admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
4183646b28bd1fa91dc74372a9dc502c8545ea53
hakril-PythonForWindows/docs/build/html/sample.html
T
Clement Rouault 8942efa36c Fix sample for FunctionBP
2016-08-22 14:05:29 +02:00

1417 lines
205 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>12. Samples of code &mdash; PythonForWindows 0.2 documentation</title>
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: './',
VERSION: '0.2',
COLLAPSE_INDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true
};
</script>
<script type="text/javascript" src="_static/jquery.js"></script>
<script type="text/javascript" src="_static/underscore.js"></script>
<script type="text/javascript" src="_static/doctools.js"></script>
<link rel="top" title="PythonForWindows 0.2 documentation" href="index.html" />
<link rel="prev" title="11. Internals" href="internals.html" />
</head>
<body role="document">
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="internals.html" title="11. Internals"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.2 documentation</a> &raquo;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<div class="section" id="samples-of-code">
<h1>12. Samples of code<a class="headerlink" href="#samples-of-code" title="Permalink to this headline"></a></h1>
<div class="section" id="windows-current-process">
<span id="sample-current-process"></span><h2>12.1. <code class="docutils literal"><span class="pre">windows.current_process</span></code><a class="headerlink" href="#windows-current-process" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
<span class="c1"># Here is our current process</span>
<span class="n">cp</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;current process is </span><span class="si">{cp}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;current process is a &lt;</span><span class="si">{cp.bitness}</span><span class="s2">&gt; bits process&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;current process is a SysWow64 process ? &lt;</span><span class="si">{cp.is_wow_64}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;current process pid &lt;</span><span class="si">{cp.pid}</span><span class="s2">&gt; and ppid &lt;</span><span class="si">{cp.ppid}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Here are the current process threads: &lt;</span><span class="si">{cp.threads}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Let&#39;s execute some native code ! (0x41 + 1)&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="c1"># Let&#39;s generate some native code</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;Eax&quot;</span><span class="p">,</span> <span class="mh">0x41</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Inc</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">,</span> <span class="mh">0x41</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Inc</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">native_code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">native_code</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Native code returned &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Allocating memory in current process&quot;</span><span class="p">)</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">cp</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span> <span class="c1"># Default alloc is RWX (so secure !)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Allocated memory is at &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Writing &#39;SOME STUFF&#39; in allocation memory&quot;</span><span class="p">)</span>
<span class="n">cp</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="s2">&quot;SOME STUFF&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Reading memory : &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">cp</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python32.exe current_process.py
current process is &lt;windows.winobject.process.CurrentProcess object at 0x030A2590&gt;
current process is a &lt;32&gt; bits process
current process is a SysWow64 process ? &lt;True&gt;
current process pid &lt;8264&gt; and ppid &lt;4100&gt;
Here are the current process threads: &lt;[&lt;WinThread 13540 owner &quot;python.exe&quot; at 0x32d3210&gt;]&gt;
Let&#39;s execute some native code ! (0x41 + 1)
Native code returned &lt;0x42&gt;
Allocating memory in current process
Allocated memory is at &lt;0xd60000&gt;
Writing &#39;SOME STUFF&#39; in allocation memory
Reading memory : &lt;&#39;SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#39;&gt;
</pre></div>
</div>
</div>
<div class="section" id="remote-process-winprocess">
<span id="sample-remote-process"></span><h2>12.2. Remote process : <code class="xref py py-class docutils literal"><span class="pre">WinProcess</span></code><a class="headerlink" href="#remote-process-winprocess" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Creating a calc&quot;</span><span class="p">)</span>
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_process</span><span class="p">(</span><span class="s2">r&quot;C:\windows\system32\calc.exe&quot;</span><span class="p">)</span>
<span class="c1"># You don&#39;t need to do that in our case, but it&#39;s useful to now</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Looking for calcs in the processes&quot;</span><span class="p">)</span>
<span class="n">all_calcs</span> <span class="o">=</span> <span class="p">[</span><span class="n">proc</span> <span class="k">for</span> <span class="n">proc</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span> <span class="k">if</span> <span class="n">proc</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">&quot;calc.exe&quot;</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;They are currently &lt;</span><span class="si">{0}</span><span class="s2">&gt; calcs running on the system&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">all_calcs</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Let&#39;s play with our calc: &lt;</span><span class="si">{calc}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">calc</span><span class="o">=</span><span class="n">calc</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Our calc pid is </span><span class="si">{calc.pid}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">calc</span><span class="o">=</span><span class="n">calc</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Our calc is a &lt;</span><span class="si">{calc.bitness}</span><span class="s2">&gt; bits process&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">calc</span><span class="o">=</span><span class="n">calc</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Our calc is a SysWow64 process ? &lt;</span><span class="si">{calc.is_wow_64}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">calc</span><span class="o">=</span><span class="n">calc</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Our calc have threads ! &lt;</span><span class="si">{calc.threads}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">calc</span><span class="o">=</span><span class="n">calc</span><span class="p">))</span>
