Commit Graph

  • 8aa71f8c44 Fix remote execute_python in multiple process where python.dll is load at differents addresses hakril 2017-04-21 21:22:24 +02:00
  • b418d85a5a Fix test_exe_in_module_list for python 64b Clement Rouault 2017-04-21 17:39:05 +02:00
  • 3f6131d621 Fix implem of bp exe!(offset|API) + add test for this case Clement Rouault 2017-04-21 17:30:18 +02:00
  • db6cec9031 Add PEB.Mutant + PEB.ImageBaseAddress in PEB definition Clement Rouault 2017-04-21 17:01:45 +02:00
  • 120e9bfa6f Add exe in the debugger list of modules (for bp) Clement Rouault 2017-04-21 15:03:48 +02:00
  • 799bca8d3f Fix BitsCopyCallback callback prototype + print error code on bits job error Clement Rouault 2017-04-20 11:52:56 +02:00
  • 979d1bd418 Regenerate doc with sphinx 1.5.5 hakril 2017-04-13 13:11:35 +02:00
  • 9cb9c2a9a0 Update doc build Clement Rouault 2017-04-13 11:42:52 +02:00
  • 1b0f1e9507 update winproxy list of function Clement Rouault 2017-04-13 11:41:48 +02:00
  • 654e6bff71 change remote_calc sample to use notepad + add demo of test_code sample + Stos[BWD] in simple_x86 + Clement Rouault 2017-04-13 11:14:09 +02:00
  • 344678de02 Add doc/sample for CryptObject Clement Rouault 2017-04-12 17:13:44 +02:00
  • 70d330961a exception reraised by registry have a winerror + remove dead code windows windows.com Clement Rouault 2017-04-12 17:11:57 +02:00
  • 0902618312 Add few test for windows.crypto + fix a syswow test Clement Rouault 2017-04-12 17:08:56 +02:00
  • b31702f783 Add BITS COM wrappers Clement Rouault 2017-04-11 17:33:52 +02:00
  • 81df41339b Improve windows.com.IID __repr__ and __eq__ + interface IBackgroundCopyCallback + COMImplementation.QueryInterface now returns better value allowing marshalling Clement Rouault 2017-04-11 13:41:00 +02:00
  • a6eb669099 Imprive windows.com.IID + add some BITS Interface/structs Clement Rouault 2017-04-10 15:02:47 +02:00
  • ab01eba54f More doc + fix sample on windows.crypto hakril 2017-04-11 01:24:27 +02:00
  • 1550c5ae3e adding sample for windows.crypto hakril 2017-04-10 00:50:05 +02:00
  • f1b1bec903 Working on documentation of windows.crypto hakril 2017-04-10 00:49:40 +02:00
  • e08720e49a Fix pickle/unpikcl of Flag + StrFlag for protocol 2 + StrFlag.__str__ is the string + test Clement Rouault 2017-04-05 15:06:02 +02:00
  • 21c179ed2e add sample for windows.crypto Clement Rouault 2017-04-04 10:30:36 +02:00
  • 4183646b28 add Handle.infos + Process.open_token Clement Rouault 2017-04-04 10:28:04 +02:00
  • 5431b57560 fix ImprovedVariant.asbool + com.create_instance accept a context parameter + fix RemoteWCharP.value logic + winutils.decompress_buffer Clement Rouault 2017-04-04 10:10:21 +02:00
  • a107656402 Add SACL/DACL related struct to func/def/structs + some winerror + some crypto func + utility func Clement Rouault 2017-04-04 09:55:35 +02:00
  • 64f56d3977 Identified a possible bug with Debugger._explicit_single_step + some DBGPRINT Clement Rouault 2017-04-04 09:44:44 +02:00
  • d2582d5e09 Renamed some error check method with intelligible name + some security functions def Clement Rouault 2017-02-13 17:49:18 +01:00
  • 3f39ca9f0c More work on windows.crypto and Add an encryption sample POC Clement Rouault 2017-02-10 18:41:28 +01:00
  • 8743883068 working on crypto.certificate.CryptObject Clement Rouault 2017-01-13 18:07:56 +01:00
  • ae02d9e916 Add some User32 API hakril 2017-01-11 00:47:22 +01:00
  • 98bc95204d still Working on windows.crypto object + API + test Clement Rouault 2016-12-30 18:03:51 +01:00
  • 68e809728a Working on windows.crypto object + API + test Clement Rouault 2016-12-30 18:03:08 +01:00
  • d5b70d829f Playing with future windows.crypto API / class hakril 2016-12-30 10:03:52 +01:00
  • 28b2596483 Fix PVOID arguments in function generated + add some func/struct from CryptoAPI hakril 2016-12-30 10:02:23 +01:00
