admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
hakril-PythonForWindows/docs/build/html/native_exec.html
T
hakril 8fa8cf9be1 Regenerating documentation for 1.0.4
2025-08-14 10:37:06 +02:00

570 lines
61 KiB
HTML
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html lang="en" data-content_root="./">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>3. windows.native_exec – Native Code Execution &#8212; PythonForWindows 1.0.4 documentation</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="_static/classic.css?v=def86cc0" />
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css?v=957880af" />
<script src="_static/documentation_options.js?v=71272d9f"></script>
<script src="_static/doctools.js?v=9a2dae69"></script>
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="4. windows.winproxy – Windows API" href="winproxy.html" />
<link rel="prev" title="2.17. ETW – Event Tracing for Windows" href="etw.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="winproxy.html" title="4. windows.winproxy – Windows API"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="etw.html" title="2.17. ETW – Event Tracing for Windows"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">3. </span><code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="windows-native-exec-native-code-execution">
<span id="module-windows.native_exec"></span><h1><span class="section-number">3. </span><code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution<a class="headerlink" href="#windows-native-exec-native-code-execution" title="Link to this heading"></a></h1>
<p><a class="reference internal" href="#module-windows.native_exec" title="windows.native_exec"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec</span></code></a> allows to create <code class="docutils literal notranslate"><span class="pre">Python</span></code> functions calling native code.
it also provides a simple assembler for x86 and x64.</p>
<p><a class="reference internal" href="#module-windows.native_exec" title="windows.native_exec"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec</span></code></a> provides those functions:</p>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.create_function">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.</span></span><span class="sig-name descname"><span class="pre">create_function</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">types</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">calling_convention=&lt;function</span> <span class="pre">CFUNCTYPE&gt;</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/native_function.html#create_function"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.create_function" title="Link to this definition"></a></dt>
<dd><p>Create a python function that call raw machine code</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><ul class="simple">
<li><p><strong>code</strong> (<em>str</em>) – Raw machine code that will be called</p></li>
<li><p><strong>types</strong> (<em>list</em>) – Return type and parameters type (see <code class="xref py py-mod docutils literal notranslate"><span class="pre">ctypes</span></code>)</p></li>
</ul>
</dd>
<dt class="field-even">Returns<span class="colon">:</span></dt>
<dd class="field-even"><p>the created function</p>
</dd>
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p>function</p>
</dd>
</dl>
</dd></dl>
<dl class="simple">
<dt>The <a class="reference internal" href="#module-windows.native_exec" title="windows.native_exec"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec</span></code></a> also contains some submodules:</dt><dd><ul class="simple">
<li><p><a class="reference internal" href="#module-windows.native_exec.cpuid" title="windows.native_exec.cpuid"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.cpuid</span></code></a></p></li>
<li><p><a class="reference internal" href="#module-windows.native_exec.simple_x86" title="windows.native_exec.simple_x86"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code></a></p></li>
<li><p><a class="reference internal" href="#module-windows.native_exec.simple_x64" title="windows.native_exec.simple_x64"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code></a></p></li>
</ul>
</dd>
</dl>
<section id="module-windows.native_exec.cpuid">
<span id="windows-native-exec-cpuid-interface-to-native-cpuid"></span><h2><span class="section-number">3.1. </span><a class="reference internal" href="#module-windows.native_exec.cpuid" title="windows.native_exec.cpuid"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.cpuid</span></code></a> – Interface to native CPUID<a class="headerlink" href="#module-windows.native_exec.cpuid" title="Link to this heading"></a></h2>
<dl class="py class">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X64CpuidResult">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">X64CpuidResult</span></span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#X64CpuidResult"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.X64CpuidResult" title="Link to this definition"></a></dt>
<dd></dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X86AmdCpuidFamilly">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">X86AmdCpuidFamilly</span></span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#X86AmdCpuidFamilly"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.X86AmdCpuidFamilly" title="Link to this definition"></a></dt>
<dd><dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X86AmdCpuidFamilly.fields">
<span class="sig-name descname"><span class="pre">fields</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">['SteppingID',</span> <span class="pre">'ModelID',</span> <span class="pre">'FamilyID',</span> <span class="pre">'Reserved2',</span> <span class="pre">'ExtendedModel',</span> <span class="pre">'ExtendedFamily',</span> <span class="pre">'Reserved']</span></em><a class="headerlink" href="#windows.native_exec.cpuid.X86AmdCpuidFamilly.fields" title="Link to this definition"></a></dt>