<span class="c1"># PEB STUFF</span>
<span class="n">peb</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">peb</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Exploring our calc PEB ! </span><span class="si">{peb}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="o">=</span><span class="n">peb</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Command line is </span><span class="si">{peb.commandline}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="o">=</span><span class="n">peb</span><span class="p">))</span>
<span class="n">modules</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Here are 3 loaded modules: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">modules</span><span class="p">[:</span><span class="mi">3</span><span class="p">]))</span>
<span class="c1"># See iat_hook.py for module exploration</span>
<span class="c1"># Remote alloc / read / write</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Allocating memory in our calc&quot;</span><span class="p">)</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Allocated memory is at &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Writing &#39;SOME STUFF&#39; in allocated memory&quot;</span><span class="p">)</span>
<span class="n">calc</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="s2">&quot;SOME STUFF&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Reading allocated memory : &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">calc</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
<span class="c1"># Remote Execution</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Execution some native code in our calc (write 0x424242 at allocated address + return 0x1337)&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">calc</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="c1"># Let&#39;s generate some native code</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">addr</span><span class="p">),</span> <span class="mh">0x42424242</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="mh">0x1337</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RAX&#39;</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">&quot;[RAX]&quot;</span><span class="p">),</span> <span class="mh">0x42424242</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RAX&quot;</span><span class="p">,</span> <span class="mh">0x1337</span><span class="p">)</span>
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Executing native code !&quot;</span><span class="p">)</span>
<span class="n">t</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
<span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Return code = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">t</span><span class="o">.</span><span class="n">exit_code</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Reading allocated memory : &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">calc</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Executing python code !&quot;</span><span class="p">)</span>
<span class="c1"># Make &#39;windows&#39; importable in remote python</span>
<span class="n">calc</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">&quot;import sys; sys.path.append(r&#39;</span><span class="si">{0}</span><span class="s2">&#39;)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="p">[</span><span class="o">-</span><span class="mi">1</span><span class="p">]))</span>
<span class="n">calc</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">&quot;import windows&quot;</span><span class="p">)</span>
<span class="c1"># Let&#39;s write in the calc &#39;current_process&#39; memory :)</span>
<span class="n">calc</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">&quot;addr = </span><span class="si">{addr}</span><span class="s2">; windows.current_process.write_memory(addr, &#39;HELLO FROM CALC&#39;)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">addr</span><span class="o">=</span><span class="n">addr</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Reading allocated memory : &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">calc</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
<span class="c1"># python_execute is &#39;safe&#39;:</span>
<span class="c1"># - it waits for the thread completion</span>
<span class="c1"># - it raise an error if remote code raised some</span>
<span class="k">try</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying to import in remote module &#39;FAKE_MODULE&#39;&quot;</span><span class="p">)</span>
<span class="n">calc</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">&quot;def func():</span><span class="se">\n</span><span class="s2"> import FAKE_MODULE</span><span class="se">\n</span><span class="s2">func()&quot;</span><span class="p">)</span>
<span class="k">except</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">RemotePythonError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Remote ERROR !&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;That&#39;s all ! killing the calc&quot;</span><span class="p">)</span>
<span class="n">calc</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe remote_calc.py
Creating a calc
Looking for calcs in the processes
They are currently &lt;1&gt; calcs running on the system
Let&#39;s play with our calc: &lt;&lt;WinProcess &quot;calc.exe&quot; pid 8052 at 0x27bd5d0&gt;&gt;
Our calc pid is 8052
Our calc is a &lt;32&gt; bits process
Our calc is a SysWow64 process ? &lt;True&gt;
Our calc have threads ! &lt;[&lt;WinThread 8552 owner &quot;calc.exe&quot; at 0x27f7f30&gt;, &lt;WinThread 3464 owner &quot;calc.exe&quot; at 0x27f7f80&gt;, &lt;WinThread 3840 owner &quot;calc.exe&quot; at 0x27fa030&gt;]&gt;
Exploring our calc PEB ! &lt;windows.winobject.RemotePEB object at 0x026DDD00&gt;
Command line is &lt;RemoteWinUnicodeString &quot;&quot;C:\windows\system32\calc.exe&quot;&quot; at 0x26ddee0&gt;
Here are 3 loaded modules: [&lt;RemoteLoadedModule &quot;calc.exe&quot; at 0x26dde40&gt;, &lt;RemoteLoadedModule &quot;ntdll.dll&quot; at 0x26ddf30&gt;, &lt;RemoteLoadedModule &quot;kernel32.dll&quot; at 0x26ddc60&gt;]
Allocating memory in our calc
Allocated memory is at &lt;0x5c90000&gt;
Writing &#39;SOME STUFF&#39; in allocated memory
Reading allocated memory : &lt;&#39;SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#39;&gt;
Execution some native code in our calc (write 0x424242 at allocated address + return 0x1337
Executing native code !
Return code = 0x1337L
Reading allocated memory : &lt;&#39;BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&#39;&gt;
Executing python code !
