bfeb2e6dec
[event_log] Configure an ETW trace to listen on specific keywords
...
By default EnableTrace will listen with a "KeywordsAny" value of
0xffffffff. Some event log providers send events with keywords over
0x100000000, so we need a mecanism to filter on thoses keywords.
2019-10-14 22:03:49 +02:00
536a60c040
[event log] Expose event keywords and publisher guid
...
Accessing the publisher guid is useful to setup an ETW trace, and we
need to know event keywords in order to activate the ETW session on the
correct "channels".
2019-10-14 22:03:49 +02:00
80799fe411
Working on improving the Evt related api
2019-10-14 21:52:02 +02:00
6bd45e8503
Added regkey.empty() based on RegDeleteTreeW
2019-08-13 14:57:56 +02:00
b9fe4d19e5
Added ControlService + service.stop() + service.start() accept arguments
2019-08-08 10:28:22 +02:00
960838ae3c
handle code now use gdef + added some handle tests
2019-08-07 17:25:36 +02:00
8a32e00f68
Handle documented key type and unkown one + add code to handle badly encoded values (REG_MULTI_SZ notably)
2019-08-07 14:48:26 +02:00
670bb713a2
Fix a bug about REG_SZ key non-null terminated in values enumeration
2019-08-07 09:47:31 +02:00
032de6a848
Moved bits.py to winobject/ + added windows.system.bits as entrypoint
2019-08-05 22:32:10 +02:00
7827a43d9a
Fixed a logic bug in object manager + import bug in syswow.py
2019-08-05 22:31:00 +02:00
7c816acdda
windows.system.registry does not use _winreg at all anymore
2019-08-05 22:26:28 +02:00
7f4ff75854
Rewrote windows.system.registry to handle unicode. added registry test (including unicode testing)
2019-08-05 16:56:48 +02:00
15f399df6d
Still playing with security-descriptor / SACL / required rights (MAXIMUM_ALLOWED does not work)
2019-06-28 10:34:20 +02:00
b628ca336b
Working on api to set security descriptor
2019-06-28 09:38:35 +02:00
b160935747
Added current etw code (event_trace)
2019-05-31 09:06:09 +02:00
578392ffde
Improve retrieving of event-log data type
2019-02-11 17:11:23 +01:00
44e5a09564
Few improvement in existing API + test of Winprocess.handles
2019-01-22 15:06:23 +01:00
d9a43a4a8b
Update readme with Token/SecurityDescriptor demo + fix flag repr in README + small docstring fix
2018-12-28 21:21:30 +01:00
4f62434dfb
Moved lookup_sid to windows.utils + add Token to window.security + update doc about official Token path
2018-12-21 18:50:22 +01:00
db44087bba
Refactor thread code for simple token retrieving on Process/Thread objects
2018-12-21 16:07:10 +01:00
f522f08e7f
Fix token.py doc + improve NDR with new class + doc NdrString new behavior + update uac.py sample to match new NdrString
2018-12-21 16:05:37 +01:00
986664d01f
update Doc + test + sample for token.py
2018-12-20 22:48:16 +01:00
8dc2d443d5
Update WMI docs / samples
2018-12-17 23:40:08 +01:00
460274d532
Process object now return new Token object (still WIP)
2018-11-24 22:59:01 +01:00
d936942d28
[WIP] improving Token object possibilities
2018-11-24 22:59:01 +01:00
c3b85068e5
Added Retn to x86/64 assemblers + encryption_demo sample can now sign a file + [WIP] token improvement
2018-11-24 22:59:01 +01:00
b6f57b8342
Code now use renamed/improved windows.com.Variant
2018-11-24 22:59:01 +01:00
267eddb5fe
Reworking windows.com.Variant + working on new wmi API + wmi test
2018-11-24 22:59:01 +01:00
a18c08ee53
Working on new WMI interface + improved ComInterface errcheck
2018-11-24 22:59:01 +01:00
e46dc48c37
Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)
2018-11-24 22:59:00 +01:00
33ca0c9c34
Added many security-related defines + moved improved-psid in extended_structs
2018-11-24 22:59:00 +01:00
967c18d521
Added POC WinProcess.memory_info + some crypto defines
2018-11-24 22:59:00 +01:00
c228a0d5cb
Added Certificate.distinguished_name and BaseSystemModule.name + some winproxy functions
2018-08-02 18:51:41 +02:00
e6a022f8be
Add windows.system.edition
2018-07-13 18:08:00 +02:00
c19241098a
Improve object manager doc + add samples
2018-07-13 14:24:55 +02:00
c59af86910
Renamed kernobj.py to object_manager.py and added to windows.system.object_manager + improve API + beginning of doc
2018-06-11 17:55:11 +02:00
041a354d17
Update some doc + document windows.system.modules
2018-06-11 11:09:48 +02:00
525432fecd
Add a POC for windows.system.modules to replace winutils.get_kernel_modules()
2018-06-05 21:55:54 +02:00
b223ed233e
Fix stuff in service.py + update test
2018-06-05 11:59:06 +02:00
93bb9b6540
Add doc/sample/test for event log code
2018-06-05 11:30:25 +02:00
057d4e5408
Add scheduled_task code/doc-source/tests
2018-06-01 12:20:13 +02:00
2bea15ffe8
add current word on event logs
2018-05-12 00:17:34 +02:00
05e7b755b0
Fix CurrentProcess read/write memory to use ctypes.memmove -> raise on bad address -> no more segv
2018-05-12 00:13:57 +02:00
849d64378f
Commit current work on scheduled tasks
2018-05-12 00:11:10 +02:00
9e1400e4ad
Forgot a file.. This is the real v0.4
2018-03-28 01:03:37 +02:00
34c2d94bc2
Some fixes in code/samples/test
2018-03-27 20:37:30 +02:00
8840b9fdb9
updated doc
2018-03-07 10:24:46 +01:00
d91bc1a45a
Fix a bug in com.init() when CoInitializeEx failed + fix test: test_wmi fail du to pytest default COM-security settings
2018-03-04 18:34:40 +01:00
a057f8c130
class CertificateContext(PCERT_CONTEXT) replaced by Certificate(CERT_CONTEXT) + multi-received encrypt/decrypt test
2018-03-04 18:28:20 +01:00
c20d443c29
windows.com.init does not raise anymore if CoInitializeEx fails but return error code + cosmetic
2018-03-03 16:55:40 +01:00
1orenz0