mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Working on eventlog
This commit is contained in:
hakril
@@ -1,10 +1,5 @@
|
||||
TODO:
|
||||
|
||||
- Better WMI interface
|
||||
|
||||
- Process:
|
||||
- set/get WinProcess.priority
|
||||
|
||||
- DBG
|
||||
- Verif multiple bp at same place..
|
||||
- Verif multiple pending at same place
|
||||
@@ -24,10 +19,6 @@ TODO:
|
||||
- Ecrire un test et fix..
|
||||
|
||||
|
||||
- windows.alpc | windows.rpc
|
||||
- Clean + doc + samples
|
||||
|
||||
|
||||
- remotectypes
|
||||
- pretty sur I can get rid of PointerToStruct64/PointerToStruct32
|
||||
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
#define EVENTLOG_SUCCESS 0x0000
|
||||
#define EVENTLOG_ERROR_TYPE 0x0001
|
||||
#define EVENTLOG_WARNING_TYPE 0x0002
|
||||
#define EVENTLOG_INFORMATION_TYPE 0x0004
|
||||
#define EVENTLOG_AUDIT_SUCCESS 0x0008
|
||||
#define EVENTLOG_AUDIT_FAILURE 0x0010
|
||||
|
||||
|
||||
#define EVENTLOG_SEQUENTIAL_READ 0x0001
|
||||
#define EVENTLOG_SEEK_READ 0x0002
|
||||
#define EVENTLOG_FORWARDS_READ 0x0004
|
||||
#define EVENTLOG_BACKWARDS_READ 0x0008
|
||||
@@ -0,0 +1,46 @@
|
||||
HANDLE WINAPI OpenEventLogA(
|
||||
_In_ LPCSTR lpUNCServerName,
|
||||
_In_ LPCSTR lpSourceName
|
||||
);
|
||||
|
||||
HANDLE WINAPI OpenEventLogW(
|
||||
_In_ LPWSTR lpUNCServerName,
|
||||
_In_ LPWSTR lpSourceName
|
||||
);
|
||||
|
||||
BOOL WINAPI ReadEventLogA(
|
||||
_In_ HANDLE hEventLog,
|
||||
_In_ DWORD dwReadFlags,
|
||||
_In_ DWORD dwRecordOffset,
|
||||
_Out_ LPVOID lpBuffer,
|
||||
_In_ DWORD nNumberOfBytesToRead,
|
||||
_Out_ DWORD *pnBytesRead,
|
||||
_Out_ DWORD *pnMinNumberOfBytesNeeded
|
||||
);
|
||||
|
||||
BOOL WINAPI ReadEventLogW(
|
||||
_In_ HANDLE hEventLog,
|
||||
_In_ DWORD dwReadFlags,
|
||||
_In_ DWORD dwRecordOffset,
|
||||
_Out_ LPVOID lpBuffer,
|
||||
_In_ DWORD nNumberOfBytesToRead,
|
||||
_Out_ DWORD *pnBytesRead,
|
||||
_Out_ DWORD *pnMinNumberOfBytesNeeded
|
||||
);
|
||||
|
||||
BOOL WINAPI GetEventLogInformation(
|
||||
_In_ HANDLE hEventLog,
|
||||
_In_ DWORD dwInfoLevel,
|
||||
_Out_ LPVOID lpBuffer,
|
||||
_In_ DWORD cbBufSize,
|
||||
_Out_ LPDWORD pcbBytesNeeded
|
||||
);
|
||||
|
||||
BOOL WINAPI GetNumberOfEventLogRecords(
|
||||
_In_ HANDLE hEventLog,
|
||||
_Out_ PDWORD NumberOfRecords
|
||||
);
|
||||
|
||||
BOOL WINAPI CloseEventLog(
|
||||
_Inout_ HANDLE hEventLog
|
||||
);
|
||||
@@ -0,0 +1,22 @@
|
||||
typedef struct _EVENTLOGRECORD {
|
||||
DWORD Length;
|
||||
DWORD Reserved;
|
||||
DWORD RecordNumber;
|
||||
DWORD TimeGenerated;
|
||||
DWORD TimeWritten;
|
||||
DWORD EventID;
|
||||
WORD EventType;
|
||||
WORD NumStrings;
|
||||
WORD EventCategory;
|
||||
WORD ReservedFlags;
|
||||
DWORD ClosingRecordNumber;
|
||||
DWORD StringOffset;
|
||||
DWORD UserSidLength;
|
||||
DWORD UserSidOffset;
|
||||
DWORD DataLength;
|
||||
DWORD DataOffset;
|
||||
} EVENTLOGRECORD, *PEVENTLOGRECORD;
|
||||
|
||||
typedef struct _EVENTLOG_FULL_INFORMATION {
|
||||
DWORD dwFull;
|
||||
} EVENTLOG_FULL_INFORMATION, *LPEVENTLOG_FULL_INFORMATION;
|
||||
@@ -782,16 +782,19 @@ defs_with_ntstatus = InitialDefGenerator(from_here("definitions\\windef.txt"), f
