 hakril
|
d9a43a4a8b
|
Update readme with Token/SecurityDescriptor demo + fix flag repr in README + small docstring fix
|
2018-12-28 21:21:30 +01:00 |
|
|
hakril
|
4f62434dfb
|
Moved lookup_sid to windows.utils + add Token to window.security + update doc about official Token path
|
2018-12-21 18:50:22 +01:00 |
|
|
hakril
|
db44087bba
|
Refactor thread code for simple token retrieving on Process/Thread objects
|
2018-12-21 16:07:10 +01:00 |
|
|
hakril
|
f522f08e7f
|
Fix token.py doc + improve NDR with new class + doc NdrString new behavior + update uac.py sample to match new NdrString
|
2018-12-21 16:05:37 +01:00 |
|
|
hakril
|
986664d01f
|
update Doc + test + sample for token.py
|
2018-12-20 22:48:16 +01:00 |
|
|
hakril
|
8dc2d443d5
|
Update WMI docs / samples
|
2018-12-17 23:40:08 +01:00 |
|
|
hakril
|
460274d532
|
Process object now return new Token object (still WIP)
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
d936942d28
|
[WIP] improving Token object possibilities
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
c3b85068e5
|
Added Retn to x86/64 assemblers + encryption_demo sample can now sign a file + [WIP] token improvement
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
b6f57b8342
|
Code now use renamed/improved windows.com.Variant
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
267eddb5fe
|
Reworking windows.com.Variant + working on new wmi API + wmi test
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
a18c08ee53
|
Working on new WMI interface + improved ComInterface errcheck
|
2018-11-24 22:59:01 +01:00 |
|
|
hakril
|
e46dc48c37
|
Addapt codebase and tests to winproxy refactoring (replace Kernel32Error to WinproxyError)
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
33ca0c9c34
|
Added many security-related defines + moved improved-psid in extended_structs
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
967c18d521
|
Added POC WinProcess.memory_info + some crypto defines
|
2018-11-24 22:59:00 +01:00 |
|
|
hakril
|
c228a0d5cb
|
Added Certificate.distinguished_name and BaseSystemModule.name + some winproxy functions
|
2018-08-02 18:51:41 +02:00 |
|
|
hakril
|
e6a022f8be
|
Add windows.system.edition
|
2018-07-13 18:08:00 +02:00 |
|
|
hakril
|
c19241098a
|
Improve object manager doc + add samples
|
2018-07-13 14:24:55 +02:00 |
|
|
hakril
|
c59af86910
|
Renamed kernobj.py to object_manager.py and added to windows.system.object_manager + improve API + beginning of doc
|
2018-06-11 17:55:11 +02:00 |
|
|
hakril
|
041a354d17
|
Update some doc + document windows.system.modules
|
2018-06-11 11:09:48 +02:00 |
|
|
hakril
|
525432fecd
|
Add a POC for windows.system.modules to replace winutils.get_kernel_modules()
|
2018-06-05 21:55:54 +02:00 |
|
|
hakril
|
b223ed233e
|
Fix stuff in service.py + update test
|
2018-06-05 11:59:06 +02:00 |
|
|
hakril
|
93bb9b6540
|
Add doc/sample/test for event log code
|
2018-06-05 11:30:25 +02:00 |
|
|
hakril
|
057d4e5408
|
Add scheduled_task code/doc-source/tests
|
2018-06-01 12:20:13 +02:00 |
|
|
hakril
|
2bea15ffe8
|
add current word on event logs
|
2018-05-12 00:17:34 +02:00 |
|
|
hakril
|
05e7b755b0
|
Fix CurrentProcess read/write memory to use ctypes.memmove -> raise on bad address -> no more segv
|
2018-05-12 00:13:57 +02:00 |
|
|
hakril
|
849d64378f
|
Commit current work on scheduled tasks
