 Clement Rouault
|
19b168df07
|
Add target_dll and target_func to TransparentApiProxy + test_code.py handles raw [x86|x64]
|
2016-08-19 15:15:04 +02:00 |
|
|
Clement Rouault
|
943945225a
|
Improve debugger/BP doc + add sample + small fixes in WMI/LocalDebugger + new data in ApiProxy for FunctionBP
|
2016-08-19 15:06:26 +02:00 |
|
|
Clement Rouault
|
0d38c1e268
|
Add NtAlpcConnectPortEx in winproxy
|
2016-08-19 10:34:41 +02:00 |
|
|
Clement Rouault
|
c7a2f7663a
|
Add PRAGMA_PACK for struct defintion in struct_parser and use it for tagBITMAPFILEHEADER
|
2016-08-08 18:11:44 +02:00 |
|
|
Clement Rouault
|
20fe59cf78
|
Implement Debugger.detach
|
2016-08-08 10:39:25 +02:00 |
|
|
Clement Rouault
|
304c7788db
|
Add structure def for BITMAP (screenshot API)
|
2016-08-05 18:14:24 +02:00 |
|
|
Clement Rouault
|
2767a08624
|
Fix bug in Process.name + create_process show_windows=True by default
|
2016-07-29 17:32:14 +02:00 |
|
|
Clement Rouault
|
fe4d41db47
|
Add/Update some doc
|
2016-07-27 18:20:36 +02:00 |
|
|
Clement Rouault
|
bc4952d513
|
Fix test_debugger with new dll format in _resolve + some test of syswow peb/context
|
2016-07-21 18:40:49 +02:00 |
|
|
Clement Rouault
|
f54a64670e
|
Add context_syswow/set_syswow_context + debugger able to handle BP in 64b part of syswow process
|
2016-07-20 18:21:28 +02:00 |
|
|
Clement Rouault
|
53acf21a2f
|
Fix x64 Mov Reg, Imm32 (sign extended)
|
2016-07-20 13:16:39 +02:00 |
|
|
Clement Rouault
|
48a40fa520
|
Improve MemBP API + restore target memory on break
|
2016-07-20 13:16:06 +02:00 |
|
|
Clement Rouault
|
2fec6a68b1
|
Fix calcul of full_page_events (translate events to set) in remove_bp
|
2016-07-18 17:40:50 +02:00 |
|
|
Clement Rouault
|
98a481ca93
|
DisabledMemoryBreakpoint now reput only the non-deleted BP + fix syntax (cc heurs <3)
|
2016-07-18 17:38:46 +02:00 |
|
|
Clement Rouault
|
13f231d6ad
|
debugger disable memory breakpoint before calling membp.trigger()
|
2016-07-18 16:30:17 +02:00 |
|
|
Clement Rouault
|
3184cbdeab
|
MemBP has explicit event RWX, add GetProcessDEPPolicy, add Debugger API to disable/re-enable memory BP
|
2016-07-18 16:23:11 +02:00 |
|
|
Clement Rouault
|
9ebb25017b
|
Better message / WindowsError raised when process die during safe_execute_python
|
2016-07-18 14:04:37 +02:00 |
|
|
Clement Rouault
|
19205f73a1
|
Improve debugger handling of memBP for future use + fix MemBP prot init + add failing test of multitple BP with diff prot
|
2016-07-13 18:23:26 +02:00 |
|
|
Clement Rouault
|
82621b881a
|
Add get_memory_breakpoint_at to debugger + fix token_user in process + add prot param to virtual_alloc
|
2016-07-13 16:28:31 +02:00 |
|
|
Clement Rouault
|
d90e461bcf
|
Playing with advanced breakpoint
|
2016-07-13 13:54:42 +02:00 |
|
|
Clement Rouault
|
1f6ffd043c
|
Better implementation of MemoryBP
|
2016-07-13 13:50:44 +02:00 |
|
|
Clement Rouault
|
1590f634d7
|
Add ReadFile to winproxy
|
2016-07-13 10:11:05 +02:00 |
|
|
Clement Rouault
|
125888cd60
|
Add sample / test for memory breakpoint and single step
|
2016-07-13 10:10:12 +02:00 |
|
|
Clement Rouault
|
8bf3c0312c
|
Checking the beginning of the MemBP is important too...
