 clement rouault
|
3149961634
|
Retrieving process ppid now use limited_handle, allowed more case of sucessful retrieval
|
2021-03-05 16:37:48 +01:00 |
|
|
hakril
|
466d94c03c
|
Fixed broken basestring for py3 compatibility (see issue #15)
|
2020-05-02 23:12:25 +02:00 |
|
|
hakril
|
4d3b3e18ad
|
Lot of small py3 compat fix
|
2020-02-13 22:23:20 +01:00 |
|
|
hakril
|
6a74c83670
|
test_process pass for python3 + added some pe_parse test
|
2020-02-07 23:06:26 +01:00 |
|
|
hakril
|
15f399df6d
|
Still playing with security-descriptor / SACL / required rights (MAXIMUM_ALLOWED does not work)
|
2019-06-28 10:34:20 +02:00 |
|
|
hakril
|
b628ca336b
|
Working on api to set security descriptor
|
2019-06-28 09:38:35 +02:00 |
|
|
hakril
|
44e5a09564
|
Few improvement in existing API + test of Winprocess.handles
|
2019-01-22 15:06:23 +01:00 |
|
|
hakril
|
db44087bba
|
Refactor thread code for simple token retrieving on Process/Thread objects
|
2018-12-21 16:07:10 +01:00 |
|
|
hakril
|
460274d532
|
Process object now return new Token object (still WIP)
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
e46dc48c37
|
Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
967c18d521
|
Added POC WinProcess.memory_info + some crypto defines
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
05e7b755b0
|
Fix CurrentProcess read/write memory to use ctypes.memmove -> raise on bad address -> no more segv
|
2018-05-12 00:13:57 +02:00 |
|
|
hakril
|
34c2d94bc2
|
Some fixes in code/samples/test
|
2018-03-27 20:37:30 +02:00 |
|
|
hakril
|
8840b9fdb9
|
updated doc
|
2018-03-07 10:24:46 +01:00 |
|
|
hakril
|
4499080a77
|
Remote load library now use LoadLibraryW and get_mapped_filename use GetMappedFileNameW: return unicode str in every case
|
2018-02-07 13:14:25 +01:00 |
|
|
hakril
|
f682fbd8c1
|
Add transaction + window APIs to winproxy + get_mapped_filename raise on non-standard error (like aborted transaction)
|
2018-01-26 11:05:53 +01:00 |
|
|
hakril
|
4251b18041
|
Fix ctypes generation + COM interface dependance check + add IPersistFile, IShellLink, strucs/defs
|
2018-01-25 16:51:04 +01:00 |
|
|
hakril
|
23837a0713
|
Improving volume objects + adding CurrentProcess.peb.apisetmap with ApiSetMap parsing capabilities
|
2017-12-04 10:12:41 +01:00 |
|
|
hakril
|
c135780ba9
|
Add Process.virtual_protect default value for 'old_protect' + add test for Improved LSA_UNICODE_STRING used in PEB.ProcessParameters + find_value now search in ntstatus values
|
2017-11-24 17:46:07 +01:00 |
|
|
Clement Rouault
|
d12bae6dbb
|
Remove 'WinUnicodeString' and add un extended struct _LSA_UNICODE_STRING: simplify lots of things
|
2017-11-17 15:13:34 +01:00 |
|
|
Clement Rouault
|
4e5733c2c5
|
Process.prioroty now use the FlagMapper
|
2017-11-10 14:20:59 +01:00 |
|
|
Clement Rouault
|
8ba325afd2
|
Add a new FlagMapper to easily transform int to Flag and change to code use it
|
2017-11-10 13:47:27 +01:00 |
|
|
Clement Rouault
|
4efae2194d
|
Adding Process.priority + fix in WMI raised exceptions + add x86.Iret
|
2017-11-10 11:12:24 +01:00 |
|
|
Clement Rouault
|
5a79e15440
|
Improve WMI capabilities by adding access to various namespaces + listing methods + add CurrentProcess.load_library
|
2017-11-08 17:55:47 +01:00 |
|
|
Clement Rouault
|
7947ace02d
|
Add alpc[Client|Server] __del__ to close handles + NtAlpcDisconnectPort + test
|
