 hakril
|
6fd32762da
|
Try improving CurrentProcessReadSyswow stability
|
2025-02-02 16:54:23 +01:00 |
|
|
hakril
|
d7cf3e0f8b
|
Fix CurrentThread.teb_base being a property and not a fixedproperty
|
2025-02-01 14:22:02 +01:00 |
|
|
hakril
|
f7542e686c
|
More teb64 fix
|
2025-02-01 11:34:09 +01:00 |
|
|
hakril
|
029f7cba35
|
More TEB syswow fix
|
2025-01-31 17:37:07 +01:00 |
|
|
hakril
|
36c1eb647f
|
Fix WinThread.teb_syswow
|
2025-01-31 17:13:33 +01:00 |
|
|
hakril
|
4bbdb538de
|
Add support for remote TEB + tests
|
2025-01-31 17:00:04 +01:00 |
|
|
hakril
|
6ccccf7e90
|
V1 of WinThread.teb
|
2025-01-31 13:46:11 +01:00 |
|
|
hakril
|
13c28422d4
|
process improv : bitness based on PVOID size + CurrentProcess.name based on GetProcessImageFileNameW + peb addr based on RtlGetCurrentPeb
|
2025-01-31 13:46:11 +01:00 |
|
|
hakril
|
92b3cfcb2b
|
Adapt sample + docs for microsoft-store-python-injection
|
2025-01-28 19:45:36 +01:00 |
|
|
Darius Houle
|
082b13112d
|
missed docstring*
|
2025-01-26 23:46:19 -07:00 |
|
|
Darius Houle
|
52859d19c4
|
feedback revisions
|
2025-01-26 23:38:50 -07:00 |
|
|
hakril
|
13dc869af6
|
Add unicode tests + comments
|
2024-06-05 22:47:26 +02:00 |
|
|
hakril
|
33766c2ffd
|
Working on WinAPI Wide-transition
|
2024-06-05 22:43:30 +02:00 |
|
|
hakril
|
9eb4405cce
|
Passed process relation API to Wide functions
|
2024-06-05 22:43:30 +02:00 |
|
|
hakril
|
e3bcde7d63
|
Add github actions for pytest CI (#48)
Integration of github CI testing workflows for python2.7 / 3.6 & 3.11 + Fix some tests & code failing
|
2024-05-14 18:44:04 +02:00 |
|
|
clement rouault
|
d7d2dacf33
|
Fixed thread.teb_base + add thread.teb_syswow_base for TEB64 of Syswow process
|
2022-08-05 11:30:45 +02:00 |
|
|
clement rouault
|
447069df32
|
Process listing now use Wide API (process name is still temporary a ascii string with backslashreplace)
|
2022-02-07 17:10:54 +01:00 |
|
|
clement rouault
|
8b90c96c1a
|
utils.create_process now use CreateProcessW for simpler py3 usage + fix code in WinProcess.read_[w]string + associated tests
|
2021-07-13 13:22:50 +02:00 |
|
|
clement rouault
|
fb9ff96a11
|
Fixed current_process.read_string/wstring for page end + tests
|
2021-06-22 19:03:35 +02:00 |
|
|
clement rouault
|
3149961634
|
Retrieving process ppid now use limited_handle, allowed more case of sucessful retrieval
|
2021-03-05 16:37:48 +01:00 |
|
|
hakril
|
466d94c03c
|
Fixed broken basestring for py3 compatibility (see issue #15)
|
2020-05-02 23:12:25 +02:00 |
|
|
hakril
|
4d3b3e18ad
|
Lot of small py3 compat fix
|
2020-02-13 22:23:20 +01:00 |
|
|
hakril
|
6a74c83670
|
test_process pass for python3 + added some pe_parse test
|
2020-02-07 23:06:26 +01:00 |
|
|
hakril
|
15f399df6d
|
Still playing with security-descriptor / SACL / required rights (MAXIMUM_ALLOWED does not work)
|
2019-06-28 10:34:20 +02:00 |
|
|
hakril
|
b628ca336b
|
Working on api to set security descriptor
|
2019-06-28 09:38:35 +02:00 |
|
|
hakril
|
44e5a09564
|
Few improvement in existing API + test of Winprocess.handles
|
2019-01-22 15:06:23 +01:00 |
|
|
hakril
|
db44087bba
|
Refactor thread code for simple token retrieving on Process/Thread objects
|
2018-12-21 16:07:10 +01:00 |
|
|
hakril
