5. windows.utils – Windows Utilities

5.1. Context Managers

windows.utils provides some context managers wrapping standard contextual operations like VirtualProtect or SysWow Redirection

5.1.1. VirtualProtected

class windows.utils.VirtualProtected(addr, size, new_protect)[source]

A context manager usable like VirtualProtect that will restore the old protection at exit

with utils.VirtualProtected(IATentry.addr, ctypes.sizeof(PVOID), windef.PAGE_EXECUTE_READWRITE):
    IATentry.value = 0x42424242

5.1.2. DisableWow64FsRedirection

class windows.utils.DisableWow64FsRedirection[source]

A context manager that disable the SysWow64 Filesystem Redirection

if is_process_32_bits:
    def pop_calc_64():
        with windows.utils.DisableWow64FsRedirection():
            return windows.utils.create_process(r"C:\Windows\system32\calc.exe", True)

5.2. Helper functions

windows.utils.enable_privilege(lpszPrivilege, bEnablePrivilege)[source]

Enable or disable a privilege:

enable_privilege(SE_DEBUG_NAME, True)
windows.utils.check_is_elevated()[source]

Return True if process is Admin

windows.utils.check_debug()[source]

Check that kernel is in debug mode (beware of NOUMEX):

https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx#_______noumex______

windows.utils.create_process(path, args=None, dwCreationFlags=0, show_windows=True)[source]

A convenient wrapper arround windows.winproxy.CreateProcessA()

windows.utils.create_console()[source]

Create a new console displaying STDOUT. Useful in injection of GUI process

windows.utils.pop_shell()[source]

Pop a console with an InterativeConsole

windows.utils.create_file_from_handle(handle, mode='r')[source]

Return a Python file around a Windows HANDLE

windows.utils.get_handle_from_file(f)[source]

Get the Windows HANDLE of a python file