|
||||
defs_with_ntstatus.append_input_file(from_here("definitions\\wintrust_crypt_def.txt"))
|
||||
defs_with_ntstatus.append_input_file(from_here("definitions\\windef_error.txt"))
|
||||
defs_with_ntstatus.append_input_file(from_here("definitions\\custom_rpc_windef.txt"))
|
||||
defs_with_ntstatus.append_input_file(from_here("definitions\\windef_evtlog.txt"))
|
||||
|
||||
|
||||
structs = StructGenerator(from_here("definitions\\winstruct.txt"), from_here(r"..\windows\generated_def\\winstructs.py"), dependances=[defs_with_ntstatus])
|
||||
structs.append_input_file(from_here("definitions\\display_struct.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_bits.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_alpc.txt"))
|
||||
structs.append_input_file(from_here("definitions\\winstruct_evtlog.txt"))
|
||||
|
||||
functions = FuncGenerator(from_here("definitions\\winfunc.txt"), from_here(r"..\windows\generated_def\\winfuncs.py"), dependances=[structs])
|
||||
functions.append_input_file(from_here("definitions\\winfunc_crypto_wintrust.txt"))
|
||||
functions.append_input_file(from_here("definitions\\winfunc_notdoc.txt"))
|
||||
functions.append_input_file(from_here("definitions\\winfunc_evtlog.txt"))
|
||||
|
||||
com = InitialCOMGenerator(from_here("definitions\\com\\*.txt"), DEFAULT_INTERFACE_TO_IID, from_here(r"..\windows\generated_def\\interfaces.py"), dependances=[structs, defs_with_ntstatus])
|
||||
|
||||
|
||||
@@ -1907,3 +1907,13 @@ Windef
|
||||
.. autodata:: BIND_IF_SYNTAX_NDR32
|
||||
.. autodata:: BIND_IF_SYNTAX_NDR64
|
||||
.. autodata:: BIND_IF_SYNTAX_UNKNOWN
|
||||
.. autodata:: EVENTLOG_SUCCESS
|
||||
.. autodata:: EVENTLOG_ERROR_TYPE
|
||||
.. autodata:: EVENTLOG_WARNING_TYPE
|
||||
.. autodata:: EVENTLOG_INFORMATION_TYPE
|
||||
.. autodata:: EVENTLOG_AUDIT_SUCCESS
|
||||
.. autodata:: EVENTLOG_AUDIT_FAILURE
|
||||
.. autodata:: EVENTLOG_SEQUENTIAL_READ
|
||||
.. autodata:: EVENTLOG_SEEK_READ
|
||||
.. autodata:: EVENTLOG_FORWARDS_READ
|
||||
.. autodata:: EVENTLOG_BACKWARDS_READ
|
||||
|
||||
@@ -10912,6 +10912,113 @@ _RPC_IF_ID
|
||||
|
||||
:class:`USHORT`
|
||||
|
||||
_EVENTLOGRECORD
|
||||
'''''''''''''''
|
||||
.. class:: PEVENTLOGRECORD
|
||||
|
||||
Pointer to :class:`_EVENTLOGRECORD`
|
||||
|
||||
.. class:: EVENTLOGRECORD
|
||||
|
||||
Alias for :class:`_EVENTLOGRECORD`
|
||||
|
||||
.. class:: _EVENTLOGRECORD
|
||||
|
||||
.. attribute:: Length
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: Reserved
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: RecordNumber
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: TimeGenerated
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: TimeWritten
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: EventID
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: EventType
|
||||
|
||||
:class:`WORD`
|
||||
|
||||
|
||||
.. attribute:: NumStrings
|
||||
|
||||
:class:`WORD`
|
||||
|
||||
|
||||
.. attribute:: EventCategory
|
||||
|
||||
:class:`WORD`
|
||||
|
||||
|
||||
.. attribute:: ReservedFlags
|
||||
|
||||
:class:`WORD`
|
||||
|
||||
|
||||
.. attribute:: ClosingRecordNumber
