diff --git a/CHANGELOG b/CHANGELOG index 9ea76b0..1193aa8 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -8,4 +8,6 @@ Since 0.2: * Object returned by `windows.native_exec.create_function` has an attribute `code_addr` with the address of the executable code * add `windows.winproxy.is_implemented` Ex: windows.winproxy.is_implemented(windows.winproxy.QueryWorkingSetEx) * registry.py handle REG_QWORD manually (_winreg does not) - * CurrentProcessReadSyswow doest not use ``current_process.handle`` anymore but ``OpenProcess(current_process.pid)`` (Compat windows10 where method 1 doest not work) \ No newline at end of file + * CurrentProcessReadSyswow doest not use ``current_process.handle`` anymore but ``OpenProcess(current_process.pid)`` (Compat windows10 where method 1 doest not work) + * Add: system.handles (winobject\handle.py) + * You can have multiple execute_python_unsafe at the same time in the same process (didn't know: consequence of new injection code) \ No newline at end of file diff --git a/TODO b/TODO index b05905b..273ce42 100644 --- a/TODO +++ b/TODO @@ -14,6 +14,7 @@ TODO: - Threading - Quid IAT hook stub ? just einit threads and remove this ? + - Continue test with new generate_callback_stub and remove commented code if it works - Injection - code generated by generate_python_exec_shellcode_64[32] may be reused diff --git a/windows/injection.py b/windows/injection.py index 8641493..11e62fa 100644 --- a/windows/injection.py +++ b/windows/injection.py @@ -115,6 +115,7 @@ def load_dll_in_remote_process(target, dll_name): # Hardcore mode # We don't have k32 or PEB->Ldr # Go inject a GetProcAddress(LoadLib) + LoadLib shellcode :D + dbgprint("DLL Via manual getproc / loadlib", "DLLINJECT") if target.bitness == 32: return perform_manual_getproc_loadlib_32(target, dll_name) return perform_manual_getproc_loadlib_64(target, dll_name) diff --git a/windows/native_exec/native_function.py b/windows/native_exec/native_function.py index d1806fa..6812298 100644 --- a/windows/native_exec/native_function.py +++ b/windows/native_exec/native_function.py @@ -271,11 +271,15 @@ def generate_stub_64(callback): def generate_callback_stub(callback, types): func_type = ctypes.WINFUNCTYPE(*types) c_callable = func_type(callback) - if windows.current_process.bitness == 32: - stub = generate_stub_32(c_callable) - else: - stub = generate_stub_64(c_callable) - stub_addr = allocator.write_code(stub.get_code()) + + + stub = c_callable + stub_addr = ctypes.cast(c_callable, ctypes.c_void_p).value + # if windows.current_process.bitness == 32: + # stub = generate_stub_32(c_callable) + # else: + # stub = generate_stub_64(c_callable) + # stub_addr = allocator.write_code(stub.get_code()) generate_callback_stub.l.append((stub, c_callable)) return stub_addr diff --git a/windows/test/__init__.py b/windows/test/__init__.py index 83ef26d..10700f0 100644 --- a/windows/test/__init__.py +++ b/windows/test/__init__.py @@ -1,3 +1,8 @@ -from mytest import WindowsTestCase, WindowsAPITestCase, DebuggerTestCase, NativeUtilsTestCase, SystemTestCase, pop_calc_32, pop_calc_64, Calc32, Calc64 -__all__ = ["SystemTestCase", "WindowsTestCase", "WindowsAPITestCase", "DebuggerTestCase", "NativeUtilsTestCase"] +from test_utils import * + +from mytest import WindowsTestCase, WindowsAPITestCase, DebuggerTestCase, NativeUtilsTestCase, SystemTestCase +from test_hooks import HookTestCase + + +__all__ = ["SystemTestCase", "WindowsTestCase", "WindowsAPITestCase", "DebuggerTestCase", "NativeUtilsTestCase", "HookTestCase"] diff --git a/windows/test/mytest.py b/windows/test/mytest.py index f1f5e8d..da7a0ac 100644 --- a/windows/test/mytest.py +++ b/windows/test/mytest.py @@ -4,70 +4,10 @@ import time import os import textwrap import random -from contextlib import contextmanager - -sys.path.append(".") -import unittest -import windows -import windows.debug -import windows.native_exec.simple_x86 as x86 -import windows.native_exec.simple_x64 as x64 -import windows.native_exec.nativeutils as nativeutils +from test_utils import * from windows.generated_def.winstructs import * -from windows.native_exec.nativeutils import GetProcAddress64, GetProcAddress32 - - -is_process_32_bits = windows.current_process.bitness == 32 -is_process_64_bits = windows.current_process.bitness == 64 - -is_windows_32_bits = windows.system.bitness == 32 -is_windows_64_bits = windows.system.bitness == 64 - -windows_32bit_only = unittest.skipIf(not is_windows_32_bits, "Test for 32bits Kernel only") -windows_64bit_only = unittest.skipIf(not is_windows_64_bits, "Test for 64bits Kernel only") - -process_32bit_only = unittest.skipIf(not is_process_32_bits, "Test for 32bits process only") -process_64bit_only = unittest.skipIf(not is_process_64_bits, "Test for 64bits process only") - - -if is_windows_32_bits: - def pop_calc_32(dwCreationFlags=0): - return windows.utils.create_process(r"C:\Windows\system32\calc.exe", dwCreationFlags=dwCreationFlags, show_windows=True) - - def pop_calc_64(dwCreationFlags=0): - raise WindowsError("Cannot create calc64 in 32bits system") -else: - def pop_calc_32(dwCreationFlags=0): - return windows.utils.create_process(r"C:\Windows\syswow64\calc.exe", dwCreationFlags=dwCreationFlags, show_windows=True) - - if is_process_32_bits: - def pop_calc_64(dwCreationFlags=0): - with windows.utils.DisableWow64FsRedirection(): - return windows.utils.create_process(r"C:\Windows\system32\calc.exe", dwCreationFlags=dwCreationFlags, show_windows=True) - else: - def pop_calc_64(dwCreationFlags=0): - return windows.utils.create_process(r"C:\Windows\system32\calc.exe", dwCreationFlags=dwCreationFlags, show_windows=True) - - -@contextmanager -def Calc64(dwCreationFlags=0, exit_code=0): - try: - calc = pop_calc_64(dwCreationFlags) - yield calc - finally: - if "calc" in locals(): - calc.exit(exit_code) - -@contextmanager -def Calc32(dwCreationFlags=0, exit_code=0): - try: - calc = pop_calc_32(dwCreationFlags) - yield calc - finally: - if "calc" in locals(): - calc.exit(exit_code) class SystemTestCase(unittest.TestCase): def test_version(self): @@ -307,40 +247,6 @@ class WindowsTestCase(unittest.TestCase): dword = struct.unpack("