBytesPerSector", ULONG),
|
||||
("PhysicalBytesPerSectorForAtomicity", ULONG),
|
||||
("PhysicalBytesPerSectorForPerformance", ULONG),
|
||||
("FileSystemEffectivePhysicalBytesPerSectorForAtomicity", ULONG),
|
||||
("Flags", ULONG),
|
||||
("ByteOffsetForSectorAlignment", ULONG),
|
||||
("ByteOffsetForPartitionAlignment", ULONG),
|
||||
]
|
||||
PFILE_FS_SECTOR_SIZE_INFORMATION = POINTER(_FILE_FS_SECTOR_SIZE_INFORMATION)
|
||||
FILE_FS_SECTOR_SIZE_INFORMATION = _FILE_FS_SECTOR_SIZE_INFORMATION
|
||||
|
||||
class tagRECT(Structure):
|
||||
_fields_ = [
|
||||
("left", LONG),
|
||||
|
||||
@@ -171,14 +171,30 @@ def check_debug():
|
||||
# print "> bcdedit /set noumex on"
|
||||
return True
|
||||
|
||||
UNIX_EPOCH = datetime.datetime(1970, 1, 1, 0, 0)
|
||||
WINDOWS_EPOCH = datetime.datetime(1601, 1, 1, 0, 0)
|
||||
|
||||
WIN_TO_UNIX_EPOCH_SECOND = int((UNIX_EPOCH - WINDOWS_EPOCH).total_seconds())
|
||||
WIN_TICK_PER_SECOND_INT = 10**7
|
||||
WIN_TICK_PER_SECOND_FLOAT = 10.0**7
|
||||
WIN_TO_UNIX_EPOCH_WIN_TICKS = WIN_TO_UNIX_EPOCH_SECOND * WIN_TICK_PER_SECOND_INT
|
||||
|
||||
# TODO: look in python stblib how filetime -> unix timestamp translation is down (os.stat code ?)
|
||||
|
||||
def unix_timestamp_from_filetime(filetime):
|
||||
# Round the filetime
|
||||
round_win_ticks = ((filetime / 10) + int(round((filetime % 10) / 10.0))) * 10
|
||||
return round((round_win_ticks - WIN_TO_UNIX_EPOCH_WIN_TICKS) / WIN_TICK_PER_SECOND_FLOAT, 7)
|
||||
|
||||
def datetime_from_filetime(filetime):
|
||||
"""return a :class:`datetime.datetime` from a ``windows`` FILETIME int"""
|
||||
return datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=filetime / 10)
|
||||
# Manual non-approx rounding as filetime will not have a perfect representation as Python float
|
||||
round_microsecond = (filetime / 10) + int(round((filetime % 10) / 10.0))
|
||||
return WINDOWS_EPOCH + datetime.timedelta(microseconds=round_microsecond)
|
||||
|
||||
def filetime_from_datetime(dtime):
|
||||
"""Return the FILETIME value from a :class:`datetime.datetime` in a python :class:`int`"""
|
||||
return int((dtime - datetime.datetime(1601,1,1)).total_seconds() * 1000) * 10000
|
||||
return int((dtime - WINDOWS_EPOCH).total_seconds()) * WIN_TICK_PER_SECOND_INT
|
||||
|
||||
|
||||
class FixedInteractiveConsole(code.InteractiveConsole):
|
||||
@@ -216,7 +232,6 @@ def get_kernel_modules_syswow64():
