mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
223 lines
24 KiB
HTML
223 lines
24 KiB
HTML
<!DOCTYPE html>
|
|
|
|
<html lang="en" data-content_root="../../">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>windows.hooks — PythonForWindows 1.0.2 documentation</title>
|
|
<link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
|
|
<link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
|
|
<link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
|
|
|
|
<script src="../../_static/documentation_options.js?v=1ed6394b"></script>
|
|
<script src="../../_static/doctools.js?v=9a2dae69"></script>
|
|
<script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
|
|
|
|
<link rel="index" title="Index" href="../../genindex.html" />
|
|
<link rel="search" title="Search" href="../../search.html" />
|
|
</head><body>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="../../genindex.html" title="General Index"
|
|
accesskey="I">index</a></li>
|
|
<li class="right" >
|
|
<a href="../../py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> »</li>
|
|
<li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> »</li>
|
|
<li class="nav-item nav-item-this"><a href="">windows.hooks</a></li>
|
|
</ul>
|
|
</div>
|
|
|
|
<div class="document">
|
|
<div class="documentwrapper">
|
|
<div class="bodywrapper">
|
|
<div class="body" role="main">
|
|
|
|
<h1>Source code for windows.hooks</h1><div class="highlight"><pre>
|
|
<span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
|
|
<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">native_exec</span>
|
|
<span class="kn">from</span> <span class="nn">.generated_def</span> <span class="kn">import</span> <span class="n">winfuncs</span>
|
|
<span class="kn">from</span> <span class="nn">.generated_def.windef</span> <span class="kn">import</span> <span class="n">PAGE_EXECUTE_READWRITE</span>
|
|
<span class="kn">from</span> <span class="nn">.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="c1"># TODO Not a big fan of importing 'meta' every load</span>
|
|
<span class="c1"># Should do an Hook API that take the winproxy function (not generate every hook possible)</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def.meta</span>
|
|
|
|
|
|
<div class="viewcode-block" id="Callback">
|
|
<a class="viewcode-back" href="../../iat_hook.html#windows.hooks.Callback">[docs]</a>
|
|
<span class="k">class</span> <span class="nc">Callback</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="w"> </span><span class="sd">"""Give type information to hook callback"""</span>
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">types</span><span class="p">):</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">types</span> <span class="o">=</span> <span class="n">types</span>
|
|
|
|
<span class="k">def</span> <span class="fm">__call__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">func</span><span class="p">):</span>
|
|
<span class="n">func</span><span class="o">.</span><span class="n">_types_info</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">types</span>
|
|
<span class="k">return</span> <span class="n">func</span></div>
|
|
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">KnownCallback</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="n">types</span> <span class="o">=</span> <span class="p">()</span>
|
|
|
|
<span class="k">def</span> <span class="fm">__call__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">func</span><span class="p">):</span>
|
|
<span class="n">func</span><span class="o">.</span><span class="n">_types_info</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">types</span>
|
|
<span class="k">return</span> <span class="n">func</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">add_callback_to_module</span><span class="p">(</span><span class="n">callback</span><span class="p">):</span>
|
|
<span class="nb">setattr</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">modules</span><span class="p">[</span><span class="vm">__name__</span><span class="p">],</span> <span class="nb">type</span><span class="p">(</span><span class="n">callback</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">callback</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Generate IATCallback decorator for all known functions</span>
|
|
|
|
|
|
|
|
<span class="k">for</span> <span class="n">func</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">generated_def</span><span class="o">.</span><span class="n">meta</span><span class="o">.</span><span class="n">functions</span><span class="p">:</span>
|
|
<span class="n">prototype</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">winfuncs</span><span class="p">,</span> <span class="n">func</span> <span class="o">+</span> <span class="s2">"Prototype"</span><span class="p">)</span>
|
|
<span class="n">callback_name</span> <span class="o">=</span> <span class="n">func</span> <span class="o">+</span> <span class="s2">"Callback"</span>
|
|
|
|
<span class="k">class</span> <span class="nc">CallBackDeclaration</span><span class="p">(</span><span class="n">KnownCallback</span><span class="p">):</span>
|
|
<span class="n">types</span> <span class="o">=</span> <span class="p">(</span><span class="n">prototype</span><span class="o">.</span><span class="n">_restype_</span><span class="p">,)</span> <span class="o">+</span> <span class="n">prototype</span><span class="o">.</span><span class="n">_argtypes_</span>
