 Clement Rouault
|
3184cbdeab
|
MemBP has explicit event RWX, add GetProcessDEPPolicy, add Debugger API to disable/re-enable memory BP
|
2016-07-18 16:23:11 +02:00 |
|
|
Clement Rouault
|
9ebb25017b
|
Better message / WindowsError raised when process die during safe_execute_python
|
2016-07-18 14:04:37 +02:00 |
|
|
Clement Rouault
|
19205f73a1
|
Improve debugger handling of memBP for future use + fix MemBP prot init + add failing test of multitple BP with diff prot
|
2016-07-13 18:23:26 +02:00 |
|
|
Clement Rouault
|
82621b881a
|
Add get_memory_breakpoint_at to debugger + fix token_user in process + add prot param to virtual_alloc
|
2016-07-13 16:28:31 +02:00 |
|
|
Clement Rouault
|
d90e461bcf
|
Playing with advanced breakpoint
|
2016-07-13 13:54:42 +02:00 |
|
|
Clement Rouault
|
1f6ffd043c
|
Better implementation of MemoryBP
|
2016-07-13 13:50:44 +02:00 |
|
|
Clement Rouault
|
1590f634d7
|
Add ReadFile to winproxy
|
2016-07-13 10:11:05 +02:00 |
|
|
Clement Rouault
|
125888cd60
|
Add sample / test for memory breakpoint and single step
|
2016-07-13 10:10:12 +02:00 |
|
|
Clement Rouault
|
8bf3c0312c
|
Checking the beginning of the MemBP is important too...
|
2016-07-08 17:23:26 +02:00 |
|
|
Clement Rouault
|
400b7b91b0
|
First try at all BP remove + check range on MemBP for call to .trigger() else ignore
|
2016-07-08 17:18:57 +02:00 |
|
|
Clement Rouault
|
2f06e9e844
|
Commit <a l'arrache> for a quick implem of del_bp on standard BP
|
2016-07-08 16:21:57 +02:00 |
|
|
Clement Rouault
|
4069c0892a
|
Add com sample + update readme/todo
|
2016-07-08 13:58:05 +02:00 |
|
|
Clement Rouault
|
d2883e9c38
|
Add a sample on memoryBP + singlestep (cc Heurs :D)
|
2016-07-08 11:46:15 +02:00 |
|
|
Clement Rouault
|
fb9cd75f40
|
Add a sample for the debugger API
|
2016-07-08 11:37:49 +02:00 |
|
|
Clement Rouault
|
9a980d87b3
|
First try at single_step and memory breakpoints in Debugger + test
|
2016-07-07 17:43:28 +02:00 |
|
|
Clement Rouault
|
cf6c48b418
|
Remove some commented old code + fix read/write of REG_QWORD values in registry
|
2016-07-07 17:41:57 +02:00 |
|
|
Clement Rouault
|
b74d7a9e7e
|
Add Jmp/Call Far 16:32 in simple_x86 + clean and simplify syswow-to-64 execution
|
2016-07-07 13:16:36 +02:00 |
|
|
Clement Rouault
|
2d1f93da45
|
Add Debugger.attach + simple single_step implementation
|
2016-07-06 11:00:30 +02:00 |
|
|
Clement Rouault
|
886b445e0e
|
Token.integrity returns a Flag + fix simple_x64 on SIB use for [r13]
|
2016-07-04 18:33:35 +02:00 |
|
|
Clement Rouault
|
2f4eef23aa
|
Add NtCreateFile to winproxy
|
2016-07-04 18:32:36 +02:00 |
|
|
Clement Rouault
|
37de039b65
|
Improve ctypes generation + new struct/func/def for crypt32.dll
|
2016-07-01 18:13:09 +02:00 |
|
|
Clement Rouault
|
3069b93d21
|
Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum
|
2016-07-01 18:12:28 +02:00 |
|
|
Clement Rouault
|
c2e7b43b9f
|
Add R8 to ECONTEXT64
|
2016-07-01 17:06:20 +02:00 |
|
|
Clement Rouault
|
2526727931
|