|
2016-07-08 17:23:26 +02:00 |
|
|
Clement Rouault
|
400b7b91b0
|
First try at all BP remove + check range on MemBP for call to .trigger() else ignore
|
2016-07-08 17:18:57 +02:00 |
|
|
Clement Rouault
|
2f06e9e844
|
Commit <a l'arrache> for a quick implem of del_bp on standard BP
|
2016-07-08 16:21:57 +02:00 |
|
|
Clement Rouault
|
fb9cd75f40
|
Add a sample for the debugger API
|
2016-07-08 11:37:49 +02:00 |
|
|
Clement Rouault
|
9a980d87b3
|
First try at single_step and memory breakpoints in Debugger + test
|
2016-07-07 17:43:28 +02:00 |
|
|
Clement Rouault
|
cf6c48b418
|
Remove some commented old code + fix read/write of REG_QWORD values in registry
|
2016-07-07 17:41:57 +02:00 |
|
|
Clement Rouault
|
b74d7a9e7e
|
Add Jmp/Call Far 16:32 in simple_x86 + clean and simplify syswow-to-64 execution
|
2016-07-07 13:16:36 +02:00 |
|
|
Clement Rouault
|
2d1f93da45
|
Add Debugger.attach + simple single_step implementation
|
2016-07-06 11:00:30 +02:00 |
|
|
Clement Rouault
|
886b445e0e
|
Token.integrity returns a Flag + fix simple_x64 on SIB use for [r13]
|
2016-07-04 18:33:35 +02:00 |
|
|
Clement Rouault
|
2f4eef23aa
|
Add NtCreateFile to winproxy
|
2016-07-04 18:32:36 +02:00 |
|
|
Clement Rouault
|
37de039b65
|
Improve ctypes generation + new struct/func/def for crypt32.dll
|
2016-07-01 18:13:09 +02:00 |
|
|
Clement Rouault
|
3069b93d21
|
Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum
|
2016-07-01 18:12:28 +02:00 |
|
|
Clement Rouault
|
c2e7b43b9f
|
Add R8 to ECONTEXT64
|
2016-07-01 17:06:20 +02:00 |
|
|
Clement Rouault
|
2526727931
|
Add __mul__ on Instruction + x64 on test_code
|
2016-06-29 15:07:14 +02:00 |
|
|
Clement Rouault
|
56b8264ffd
|
Add x64.assemble + sample test_code
|
2016-06-28 11:31:53 +02:00 |
|
|
Clement Rouault
|
ce7866cbf3
|
Improve x86.assemble for int + a demo of code tester
|
2016-06-28 11:03:57 +02:00 |
|
|
Clement Rouault
|
ed42580b4e
|
Fix some x64 encoding of [NEW_REG] | pop/push [RAX] doest not contains a useless prefix anymore
|
2016-06-27 14:51:47 +02:00 |
|
|
Clement Rouault
|
86fe9c9f82
|
Update generation for ntstatus and add a parallele define module to ApiProxy
|
2016-06-24 16:55:25 +02:00 |
|
|
Clement Rouault
|
75c48103c4
|
Added SetConsoleCtrlHandler to winproxy
|
2016-06-17 11:14:46 +02:00 |
|
|
Clement Rouault
|
4a0669ad41
|
Add COMImplementation
|
2016-06-17 10:18:12 +02:00 |
|
|
Clement Rouault
|
4436be72c0
|
first working version of new_generate
|
2016-06-16 13:31:16 +02:00 |
|
|
Clement Rouault
|
2289895423
|
Add test + fix Imm32 stuff in x64
|
2016-06-13 18:19:38 +02:00 |
|
|
Clement Rouault
|
0f5fce424b
|
Fix test_hook to disable the hook after test
|
2016-06-13 18:18:59 +02:00 |
|
|
Clement Rouault
|
0b32302591
|
Remove generate_callback_stub (only IATHook are impacted)
|
2016-06-09 18:51:48 +02:00 |
|
|
Clement Rouault
|
e1f7f1e500
|
execute_python doest not reinject the shellcode everytime + test hook 64b
|
2016-06-08 11:01:19 +02:00 |
|
|
Clement Rouault
|
f23357c13e
|
Testing hook without generated stub + new hook test in new file
|
2016-06-07 19:59:00 +02:00 |
|
|
Clement Rouault
|
bc9d3b61ef
|
Draft version of system handles
|
2016-06-07 17:13:44 +02:00 |
|