Reading allocated memory : &lt;&#39;HELLO FROM CALC\x00\x00\x00\x00\x00&#39;&gt;
Trying to import in remote module &#39;FAKE_MODULE&#39;
Remote ERROR !
Traceback (most recent call last):
File &quot;&lt;string&gt;&quot;, line 3, in &lt;module&gt;
File &quot;&lt;string&gt;&quot;, line 2, in func
ImportError: No module named FAKE_MODULE
That&#39;s all ! killing the calc
</pre></div>
</div>
</div>
<div class="section" id="peb-exploration">
<span id="sample-peb-exploration"></span><h2>12.3. <code class="xref py py-class docutils literal"><span class="pre">PEB</span></code> exploration<a class="headerlink" href="#peb-exploration" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Exploring the current process PEB&quot;</span><span class="p">)</span>
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;PEB is &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="p">))</span>
<span class="n">commandline</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">commandline</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Commandline object is </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">commandline</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Commandline string is </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">commandline</span><span class="o">.</span><span class="n">Buffer</span><span class="p">)))</span>
<span class="n">imagepath</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">imagepath</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Imagepath </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">imagepath</span><span class="p">))</span>
<span class="n">modules</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Printing some modules: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="nb">str</span><span class="p">(</span><span class="n">m</span><span class="p">)</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">modules</span><span class="p">[:</span><span class="mi">6</span><span class="p">])))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;=== K32 ===&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Looking for kernel32.dll&quot;</span><span class="p">)</span>
<span class="n">k32</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">&quot;kernel32.dll&quot;</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Kernel32 module: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Module name = &lt;</span><span class="si">{0}</span><span class="s2">&gt; | Fullname = &lt;</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">k32</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Kernel32 is loaded at address </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">k32</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;=== K32 PE ===&quot;</span><span class="p">)</span>
<span class="n">k32pe</span> <span class="o">=</span> <span class="n">k32</span><span class="o">.</span><span class="n">pe</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;PE Representation of k32: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32pe</span><span class="p">))</span>
<span class="n">exports</span> <span class="o">=</span> <span class="n">k32pe</span><span class="o">.</span><span class="n">exports</span>
<span class="n">some_exports</span> <span class="o">=</span> <span class="nb">dict</span><span class="p">((</span><span class="n">k</span><span class="p">,</span><span class="n">v</span><span class="p">)</span> <span class="k">for</span> <span class="n">k</span><span class="p">,</span><span class="n">v</span> <span class="ow">in</span> <span class="n">exports</span><span class="o">.</span><span class="n">items</span><span class="p">()</span> <span class="k">if</span> <span class="n">k</span> <span class="ow">in</span> <span class="p">[</span><span class="mi">0</span><span class="p">,</span> <span class="mi">42</span><span class="p">,</span> <span class="s2">&quot;VirtualAlloc&quot;</span><span class="p">,</span> <span class="s2">&quot;CreateFileA&quot;</span><span class="p">])</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Here are some exports </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">some_exports</span><span class="p">))</span>
<span class="n">imports</span> <span class="o">=</span> <span class="n">k32pe</span><span class="o">.</span><span class="n">imports</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Import DLL dependancies are (without api-*): </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">imports</span><span class="o">.</span><span class="n">keys</span><span class="p">()</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">x</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">&quot;api-&quot;</span><span class="p">)]))</span>
<span class="n">NtCreateFile_iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">imports</span><span class="p">[</span><span class="s2">&quot;ntdll.dll&quot;</span><span class="p">]</span> <span class="k">if</span> <span class="n">x</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">&quot;NtCreateFile&quot;</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;IAT Entry for ntdll!NtCreateFile = </span><span class="si">{0}</span><span class="s2"> | addr = </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">NtCreateFile_iat</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="n">NtCreateFile_iat</span><span class="o">.</span><span class="n">addr</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Sections: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32pe</span><span class="o">.</span><span class="n">sections</span><span class="p">))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe peb.py
Exploring the current process PEB
PEB is &lt;&lt;windows.winobject.PEB object at 0x02649B70&gt;&gt;
Commandline object is &lt;WinUnicodeString &quot;python.exe peb.py &quot; at 0x2649c60&gt;
Commandline string is u&#39;python.exe peb.py &#39;
Imagepath &lt;WinUnicodeString &quot;C:\Python27\python.exe&quot; at 0x2649d50&gt;
Printing some modules: &lt;LoadedModule &quot;python.exe&quot; at 0x272a030&gt;
&lt;LoadedModule &quot;ntdll.dll&quot; at 0x272a080&gt;
&lt;LoadedModule &quot;kernel32.dll&quot; at 0x272acb0&gt;
&lt;LoadedModule &quot;kernelbase.dll&quot; at 0x272ad00&gt;
&lt;LoadedModule &quot;python27.dll&quot; at 0x272ad50&gt;
&lt;LoadedModule &quot;msvcr90.dll&quot; at 0x272ada0&gt;