|
2018-05-12 00:11:10 +02:00 |
|
|
hakril
|
9e1400e4ad
|
Forgot a file.. This is the real v0.4
|
2018-03-28 01:03:37 +02:00 |
|
|
hakril
|
34c2d94bc2
|
Some fixes in code/samples/test
|
2018-03-27 20:37:30 +02:00 |
|
|
hakril
|
8840b9fdb9
|
updated doc
|
2018-03-07 10:24:46 +01:00 |
|
|
hakril
|
d91bc1a45a
|
Fix a bug in com.init() when CoInitializeEx failed + fix test: test_wmi fail du to pytest default COM-security settings
|
2018-03-04 18:34:40 +01:00 |
|
|
hakril
|
a057f8c130
|
class CertificateContext(PCERT_CONTEXT) replaced by Certificate(CERT_CONTEXT) + multi-received encrypt/decrypt test
|
2018-03-04 18:28:20 +01:00 |
|
|
hakril
|
c20d443c29
|
windows.com.init does not raise anymore if CoInitializeEx fails but return error code + cosmetic
|
2018-03-03 16:55:40 +01:00 |
|
|
hakril
|
4499080a77
|
Remote load library now use LoadLibraryW and get_mapped_filename use GetMappedFileNameW: return unicode str in every case
|
2018-02-07 13:14:25 +01:00 |
|
|
hakril
|
f682fbd8c1
|
Add transaction + window APIs to winproxy + get_mapped_filename raise on non-standard error (like aborted transaction)
|
2018-01-26 11:05:53 +01:00 |
|
|
hakril
|
4251b18041
|
Fix ctypes generation + COM interface dependance check + add IPersistFile, IShellLink, strucs/defs
|
2018-01-25 16:51:04 +01:00 |
|
|
hakril
|
65726e706f
|
Add Int X86/64 instruction
|
2018-01-13 16:40:21 +01:00 |
|
|
hakril
|
48b6758f7f
|
Add exists/create to PyHKey
|
2018-01-13 16:38:29 +01:00 |
|
|
hakril
|
f882bd1e35
|
Add wmi.gen_select for class select returning a generator + fom E_CRYPT define + CryptObj.nb_signer return 0 if CRYPT_E_INVALID_MSG_TYPE
|
2017-12-08 16:54:49 +01:00 |
|
|
hakril
|
4a75453a8b
|
Clean and Improve WMI query API that now accept a Timeout
|
2017-12-08 14:49:03 +01:00 |
|
|
hakril
|
32de3cb824
|
Improve ApiSetMap resolve to match ntdll behavior + add sizekey option to encryption_demo genkey option
|
2017-12-06 10:21:40 +01:00 |
|
|
hakril
|
23837a0713
|
Improving volume objects + adding CurrentProcess.peb.apisetmap with ApiSetMap parsing capabilities
|
2017-12-04 10:12:41 +01:00 |
|
|
hakril
|
c135780ba9
|
Add Process.virtual_protect default value for 'old_protect' + add test for Improved LSA_UNICODE_STRING used in PEB.ProcessParameters + find_value now search in ntstatus values
|
2017-11-24 17:46:07 +01:00 |
|
|
Clement Rouault
|
d12bae6dbb
|
Remove 'WinUnicodeString' and add un extended struct _LSA_UNICODE_STRING: simplify lots of things
|
2017-11-17 15:13:34 +01:00 |
|
|
Clement Rouault
|
4e5733c2c5
|
Process.prioroty now use the FlagMapper
|
2017-11-10 14:20:59 +01:00 |
|
|
Clement Rouault
|
8ba325afd2
|
Add a new FlagMapper to easily transform int to Flag and change to code use it
|
2017-11-10 13:47:27 +01:00 |
|
|
Clement Rouault
|
4efae2194d
|
Adding Process.priority + fix in WMI raised exceptions + add x86.Iret
|
2017-11-10 11:12:24 +01:00 |
|
|
Clement Rouault
|
5a79e15440
|
Improve WMI capabilities by adding access to various namespaces + listing methods + add CurrentProcess.load_library
|
2017-11-08 17:55:47 +01:00 |
|
|
hakril
|
930c992be3
|
Working on improving crypto stuff
|
2017-10-09 09:11:48 +02:00 |
|
|
Clement Rouault
|
7947ace02d
|
Add alpc[Client|Server] __del__ to close handles + NtAlpcDisconnectPort + test
|
2017-09-15 17:54:19 +02:00 |
|