<dd><p>Fields of the Structure</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X86CpuidResult">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">X86CpuidResult</span></span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#X86CpuidResult"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.X86CpuidResult" title="Link to this definition"></a></dt>
<dd><p>Raw result of the CPUID instruction</p>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X86CpuidResult.fields">
<span class="sig-name descname"><span class="pre">fields</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">['EAX',</span> <span class="pre">'EBX',</span> <span class="pre">'ECX',</span> <span class="pre">'EDX']</span></em><a class="headerlink" href="#windows.native_exec.cpuid.X86CpuidResult.fields" title="Link to this definition"></a></dt>
<dd><p>Fields of the Structure</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X86IntelCpuidFamilly">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">X86IntelCpuidFamilly</span></span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#X86IntelCpuidFamilly"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.X86IntelCpuidFamilly" title="Link to this definition"></a></dt>
<dd><dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.X86IntelCpuidFamilly.fields">
<span class="sig-name descname"><span class="pre">fields</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">['SteppingID',</span> <span class="pre">'ModelID',</span> <span class="pre">'FamilyID',</span> <span class="pre">'ProcessorType',</span> <span class="pre">'Reserved2',</span> <span class="pre">'ExtendedModel',</span> <span class="pre">'ExtendedFamily',</span> <span class="pre">'Reserved']</span></em><a class="headerlink" href="#windows.native_exec.cpuid.X86IntelCpuidFamilly.fields" title="Link to this definition"></a></dt>
<dd><p>Fields of the Structure</p>
</dd></dl>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.do_cpuid">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">do_cpuid</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">req</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#do_cpuid"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.do_cpuid" title="Link to this definition"></a></dt>
<dd><p>Performs a CPUID for the current process bitness</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.native_exec.cpuid.X86CpuidResult" title="windows.native_exec.cpuid.X86CpuidResult"><code class="xref py py-class docutils literal notranslate"><span class="pre">X86CpuidResult</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.get_proc_family_model">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">get_proc_family_model</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#get_proc_family_model"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.get_proc_family_model" title="Link to this definition"></a></dt>
<dd><p>Extracts the family and model based on vendorId</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p>(ComputedFamily, ComputedModel)</p>
</dd>
</dl>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.get_vendor_id">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">get_vendor_id</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#get_vendor_id"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.get_vendor_id" title="Link to this definition"></a></dt>
<dd><p>Extracts the VendorId string from CPUID</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.is_amd_proc">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">is_amd_proc</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#is_amd_proc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.is_amd_proc" title="Link to this definition"></a></dt>
<dd><p>get_vendor_id() == b’AuthenticAMD’</p>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.is_intel_proc">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">is_intel_proc</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#is_intel_proc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.is_intel_proc" title="Link to this definition"></a></dt>
<dd><p>get_vendor_id() == b’GenuineIntel’</p>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.x64_cpuid">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">x64_cpuid</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">req</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#x64_cpuid"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.x64_cpuid" title="Link to this definition"></a></dt>
<dd><p>Performs a CPUID in 64bits mode</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.native_exec.cpuid.X86CpuidResult" title="windows.native_exec.cpuid.X86CpuidResult"><code class="xref py py-class docutils literal notranslate"><span class="pre">X86CpuidResult</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.cpuid.x86_cpuid">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.cpuid.</span></span><span class="sig-name descname"><span class="pre">x86_cpuid</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">req</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/cpuid.html#x86_cpuid"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.cpuid.x86_cpuid" title="Link to this definition"></a></dt>
<dd><p>Performs a CPUID in 32bits mode</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.native_exec.cpuid.X86CpuidResult" title="windows.native_exec.cpuid.X86CpuidResult"><code class="xref py py-class docutils literal notranslate"><span class="pre">X86CpuidResult</span></code></a></p>
</dd>
</dl>
</dd></dl>
<p>Demo:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="kn">import</span> <span class="nn">windows.native_exec.cpuid</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">cpuid</span><span class="o">.</span><span class="n">do_cpuid</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span>
<span class="go">&lt;windows.native_exec.cpuid.X86CpuidResult object at 0x0330D990&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">cpuid</span><span class="o">.</span><span class="n">do_cpuid</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x</span><span class="o">.</span><span class="n">EAX</span>