|
|
|
|
<span class="n">CallBackDeclaration</span><span class="o">.</span><span class="vm">__name__</span> <span class="o">=</span> <span class="n">callback_name</span>
|
|
<span class="n">add_callback_to_module</span><span class="p">(</span><span class="n">CallBackDeclaration</span><span class="p">())</span>
|
|
|
|
|
|
<div class="viewcode-block" id="IATHook">
|
|
<a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook">[docs]</a>
|
|
<span class="k">class</span> <span class="nc">IATHook</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="w"> </span><span class="sd">"""Look at my hook <3"""</span>
|
|
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">IAT_entry</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">types</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">callback</span><span class="p">,</span> <span class="s2">"_types_info"</span><span class="p">):</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Callback for IATHook has no type infomations"</span><span class="p">)</span>
|
|
<span class="n">types</span> <span class="o">=</span> <span class="n">callback</span><span class="o">.</span><span class="n">_types_info</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">original_types</span> <span class="o">=</span> <span class="n">types</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">callback_types</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transform_arguments</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">original_types</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span> <span class="o">=</span> <span class="n">IAT_entry</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">callback</span> <span class="o">=</span> <span class="n">callback</span>
|
|
<span class="c1">## No more circular ref -> but stub is destroyed -> segv :(</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">stub</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="bp">self</span><span class="o">.</span><span class="n">callback_types</span><span class="p">)(</span><span class="bp">self</span><span class="o">.</span><span class="n">hook_callback</span><span class="p">)</span>
|
|
<span class="c1"># stub = ctypes.WINFUNCTYPE(*self.callback_types)(self.hook_callback)</span>
|
|
<span class="c1"># self.stub_addr = ctypes.cast(stub, PVOID) # Same problem as keep stub... (GC..)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">stub</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span> <span class="c1"># Same problem as keep stub... (GC..)</span>
|
|
<span class="c1"># IAT_entry.stub = stub</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">realfunction</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="n">types</span><span class="p">)(</span><span class="n">IAT_entry</span><span class="o">.</span><span class="n">nonhookvalue</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span>
|
|
|
|
<span class="k">def</span> <span class="nf">transform_arguments</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">types</span><span class="p">):</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="k">for</span> <span class="nb">type</span> <span class="ow">in</span> <span class="n">types</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="nb">type</span> <span class="ow">in</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar_p</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">):</span>
|
|
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="nb">type</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">res</span>
|
|
|
|
<div class="viewcode-block" id="IATHook.enable">
|
|
<a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook.enable">[docs]</a>
|
|
<span class="k">def</span> <span class="nf">enable</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
|
<span class="w"> </span><span class="sd">"""Enable the IAT hook: you MUST keep a reference to the IATHook while the hook is enabled"""</span>
|
|
<span class="k">with</span> <span class="n">utils</span><span class="o">.</span><span class="n">VirtualProtected</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">),</span> <span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">True</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span></div>
|
|
|
|
|
|
<div class="viewcode-block" id="IATHook.disable">
|
|
<a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook.disable">[docs]</a>
|
|
<span class="k">def</span> <span class="nf">disable</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
|
<span class="w"> </span><span class="sd">"""Disable the IAT hook"""</span>
|
|
<span class="k">with</span> <span class="n">utils</span><span class="o">.</span><span class="n">VirtualProtected</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">),</span> <span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">nonhookvalue</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span></div>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">hook_callback</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
|
|
