hakril
|
930c992be3
|
Working on improving crypto stuff
|
2017-10-09 09:11:48 +02:00 |
|
Clement Rouault
|
7947ace02d
|
Add alpc[Client|Server] __del__ to close handles + NtAlpcDisconnectPort + test
|
2017-09-15 17:54:19 +02:00 |
|
Clement Rouault
|
5301f91927
|
Add sample for thread + fix code to get a WinProcess from a pid not using WinProcess(pid=xxx) + test
|
2017-09-11 18:20:49 +02:00 |
|
Clement Rouault
|
492b6f4f02
|
pytest added --leaks for leak check + test Handle.description
|
2017-09-08 17:53:59 +02:00 |
|
Clement Rouault
|
7db5620210
|
more pytest POC + fixed debugger code + test FunctionHXBP
|
2017-09-07 17:13:59 +02:00 |
|
Clement Rouault
|
e9c62a125c
|
add system.build_number + better handling of closing python in Winprocess.__del__
|
2017-08-17 18:49:42 +02:00 |
|
Clement Rouault
|
c76a50c045
|
add doc to alpc.py + improve doc now that Winstruct are documented
|
2017-08-16 17:38:18 +02:00 |
|
hakril
|
3d33c97335
|
add system.windir + needed winfuncs
|
2017-08-16 09:25:23 +02:00 |
|
Clement Rouault
|
d1cadf062a
|
working on windows.alpc + fix in current_process.threads
|
2017-08-04 17:18:41 +02:00 |
|
Clement Rouault
|
aff6ee4e17
|
replace PORT_MESSAGE struct def with PORT_MESSAGE[32|64] + FunctionBP can get the function via a class parameter
|
2017-06-21 13:16:22 +02:00 |
|
hakril
|
1a7e342318
|
Add Winprocess.limited_handle for QUERY_LIMITED_INFORMATION api call
|
2017-06-07 20:00:37 +02:00 |
|
Clement Rouault
|
1a73fe713b
|
Add missing psid.py + some rpc fix + alpc sample + wincli
|
2017-05-24 17:49:46 +02:00 |
|
Clement Rouault
|
3c21d8c59c
|
token.integrity is now settable
|
2017-05-24 17:43:34 +02:00 |
|
Clement Rouault
|
9461d4a2fb
|
Add structs/def/funcs + Service.start()
|
2017-05-24 17:40:31 +02:00 |
|
Clement Rouault
|
dbd98c93ed
|
fix Process.ppid implem + new version does not enum processes
|
2017-04-28 17:29:17 +02:00 |
|
Clement Rouault
|
f9a650fcf3
|
WinThread is not a THREADENTRY32 anymore + add Winprocess.peb.exe
|
2017-04-27 12:06:04 +02:00 |
|
Clement Rouault
|
c0d03a2f58
|
Fix some handle leak, debugger close hFile on event + enumerate processes/threads close snap handle
|
2017-04-26 14:46:45 +02:00 |
|
hakril
|
be5cbe2631
|
Winprocess.peb not a fixedproperty anymore to prevent ref-cycle + add windows.crypto to setup.py
|
2017-04-24 22:43:49 +02:00 |
|
Clement Rouault
|
70d330961a
|
exception reraised by registry have a winerror + remove dead code windows windows.com
|
2017-04-12 17:20:37 +02:00 |
|
Clement Rouault
|
4183646b28
|
add Handle.infos + Process.open_token
|
2017-04-12 17:20:36 +02:00 |
|
hakril
|
ae02d9e916
|
Add some User32 API
|
2017-04-12 17:19:01 +02:00 |
|
Clement Rouault
|
5478bda8bc
|
Working on CryptoAPI
|
2017-04-12 17:19:01 +02:00 |
|
hakril
|
03aec90d63
|
WIP: fixing handle 'leak' in dbg that require manual garbare collection for now
|
2017-04-12 17:19:01 +02:00 |
|
hakril
|
861884099f
|
Better handling of read_string for string at the end of readable memory
|
2017-04-12 17:19:00 +02:00 |
|
hakril
|
63cdb3bbeb
|
