466d94c03c
Fixed broken basestring for py3 compatibility (see issue #15 )
2020-05-02 23:12:25 +02:00
c691d8eb84
Added EvtQuery.seek() + IsDebuggerPresent API for sample purpose
2020-03-19 10:33:12 +01:00
91e6ef824c
Added EventLog.date for simplicity of use
2020-03-16 13:19:03 +01:00
7921e74647
Fixed a GC issue with system.modules + added deprecation warning to utils.get_kernel_modules()
2020-03-10 20:50:04 +01:00
02b2ba13f9
Added a poc for a WinFile object
2020-02-13 23:24:37 +01:00
66382b89f7
Some more py3 compat fix + few feature in POC
2020-02-13 22:30:46 +01:00
4d3b3e18ad
Lot of small py3 compat fix
2020-02-13 22:23:20 +01:00
6a74c83670
test_process pass for python3 + added some pe_parse test
2020-02-07 23:06:26 +01:00
7638080ee4
Added new service API allowing to find service by name easily
2019-11-14 13:31:20 +01:00
5b55d4d693
[event_log] Add some more format type to support
2019-10-14 22:03:49 +02:00
4f92323abf
[event log] export message_id instead of message_name
...
It's more consistent with the other classes
2019-10-14 22:03:49 +02:00
6dd314659d
[event log] adding event channel metadata message ID
2019-10-14 22:03:49 +02:00
adb7d3b63a
[event log] adding event metadata
2019-10-14 22:03:49 +02:00
b5371ddf33
[event log] still adding publisher metadata
2019-10-14 22:03:49 +02:00
4495eca6d0
[event log] add some more metadata
2019-10-14 22:03:49 +02:00
df28515b97
[event log] Expose message filename
2019-10-14 22:03:49 +02:00
6374f91fef
[event log] Expose channel metadatas
2019-10-14 22:03:49 +02:00
6125a1fb15
[event_trace] Add a way to pass a Python object to an ETW trace's
...
context
It may be useful to pass a python object (e.g. class) to the ETW
processing callback. The ETW tracing API allows the user to fill out a
"Context" field with a pointer value that will be passed to the event
being sent, the rest is ctypes magic for wrapping the python object
into a native pointer value.
2019-10-14 22:03:49 +02:00
bfeb2e6dec
[event_log] Configure an ETW trace to listen on specific keywords
...
By default EnableTrace will listen with a "KeywordsAny" value of
0xffffffff. Some event log providers send events with keywords over
0x100000000, so we need a mecanism to filter on thoses keywords.
2019-10-14 22:03:49 +02:00
536a60c040
[event log] Expose event keywords and publisher guid
...
Accessing the publisher guid is useful to setup an ETW trace, and we
need to know event keywords in order to activate the ETW session on the
correct "channels".
2019-10-14 22:03:49 +02:00
80799fe411
Working on improving the Evt related api
2019-10-14 21:52:02 +02:00
6bd45e8503
Added regkey.empty() based on RegDeleteTreeW
2019-08-13 14:57:56 +02:00
b9fe4d19e5
Added ControlService + service.stop() + service.start() accept arguments
2019-08-08 10:28:22 +02:00
960838ae3c
handle code now use gdef + added some handle tests
2019-08-07 17:25:36 +02:00
8a32e00f68
Handle documented key type and unkown one + add code to handle badly encoded values (REG_MULTI_SZ notably)
2019-08-07 14:48:26 +02:00
670bb713a2
Fix a bug about REG_SZ key non-null terminated in values enumeration
2019-08-07 09:47:31 +02:00
032de6a848
Moved bits.py to winobject/ + added windows.system.bits as entrypoint
2019-08-05 22:32:10 +02:00
7827a43d9a
Fixed a logic bug in object manager + import bug in syswow.py
2019-08-05 22:31:00 +02:00
7c816acdda
windows.system.registry does not use _winreg at all anymore
2019-08-05 22:26:28 +02:00
7f4ff75854
Rewrote windows.system.registry to handle unicode. added registry test (including unicode testing)
2019-08-05 16:56:48 +02:00
15f399df6d
Still playing with security-descriptor / SACL / required rights (MAXIMUM_ALLOWED does not work)
2019-06-28 10:34:20 +02:00
b628ca336b
Working on api to set security descriptor
2019-06-28 09:38:35 +02:00
b160935747
Added current etw code (event_trace)
2019-05-31 09:06:09 +02:00
578392ffde
Improve retrieving of event-log data type
2019-02-11 17:11:23 +01:00
44e5a09564
Few improvement in existing API + test of Winprocess.handles
2019-01-22 15:06:23 +01:00
d9a43a4a8b
Update readme with Token/SecurityDescriptor demo + fix flag repr in README + small docstring fix
2018-12-28 21:21:30 +01:00
4f62434dfb
Moved lookup_sid to windows.utils + add Token to window.security + update doc about official Token path
2018-12-21 18:50:22 +01:00
db44087bba
Refactor thread code for simple token retrieving on Process/Thread objects
2018-12-21 16:07:10 +01:00
f522f08e7f
Fix token.py doc + improve NDR with new class + doc NdrString new behavior + update uac.py sample to match new NdrString
2018-12-21 16:05:37 +01:00
986664d01f
update Doc + test + sample for token.py
2018-12-20 22:48:16 +01:00
8dc2d443d5
Update WMI docs / samples
2018-12-17 23:40:08 +01:00
460274d532
Process object now return new Token object (still WIP)
2018-11-24 22:59:01 +01:00
d936942d28
[WIP] improving Token object possibilities
2018-11-24 22:59:01 +01:00
c3b85068e5
Added Retn to x86/64 assemblers + encryption_demo sample can now sign a file + [WIP] token improvement
2018-11-24 22:59:01 +01:00
b6f57b8342
Code now use renamed/improved windows.com.Variant
2018-11-24 22:59:01 +01:00
267eddb5fe
Reworking windows.com.Variant + working on new wmi API + wmi test
2018-11-24 22:59:01 +01:00
a18c08ee53
Working on new WMI interface + improved ComInterface errcheck
2018-11-24 22:59:01 +01:00
e46dc48c37
Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)
2018-11-24 22:59:00 +01:00
33ca0c9c34
Added many security-related defines + moved improved-psid in extended_structs
2018-11-24 22:59:00 +01:00
967c18d521
Added POC WinProcess.memory_info + some crypto defines
2018-11-24 22:59:00 +01:00
hakril