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: StringOffset
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: UserSidLength
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: UserSidOffset
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: DataLength
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
|
||||
.. attribute:: DataOffset
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
_EVENTLOG_FULL_INFORMATION
|
||||
''''''''''''''''''''''''''
|
||||
.. class:: EVENTLOG_FULL_INFORMATION
|
||||
|
||||
Alias for :class:`_EVENTLOG_FULL_INFORMATION`
|
||||
|
||||
.. class:: LPEVENTLOG_FULL_INFORMATION
|
||||
|
||||
Pointer to :class:`_EVENTLOG_FULL_INFORMATION`
|
||||
|
||||
.. class:: _EVENTLOG_FULL_INFORMATION
|
||||
|
||||
.. attribute:: dwFull
|
||||
|
||||
:class:`DWORD`
|
||||
|
||||
WinEnums
|
||||
--------
|
||||
_SYSTEM_INFORMATION_CLASS
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1962,4 +1962,14 @@ RPC_RESPONSE_TYPE_FAIL = make_flag("RPC_RESPONSE_TYPE_FAIL", 2)
|
||||
RPC_RESPONSE_TYPE_SUCCESS = make_flag("RPC_RESPONSE_TYPE_SUCCESS", 3)
|
||||
BIND_IF_SYNTAX_NDR32 = make_flag("BIND_IF_SYNTAX_NDR32", 1)
|
||||
BIND_IF_SYNTAX_NDR64 = make_flag("BIND_IF_SYNTAX_NDR64", 2)
|
||||
BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4)
|
||||
BIND_IF_SYNTAX_UNKNOWN = make_flag("BIND_IF_SYNTAX_UNKNOWN", 4)
|
||||
EVENTLOG_SUCCESS = make_flag("EVENTLOG_SUCCESS", 0x0000)
|
||||
EVENTLOG_ERROR_TYPE = make_flag("EVENTLOG_ERROR_TYPE", 0x0001)
|
||||
EVENTLOG_WARNING_TYPE = make_flag("EVENTLOG_WARNING_TYPE", 0x0002)
|
||||
EVENTLOG_INFORMATION_TYPE = make_flag("EVENTLOG_INFORMATION_TYPE", 0x0004)
|
||||
EVENTLOG_AUDIT_SUCCESS = make_flag("EVENTLOG_AUDIT_SUCCESS", 0x0008)
|
||||
EVENTLOG_AUDIT_FAILURE = make_flag("EVENTLOG_AUDIT_FAILURE", 0x0010)
|
||||
EVENTLOG_SEQUENTIAL_READ = make_flag("EVENTLOG_SEQUENTIAL_READ", 0x0001)
|
||||
EVENTLOG_SEEK_READ = make_flag("EVENTLOG_SEEK_READ", 0x0002)
|
||||
EVENTLOG_FORWARDS_READ = make_flag("EVENTLOG_FORWARDS_READ", 0x0004)
|
||||
EVENTLOG_BACKWARDS_READ = make_flag("EVENTLOG_BACKWARDS_READ", 0x0008)
|
||||
File diff suppressed because one or more lines are too long
@@ -1059,23 +1059,6 @@ PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
||||
INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
||||
|
||||
class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING):
|
||||
@property
|
||||
def str(self):
|
||||
"""The python string of the LSA_UNICODE_STRING object
|
||||
|
||||
:type: :class:`unicode`
|
||||
"""
|
||||
if not self.Length:
|
||||
return ""
|
||||
if getattr(self, "_target", None) is not None: # remote ctypes :D -> TRICKS OF THE YEAR
|
||||
# raw_data = self._target.read_memory(self.Buffer, self.Length)
|
||||
buffer_ptr = self._target.read_ptr(self._base_addr + type(self).Buffer.offset)
|
||||
raw_data = self._target.read_memory(buffer_ptr, self.Length)
|
||||
return raw_data.decode("utf16")
|
||||
size = self.Length / 2
|
||||
buffer_ptr = PVOID.from_address(ctypes.addressof(self) + type(self).Buffer.offset).value
|
||||
return (ctypes.c_wchar * size).from_address(buffer_ptr)[:]
|
||||
|
||||
@property
|
||||
def str(self):
|
||||
"""The python string of the LSA_UNICODE_STRING object
|
||||
@@ -4504,3 +4487,32 @@ class _RPC_IF_ID(INITIAL_RPC_IF_ID):
|
||||
def __repr__(self):
|
||||
return '<RPC_IF_ID "{0}" ({1}, {2})>'.format(self.Uuid.to_string(), self.VersMajor, self.VersMinor)
|
||||
RPC_IF_ID = _RPC_IF_ID
|
||||
|
||||
class _EVENTLOGRECORD(Structure):
|
||||
_fields_ = [
|
||||
("Length", DWORD),
|
||||
("Reserved", DWORD),
|
||||
("RecordNumber", DWORD),
|
||||
("TimeGenerated", DWORD),
|
||||
("TimeWritten", DWORD),
|
||||
("EventID", DWORD),
|
||||
("EventType", WORD),
|
||||
("NumStrings", WORD),
|
||||
("EventCategory", WORD),
|
||||
("ReservedFlags", WORD),
|
||||
("ClosingRecordNumber", DWORD),
|
||||
("StringOffset", DWORD),
|
||||
("UserSidLength", DWORD),
|
||||
("UserSidOffset", DWORD),
|
||||
("DataLength", DWORD),
|
||||
("DataOffset", DWORD),
|
||||
]
|
||||
PEVENTLOGRECORD = POINTER(_EVENTLOGRECORD)
|
||||
EVENTLOGRECORD = _EVENTLOGRECORD
|
||||
|
||||
class _EVENTLOG_FULL_INFORMATION(Structure):
|
||||
_fields_ = [
|
||||
("dwFull", DWORD),
|
||||
]
|
||||
EVENTLOG_FULL_INFORMATION = _EVENTLOG_FULL_INFORMATION
|
||||
LPEVENTLOG_FULL_INFORMATION = POINTER(_EVENTLOG_FULL_INFORMATION)
|
||||
|
||||
@@ -1176,6 +1176,36 @@ def CreateProcessAsUserW(hToken, lpApplicationName, lpCommandLine, lpProcessAttr
|
||||
return CreateProcessAsUserW.ctypes_function(hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
|
||||
|
||||
|
||||
# Event log stuff
|
||||
|
||||
@Advapi32Proxy('OpenEventLogA')
|
||||
def OpenEventLogA(lpUNCServerName=None, lpSourceName=NeededParameter):
|
||||
return OpenEventLogA.ctypes_function(lpUNCServerName, lpSourceName)
|
||||
|
||||
@Advapi32Proxy('OpenEventLogW')
|
||||
def OpenEventLogW(lpUNCServerName=None, lpSourceName=NeededParameter):
|
||||
return OpenEventLogW.ctypes_function(lpUNCServerName, lpSourceName)
|
||||
|
||||
@Advapi32Proxy('ReadEventLogA')
|
||||
def ReadEventLogA(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded):
|
||||
return ReadEventLogA.ctypes_function(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded)
|
||||
|
||||
@Advapi32Proxy('ReadEventLogW')
|
||||
def ReadEventLogW(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded):
|
||||
return ReadEventLogW.ctypes_function(hEventLog, dwReadFlags, dwRecordOffset, lpBuffer, nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded)
|
||||
|
||||
@Advapi32Proxy('GetEventLogInformation')
|
||||
def GetEventLogInformation(hEventLog, dwInfoLevel, lpBuffer, cbBufSize, pcbBytesNeeded):
|
||||
return GetEventLogInformation.ctypes_function(hEventLog, dwInfoLevel, lpBuffer, cbBufSize, pcbBytesNeeded)
|
||||
|
||||
@Advapi32Proxy('GetNumberOfEventLogRecords')
|
||||
def GetNumberOfEventLogRecords(hEventLog, NumberOfRecords):
|
||||
return GetNumberOfEventLogRecords.ctypes_function(hEventLog, NumberOfRecords)
|
||||
|
||||
@Advapi32Proxy('CloseEventLog')
|
||||
def CloseEventLog(hEventLog):
|
||||
return CloseEventLog.ctypes_function(hEventLog)
|
||||
|
||||
# ##### Iphlpapi (network list and stuff) ###### #
|
||||
|
||||
def set_tcp_entry_error_check(func_name, result, func, args):
|
||||
|
||||
Reference in New Issue
Block a user