<span class="go">13L</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x</span><span class="o">.</span><span class="n">EBX</span>
<span class="go">1970169159L</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">cpuid</span><span class="o">.</span><span class="n">get_vendor_id</span><span class="p">()</span>
<span class="go">&#39;GenuineIntel&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">cpuid</span><span class="o">.</span><span class="n">get_proc_family_model</span><span class="p">()</span>
<span class="go">(6L, 58L)</span>
</pre></div>
</div>
</section>
<section id="module-windows.native_exec.simple_x86">
<span id="windows-native-exec-simple-x86-x86-assembler"></span><h2><span class="section-number">3.2. </span><a class="reference internal" href="#module-windows.native_exec.simple_x86" title="windows.native_exec.simple_x86"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code></a> – X86 Assembler<a class="headerlink" href="#module-windows.native_exec.simple_x86" title="Link to this heading"></a></h2>
<p>The <a class="reference internal" href="#module-windows.native_exec.simple_x86" title="windows.native_exec.simple_x86"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code></a> module allows to create simple x86 code.</p>
<dl class="simple">
<dt>Its features are:</dt><dd><ul class="simple">
<li><p>Forward - Backward jump (using labels)</p></li>
<li><p>Non-string interface for conditional/context dependent generation</p></li>
</ul>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The assembler DOES NOT handle every instruction at all.</p>
</div>
<p>The assembler instructions are <code class="docutils literal notranslate"><span class="pre">Python</span></code> object that may accept arguments representing
the mnemonic operands.</p>
<dl class="simple">
<dt>These parameters can be of type:</dt><dd><ul class="simple">
<li><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code> (register)</p></li>
<li><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> (int)</p></li>
<li><p><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access" title="windows.native_exec.simple_x86.mem_access"><code class="xref py py-class docutils literal notranslate"><span class="pre">mem_access</span></code></a> (memory access)</p></li>
</ul>
</dd>
</dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem_access">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.native_exec.simple_x86.</span></span><span class="sig-name descname"><span class="pre">mem_access</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">index</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">scale</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">disp</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prefix</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.native_exec.simple_x86.mem_access" title="Link to this definition"></a></dt>
<dd><dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem_access.base">
<span class="sig-name descname"><span class="pre">base</span></span><a class="headerlink" href="#windows.native_exec.simple_x86.mem_access.base" title="Link to this definition"></a></dt>
<dd><p>Alias for field number 0</p>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem_access.disp">
<span class="sig-name descname"><span class="pre">disp</span></span><a class="headerlink" href="#windows.native_exec.simple_x86.mem_access.disp" title="Link to this definition"></a></dt>
<dd><p>Alias for field number 3</p>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem_access.index">
<span class="sig-name descname"><span class="pre">index</span></span><a class="headerlink" href="#windows.native_exec.simple_x86.mem_access.index" title="Link to this definition"></a></dt>
<dd><p>Alias for field number 1</p>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem_access.prefix">
<span class="sig-name descname"><span class="pre">prefix</span></span><a class="headerlink" href="#windows.native_exec.simple_x86.mem_access.prefix" title="Link to this definition"></a></dt>
<dd><p>Alias for field number 4</p>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem_access.scale">
<span class="sig-name descname"><span class="pre">scale</span></span><a class="headerlink" href="#windows.native_exec.simple_x86.mem_access.scale" title="Link to this definition"></a></dt>
<dd><p>Alias for field number 2</p>
</dd></dl>
</dd></dl>
<dl class="simple">
<dt>The <a class="reference internal" href="#windows.native_exec.simple_x86.mem_access" title="windows.native_exec.simple_x86.mem_access"><code class="xref py py-class docutils literal notranslate"><span class="pre">mem_access</span></code></a> object can be created:</dt><dd><ul class="simple">
<li><p>By hand</p></li>
<li><p>Using <a class="reference internal" href="#windows.native_exec.simple_x86.create_displacement" title="windows.native_exec.simple_x86.create_displacement"><code class="xref py py-func docutils literal notranslate"><span class="pre">create_displacement()</span></code></a></p></li>
<li><p>Using <a class="reference internal" href="#windows.native_exec.simple_x86.mem" title="windows.native_exec.simple_x86.mem"><code class="xref py py-func docutils literal notranslate"><span class="pre">mem()</span></code></a></p></li>
</ul>
</dd>
</dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.create_displacement">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.simple_x86.</span></span><span class="sig-name descname"><span class="pre">create_displacement</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">index</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">scale</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">disp</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prefix</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/simple_x86.html#create_displacement"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.simple_x86.create_displacement" title="Link to this definition"></a></dt>