2017-09-15 17:54:19 +02:00 |
|
|
Clement Rouault
|
e9c62a125c
|
add system.build_number + better handling of closing python in Winprocess.__del__
|
2017-08-17 18:49:42 +02:00 |
|
|
Clement Rouault
|
c76a50c045
|
add doc to alpc.py + improve doc now that Winstruct are documented
|
2017-08-16 17:38:18 +02:00 |
|
|
Clement Rouault
|
d1cadf062a
|
working on windows.alpc + fix in current_process.threads
|
2017-08-04 17:18:41 +02:00 |
|
|
Clement Rouault
|
aff6ee4e17
|
replace PORT_MESSAGE struct def with PORT_MESSAGE[32|64] + FunctionBP can get the function via a class parameter
|
2017-06-21 13:16:22 +02:00 |
|
|
hakril
|
1a7e342318
|
Add Winprocess.limited_handle for QUERY_LIMITED_INFORMATION api call
|
2017-06-07 20:00:37 +02:00 |
|
|
Clement Rouault
|
3c21d8c59c
|
token.integrity is now settable
|
2017-05-24 17:43:34 +02:00 |
|
|
Clement Rouault
|
dbd98c93ed
|
fix Process.ppid implem + new version does not enum processes
|
2017-04-28 17:29:17 +02:00 |
|
|
Clement Rouault
|
f9a650fcf3
|
WinThread is not a THREADENTRY32 anymore + add Winprocess.peb.exe
|
2017-04-27 12:06:04 +02:00 |
|
|
hakril
|
be5cbe2631
|
Winprocess.peb not a fixedproperty anymore to prevent ref-cycle + add windows.crypto to setup.py
|
2017-04-24 22:43:49 +02:00 |
|
|
Clement Rouault
|
4183646b28
|
add Handle.infos + Process.open_token
|
2017-04-12 17:20:36 +02:00 |
|
|
hakril
|
03aec90d63
|
WIP: fixing handle 'leak' in dbg that require manual garbare collection for now
|
2017-04-12 17:19:01 +02:00 |
|
|
hakril
|
861884099f
|
Better handling of read_string for string at the end of readable memory
|
2017-04-12 17:19:00 +02:00 |
|
|
hakril
|
63cdb3bbeb
|
Better handling of read_wstring for wstring at the end of readable memory
|
2017-04-12 17:19:00 +02:00 |
|
|
hakril
|
e17400ed63
|
Debugger.detach remove self.target + better handling/clean of Thread/Process handles
|
2017-04-12 17:19:00 +02:00 |
|
|
Clement Rouault
|
2767a08624
|
Fix bug in Process.name + create_process show_windows=True by default
|
2016-07-29 17:32:14 +02:00 |
|
|
Clement Rouault
|
fe4d41db47
|
Add/Update some doc
|
2016-07-27 18:20:36 +02:00 |
|
|
Clement Rouault
|
f54a64670e
|
Add context_syswow/set_syswow_context + debugger able to handle BP in 64b part of syswow process
|
2016-07-20 18:21:28 +02:00 |
|
|
Clement Rouault
|
48a40fa520
|
Improve MemBP API + restore target memory on break
|
2016-07-20 13:16:06 +02:00 |
|
|
Clement Rouault
|
82621b881a
|
Add get_memory_breakpoint_at to debugger + fix token_user in process + add prot param to virtual_alloc
|
2016-07-13 16:28:31 +02:00 |
|
|
Clement Rouault
|
400b7b91b0
|
First try at all BP remove + check range on MemBP for call to .trigger() else ignore
|
2016-07-08 17:18:57 +02:00 |
|
|
Clement Rouault
|
9a980d87b3
|
First try at single_step and memory breakpoints in Debugger + test
|
2016-07-07 17:43:28 +02:00 |
|
|
Clement Rouault
|
886b445e0e
|
Token.integrity returns a Flag + fix simple_x64 on SIB use for [r13]
|
2016-07-04 18:33:35 +02:00 |
|
|
Clement Rouault
|
3069b93d21
|
Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum
|
2016-07-01 18:12:28 +02:00 |
|
|
Clement Rouault
|
3d51278039
|
fix UNICODE_STRING.str / test assemblers / improve com_parser for future work
|
2016-06-06 17:24:10 +02:00 |
|
|
Clement Rouault
|
976ce78455
|
First try to replace unexisting GetThreadId on XP
|
2016-05-20 18:03:36 +02:00 |
|