=== K32 ===
Looking for kernel32.dll
Kernel32 module: &lt;LoadedModule &quot;kernel32.dll&quot; at 0x272acb0&gt;
Module name = &lt;kernel32.dll&gt; | Fullname = &lt;C:\Windows\SYSTEM32\KERNEL32.DLL&gt;
Kernel32 is loaded at address 0x774c0000
=== K32 PE ===
PE Representation of k32: &lt;windows.pe_parse.PEFile object at 0x0272D350&gt;
Here are some exports {0: 2001566688L, u&#39;CreateFileA&#39;: 2001635616L, 42: 2001647872L, u&#39;VirtualAlloc&#39;: 2001570704L}
Import DLL dependancies are (without api-*): [u&#39;ntdll.dll&#39;, u&#39;kernelbase.dll&#39;]
IAT Entry for ntdll!NtCreateFile = &lt;IATEntry &quot;NtCreateFile&quot; ordinal 253&gt; | addr = 0x77541128L
Sections: [&lt;PESection &quot;.text&quot;&gt;, &lt;PESection &quot;.rdata&quot;&gt;, &lt;PESection &quot;.data&quot;&gt;, &lt;PESection &quot;.rsrc&quot;&gt;, &lt;PESection &quot;.reloc&quot;&gt;]
</pre></div>
</div>
</div>
<div class="section" id="windows-system">
<span id="sample-system"></span><h2>12.4. <code class="docutils literal"><span class="pre">windows.system</span></code><a class="headerlink" href="#windows-system" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="n">system</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Basic system infos:&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; version = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; bitness = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; computer_name = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">computer_name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; product_type = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">product_type</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; version_name = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">version_name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;There is </span><span class="si">{0}</span><span class="s2"> processes&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;There is </span><span class="si">{0}</span><span class="s2"> threads&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">threads</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Dumping first logical drive:&quot;</span><span class="p">)</span>
<span class="n">drive</span> <span class="o">=</span> <span class="n">system</span><span class="o">.</span><span class="n">logicaldrives</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; &quot;</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">drive</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;name = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;type = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;path = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">path</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Dumping first service:&quot;</span><span class="p">)</span>
<span class="n">serv</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; &quot;</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">serv</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;name = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;description = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;status = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">status</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;process = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">process</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Finding a service in a user process:&quot;</span><span class="p">)</span>
<span class="n">serv</span> <span class="o">=</span> <span class="p">[</span><span class="n">s</span> <span class="k">for</span> <span class="n">s</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span> <span class="k">if</span> <span class="n">s</span><span class="o">.</span><span class="n">process</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; &quot;</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">serv</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;name = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;description = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;status = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">status</span><span class="p">))</span>
<span class="nb">print</span><span class="p">((</span><span class="s2">&quot; &quot;</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">&quot;process = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">process</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Enumerating handles:&quot;</span><span class="p">)</span>
<span class="n">handles</span> <span class="o">=</span> <span class="n">system</span><span class="o">.</span><span class="n">handles</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; There are </span><span class="si">{0}</span><span class="s2"> handles:&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">handles</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; First handle is: &quot;</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">handles</span><span class="p">[</span><span class="mi">0</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; Enumerating handles of the current process:&quot;</span><span class="p">)</span>
<span class="n">cp_handles</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; There are </span><span class="si">{0}</span><span class="s2"> handles for this process&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">cp_handles</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; Looking for a File handle:&quot;</span><span class="p">)</span>
<span class="n">file_h</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">cp_handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">type</span> <span class="o">==</span> <span class="s2">&quot;File&quot;</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; Handle is </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">file_h</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; Name is &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">file_h</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">system</span><span class="o">.</span><span class="n">py</span>
<span class="n">Basic</span> <span class="n">system</span> <span class="n">infos</span><span class="p">:</span>
<span class="n">version</span> <span class="o">=</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">3</span><span class="p">)</span>