  • 50e7a1f2e3 Still Working on CryptoAPI Clement Rouault 2016-12-05 17:41:49 +01:00
  • 5478bda8bc Working on CryptoAPI Clement Rouault 2016-12-05 17:41:12 +01:00
  • 15e40da1ca Playing with CryptoApi hakril 2016-11-27 11:49:18 +01:00
  • d2b801cada Fix handle_exit_process + detach in Debugger to prevent keeping ref on process + fix pe_parse IATHook: all test pass hakril 2016-11-03 23:17:24 +01:00
  • 8653c4c1e4 No-closure pe_parse pass the test of WindowsTestCase hakril 2016-11-02 22:35:18 +01:00
  • f863d75eee exception is raised if remote dll injection fails hakril 2016-10-30 15:30:18 +01:00
  • bc7656da05 [WIP] pe_parse refactor, imports and exports works without closure by code in dirty hakril 2016-10-23 23:51:54 +02:00
  • 03aec90d63 WIP: fixing handle 'leak' in dbg that require manual garbare collection for now hakril 2016-09-16 00:50:32 +02:00
  • 861884099f Better handling of read_string for string at the end of readable memory hakril 2016-09-15 22:16:36 +02:00
  • 63cdb3bbeb Better handling of read_wstring for wstring at the end of readable memory hakril 2016-09-15 22:07:29 +02:00
  • e17400ed63 Debugger.detach remove self.target + better handling/clean of Thread/Process handles hakril 2016-09-15 00:23:26 +02:00
  • e58fb73f3b Fix VARIANT interpretation of VT_BOOL Clement Rouault 2016-12-06 16:20:02 +01:00
  • 11bdbd8873 Remove TrapFlag when detaching debugger Clement Rouault 2016-08-23 11:56:54 +02:00
  • 8942efa36c Fix sample for FunctionBP Clement Rouault 2016-08-22 14:05:29 +02:00
  • 59776e40c3 Let's call it a V0.3 V0.3 Clement Rouault 2016-08-22 13:50:44 +02:00
  • c7b0b8d0aa Update doc for COMImplementation usage Clement Rouault 2016-08-22 13:50:08 +02:00
  • f045b58391 Fix README links for new /docs tree Clement Rouault 2016-08-22 09:47:06 +02:00
  • 83e8dcd56b Rename /doc to /docs + commit build/ for the new source of github pages method Clement Rouault 2016-08-19 16:21:34 +02:00
  • 3773d87993 Add missing sample debug_functionbp.py Clement Rouault 2016-08-19 15:18:10 +02:00
  • 19b168df07 Add target_dll and target_func to TransparentApiProxy + test_code.py handles raw [x86|x64] Clement Rouault 2016-08-19 15:15:04 +02:00
  • 943945225a Improve debugger/BP doc + add sample + small fixes in WMI/LocalDebugger + new data in ApiProxy for FunctionBP Clement Rouault 2016-08-19 15:06:26 +02:00
  • 0d38c1e268 Add NtAlpcConnectPortEx in winproxy Clement Rouault 2016-08-19 10:32:42 +02:00
  • c7a2f7663a Add PRAGMA_PACK for struct defintion in struct_parser and use it for tagBITMAPFILEHEADER Clement Rouault 2016-08-08 18:11:44 +02:00
  • 20fe59cf78 Implement Debugger.detach Clement Rouault 2016-08-08 10:39:25 +02:00
  • 304c7788db Add structure def for BITMAP (screenshot API) Clement Rouault 2016-08-05 18:14:24 +02:00
  • 2767a08624 Fix bug in Process.name + create_process show_windows=True by default Clement Rouault 2016-07-29 17:32:14 +02:00
  • fe4d41db47 Add/Update some doc Clement Rouault 2016-07-27 18:20:36 +02:00
  • bc4952d513 Fix test_debugger with new dll format in _resolve + some test of syswow peb/context Clement Rouault 2016-07-21 18:40:49 +02:00
  • f54a64670e Add context_syswow/set_syswow_context + debugger able to handle BP in 64b part of syswow process Clement Rouault 2016-07-20 18:21:28 +02:00
  • 53acf21a2f Fix x64 Mov Reg, Imm32 (sign extended) Clement Rouault 2016-07-20 13:16:39 +02:00
  • 48a40fa520 Improve MemBP API + restore target memory on break Clement Rouault 2016-07-20 13:16:06 +02:00
  • 2fec6a68b1 Fix calcul of full_page_events (translate events to set) in remove_bp Clement Rouault 2016-07-18 17:40:50 +02:00
  • 98a481ca93 DisabledMemoryBreakpoint now reput only the non-deleted BP + fix syntax (cc heurs <3) Clement Rouault 2016-07-18 17:38:46 +02:00
  • 13f231d6ad debugger disable memory breakpoint before calling membp.trigger() Clement Rouault 2016-07-18 16:30:17 +02:00