<dd><p>Creates a X86 memory access description</p>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.deref">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.simple_x86.</span></span><span class="sig-name descname"><span class="pre">deref</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">disp</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/simple_x86.html#deref"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.simple_x86.deref" title="Link to this definition"></a></dt>
<dd><p>Create a memory access for an immediate value <code class="docutils literal notranslate"><span class="pre">Ex:</span> <span class="pre">[0x42424242]</span></code></p>
</dd></dl>
<dl class="py function">
<dt class="sig sig-object py" id="windows.native_exec.simple_x86.mem">
<span class="sig-prename descclassname"><span class="pre">windows.native_exec.simple_x86.</span></span><span class="sig-name descname"><span class="pre">mem</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/native_exec/simple_x86.html#mem"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.native_exec.simple_x86.mem" title="Link to this definition"></a></dt>
<dd><p>Parse a memory access string of format <code class="docutils literal notranslate"><span class="pre">[EXPR]</span></code> or <code class="docutils literal notranslate"><span class="pre">seg:[EXPR]</span></code></p>
<p><code class="docutils literal notranslate"><span class="pre">EXPR</span></code> may describe: <code class="docutils literal notranslate"><span class="pre">BASE</span> <span class="pre">|</span> <span class="pre">INDEX</span> <span class="pre">*</span> <span class="pre">SCALE</span> <span class="pre">|</span> <span class="pre">DISPLACEMENT</span></code> or any combinaison (in this order)</p>
</dd></dl>
<p>Instruction assembling:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="gp">&gt;&gt;&gt; </span><span class="kn">import</span> <span class="nn">random</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x86</span><span class="o">.</span><span class="n">Mov</span>
<span class="go">&lt;class &#39;windows.native_exec.simple_x86.Mov&#39;&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">instr</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="s2">&quot;EBX&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">instr</span>
<span class="go">&lt;windows.native_exec.simple_x86.Mov object at 0x03243770&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">instr</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;\x89\xd8&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="mh">0x42424242</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;\xc7\xc0BBBB&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="n">x86</span><span class="o">.</span><span class="n">create_displacement</span><span class="p">(</span><span class="n">base</span><span class="o">=</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="n">disp</span><span class="o">=</span><span class="n">random</span><span class="o">.</span><span class="n">randint</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="mh">0xffffffff</span><span class="p">)))</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;\x8b\x80\x977\n&amp;&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[EBX + EDI * 2 + 0x11111111]&quot;</span><span class="p">),</span> <span class="s2">&quot;EAX&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;\x89\x84{\x11\x11\x11\x11&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;gs:[EBX + EDI * 2 + 0x11111111]&quot;</span><span class="p">),</span> <span class="s2">&quot;EAX&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;e\x89\x84{\x11\x11\x11\x11&#39;</span>
</pre></div>
</div>
<p><a class="reference internal" href="#module-windows.native_exec.simple_x86" title="windows.native_exec.simple_x86"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code></a> also provides an interface to complex shellcode assembling
including jump and label via the <code class="xref py py-class docutils literal notranslate"><span class="pre">MultipleInstr</span></code> class.</p>
<p>Shellcode assembling:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Label</span><span class="p">(</span><span class="s2">&quot;:BEGIN&quot;</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Jmp</span><span class="p">(</span><span class="s2">&quot;:BEGIN&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()))</span>
<span class="c1"># &#39;\xeb\xfe&#39;</span>
</pre></div>
</div>
<p>Another example from a project:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">IO_STACK_INPUT_BUFFER_LEN</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;[ESI + 8]&#39;</span><span class="p">)</span>
<span class="n">IO_STACK_INPUT_BUFFER</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;[ESI + 0x10]&#39;</span><span class="p">)</span>
<span class="n">INPUT_BUFFER_SIZE</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;[ECX]&#39;</span><span class="p">)</span>
<span class="n">INPUT_BUFFER_PORT</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;[ECX + 4]&#39;</span><span class="p">)</span>
