91ef7da2e1
[event_log] Fix typo in wevtutil
2019-10-14 22:03:49 +02:00
8a14fe9174
[event_log] add realtime logger to wevtutil
2019-10-14 22:03:49 +02:00
4f92323abf
[event log] export message_id instead of message_name
...
It's more consistent with the other classes
2019-10-14 22:03:49 +02:00
44d9d0dd35
[event log] Add example of what can be done with events
2019-10-14 22:03:49 +02:00
6dd314659d
[event log] adding event channel metadata message ID
2019-10-14 22:03:49 +02:00
adb7d3b63a
[event log] adding event metadata
2019-10-14 22:03:49 +02:00
b5371ddf33
[event log] still adding publisher metadata
2019-10-14 22:03:49 +02:00
4495eca6d0
[event log] add some more metadata
2019-10-14 22:03:49 +02:00
df28515b97
[event log] Expose message filename
2019-10-14 22:03:49 +02:00
6374f91fef
[event log] Expose channel metadatas
2019-10-14 22:03:49 +02:00
6125a1fb15
[event_trace] Add a way to pass a Python object to an ETW trace's
...
context
It may be useful to pass a python object (e.g. class) to the ETW
processing callback. The ETW tracing API allows the user to fill out a
"Context" field with a pointer value that will be passed to the event
being sent, the rest is ctypes magic for wrapping the python object
into a native pointer value.
2019-10-14 22:03:49 +02:00
bfeb2e6dec
[event_log] Configure an ETW trace to listen on specific keywords
...
By default EnableTrace will listen with a "KeywordsAny" value of
0xffffffff. Some event log providers send events with keywords over
0x100000000, so we need a mecanism to filter on thoses keywords.
2019-10-14 22:03:49 +02:00
536a60c040
[event log] Expose event keywords and publisher guid
...
Accessing the publisher guid is useful to setup an ETW trace, and we
need to know event keywords in order to activate the ETW session on the
correct "channels".
2019-10-14 22:03:49 +02:00
05ee89de81
Adding some service related definition + added services specific access right to security.py
2019-10-14 21:52:54 +02:00
80799fe411
Working on improving the Evt related api
2019-10-14 21:52:02 +02:00
265ef59011
Update/Fix PROCESSINFOCLASS enum + NtSetInformationProcess use a PROCESSINFOCLASS not a PROCESS_INFORMATION_CLASS
2019-10-08 14:00:56 +02:00
30b05d25f1
Improved MultipleInstr capabilities + fix a bug in x64 that failed to recognize 32b register name not uppercase
2019-09-20 16:18:16 +02:00
6bd45e8503
Added regkey.empty() based on RegDeleteTreeW
2019-08-13 14:57:56 +02:00
1e42553112
Added some test + added a com security fixture allowing allowed correct COM init accross all tests
2019-08-12 13:53:15 +02:00
168783af9d
Improved CryptMsg API with some more properties
2019-08-12 13:50:08 +02:00
b9fe4d19e5
Added ControlService + service.stop() + service.start() accept arguments
2019-08-08 10:28:22 +02:00
6fcba46739
Added <Raw> pseudo instruction to both assemblers + corresponding test
2019-08-07 17:42:56 +02:00
960838ae3c
handle code now use gdef + added some handle tests
2019-08-07 17:25:36 +02:00
8a32e00f68
Handle documented key type and unkown one + add code to handle badly encoded values (REG_MULTI_SZ notably)
2019-08-07 14:48:26 +02:00
670bb713a2
Fix a bug about REG_SZ key non-null terminated in values enumeration
2019-08-07 09:47:31 +02:00
032de6a848
Moved bits.py to winobject/ + added windows.system.bits as entrypoint
2019-08-05 22:32:10 +02:00
7827a43d9a
Fixed a logic bug in object manager + import bug in syswow.py
2019-08-05 22:31:00 +02:00
b0fa864271
Added some API to winproxy
2019-08-05 22:27:07 +02:00
7c816acdda
windows.system.registry does not use _winreg at all anymore
2019-08-05 22:26:28 +02:00
7f4ff75854
Rewrote windows.system.registry to handle unicode. added registry test (including unicode testing)
2019-08-05 16:56:48 +02:00
0697891026
Some improvment to ctypes generation + a lot of new definitions
2019-08-05 16:55:35 +02:00
15f399df6d
Still playing with security-descriptor / SACL / required rights (MAXIMUM_ALLOWED does not work)
2019-06-28 10:34:20 +02:00
b628ca336b
Working on api to set security descriptor
2019-06-28 09:38:35 +02:00
b160935747
Added current etw code (event_trace)
2019-05-31 09:06:09 +02:00
554a6b0572
Added some more ctypes defition
2019-05-18 23:35:52 +02:00
f9104141e5
Added/refactored many ctypes_generation definitions
2019-04-26 13:49:55 +02:00
5794a92168
ctypes_generation now handle anonymous sub-struct/union
2019-04-26 13:43:41 +02:00
578392ffde
Improve retrieving of event-log data type
2019-02-11 17:11:23 +01:00
44e5a09564
Few improvement in existing API + test of Winprocess.handles
2019-01-22 15:06:23 +01:00
4e8a765bd6
Added some generated def
2019-01-22 15:02:18 +01:00
f3de7b528b
go go gadget 0.5
2019-01-03 22:43:40 +01:00
252f6f8efa
Update replace deprecated use of getfuncargvalue to please new pytest versions
2019-01-03 22:32:19 +01:00
f53cd00bc4
cosmetic changes to doc + generate html doc
2019-01-03 22:20:19 +01:00
3fe7ee2cce
Fix bug in debugger caused by on_setup new code
2019-01-03 22:00:01 +01:00
370210a610
Fix a bug in MEMORY_BASIC_INFORMATION64 extended struct + add related test
2019-01-03 21:51:35 +01:00
288e87a0d3
Update windows.security doc + add ref to module in doc
2019-01-03 21:50:17 +01:00
abded9944d
Regenerated ctypes
2018-12-28 21:22:29 +01:00
d9a43a4a8b
Update readme with Token/SecurityDescriptor demo + fix flag repr in README + small docstring fix
2018-12-28 21:21:30 +01:00
c2f2f4c0a5
Flag repr does not print long 'L' at the end of hex value
2018-12-28 21:13:40 +01:00
771593f17d
Fix in safe_execute_python to raise WindowsError if process die during execution
2018-12-21 18:53:55 +01:00
1orenz0