Better handling of read_wstring for wstring at the end of readable memory
|
2017-04-12 17:19:00 +02:00 |
|
hakril
|
e17400ed63
|
Debugger.detach remove self.target + better handling/clean of Thread/Process handles
|
2017-04-12 17:19:00 +02:00 |
|
Clement Rouault
|
943945225a
|
Improve debugger/BP doc + add sample + small fixes in WMI/LocalDebugger + new data in ApiProxy for FunctionBP
|
2016-08-19 15:06:26 +02:00 |
|
Clement Rouault
|
2767a08624
|
Fix bug in Process.name + create_process show_windows=True by default
|
2016-07-29 17:32:14 +02:00 |
|
Clement Rouault
|
fe4d41db47
|
Add/Update some doc
|
2016-07-27 18:20:36 +02:00 |
|
Clement Rouault
|
f54a64670e
|
Add context_syswow/set_syswow_context + debugger able to handle BP in 64b part of syswow process
|
2016-07-20 18:21:28 +02:00 |
|
Clement Rouault
|
48a40fa520
|
Improve MemBP API + restore target memory on break
|
2016-07-20 13:16:06 +02:00 |
|
Clement Rouault
|
82621b881a
|
Add get_memory_breakpoint_at to debugger + fix token_user in process + add prot param to virtual_alloc
|
2016-07-13 16:28:31 +02:00 |
|
Clement Rouault
|
d90e461bcf
|
Playing with advanced breakpoint
|
2016-07-13 13:54:42 +02:00 |
|
Clement Rouault
|
400b7b91b0
|
First try at all BP remove + check range on MemBP for call to .trigger() else ignore
|
2016-07-08 17:18:57 +02:00 |
|
Clement Rouault
|
9a980d87b3
|
First try at single_step and memory breakpoints in Debugger + test
|
2016-07-07 17:43:28 +02:00 |
|
Clement Rouault
|
cf6c48b418
|
Remove some commented old code + fix read/write of REG_QWORD values in registry
|
2016-07-07 17:41:57 +02:00 |
|
Clement Rouault
|
886b445e0e
|
Token.integrity returns a Flag + fix simple_x64 on SIB use for [r13]
|
2016-07-04 18:33:35 +02:00 |
|
Clement Rouault
|
3069b93d21
|
Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum
|
2016-07-01 18:12:28 +02:00 |
|
Clement Rouault
|
c2e7b43b9f
|
Add R8 to ECONTEXT64
|
2016-07-01 17:06:20 +02:00 |
|
Clement Rouault
|
56b8264ffd
|
Add x64.assemble + sample test_code
|
2016-06-28 11:31:53 +02:00 |
|
Clement Rouault
|
bc9d3b61ef
|
Draft version of system handles
|
2016-06-07 17:13:44 +02:00 |
|
Clement Rouault
|
971610bbe3
|
[WIP] system.handles
|
2016-06-06 17:24:30 +02:00 |
|
Clement Rouault
|
3d51278039
|
fix UNICODE_STRING.str / test assemblers / improve com_parser for future work
|
2016-06-06 17:24:10 +02:00 |
|
Clement Rouault
|
976ce78455
|
First try to replace unexisting GetThreadId on XP
|
2016-05-20 18:03:36 +02:00 |
|
Clement Rouault
|
8bee07b8dc
|
Add REG_QWORD handling in registry.py
|
2016-05-19 10:59:43 +02:00 |
|
Clement Rouault
|
dfe8217259
|
Fix system.version_name on windows10
|
2016-05-13 16:31:07 +02:00 |
|
hakril
|
c2c3fe2dc2
|
more doc
|
2016-04-27 00:33:02 +02:00 |
|
Clement Rouault
|
a988ad03e3
|
Add struct + thread.teb_base
|
2016-04-25 17:48:49 +02:00 |
|
Clement Rouault
|
57634f076c
|
Add process.time_info
|
2016-04-21 10:58:35 +02:00 |
|
Clement Rouault
|
09e9b7efbb
|
Fix get_mapped_filename 32 -> 64 (use NtQueryVirtualMemory)
|
2016-04-19 11:49:33 +02:00 |
|