<span class="n">adapted_args</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="k">for</span> <span class="n">value</span><span class="p">,</span> <span class="nb">type</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">original_types</span><span class="p">[</span><span class="mi">1</span><span class="p">:]):</span>
|
|
<span class="k">if</span> <span class="nb">type</span> <span class="o">==</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar_p</span><span class="p">:</span>
|
|
<span class="n">adapted_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar_p</span><span class="p">(</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="k">elif</span> <span class="nb">type</span> <span class="o">==</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">:</span>
|
|
<span class="n">adapted_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">((</span><span class="n">value</span><span class="p">)))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">adapted_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">value</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">real_function</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">args</span> <span class="o">==</span> <span class="p">():</span>
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">adapted_args</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">realfunction</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">callback</span><span class="p">(</span><span class="o">*</span><span class="n">adapted_args</span><span class="p">,</span> <span class="n">real_function</span><span class="o">=</span><span class="n">real_function</span><span class="p">)</span></div>
|
|
|
|
|
|
<span class="c1">## New simple hook API based on winproxy</span>
|
|
<span class="k">def</span> <span class="nf">setup_hook</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">hook</span><span class="p">,</span> <span class="n">dll_to_hook</span><span class="p">):</span>
|
|
<span class="s2">"TODO: Test and doc :D"</span>
|
|
<span class="n">dll_name</span><span class="p">,</span> <span class="n">api_name</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">get_target</span><span class="p">(</span><span class="n">target</span><span class="p">)</span>
|
|
<span class="n">prototype</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">prototype</span>
|
|
<span class="n">hook</span><span class="o">.</span><span class="n">_types_info</span> <span class="o">=</span> <span class="p">(</span><span class="n">prototype</span><span class="o">.</span><span class="n">_restype_</span><span class="p">,)</span> <span class="o">+</span> <span class="n">prototype</span><span class="o">.</span><span class="n">_argtypes_</span>
|
|
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">dll_name</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">".dll"</span><span class="p">):</span>
|
|
<span class="n">dll_name</span> <span class="o">+=</span> <span class="s2">".dll"</span>
|
|
<span class="c1"># Get the peb of our process</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
|
|
<span class="c1"># Get the dll_to_hook</span>
|
|
<span class="n">module_to_hook</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span> <span class="o">==</span> <span class="n">dll_to_hook</span><span class="o">.</span><span class="n">lower</span><span class="p">()][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="c1"># Get the iat entries for DLL dll_name</span>
|
|
<span class="n">adv_imports</span> <span class="o">=</span> <span class="n">module_to_hook</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">imports</span><span class="p">[</span><span class="n">dll_name</span><span class="p">]</span>
|
|
<span class="c1"># Get RegOpenKeyExA iat entry</span>
|
|
<span class="n">iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">n</span> <span class="k">for</span> <span class="n">n</span> <span class="ow">in</span> <span class="n">adv_imports</span> <span class="k">if</span> <span class="n">n</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="n">api_name</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="n">iat</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">hook</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">iat</span>
|
|
</pre></div>
|
|
|
|
<div class="clearer"></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
|
<div class="sphinxsidebarwrapper">
|
|
<search id="searchbox" style="display: none" role="search">
|
|
<h3 id="searchlabel">Quick search</h3>
|
|
<div class="searchformwrapper">
|
|
<form class="search" action="../../search.html" method="get">
|
|
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
|
|
<input type="submit" value="Go" />
|
|
</form>
|
|
</div>
|
|
</search>
|
|
<script>document.getElementById('searchbox').style.display = "block"</script>
|
|
</div>
|
|
</div>
|
|
<div class="clearer"></div>
|
|
</div>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="../../genindex.html" title="General Index"
|
|
>index</a></li>
|
|
<li class="right" >
|
|
<a href="../../py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> »</li>
|
|
<li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> »</li>
|
|
<li class="nav-item nav-item-this"><a href="">windows.hooks</a></li>
|
|
</ul>
|
|
</div>
|
|
<div class="footer" role="contentinfo">
|
|
© Copyright 2015-2020, Clement Rouault.
|
|
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
|
|
</div>
|
|
</body>
|
|
</html> |