<span class="n">INPUT_BUFFER_VALUE</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;[ECX + 8]&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Cmp</span><span class="p">(</span><span class="n">IO_STACK_INPUT_BUFFER_LEN</span><span class="p">,</span> <span class="mh">0xc</span><span class="p">)</span> <span class="c1"># size indicator / port / value</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Jnz</span><span class="p">(</span><span class="s2">&quot;:FAIL&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;ECX&#39;</span><span class="p">,</span> <span class="n">IO_STACK_INPUT_BUFFER</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;EDX&#39;</span><span class="p">,</span> <span class="n">INPUT_BUFFER_PORT</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;EAX&#39;</span><span class="p">,</span> <span class="n">INPUT_BUFFER_VALUE</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;ECX&#39;</span><span class="p">,</span> <span class="n">INPUT_BUFFER_SIZE</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Cmp</span><span class="p">(</span><span class="s1">&#39;ECX&#39;</span><span class="p">,</span> <span class="mh">0x1</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Jnz</span><span class="p">(</span><span class="s2">&quot;:OUT_2_OR_4&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Out</span><span class="p">(</span><span class="s1">&#39;DX&#39;</span><span class="p">,</span> <span class="s1">&#39;AL&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Jmp</span><span class="p">(</span><span class="s1">&#39;:SUCCESS&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Label</span><span class="p">(</span><span class="s2">&quot;:OUT_2_OR_4&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Cmp</span><span class="p">(</span><span class="s1">&#39;ECX&#39;</span><span class="p">,</span> <span class="mh">0x2</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Jnz</span><span class="p">(</span><span class="s2">&quot;:OUT_4&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Out</span><span class="p">(</span><span class="s1">&#39;DX&#39;</span><span class="p">,</span> <span class="s1">&#39;AX&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Jmp</span><span class="p">(</span><span class="s1">&#39;:SUCCESS&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Label</span><span class="p">(</span><span class="s2">&quot;:OUT_4&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Out</span><span class="p">(</span><span class="s1">&#39;DX&#39;</span><span class="p">,</span> <span class="s1">&#39;EAX&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Label</span><span class="p">(</span><span class="s2">&quot;:SUCCESS&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Xor</span><span class="p">(</span><span class="s1">&#39;EAX&#39;</span><span class="p">,</span> <span class="s1">&#39;EAX&#39;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Label</span><span class="p">(</span><span class="s2">&quot;:FAIL&quot;</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;EAX&#39;</span><span class="p">,</span> <span class="mh">0x0C000000D</span><span class="p">)</span>
<span class="n">out_ioctl</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">out_ioctl</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="s1">&#39;</span><span class="se">\x81</span><span class="s1">~</span><span class="se">\x08\x0c\x00\x00\x00</span><span class="s1">u&amp;</span><span class="se">\x8b</span><span class="s1">N</span><span class="se">\x10\x8b</span><span class="s1">Q</span><span class="se">\x04\x8b</span><span class="s1">A</span><span class="se">\x08\x8b\t\x81\xf9\x01\x00\x00\x00</span><span class="s1">u</span><span class="se">\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00</span><span class="s1">u</span><span class="se">\x04</span><span class="s1">f</span><span class="se">\xef\xeb\x01\xef</span><span class="s1">1</span><span class="se">\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3</span><span class="s1">&#39;</span>
</pre></div>
</div>
</section>
<section id="module-windows.native_exec.simple_x64">
<span id="windows-native-exec-simple-x64-x64-assembler"></span><h2><span class="section-number">3.3. </span><a class="reference internal" href="#module-windows.native_exec.simple_x64" title="windows.native_exec.simple_x64"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code></a> – X64 Assembler<a class="headerlink" href="#module-windows.native_exec.simple_x64" title="Link to this heading"></a></h2>
<p>Same things as <a class="reference internal" href="#module-windows.native_exec.simple_x86" title="windows.native_exec.simple_x86"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code></a></p>
<dl class="simple">
<dt>The only things that change are:</dt><dd><ul class="simple">
<li><p>The registers name</p></li>
</ul>
</dd>
</dl>
<p><a class="reference internal" href="#module-windows.native_exec.simple_x64" title="windows.native_exec.simple_x64"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code></a> handles 32 and 64 bits operations.</p>
<p>Demo:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">,</span> <span class="s2">&quot;R13&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;L\x89\xe8&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="s2">&quot;EDI&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;\x89\xf8&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">,</span> <span class="s2">&quot;EDI&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&quot;&quot;&quot;</span>
<span class="go">ValueError: Size mismatch</span>
<span class="go">&quot;&quot;&quot;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[EAX]&quot;</span><span class="p">))</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;gH\x8b\x00&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[RAX]&quot;</span><span class="p">))</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;H\x8b\x00&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[RAX]&quot;</span><span class="p">))</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;\x8b\x00&#39;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[EAX]&quot;</span><span class="p">))</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="go">&#39;g\x8b\x00&#39;</span>
</pre></div>
</div>
</section>
<section id="module-windows.native_exec.nativeutils">
<span id="windows-native-exec-nativeutils-native-utility-functions"></span><h2><span class="section-number">3.4. </span><a class="reference internal" href="#module-windows.native_exec.nativeutils" title="windows.native_exec.nativeutils"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.nativeutils</span></code></a> – Native utility functions<a class="headerlink" href="#module-windows.native_exec.nativeutils" title="Link to this heading"></a></h2>
<p>This module contains some native-code functions that can be used for various purposes.