|
||||
|
||||
|
||||
# Split winutils.py ?
|
||||
|
||||
ntqueryinformationfile_info_structs = {
|
||||
gdef.FileAccessInformation: gdef.FILE_ACCESS_INFORMATION,
|
||||
gdef.FileAlignmentInformation: gdef.FILE_ALIGNMENT_INFORMATION,
|
||||
@@ -234,7 +249,10 @@ ntqueryinformationfile_info_structs = {
|
||||
gdef.FileIsRemoteDeviceInformation: gdef.FILE_IS_REMOTE_DEVICE_INFORMATION,
|
||||
}
|
||||
|
||||
def query_file_informations(handle, file_info_class):
|
||||
def query_file_information(file_or_handle, file_info_class):
|
||||
if isinstance(file_or_handle, file):
|
||||
file_or_handle = get_handle_from_file(file_or_handle)
|
||||
handle = file_or_handle
|
||||
io_status = gdef.IO_STATUS_BLOCK()
|
||||
info = ntqueryinformationfile_info_structs[file_info_class]()
|
||||
# Do helper for 'is_pointer' / get pointed_size & co ? (useful for winproxy)
|
||||
@@ -259,6 +277,49 @@ def query_file_informations(handle, file_info_class):
|
||||
return info
|
||||
|
||||
|
||||
ntqueryvolumeinformationfile_info_structs = {
|
||||
gdef.FileFsAttributeInformation: gdef.FILE_FS_ATTRIBUTE_INFORMATION,
|
||||
gdef.FileFsControlInformation: gdef.FILE_FS_CONTROL_INFORMATION,
|
||||
gdef.FileFsDeviceInformation: gdef.FILE_FS_DEVICE_INFORMATION,
|
||||
gdef.FileFsDriverPathInformation: gdef.FILE_FS_DRIVER_PATH_INFORMATION,
|
||||
gdef.FileFsFullSizeInformation: gdef.FILE_FS_FULL_SIZE_INFORMATION,
|
||||
gdef.FileFsObjectIdInformation: gdef.FILE_FS_OBJECTID_INFORMATION,
|
||||
gdef.FileFsSizeInformation: gdef.FILE_FS_SIZE_INFORMATION,
|
||||
gdef.FileFsVolumeInformation: gdef.FILE_FS_VOLUME_INFORMATION,
|
||||
gdef.FileFsSectorSizeInformation: gdef.FILE_FS_SECTOR_SIZE_INFORMATION,
|
||||
}
|
||||
|
||||
|
||||
# TODO: FileFsDriverPathInformation
|
||||
# TODO: Extended FILE_FS_VOLUME_INFORMATION that can read the real value of 'VolumeLabel'
|
||||
def query_volume_information(file_or_handle,volume_info_class):
|
||||
if isinstance(file_or_handle, file):
|
||||
file_or_handle = get_handle_from_file(file_or_handle)
|
||||
handle = file_or_handle
|
||||
io_status = gdef.IO_STATUS_BLOCK()
|
||||
info = ntqueryvolumeinformationfile_info_structs[volume_info_class]()
|
||||
# Do helper for 'is_pointer' / get pointed_size & co ? (useful for winproxy)
|
||||
pinfo = ctypes.pointer(info)
|
||||
try:
|
||||
windows.winproxy.NtQueryVolumeInformationFile(handle, io_status, pinfo, ctypes.sizeof(info), FsInformationClass=volume_info_class)
|
||||
except WindowsError as e:
|
||||
# import pdb;pdb.set_trace()
|
||||
if not (e.winerror & 0xffffffff) == gdef.STATUS_BUFFER_OVERFLOW:
|
||||
raise
|
||||
if volume_info_class == gdef.FileFsAttributeInformation:
|
||||
file_name_length = pinfo[0].FileSystemNameLength
|
||||
elif volume_info_class == gdef.FileFsVolumeInformation:
|
||||
file_name_length = pinfo[0].VolumeLabelLength
|
||||
else:
|
||||
raise
|
||||
full_size = ctypes.sizeof(info) + file_name_length # We add a little too much size for the sake of simplicity
|
||||
buffer = ctypes.c_buffer(full_size)
|
||||
windows.winproxy.NtQueryVolumeInformationFile(handle, io_status, buffer, full_size, FsInformationClass=volume_info_class)
|
||||
pinfo = ctypes.cast(buffer, ctypes.POINTER(ntqueryvolumeinformationfile_info_structs[volume_info_class]))
|
||||
info = pinfo[0]
|
||||
return info
|
||||
return info
|
||||
|
||||
# String stuff
|
||||
def ntstatus(code):
|
||||
return windows.generated_def.ntstatus.NtStatusException(code)
|
||||
|
||||
+51
-1
@@ -692,6 +692,8 @@ QueryDosDeviceW = TransparentKernel32Proxy("QueryDosDeviceW")
|
||||
GetVolumeNameForVolumeMountPointA = TransparentKernel32Proxy("GetVolumeNameForVolumeMountPointA")
|
||||
GetVolumeNameForVolumeMountPointW = TransparentKernel32Proxy("GetVolumeNameForVolumeMountPointW")
|
||||
|
||||
|
||||
|
||||
@Kernel32Proxy("GetVolumeInformationA")
|
||||
def GetVolumeInformationA(lpRootPathName, lpVolumeNameBuffer, nVolumeNameSize, lpVolumeSerialNumber, lpMaximumComponentLength, lpFileSystemFlags, lpFileSystemNameBuffer, nFileSystemNameSize):
