Commit Graph

  • 4436be72c0 first working version of new_generate Clement Rouault 2016-06-16 13:31:16 +02:00
  • e42dafee7c working on cleaner generate.py Clement Rouault 2016-06-16 11:16:33 +02:00
  • 2289895423 Add test + fix Imm32 stuff in x64 Clement Rouault 2016-06-13 18:19:38 +02:00
  • 0f5fce424b Fix test_hook to disable the hook after test Clement Rouault 2016-06-13 18:18:59 +02:00
  • 0b32302591 Remove generate_callback_stub (only IATHook are impacted) Clement Rouault 2016-06-09 18:51:48 +02:00
  • e1f7f1e500 execute_python doest not reinject the shellcode everytime + test hook 64b Clement Rouault 2016-06-08 11:01:19 +02:00
  • f23357c13e Testing hook without generated stub + new hook test in new file Clement Rouault 2016-06-07 19:59:00 +02:00
  • bc9d3b61ef Draft version of system handles Clement Rouault 2016-06-07 17:13:44 +02:00
  • 971610bbe3 [WIP] system.handles Clement Rouault 2016-06-06 17:24:30 +02:00
  • 3d51278039 fix UNICODE_STRING.str / test assemblers / improve com_parser for future work Clement Rouault 2016-06-06 17:24:10 +02:00
  • 899e6b9147 Removed a debug print Clement Rouault 2016-05-23 09:48:00 +02:00
  • aaa680c61c Fix CurrentProcessReadSyswow for windows10 hakril 2016-05-22 12:00:34 +02:00
  • 976ce78455 First try to replace unexisting GetThreadId on XP Clement Rouault 2016-05-20 18:03:36 +02:00
  • 8bee07b8dc Add REG_QWORD handling in registry.py Clement Rouault 2016-05-19 10:59:43 +02:00
  • d09cb4ca51 Add winproxy.is_implemented Clement Rouault 2016-05-18 10:54:58 +02:00
  • dfe8217259 Fix system.version_name on windows10 Clement Rouault 2016-05-13 16:31:07 +02:00
  • 55c4721774 Fix exception stack update in LocalDebugger Clement Rouault 2016-05-09 18:52:55 +02:00
  • 5c8125a9ff Add get_short_path / get_long_path to windows.utils Clement Rouault 2016-05-03 11:23:38 +02:00
  • 10a803e9c9 Add shr/shl + small fix simple_x64 Imm8 + execute_64bits_code_from_syswow able to return ULONG64 Clement Rouault 2016-05-02 18:21:09 +02:00
  • d7127c108c NtStatusException is a WindowsError Clement Rouault 2016-05-02 16:23:13 +02:00
  • dfdeb82682 Let's call it a version 0.2 V0.2 Clement Rouault 2016-04-27 18:27:11 +02:00
  • feeb2e406e Update readme with more features + some simple demos Clement Rouault 2016-04-27 18:25:21 +02:00
  • 3243f6e8fc more doc Clement Rouault 2016-04-27 16:36:17 +02:00
  • c2c3fe2dc2 more doc hakril 2016-04-27 00:33:02 +02:00
  • a988ad03e3 Add struct + thread.teb_base Clement Rouault 2016-04-25 17:48:49 +02:00
  • 57634f076c Add process.time_info Clement Rouault 2016-04-21 10:58:35 +02:00
  • 085c36c706 fix/simplify get_string in pe_parse / adapt syswow.py Clement Rouault 2016-04-21 10:47:00 +02:00
  • 09e9b7efbb Fix get_mapped_filename 32 -> 64 (use NtQueryVirtualMemory) Clement Rouault 2016-04-19 11:49:33 +02:00
  • 5b66242680 writing some doc Clement Rouault 2016-04-18 23:09:26 +02:00
  • 4ab9e97667 fix setup.py to include windows.test Clement Rouault 2016-04-18 21:20:02 +02:00
  • cb3c0f20c0 pe_parse: fix read string PE32 in process 64b Clement Rouault 2016-04-18 11:54:51 +02:00
  • b621e6a09f fix queryworkingset / add test / add virtual protect context manager Clement Rouault 2016-04-18 11:24:41 +02:00
  • 3454801ad0 small fix in Debugger.add_bp Clement Rouault 2016-04-11 19:15:39 +02:00