Each function export a label that allow another <code class="xref py py-class docutils literal notranslate"><span class="pre">MultipleInstr</span></code> to call the code of the function.</p>
<p>The current functions are:</p>
<blockquote>
<div><ul>
<li><p><code class="docutils literal notranslate"><span class="pre">StrlenW64</span></code> A 64bits wide-string STRLEN (<code class="docutils literal notranslate"><span class="pre">Label(&quot;:FUNC_STRLENW64&quot;)</span></code>)</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">StrlenA64</span></code> A 64bits ASCII STRLEN (<code class="docutils literal notranslate"><span class="pre">Label(&quot;:FUNC_STRLENA64&quot;)</span></code>)</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">GetProcAddress64</span></code> A 64bits export resolver (<code class="docutils literal notranslate"><span class="pre">Label(&quot;:FUNC_GETPROCADDRESS64&quot;)</span></code>)</p>
<blockquote>
<div><ul>
<li><p>Arg1: The DLL (wstring)</p></li>
<li><p>Arg2: The API (string)</p></li>
<li><p>Return value:</p>
<blockquote>
<div><ul class="simple">
<li><p>0xfffffffffffffffe if the DLL is not found</p></li>
<li><p>0xffffffffffffffff if the API is not found</p></li>
<li><p>The address of the function</p></li>
</ul>
</div></blockquote>
</li>
</ul>
</div></blockquote>
</li>
<li><p><code class="docutils literal notranslate"><span class="pre">StrlenW32</span></code> A 32bits wide-string STRLEN (<code class="docutils literal notranslate"><span class="pre">Label(&quot;:FUNC_STRLENW32&quot;)</span></code>)</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">StrlenA32</span></code> A 32bits ASCII STRLEN (<code class="docutils literal notranslate"><span class="pre">Label(&quot;:FUNC_STRLENA32&quot;)</span></code>)</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">GetProcAddress32</span></code> A 32bits export resolver (<code class="docutils literal notranslate"><span class="pre">Label(&quot;:FUNC_GETPROCADDRESS32&quot;)</span></code>)</p>
<blockquote>
<div><ul>
<li><p>Arg1: The DLL (wstring)</p></li>
<li><p>Arg2: The API (string)</p></li>
<li><p>Return value:</p>
<blockquote>
<div><ul class="simple">
<li><p>0xfffffffe if the DLL is not found</p></li>
<li><p>0xffffffff if the API is not found</p></li>
<li><p>The address of the function</p></li>
</ul>
</div></blockquote>
</li>
</ul>
</div></blockquote>
</li>
</ul>
</div></blockquote>
<p>To use those functions in a <code class="xref py py-class docutils literal notranslate"><span class="pre">MultipleInstr</span></code> just call the label in your code and append the function at
the end of your <code class="xref py py-class docutils literal notranslate"><span class="pre">MultipleInstr</span></code></p>
<p>Example:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">RemoteManualLoadLibray</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;ECX&quot;</span><span class="p">,</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[ESP + 4]&quot;</span><span class="p">))</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[ECX + 4]&quot;</span><span class="p">))</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[ECX]&quot;</span><span class="p">))</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Call</span><span class="p">(</span><span class="s2">&quot;:FUNC_GETPROCADDRESS32&quot;</span><span class="p">)</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[ECX + 8]&quot;</span><span class="p">))</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Call</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">)</span> <span class="c1"># LoadLibrary</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s2">&quot;ECX&quot;</span><span class="p">)</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s2">&quot;ECX&quot;</span><span class="p">)</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">RemoteManualLoadLibray</span> <span class="o">+=</span> <span class="n">GetProcAddress32</span>
</pre></div>
</div>
</section>
</section>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div>
<h3><a href="index.html">Table of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a><ul>
<li><a class="reference internal" href="#windows.native_exec.create_function"><code class="docutils literal notranslate"><span class="pre">create_function()</span></code></a></li>