<span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
<span class="n">computer_name</span> <span class="o">=</span> <span class="n">HAKRIL</span><span class="o">-</span><span class="n">PC</span>
<span class="n">product_type</span> <span class="o">=</span> <span class="n">VER_NT_WORKSTATION</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span>
<span class="n">version_name</span> <span class="o">=</span> <span class="n">Windows</span> <span class="mf">8.1</span>
<span class="n">There</span> <span class="ow">is</span> <span class="mi">117</span> <span class="n">processes</span>
<span class="n">There</span> <span class="ow">is</span> <span class="mi">1246</span> <span class="n">threads</span>
<span class="n">Dumping</span> <span class="n">first</span> <span class="n">logical</span> <span class="n">drive</span><span class="p">:</span>
<span class="o">&lt;</span><span class="n">LogicalDrive</span> <span class="s2">&quot;C:</span><span class="se">\&quot;</span><span class="s2"> (DRIVE_FIXED)&gt;</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">C</span><span class="p">:</span>\
<span class="nb">type</span> <span class="o">=</span> <span class="n">DRIVE_FIXED</span><span class="p">(</span><span class="mh">0x3</span><span class="n">L</span><span class="p">)</span>
<span class="n">path</span> <span class="o">=</span> \<span class="n">Device</span>\<span class="n">HarddiskVolume2</span>
<span class="n">Dumping</span> <span class="n">first</span> <span class="n">service</span><span class="p">:</span>
<span class="o">&lt;</span><span class="n">ServiceA</span> <span class="s2">&quot;ACPI&quot;</span><span class="o">&gt;</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">ACPI</span>
<span class="n">description</span> <span class="o">=</span> <span class="n">Microsoft</span> <span class="n">ACPI</span> <span class="n">Driver</span>
<span class="n">status</span> <span class="o">=</span> <span class="n">ServiceStatus</span><span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="n">SERVICE_KERNEL_DRIVER</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">),</span> <span class="n">state</span><span class="o">=</span><span class="n">SERVICE_RUNNING</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">),</span> <span class="n">control_accepted</span><span class="o">=</span><span class="mi">1</span><span class="n">L</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="n">L</span><span class="p">)</span>
<span class="n">process</span> <span class="o">=</span> <span class="kc">None</span>
<span class="n">Finding</span> <span class="n">a</span> <span class="n">service</span> <span class="ow">in</span> <span class="n">a</span> <span class="n">user</span> <span class="n">process</span><span class="p">:</span>
<span class="o">&lt;</span><span class="n">ServiceA</span> <span class="s2">&quot;Appinfo&quot;</span><span class="o">&gt;</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">Appinfo</span>
<span class="n">description</span> <span class="o">=</span> <span class="n">Application</span> <span class="n">Information</span>
<span class="n">status</span> <span class="o">=</span> <span class="n">ServiceStatus</span><span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="n">SERVICE_WIN32_SHARE_PROCESS</span><span class="p">(</span><span class="mh">0x20</span><span class="n">L</span><span class="p">),</span> <span class="n">state</span><span class="o">=</span><span class="n">SERVICE_RUNNING</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">),</span> <span class="n">control_accepted</span><span class="o">=</span><span class="mi">129</span><span class="n">L</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="n">L</span><span class="p">)</span>
<span class="n">process</span> <span class="o">=</span> <span class="o">&lt;</span><span class="n">WinProcess</span> <span class="s2">&quot;svchost.exe&quot;</span> <span class="n">pid</span> <span class="mi">988</span> <span class="n">at</span> <span class="mh">0x2e64750</span><span class="o">&gt;</span>
<span class="n">Enumerating</span> <span class="n">handles</span><span class="p">:</span>
<span class="n">There</span> <span class="n">are</span> <span class="mi">40664</span> <span class="n">handles</span><span class="p">:</span>
<span class="n">First</span> <span class="n">handle</span> <span class="ow">is</span><span class="p">:</span> <span class="o">&lt;</span><span class="n">Handle</span> <span class="n">value</span><span class="o">=&lt;</span><span class="mh">0x4</span><span class="o">&gt;</span> <span class="ow">in</span> <span class="n">process</span> <span class="n">pid</span><span class="o">=</span><span class="mi">4</span><span class="o">&gt;</span>
<span class="n">Enumerating</span> <span class="n">handles</span> <span class="n">of</span> <span class="n">the</span> <span class="n">current</span> <span class="n">process</span><span class="p">:</span>
<span class="n">There</span> <span class="n">are</span> <span class="mi">255</span> <span class="n">handles</span> <span class="k">for</span> <span class="n">this</span> <span class="n">process</span>
<span class="n">Looking</span> <span class="k">for</span> <span class="n">a</span> <span class="n">File</span> <span class="n">handle</span><span class="p">:</span>
<span class="n">Handle</span> <span class="ow">is</span> <span class="o">&lt;</span><span class="n">Handle</span> <span class="n">value</span><span class="o">=&lt;</span><span class="mh">0x4</span><span class="o">&gt;</span> <span class="ow">in</span> <span class="n">process</span> <span class="n">pid</span><span class="o">=</span><span class="mi">14340</span><span class="o">&gt;</span>
<span class="n">Name</span> <span class="ow">is</span> <span class="o">&lt;</span>\<span class="n">Device</span>\<span class="n">ConDrv</span><span class="o">&gt;</span>
</pre></div>
</div>
</div>
<div class="section" id="iat-hooking">
<span id="sample-iat-hook"></span><h2>12.5. IAT hooking<a class="headerlink" href="#iat-hooking" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">_winreg</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="c1"># Here is a demo of IAT hooking in python</span>
<span class="c1"># We will hook the &#39;RegOpenKeyExA&#39; entry of Python27.dll because it is easy to trigger !</span>