  • e781e3493f Playing with workingset Clement Rouault 2016-04-11 19:15:23 +02:00
  • 85cb4eef1b add some additional info to full_signature_information Clement Rouault 2016-04-11 10:16:06 +02:00
  • 18bba9b24e Fix pe_parse to handle 32bits PE in 64bits process (PE32 .NET) Clement Rouault 2016-04-08 16:11:55 +02:00
  • ef9b2486ec fix + add some info in Section Clement Rouault 2016-04-08 13:46:06 +02:00
  • b698b27a6f Add process.query_working_set Clement Rouault 2016-04-08 13:45:27 +02:00
  • 0e9ec9ed82 add / fix in registry and registry sample Clement Rouault 2016-04-01 17:34:56 +02:00
  • 6c1b4cf5e6 More doc / sample Clement Rouault 2016-03-30 18:27:40 +02:00
  • 96c8d68297 kernobj.py -> WinObj explorer Clement Rouault 2016-03-30 15:28:04 +02:00
  • 53e131831d Writing / updating some doc hakril 2016-03-29 23:41:54 +02:00
  • 4c1192bf75 Fix crash du to bad declaration / size of CONTEXT64 Clement Rouault 2016-03-29 18:53:04 +02:00
  • da52b1a014 More Nt def/structs/funcs Clement Rouault 2016-03-29 17:19:17 +02:00
  • cf8386400f Fix WinUnicodeString to use Length Clement Rouault 2016-03-29 14:01:40 +02:00
  • ff5ce9ae86 Add EnumType for generated enum Clement Rouault 2016-03-25 16:59:40 +01:00
  • 480cbcf1dc Improving com / wmi API / code Clement Rouault 2016-03-25 15:14:53 +01:00
  • cbd4f0b6b7 More struct/defs/funcs Clement Rouault 2016-03-25 15:13:49 +01:00
  • 9856a1614b Add firewall interface to system.network Clement Rouault 2016-03-25 13:44:04 +01:00
  • eadc0c6963 More COM interfaces/ API Clement Rouault 2016-03-24 18:14:45 +01:00
  • 374e842d3d Add com interfaces generated file Clement Rouault 2016-03-24 16:05:09 +01:00
  • 1a85d99b0e windows.com with a cleaner interface + use in wmi.pu Clement Rouault 2016-03-24 16:03:13 +01:00
  • d794ac8ceb Cleaning/working on windows.com API Clement Rouault 2016-03-24 15:23:15 +01:00
  • 641790f917 Still working on COM ctypes generation Clement Rouault 2016-03-24 14:14:39 +01:00
  • 1b33bbb025 Beginning to generate ctypes for COM interfaces Clement Rouault 2016-03-23 22:11:35 +01:00
  • 34ae5084cd Working/Trying com ctypes generator Clement Rouault 2016-03-23 19:04:15 +01:00
  • 3cb8cc6f9e Refactor: new winobject directory Clement Rouault 2016-03-23 13:42:54 +01:00
  • c24816f51f Improve create_process + test some other utils Clement Rouault 2016-03-22 13:40:03 +01:00
  • d096da3709 Exploring on system attribute and Token Clement Rouault 2016-03-22 13:39:37 +01:00
  • 9cae319c11 New registry API Clement Rouault 2016-03-22 13:39:11 +01:00
  • f06afc9b79 winproxy imported directly, use same format for call Clement Rouault 2016-03-22 13:38:45 +01:00
  • db4c51dc67 Syswow64ApiProxy now handle None from OptionalExport Clement Rouault 2016-03-22 13:37:22 +01:00
  • 1422db08ae More winproxy functions Clement Rouault 2016-03-22 13:30:44 +01:00
  • 16ef768f3f Unifor the import / use of winproxy Clement Rouault 2016-03-21 13:27:23 +01:00
  • fb0171b8b9 WinpProcess in not a PROCESSENTRY32 anymore Clement Rouault 2016-03-21 13:18:01 +01:00
  • 8628ff5595 new funcs + struct + fix winobject Clement Rouault 2016-03-18 18:04:50 +01:00
  • 5f1c841b75 Add ctypes struct pprinter Clement Rouault 2016-03-18 18:03:45 +01:00
  • 6a305458d5 Add signature verification by catalog Clement Rouault 2016-03-18 18:01:57 +01:00