<li><a class="reference internal" href="#module-windows.native_exec.cpuid">3.1. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.cpuid</span></code> – Interface to native CPUID</a><ul>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X64CpuidResult"><code class="docutils literal notranslate"><span class="pre">X64CpuidResult</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X86AmdCpuidFamilly"><code class="docutils literal notranslate"><span class="pre">X86AmdCpuidFamilly</span></code></a><ul>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X86AmdCpuidFamilly.fields"><code class="docutils literal notranslate"><span class="pre">fields</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X86CpuidResult"><code class="docutils literal notranslate"><span class="pre">X86CpuidResult</span></code></a><ul>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X86CpuidResult.fields"><code class="docutils literal notranslate"><span class="pre">fields</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X86IntelCpuidFamilly"><code class="docutils literal notranslate"><span class="pre">X86IntelCpuidFamilly</span></code></a><ul>
<li><a class="reference internal" href="#windows.native_exec.cpuid.X86IntelCpuidFamilly.fields"><code class="docutils literal notranslate"><span class="pre">fields</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.do_cpuid"><code class="docutils literal notranslate"><span class="pre">do_cpuid()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.get_proc_family_model"><code class="docutils literal notranslate"><span class="pre">get_proc_family_model()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.get_vendor_id"><code class="docutils literal notranslate"><span class="pre">get_vendor_id()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.is_amd_proc"><code class="docutils literal notranslate"><span class="pre">is_amd_proc()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.is_intel_proc"><code class="docutils literal notranslate"><span class="pre">is_intel_proc()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.x64_cpuid"><code class="docutils literal notranslate"><span class="pre">x64_cpuid()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.cpuid.x86_cpuid"><code class="docutils literal notranslate"><span class="pre">x86_cpuid()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#module-windows.native_exec.simple_x86">3.2. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code> – X86 Assembler</a><ul>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access"><code class="docutils literal notranslate"><span class="pre">mem_access</span></code></a><ul>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access.base"><code class="docutils literal notranslate"><span class="pre">base</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access.disp"><code class="docutils literal notranslate"><span class="pre">disp</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access.index"><code class="docutils literal notranslate"><span class="pre">index</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access.prefix"><code class="docutils literal notranslate"><span class="pre">prefix</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem_access.scale"><code class="docutils literal notranslate"><span class="pre">scale</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.create_displacement"><code class="docutils literal notranslate"><span class="pre">create_displacement()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.deref"><code class="docutils literal notranslate"><span class="pre">deref()</span></code></a></li>
<li><a class="reference internal" href="#windows.native_exec.simple_x86.mem"><code class="docutils literal notranslate"><span class="pre">mem()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#module-windows.native_exec.simple_x64">3.3. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code> – X64 Assembler</a></li>
<li><a class="reference internal" href="#module-windows.native_exec.nativeutils">3.4. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.nativeutils</span></code> – Native utility functions</a></li>
</ul>
</li>
</ul>
</div>
<div>
<h4>Previous topic</h4>
<p class="topless"><a href="etw.html"
title="previous chapter"><span class="section-number">2.17. </span>ETW – Event Tracing for Windows</a></p>
</div>
<div>
<h4>Next topic</h4>
<p class="topless"><a href="winproxy.html"
title="next chapter"><span class="section-number">4. </span><code class="docutils literal notranslate"><span class="pre">windows.winproxy</span></code> – Windows API</a></p>
</div>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/native_exec.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="winproxy.html" title="4. windows.winproxy – Windows API"
>next</a> |</li>
<li class="right" >
<a href="etw.html" title="2.17. ETW – Event Tracing for Windows"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">3. </span><code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015-2020, Clement Rouault.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink