admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adapte get_peb code to use simple_x86/64 with new prefix feature

Browse Source
This commit is contained in:
Clement Rouault
2015-09-18 15:41:12 +02:00
parent a7cc77dece
commit f7684913f4
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
winobject.py
+15 -11
View File
@@ -235,14 +235,19 @@ class CurrentThread(AutoHandle):
class CurrentProcess(Process):
"""The current process"""
get_peb = None
get_peb_32_code = codecs.decode(b'64a130000000c3', 'hex')
# mov rax,QWORD PTR gs:0x60
# ret
get_peb_64_code = codecs.decode(b"65488B042560000000C3", 'hex')
get_peb_32_code = x86.MultipleInstr()
get_peb_32_code += x86.Mov('EAX', x86.mem('fs:[0x30]'))
get_peb_32_code += x86.Ret()
get_peb_32_code = get_peb_32_code.get_code()
get_peb_64_code = x64.MultipleInstr()
get_peb_64_code += x64.Mov('RAX', x64.mem('gs:[0x60]'))
get_peb_64_code += x64.Ret()
get_peb_64_code = get_peb_64_code.get_code()
allocator = native_exec.native_function.allocator
def get_peb_builtin(self):
if self.get_peb is not None:
return self.get_peb
@@ -426,15 +431,14 @@ class WinProcess(PROCESSENTRY32, Process):
return injection.execute_python_code(self, pycode)
def get_peb_addr(self):
get_peb_32_code = codecs.decode(b'64a130000000', 'hex')
get_peb_64_code = codecs.decode(b"65488B042560000000", 'hex')
dest = self.virtual_alloc(0x1000)
if self.bitness == 32:
get_peb_code = get_peb_32_code
#get_peb_code = get_peb_32_code
store_peb = x86.MultipleInstr()
store_peb += x86.Mov('EAX', x86.mem('fs:[0x30]'))
store_peb += x86.Mov(x86.create_displacement(disp=dest), 'EAX')
store_peb += x86.Ret()
get_peb_code += store_peb.get_code()
get_peb_code = store_peb.get_code()
self.write_memory(dest, "\x00" * 4)
self.write_memory(dest + 4, get_peb_code)
self.create_thread(dest + 4, 0)
@@ -442,11 +446,11 @@ class WinProcess(PROCESSENTRY32, Process):
peb_addr = struct.unpack("<I", self.read_memory(dest, 4))[0]
return peb_addr
else:
get_peb_code = get_peb_64_code
store_peb = x64.MultipleInstr()
store_peb += x64.Mov('RAX', x64.mem('gs:[0x60]'))
store_peb += x64.Mov(x64.create_displacement(disp=dest), 'RAX')
store_peb += x64.Ret()
get_peb_code += store_peb.get_code()
get_peb_code = store_peb.get_code()
self.write_memory(dest, "\x00" * 8)
self.write_memory(dest + 8, get_peb_code)
self.create_thread(dest + 8, 0)