|
||||
if nVolumeNameSize == 0 and lpVolumeNameBuffer is not None:
|
||||
@@ -710,6 +712,35 @@ def GetVolumeInformationW(lpRootPathName, lpVolumeNameBuffer=None, nVolumeNameSi
|
||||
return GetVolumeInformationW.ctypes_function(lpRootPathName, lpVolumeNameBuffer, nVolumeNameSize, lpVolumeSerialNumber, lpMaximumComponentLength, lpFileSystemFlags, lpFileSystemNameBuffer, nFileSystemNameSize)
|
||||
|
||||
|
||||
@Kernel32Proxy("FindFirstVolumeA")
|
||||
def FindFirstVolumeA(lpszVolumeName, cchBufferLength):
|
||||
if cchBufferLength is None:
|
||||
cchBufferLength = len(lpszVolumeName)
|
||||
return FindFirstVolumeA.ctypes_function(lpszVolumeName, cchBufferLength)
|
||||
|
||||
|
||||
@Kernel32Proxy("FindFirstVolumeW")
|
||||
def FindFirstVolumeW(lpszVolumeName, cchBufferLength):
|
||||
if cchBufferLength is None:
|
||||
cchBufferLength = len(lpszVolumeName)
|
||||
return FindFirstVolumeW.ctypes_function(lpszVolumeName, cchBufferLength)
|
||||
|
||||
|
||||
|
||||
@Kernel32Proxy("FindNextVolumeA")
|
||||
def FindNextVolumeA(hFindVolume, lpszVolumeName, cchBufferLength):
|
||||
if cchBufferLength is None:
|
||||
cchBufferLength = len(lpszVolumeName)
|
||||
return FindNextVolumeA.ctypes_function(hFindVolume, lpszVolumeName, cchBufferLength)
|
||||
|
||||
|
||||
@Kernel32Proxy("FindNextVolumeW")
|
||||
def FindNextVolumeW(hFindVolume, lpszVolumeName, cchBufferLength):
|
||||
if cchBufferLength is None:
|
||||
cchBufferLength = len(lpszVolumeName)
|
||||
return FindNextVolumeW.ctypes_function(hFindVolume, lpszVolumeName, cchBufferLength)
|
||||
|
||||
|
||||
@Kernel32Proxy("SetConsoleCtrlHandler")
|
||||
def SetConsoleCtrlHandler(HandlerRoutine, Add):
|
||||
return SetConsoleCtrlHandler.ctypes_function(HandlerRoutine, Add)
|
||||
@@ -957,12 +988,31 @@ def NtQueryDirectoryFile(FileHandle, Event=None, ApcRoutine=None, ApcContext=Non
|
||||
Length = ctypes.sizeof(FileInformation)
|
||||
return NtQueryDirectoryFile.ctypes_function(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, FileInformation, Length, FileInformationClass, ReturnSingleEntry, FileName, RestartScan)
|
||||
|
||||
@NtdllProxy("NtQueryVolumeInformationFile", error_ntstatus)
|
||||
def NtQueryVolumeInformationFile(FileHandle, IoStatusBlock, FsInformation, Length=None, FsInformationClass=NeededParameter):
|
||||
if Length is None:
|
||||
Length = ctypes.sizeof(FsInformation)
|
||||
return NtQueryVolumeInformationFile.ctypes_function(FileHandle, IoStatusBlock, FsInformation, Length, FsInformationClass)
|
||||
|
||||
|
||||
@NtdllProxy("RtlDecompressBuffer", error_ntstatus)
|
||||
def RtlDecompressBuffer(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize):
|
||||
def RtlDecompressBuffer(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize=None, FinalUncompressedSize=NeededParameter):
|
||||
if CompressedBufferSize is None:
|
||||
CompressedBufferSize = len(CompressedBuffer)
|
||||
return RtlDecompressBuffer.ctypes_function(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize)
|
||||
|
||||
@NtdllProxy("RtlDecompressBufferEx", error_ntstatus)
|
||||
def RtlDecompressBufferEx(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize=None, FinalUncompressedSize=NeededParameter, WorkSpace=NeededParameter):
|
||||
if CompressedBufferSize is None:
|
||||
CompressedBufferSize = len(CompressedBuffer)
|
||||
# TODO: automatic 'WorkSpace' size calc + allocation ?
|
||||
return RtlDecompressBufferEx.ctypes_function(CompressionFormat, UncompressedBuffer, UncompressedBufferSize, CompressedBuffer, CompressedBufferSize, FinalUncompressedSize, WorkSpace)
|
||||
|
||||
@NtdllProxy("RtlGetCompressionWorkSpaceSize", error_ntstatus)
|
||||
def RtlGetCompressionWorkSpaceSize(CompressionFormatAndEngine, CompressBufferWorkSpaceSize, CompressFragmentWorkSpaceSize):
|
||||
return RtlGetCompressionWorkSpaceSize.ctypes_function(CompressionFormatAndEngine, CompressBufferWorkSpaceSize, CompressFragmentWorkSpaceSize)
|
||||
|
||||
|
||||
|
||||
# Section stuff
|
||||
|
||||
|
||||
Reference in New Issue
Block a user