  • 3184cbdeab MemBP has explicit event RWX, add GetProcessDEPPolicy, add Debugger API to disable/re-enable memory BP Clement Rouault 2016-07-18 16:23:11 +02:00
  • 9ebb25017b Better message / WindowsError raised when process die during safe_execute_python Clement Rouault 2016-07-18 14:04:37 +02:00
  • 19205f73a1 Improve debugger handling of memBP for future use + fix MemBP prot init + add failing test of multitple BP with diff prot Clement Rouault 2016-07-13 18:23:26 +02:00
  • 82621b881a Add get_memory_breakpoint_at to debugger + fix token_user in process + add prot param to virtual_alloc Clement Rouault 2016-07-13 16:28:31 +02:00
  • d90e461bcf Playing with advanced breakpoint Clement Rouault 2016-07-13 13:54:42 +02:00
  • 1f6ffd043c Better implementation of MemoryBP Clement Rouault 2016-07-13 13:50:44 +02:00
  • 1590f634d7 Add ReadFile to winproxy Clement Rouault 2016-07-13 10:11:05 +02:00
  • 125888cd60 Add sample / test for memory breakpoint and single step Clement Rouault 2016-07-13 10:10:12 +02:00
  • 8bf3c0312c Checking the beginning of the MemBP is important too... Clement Rouault 2016-07-08 17:23:26 +02:00
  • 400b7b91b0 First try at all BP remove + check range on MemBP for call to .trigger() else ignore Clement Rouault 2016-07-08 17:18:57 +02:00
  • 2f06e9e844 Commit <a l'arrache> for a quick implem of del_bp on standard BP Clement Rouault 2016-07-08 16:21:57 +02:00
  • 4069c0892a Add com sample + update readme/todo Clement Rouault 2016-07-08 13:58:05 +02:00
  • d2883e9c38 Add a sample on memoryBP + singlestep (cc Heurs :D) Clement Rouault 2016-07-08 11:46:15 +02:00
  • fb9cd75f40 Add a sample for the debugger API Clement Rouault 2016-07-08 11:37:49 +02:00
  • 9a980d87b3 First try at single_step and memory breakpoints in Debugger + test Clement Rouault 2016-07-07 17:43:28 +02:00
  • cf6c48b418 Remove some commented old code + fix read/write of REG_QWORD values in registry Clement Rouault 2016-07-07 17:41:57 +02:00
  • b74d7a9e7e Add Jmp/Call Far 16:32 in simple_x86 + clean and simplify syswow-to-64 execution Clement Rouault 2016-07-07 13:16:36 +02:00
  • 2d1f93da45 Add Debugger.attach + simple single_step implementation Clement Rouault 2016-07-06 11:00:30 +02:00
  • 886b445e0e Token.integrity returns a Flag + fix simple_x64 on SIB use for [r13] Clement Rouault 2016-07-04 18:33:35 +02:00
  • 2f4eef23aa Add NtCreateFile to winproxy Clement Rouault 2016-07-04 18:32:36 +02:00
  • 37de039b65 Improve ctypes generation + new struct/func/def for crypt32.dll Clement Rouault 2016-07-01 18:13:09 +02:00
  • 3069b93d21 Remove winproxy.OptionExport + Add some classes ton MEMORY_INFORMATION enum Clement Rouault 2016-07-01 18:12:28 +02:00
  • c2e7b43b9f Add R8 to ECONTEXT64 Clement Rouault 2016-07-01 17:06:20 +02:00
  • 2526727931 Add __mul__ on Instruction + x64 on test_code Clement Rouault 2016-06-29 15:07:14 +02:00
  • 56b8264ffd Add x64.assemble + sample test_code Clement Rouault 2016-06-28 11:31:53 +02:00
  • ce7866cbf3 Improve x86.assemble for int + a demo of code tester Clement Rouault 2016-06-28 11:03:57 +02:00
  • ed42580b4e Fix some x64 encoding of [NEW_REG] | pop/push [RAX] doest not contains a useless prefix anymore Clement Rouault 2016-06-27 14:51:47 +02:00
  • 75c64e4490 Create usable API for sub ctypes generator Clement Rouault 2016-06-24 16:57:21 +02:00
  • 86fe9c9f82 Update generation for ntstatus and add a parallele define module to ApiProxy Clement Rouault 2016-06-24 16:55:25 +02:00
  • 75c48103c4 Added SetConsoleCtrlHandler to winproxy Clement Rouault 2016-06-17 11:14:46 +02:00
  • 4a0669ad41 Add COMImplementation Clement Rouault 2016-06-17 10:18:12 +02:00
  • acdd3ac93e new_generate.py replace old one Clement Rouault 2016-06-16 15:45:18 +02:00
  • 48f6eed961 Working on 'API' to easily import/use new_generate Clement Rouault 2016-06-16 15:11:29 +02:00