<span class="c1"># First: let&#39;s create our hook</span>
<span class="c1"># windows.hooks.RegOpenKeyExACallback is generated based on windows.generated_def.winfuncs</span>
<span class="nd">@windows</span><span class="o">.</span><span class="n">hooks</span><span class="o">.</span><span class="n">RegOpenKeyExACallback</span>
<span class="k">def</span> <span class="nf">open_reg_hook</span><span class="p">(</span><span class="n">hKey</span><span class="p">,</span> <span class="n">lpSubKey</span><span class="p">,</span> <span class="n">ulOptions</span><span class="p">,</span> <span class="n">samDesired</span><span class="p">,</span> <span class="n">phkResult</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;in hook&gt; Hook called | hKey = </span><span class="si">{0}</span><span class="s2"> | lpSubKey = &lt;</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">hKey</span><span class="p">),</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
<span class="c1"># Our hook can choose to call the real_function or not</span>
<span class="k">if</span> <span class="s2">&quot;SECRET&quot;</span> <span class="ow">in</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;in hook&gt; Secret key asked, returning magic handle 0x12345678&quot;</span><span class="p">)</span>
<span class="c1"># We must respect the hooked method return-value interface</span>
<span class="n">phkResult</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="mh">0x12345678</span>
<span class="k">return</span> <span class="mi">0</span>
<span class="k">if</span> <span class="s2">&quot;FAIL&quot;</span> <span class="ow">in</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;in hook&gt; Asked for a failing key: returning 0x2a&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="mi">42</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;in hook&gt; Non-secret key : calling normal function&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">real_function</span><span class="p">()</span>
<span class="c1"># Get the peb of our process</span>
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
<span class="c1"># Get the pythonxx.dll module</span>
<span class="n">pythondll_module</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">&quot;python&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">&quot;.dll&quot;</span><span class="p">)][</span><span class="mi">0</span><span class="p">]</span>
<span class="c1"># Get the iat entries for DLL advapi32.dll</span>
<span class="n">adv_imports</span> <span class="o">=</span> <span class="n">pythondll_module</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">imports</span><span class="p">[</span><span class="s1">&#39;advapi32.dll&#39;</span><span class="p">]</span>
<span class="c1"># Get RegOpenKeyExA iat entry</span>
<span class="n">RegOpenKeyExA_iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">n</span> <span class="k">for</span> <span class="n">n</span> <span class="ow">in</span> <span class="n">adv_imports</span> <span class="k">if</span> <span class="n">n</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">&quot;RegOpenKeyExA&quot;</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="c1"># Setup our hook</span>
<span class="n">RegOpenKeyExA_iat</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">open_reg_hook</span><span class="p">)</span>
<span class="c1"># Use python native module _winreg that call &#39;RegOpenKeyExA&#39;</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Asking for &lt;MY_SECRET_KEY&gt;&quot;</span><span class="p">)</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">&quot;MY_SECRET_KEY&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Result = &quot;</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Asking for &lt;MY_FAIL_KEY&gt;&quot;</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">&quot;MY_FAIL_KEY&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Result = &quot;</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Asking for &lt;HKEY_CURRENT_USER/Software&gt;&quot;</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="n">_winreg</span><span class="o">.</span><span class="n">HKEY_CURRENT_USER</span><span class="p">,</span> <span class="s2">&quot;Software&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Result = &quot;</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">iat_hook</span><span class="o">.</span><span class="n">py</span>
<span class="n">Asking</span> <span class="k">for</span> <span class="o">&lt;</span><span class="n">MY_SECRET_KEY</span><span class="o">&gt;</span>
<span class="o">&lt;</span><span class="ow">in</span> <span class="n">hook</span><span class="o">&gt;</span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x12d687</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o">&lt;</span><span class="n">MY_SECRET_KEY</span><span class="o">&gt;</span>
<span class="o">&lt;</span><span class="ow">in</span> <span class="n">hook</span><span class="o">&gt;</span> <span class="n">Secret</span> <span class="n">key</span> <span class="n">asked</span><span class="p">,</span> <span class="n">returning</span> <span class="n">magic</span> <span class="n">handle</span> <span class="mh">0x12345678</span>
<span class="n">Result</span> <span class="o">=</span> <span class="mh">0x12345678</span>
<span class="n">Asking</span> <span class="k">for</span> <span class="o">&lt;</span><span class="n">MY_FAIL_KEY</span><span class="o">&gt;</span>
<span class="o">&lt;</span><span class="ow">in</span> <span class="n">hook</span><span class="o">&gt;</span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x12d687</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o">&lt;</span><span class="n">MY_FAIL_KEY</span><span class="o">&gt;</span>
<span class="o">&lt;</span><span class="ow">in</span> <span class="n">hook</span><span class="o">&gt;</span> <span class="n">Asked</span> <span class="k">for</span> <span class="n">a</span> <span class="n">failing</span> <span class="n">key</span><span class="p">:</span> <span class="n">returning</span> <span class="mh">0x2a</span>
<span class="ne">WindowsError</span><span class="p">(</span><span class="mi">42</span><span class="p">,</span> <span class="s1">&#39;Windows Error 0x2A&#39;</span><span class="p">)</span>