Add __mul__ on Instruction + x64 on test_code
|
2016-06-29 15:07:14 +02:00 |
|
|
Clement Rouault
|
56b8264ffd
|
Add x64.assemble + sample test_code
|
2016-06-28 11:31:53 +02:00 |
|
|
Clement Rouault
|
ce7866cbf3
|
Improve x86.assemble for int + a demo of code tester
|
2016-06-28 11:03:57 +02:00 |
|
|
Clement Rouault
|
ed42580b4e
|
Fix some x64 encoding of [NEW_REG] | pop/push [RAX] doest not contains a useless prefix anymore
|
2016-06-27 14:51:47 +02:00 |
|
|
Clement Rouault
|
75c64e4490
|
Create usable API for sub ctypes generator
|
2016-06-24 16:57:21 +02:00 |
|
|
Clement Rouault
|
86fe9c9f82
|
Update generation for ntstatus and add a parallele define module to ApiProxy
|
2016-06-24 16:55:25 +02:00 |
|
|
Clement Rouault
|
75c48103c4
|
Added SetConsoleCtrlHandler to winproxy
|
2016-06-17 11:14:46 +02:00 |
|
|
Clement Rouault
|
4a0669ad41
|
Add COMImplementation
|
2016-06-17 10:18:12 +02:00 |
|
|
Clement Rouault
|
acdd3ac93e
|
new_generate.py replace old one
|
2016-06-16 15:45:18 +02:00 |
|
|
Clement Rouault
|
48f6eed961
|
Working on 'API' to easily import/use new_generate
|
2016-06-16 15:11:29 +02:00 |
|
|
Clement Rouault
|
4436be72c0
|
first working version of new_generate
|
2016-06-16 13:31:16 +02:00 |
|
|
Clement Rouault
|
e42dafee7c
|
working on cleaner generate.py
|
2016-06-16 11:16:33 +02:00 |
|
|
Clement Rouault
|
2289895423
|
Add test + fix Imm32 stuff in x64
|
2016-06-13 18:19:38 +02:00 |
|
|
Clement Rouault
|
0f5fce424b
|
Fix test_hook to disable the hook after test
|
2016-06-13 18:18:59 +02:00 |
|
|
Clement Rouault
|
0b32302591
|
Remove generate_callback_stub (only IATHook are impacted)
|
2016-06-09 18:51:48 +02:00 |
|
|
Clement Rouault
|
e1f7f1e500
|
execute_python doest not reinject the shellcode everytime + test hook 64b
|
2016-06-08 11:01:19 +02:00 |
|
|
Clement Rouault
|
f23357c13e
|
Testing hook without generated stub + new hook test in new file
|
2016-06-07 19:59:00 +02:00 |
|
|
Clement Rouault
|
bc9d3b61ef
|
Draft version of system handles
|
2016-06-07 17:13:44 +02:00 |
|
|
Clement Rouault
|
971610bbe3
|
[WIP] system.handles
|
2016-06-06 17:24:30 +02:00 |
|
|
Clement Rouault
|
3d51278039
|
fix UNICODE_STRING.str / test assemblers / improve com_parser for future work
|
2016-06-06 17:24:10 +02:00 |
|
|
Clement Rouault
|
899e6b9147
|
Removed a debug print
|
2016-05-23 09:48:00 +02:00 |
|
|
hakril
|
aaa680c61c
|
Fix CurrentProcessReadSyswow for windows10
|
2016-05-22 12:00:34 +02:00 |
|
|
Clement Rouault
|
976ce78455
|
First try to replace unexisting GetThreadId on XP
|
2016-05-20 18:03:36 +02:00 |
|
|
Clement Rouault
|
8bee07b8dc
|
Add REG_QWORD handling in registry.py
|
2016-05-19 10:59:43 +02:00 |
|
|
Clement Rouault
|
d09cb4ca51
|
Add winproxy.is_implemented
|
2016-05-18 10:54:58 +02:00 |
|
|
Clement Rouault
|
dfe8217259
|
Fix system.version_name on windows10
|
2016-05-13 16:31:07 +02:00 |
|
|
Clement Rouault
|
55c4721774
|
Fix exception stack update in LocalDebugger
|
2016-05-09 18:52:55 +02:00 |
|