  • faa0acd030 Add services and volumes files Clement Rouault 2016-03-18 11:24:02 +01:00
  • 78f9733295 Add del_bp + import LocalDebugger Clement Rouault 2016-03-18 11:16:53 +01:00
  • a4090ea215 Add some defs + wintrust catalog functions Clement Rouault 2016-03-16 16:33:38 +01:00
  • 9db75b0226 Add some doc/sample on LocalDebugger Clement Rouault 2016-02-12 15:06:41 +01:00
  • 5ffa21cd8a LocalDebugger sample + fix Clement Rouault 2016-02-12 14:44:00 +01:00
  • 9a1088daab Small fixes in DOC + update winproxy function list hakril 2016-02-10 23:01:32 +01:00
  • f9ce637ffa Small doc stuff + fix setup.py Clement Rouault 2016-02-10 17:51:54 +01:00
  • c5e021f10d Writing samples and doc ! Clement Rouault 2016-02-10 17:30:54 +01:00
  • c40cb0c8b0 Add get_mapped_filename to WinProcess Clement Rouault 2016-02-10 16:29:46 +01:00
  • b789a12040 Improve debugger + pe_parse 'guess' the PE type (32/64) Clement Rouault 2016-02-10 16:27:53 +01:00
  • 401db9c347 Working on debugger (str address + rewrite + test) Clement Rouault 2016-02-10 11:53:13 +01:00
  • 6cf4a9cae4 Add test / fix Winprocess.load_library / free some of the memory Clement Rouault 2016-02-03 17:47:07 +01:00
  • 9fbba331ca Add NTSTATUS to windef/add virtual_free/improve nativeutils GetProcAddr + test Clement Rouault 2016-02-02 18:45:24 +01:00
  • 3f06e95617 First - shameful version of syswow64 debugging Clement Rouault 2016-02-01 18:45:51 +01:00
  • 0da86e20aa SetThreadContext 32<->64 + test Clement Rouault 2016-02-01 17:31:56 +01:00
  • d720170781 Big commit GetProcAddrss 32 and 64 (fixed) Clement Rouault 2016-01-29 18:05:21 +01:00
  • 5b5db57e17 Rewrite injected stub for remote python -> now have nice threads handling Clement Rouault 2016-01-29 13:51:35 +01:00
  • 7be3561ccf Better remote veh sample :) Clement Rouault 2016-01-28 17:02:18 +01:00
  • ee62d6a972 Add sample on veh handle setup in remote process Clement Rouault 2016-01-28 16:58:12 +01:00
  • f307f8202a Add Process.write_[dq]word + rewrite injection.py to use PEB parsing if needed Clement Rouault 2016-01-28 16:48:44 +01:00
  • 38a2298dee Add nativeutils.py with GetProcAddress64 + add instr to x86/x64 assembler + add merge of labels in multipleinstr (dummy function support) Clement Rouault 2016-01-28 15:13:49 +01:00
  • ec4862439f Add LdrLoadDLL + Fix winproxy.VirtualProtect Commit2 hakril 2016-01-27 12:41:41 +01:00
  • 6d8796f3ed Add LdrLoadDLL + Fix winproxy.VirtualProtect + add a first draft on veh sample hakril 2016-01-26 22:06:02 +01:00
  • 588a1e0461 Update TODO Clement Rouault 2016-01-26 18:12:59 +01:00
  • 010453e96d Fix test + Fix a Use-After-CloseHandle in debugger + add dbgprint on HANDLE Clement Rouault 2016-01-26 14:50:21 +01:00
  • 7c35615319 Working / testing the debugger Clement Rouault 2016-01-25 19:11:51 +01:00
  • cf89d25486 Slowly working on debug.py hakril 2016-01-25 09:45:09 +01:00
  • 99788d0368 Writting a debugger is fun :D Clement Rouault 2016-01-22 18:19:00 +01:00
  • f6f206b842 Still playing will debug API + add Winprocess.read_[dq]word hakril 2016-01-21 00:43:41 +01:00
  • 6b75fe3185 Playing with Token and Debugger API Clement Rouault 2016-01-20 19:07:18 +01:00
  • f43f7c4838 Fix WinProcess.is_exit + test case hakril 2016-01-19 23:50:10 +01:00
  • fad8121cbf Updated TODO and test for CreateFile error_check fix hakril 2016-01-13 23:43:04 +01:00