<span class="n">Asking</span> <span class="k">for</span> <span class="o">&lt;</span><span class="n">HKEY_CURRENT_USER</span><span class="o">/</span><span class="n">Software</span><span class="o">&gt;</span>
<span class="o">&lt;</span><span class="ow">in</span> <span class="n">hook</span><span class="o">&gt;</span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x80000001</span><span class="n">L</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o">&lt;</span><span class="n">Software</span><span class="o">&gt;</span>
<span class="o">&lt;</span><span class="ow">in</span> <span class="n">hook</span><span class="o">&gt;</span> <span class="n">Non</span><span class="o">-</span><span class="n">secret</span> <span class="n">key</span> <span class="p">:</span> <span class="n">calling</span> <span class="n">normal</span> <span class="n">function</span>
<span class="n">Result</span> <span class="o">=</span> <span class="mh">0x108</span>
</pre></div>
</div>
</div>
<div class="section" id="network-socket-exploration">
<span id="sample-network-exploration"></span><h2>12.6. <code class="xref py py-class docutils literal"><span class="pre">Network</span></code> - socket exploration<a class="headerlink" href="#network-socket-exploration" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">socket</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">check_is_elevated</span><span class="p">():</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;!!! Demo will fail because closing a connection require elevated process !!!&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Working on ipv4&quot;</span><span class="p">)</span>
<span class="n">conns</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">ipv4</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;== Listening ==&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Some listening connections: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">][:</span><span class="mi">3</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Listening ports are : </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span><span class="o">.</span><span class="n">local_port</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;== Established ==&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Some established connections: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">][:</span><span class="mi">3</span><span class="p">]))</span>
<span class="n">TARGET_HOST</span> <span class="o">=</span> <span class="s2">&quot;localhost&quot;</span>
<span class="n">TARGET_PORT</span> <span class="o">=</span> <span class="mi">80</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;== connection to </span><span class="si">{0}</span><span class="s2">:</span><span class="si">{1}</span><span class="s2"> ==&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_HOST</span><span class="p">,</span> <span class="n">TARGET_PORT</span><span class="p">))</span>
<span class="n">s</span> <span class="o">=</span> <span class="n">socket</span><span class="o">.</span><span class="n">create_connection</span><span class="p">((</span><span class="n">TARGET_HOST</span><span class="p">,</span> <span class="n">TARGET_PORT</span><span class="p">))</span>
<span class="n">our_connection</span> <span class="o">=</span> <span class="p">[</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">ipv4</span> <span class="k">if</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span> <span class="ow">and</span> <span class="n">c</span><span class="o">.</span><span class="n">remote_port</span> <span class="o">==</span> <span class="n">TARGET_PORT</span> <span class="ow">and</span> <span class="n">c</span><span class="o">.</span><span class="n">remote_addr</span> <span class="o">==</span> <span class="n">s</span><span class="o">.</span><span class="n">getpeername</span><span class="p">()[</span><span class="mi">0</span><span class="p">]]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Our connection is </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">our_connection</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Sending YOP&quot;</span><span class="p">)</span>
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">&quot;YOP&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Closing socket&quot;</span><span class="p">)</span>
<span class="n">our_connection</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Sending LAIT&quot;</span><span class="p">)</span>
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">&quot;LAIT&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">network</span><span class="o">.</span><span class="n">py</span>
<span class="n">Working</span> <span class="n">on</span> <span class="n">ipv4</span>
<span class="o">==</span> <span class="n">Listening</span> <span class="o">==</span>
<span class="n">Some</span> <span class="n">listening</span> <span class="n">connections</span><span class="p">:</span> <span class="p">[</span><span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">80</span><span class="o">&gt;</span><span class="p">,</span> <span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">135</span><span class="o">&gt;</span><span class="p">,</span> <span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">443</span><span class="o">&gt;</span><span class="p">]</span>
<span class="n">Listening</span> <span class="n">ports</span> <span class="n">are</span> <span class="p">:</span> <span class="p">[</span><span class="mi">80</span><span class="p">,</span> <span class="mi">135</span><span class="p">,</span> <span class="mi">443</span><span class="p">,</span> <span class="mi">445</span><span class="p">,</span> <span class="mi">902</span><span class="p">,</span> <span class="mi">912</span><span class="p">,</span> <span class="mi">5357</span><span class="p">,</span> <span class="mi">49152</span><span class="p">,</span> <span class="mi">49153</span><span class="p">,</span> <span class="mi">49154</span><span class="p">,</span> <span class="mi">49155</span><span class="p">,</span> <span class="mi">49157</span><span class="p">,</span> <span class="mi">49159</span><span class="p">,</span> <span class="mi">8307</span><span class="p">,</span> <span class="mi">25340</span><span class="p">,</span> <span class="mi">139</span><span class="p">,</span> <span class="mi">139</span><span class="p">]</span>
<span class="o">==</span> <span class="n">Established</span> <span class="o">==</span>