|
460274d532
|
Process object now return new Token object (still WIP)
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
e46dc48c37
|
Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
967c18d521
|
Added POC WinProcess.memory_info + some crypto defines
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
05e7b755b0
|
Fix CurrentProcess read/write memory to use ctypes.memmove -> raise on bad address -> no more segv
|
2018-05-12 00:13:57 +02:00 |
|
|
hakril
|
34c2d94bc2
|
Some fixes in code/samples/test
|
2018-03-27 20:37:30 +02:00 |
|
|
hakril
|
8840b9fdb9
|
updated doc
|
2018-03-07 10:24:46 +01:00 |
|
|
hakril
|
4499080a77
|
Remote load library now use LoadLibraryW and get_mapped_filename use GetMappedFileNameW: return unicode str in every case
|
2018-02-07 13:14:25 +01:00 |
|
|
hakril
|
f682fbd8c1
|
Add transaction + window APIs to winproxy + get_mapped_filename raise on non-standard error (like aborted transaction)
|
2018-01-26 11:05:53 +01:00 |
|
|
hakril
|
4251b18041
|
Fix ctypes generation + COM interface dependance check + add IPersistFile, IShellLink, strucs/defs
|
2018-01-25 16:51:04 +01:00 |
|
|
hakril
|
23837a0713
|
Improving volume objects + adding CurrentProcess.peb.apisetmap with ApiSetMap parsing capabilities
|
2017-12-04 10:12:41 +01:00 |
|
|
hakril
|
c135780ba9
|
Add Process.virtual_protect default value for 'old_protect' + add test for Improved LSA_UNICODE_STRING used in PEB.ProcessParameters + find_value now search in ntstatus values
|
2017-11-24 17:46:07 +01:00 |
|
|
Clement Rouault
|
d12bae6dbb
|
Remove 'WinUnicodeString' and add un extended struct _LSA_UNICODE_STRING: simplify lots of things
|
2017-11-17 15:13:34 +01:00 |
|
|
Clement Rouault
|
4e5733c2c5
|
Process.prioroty now use the FlagMapper
|
2017-11-10 14:20:59 +01:00 |
|
|
Clement Rouault
|
8ba325afd2
|
Add a new FlagMapper to easily transform int to Flag and change to code use it
|
2017-11-10 13:47:27 +01:00 |
|
|
Clement Rouault
|
4efae2194d
|
Adding Process.priority + fix in WMI raised exceptions + add x86.Iret
|
2017-11-10 11:12:24 +01:00 |
|
|
Clement Rouault
|
5a79e15440
|
Improve WMI capabilities by adding access to various namespaces + listing methods + add CurrentProcess.load_library
|
2017-11-08 17:55:47 +01:00 |
|
|
Clement Rouault
|
7947ace02d
|
Add alpc[Client|Server] __del__ to close handles + NtAlpcDisconnectPort + test
|
2017-09-15 17:54:19 +02:00 |
|
|
Clement Rouault
|
e9c62a125c
|
add system.build_number + better handling of closing python in Winprocess.__del__
|
2017-08-17 18:49:42 +02:00 |
|
|
Clement Rouault
|
c76a50c045
|
add doc to alpc.py + improve doc now that Winstruct are documented
|
2017-08-16 17:38:18 +02:00 |
|
|
Clement Rouault
|
d1cadf062a
|
working on windows.alpc + fix in current_process.threads
|
2017-08-04 17:18:41 +02:00 |
|
|
Clement Rouault
|
aff6ee4e17
|
replace PORT_MESSAGE struct def with PORT_MESSAGE[32|64] + FunctionBP can get the function via a class parameter
|
2017-06-21 13:16:22 +02:00 |
|
|
hakril
|
1a7e342318
|
Add Winprocess.limited_handle for QUERY_LIMITED_INFORMATION api call
|
2017-06-07 20:00:37 +02:00 |
|
|
Clement Rouault
|
3c21d8c59c
|
token.integrity is now settable
|
2017-05-24 17:43:34 +02:00 |
|