65 Commits

Author SHA1 Message Date
hakril 930c992be3 Working on improving crypto stuff 2017-10-09 09:11:48 +02:00
Clement Rouault 7947ace02d Add alpc[Client|Server] __del__ to close handles + NtAlpcDisconnectPort + test 2017-09-15 17:54:19 +02:00
Clement Rouault 5301f91927 Add sample for thread + fix code to get a WinProcess from a pid not using WinProcess(pid=xxx) + test 2017-09-11 18:20:49 +02:00
Clement Rouault 492b6f4f02 pytest added --leaks for leak check + test Handle.description 2017-09-08 17:53:59 +02:00
Clement Rouault 7db5620210 more pytest POC + fixed debugger code + test FunctionHXBP 2017-09-07 17:13:59 +02:00
Clement Rouault e9c62a125c add system.build_number + better handling of closing python in Winprocess.__del__ 2017-08-17 18:49:42 +02:00
Clement Rouault c76a50c045 add doc to alpc.py + improve doc now that Winstruct are documented 2017-08-16 17:38:18 +02:00
hakril 3d33c97335 add system.windir + needed winfuncs 2017-08-16 09:25:23 +02:00
Clement Rouault d1cadf062a working on windows.alpc + fix in current_process.threads 2017-08-04 17:18:41 +02:00
Clement Rouault aff6ee4e17 replace PORT_MESSAGE struct def with PORT_MESSAGE[32|64] + FunctionBP can get the function via a class parameter 2017-06-21 13:16:22 +02:00
hakril 1a7e342318 Add Winprocess.limited_handle for QUERY_LIMITED_INFORMATION api call 2017-06-07 20:00:37 +02:00
Clement Rouault 1a73fe713b Add missing psid.py + some rpc fix + alpc sample + wincli 2017-05-24 17:49:46 +02:00
Clement Rouault 3c21d8c59c token.integrity is now settable 2017-05-24 17:43:34 +02:00
Clement Rouault 9461d4a2fb Add structs/def/funcs + Service.start() 2017-05-24 17:40:31 +02:00
Clement Rouault dbd98c93ed fix Process.ppid implem + new version does not enum processes 2017-04-28 17:29:17 +02:00
Clement Rouault f9a650fcf3 WinThread is not a THREADENTRY32 anymore + add Winprocess.peb.exe 2017-04-27 12:06:04 +02:00
Clement Rouault c0d03a2f58 Fix some handle leak, debugger close hFile on event + enumerate processes/threads close snap handle 2017-04-26 14:46:45 +02:00
hakril be5cbe2631 Winprocess.peb not a fixedproperty anymore to prevent ref-cycle + add windows.crypto to setup.py 2017-04-24 22:43:49 +02:00
Clement Rouault 70d330961a exception reraised by registry have a winerror + remove dead code windows windows.com 2017-04-12 17:20:37 +02:00
Clement Rouault 4183646b28 add Handle.infos + Process.open_token 2017-04-12 17:20:36 +02:00
hakril ae02d9e916 Add some User32 API 2017-04-12 17:19:01 +02:00
Clement Rouault 5478bda8bc Working on CryptoAPI 2017-04-12 17:19:01 +02:00
hakril 03aec90d63 WIP: fixing handle 'leak' in dbg that require manual garbare collection for now 2017-04-12 17:19:01 +02:00
hakril 861884099f Better handling of read_string for string at the end of readable memory 2017-04-12 17:19:00 +02:00
hakril 63cdb3bbeb Better handling of read_wstring for wstring at the end of readable memory 2017-04-12 17:19:00 +02:00
hakril e17400ed63 Debugger.detach remove self.target + better handling/clean of Thread/Process handles 2017-04-12 17:19:00 +02:00
Clement Rouault 943945225a Improve debugger/BP doc + add sample + small fixes in WMI/LocalDebugger + new data in ApiProxy for FunctionBP 2016-08-19 15:06:26 +02:00
Clement Rouault 2767a08624 Fix bug in Process.name + create_process show_windows=True by default 2016-07-29 17:32:14 +02:00
Clement Rouault fe4d41db47 Add/Update some doc 2016-07-27 18:20:36 +02:00
Clement Rouault f54a64670e Add context_syswow/set_syswow_context + debugger able to handle BP in 64b part of syswow process 2016-07-20 18:21:28 +02:00
Clement Rouault 48a40fa520 Improve MemBP API + restore target memory on break 2016-07-20 13:16:06 +02:00
Clement Rouault 82621b881a Add get_memory_breakpoint_at to debugger + fix token_user in process + add prot param to virtual_alloc 2016-07-13 16:28:31 +02:00
Clement Rouault d90e461bcf Playing with advanced breakpoint 2016-07-13 13:54:42 +02:00
Clement Rouault 400b7b91b0 First try at all BP remove + check range on MemBP for call to .trigger() else ignore 2016-07-08 17:18:57 +02:00
Clement Rouault 9a980d87b3 First try at single_step and memory breakpoints in Debugger + test 2016-07-07 17:43:28 +02:00
Clement Rouault cf6c48b418 Remove some commented old code + fix read/write of REG_QWORD values in registry 2016-07-07 17:41:57 +02:00
Clement Rouault 886b445e0e Token.integrity returns a Flag + fix simple_x64 on SIB use for [r13] 2016-07-04 18:33:35 +02:00
Clement Rouault 3069b93d21 Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum 2016-07-01 18:12:28 +02:00
Clement Rouault c2e7b43b9f Add R8 to ECONTEXT64 2016-07-01 17:06:20 +02:00
Clement Rouault 56b8264ffd Add x64.assemble + sample test_code 2016-06-28 11:31:53 +02:00
Clement Rouault bc9d3b61ef Draft version of system handles 2016-06-07 17:13:44 +02:00
Clement Rouault 971610bbe3 [WIP] system.handles 2016-06-06 17:24:30 +02:00
Clement Rouault 3d51278039 fix UNICODE_STRING.str / test assemblers / improve com_parser for future work 2016-06-06 17:24:10 +02:00
Clement Rouault 976ce78455 First try to replace unexisting GetThreadId on XP 2016-05-20 18:03:36 +02:00
Clement Rouault 8bee07b8dc Add REG_QWORD handling in registry.py 2016-05-19 10:59:43 +02:00
Clement Rouault dfe8217259 Fix system.version_name on windows10 2016-05-13 16:31:07 +02:00
hakril c2c3fe2dc2 more doc 2016-04-27 00:33:02 +02:00
Clement Rouault a988ad03e3 Add struct + thread.teb_base 2016-04-25 17:48:49 +02:00
Clement Rouault 57634f076c Add process.time_info 2016-04-21 10:58:35 +02:00
Clement Rouault 09e9b7efbb Fix get_mapped_filename 32 -> 64 (use NtQueryVirtualMemory) 2016-04-19 11:49:33 +02:00