<span class="n">Some</span> <span class="n">established</span> <span class="n">connections</span><span class="p">:</span> <span class="p">[</span><span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">25340</span> <span class="o">-&gt;</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49472</span><span class="o">&gt;</span><span class="p">,</span> <span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49173</span> <span class="o">-&gt;</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49174</span><span class="o">&gt;</span><span class="p">,</span> <span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49174</span> <span class="o">-&gt;</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49173</span><span class="o">&gt;</span><span class="p">]</span>
<span class="o">==</span> <span class="n">connection</span> <span class="n">to</span> <span class="n">localhost</span><span class="p">:</span><span class="mi">80</span> <span class="o">==</span>
<span class="n">Our</span> <span class="n">connection</span> <span class="ow">is</span> <span class="p">[</span><span class="o">&lt;</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49616</span> <span class="o">-&gt;</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">80</span><span class="o">&gt;</span><span class="p">]</span>
<span class="n">Sending</span> <span class="n">YOP</span>
<span class="n">Closing</span> <span class="n">socket</span>
<span class="n">Sending</span> <span class="n">LAIT</span>
<span class="n">Traceback</span> <span class="p">(</span><span class="n">most</span> <span class="n">recent</span> <span class="n">call</span> <span class="n">last</span><span class="p">):</span>
<span class="n">File</span> <span class="s2">&quot;.</span><span class="se">\n</span><span class="s2">etwork.py&quot;</span><span class="p">,</span> <span class="n">line</span> <span class="mi">45</span><span class="p">,</span> <span class="ow">in</span> <span class="o">&lt;</span><span class="n">module</span><span class="o">&gt;</span>
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">&quot;LAIT&quot;</span><span class="p">)</span>
<span class="n">socket</span><span class="o">.</span><span class="n">error</span><span class="p">:</span> <span class="p">[</span><span class="n">Errno</span> <span class="mi">10054</span><span class="p">]</span> <span class="n">An</span> <span class="n">existing</span> <span class="n">connection</span> <span class="n">was</span> <span class="n">forcibly</span> <span class="n">closed</span> <span class="n">by</span> <span class="n">the</span> <span class="n">remote</span> <span class="n">host</span>
</pre></div>
</div>
</div>
<div class="section" id="registry">
<span id="sample-registry"></span><h2>12.7. <code class="xref py py-class docutils literal"><span class="pre">Registry</span></code><a class="headerlink" href="#registry" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="n">registry</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">registry</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Registry is &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registry</span><span class="p">))</span>
<span class="n">current_user</span> <span class="o">=</span> <span class="n">registry</span><span class="p">(</span><span class="s2">&quot;HKEY_CURRENT_USER&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;HKEY_CURRENT_USER is &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">current_user</span><span class="p">))</span>
<span class="n">subkeys_name</span> <span class="o">=</span> <span class="p">[</span><span class="n">s</span><span class="o">.</span><span class="n">name</span> <span class="k">for</span> <span class="n">s</span> <span class="ow">in</span> <span class="n">current_user</span><span class="o">.</span><span class="n">subkeys</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;HKEY_CURRENT_USER subkeys names are:&quot;</span><span class="p">)</span>
<span class="n">pprint</span><span class="o">.</span><span class="n">pprint</span><span class="p">(</span><span class="n">subkeys_name</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Opening &#39;Software&#39; in HKEY_CURRENT_USER: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">current_user</span><span class="p">(</span><span class="s2">&quot;Software&quot;</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;We can also open it in one access: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registry</span><span class="p">(</span><span class="s2">r&quot;HKEY_CURRENT_USER\Sofware&quot;</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Looking at CurrentVersion&quot;</span><span class="p">)</span>
<span class="n">windows_info</span> <span class="o">=</span> <span class="n">registry</span><span class="p">(</span><span class="s2">&quot;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Key is </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows_info</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;values are:&quot;</span><span class="p">)</span>
<span class="n">pprint</span><span class="o">.</span><span class="n">pprint</span><span class="p">(</span><span class="n">windows_info</span><span class="o">.</span><span class="n">values</span><span class="p">)</span>
<span class="n">registered_owner</span> <span class="o">=</span> <span class="n">windows_info</span><span class="p">[</span><span class="s2">&quot;RegisteredOwner&quot;</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;registered owner = &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registered_owner</span><span class="p">))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">registry</span><span class="o">.</span><span class="n">py</span>
<span class="n">Registry</span> <span class="ow">is</span> <span class="o">&lt;&lt;</span><span class="n">windows</span><span class="o">.</span><span class="n">registry</span><span class="o">.</span><span class="n">Registry</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02941290</span><span class="o">&gt;&gt;</span>
<span class="n">HKEY_CURRENT_USER</span> <span class="ow">is</span> <span class="o">&lt;&lt;</span><span class="n">PyHKey</span> <span class="s2">&quot;HKEY_CURRENT_USER&quot;</span><span class="o">&gt;&gt;</span>
<span class="n">HKEY_CURRENT_USER</span> <span class="n">subkeys</span> <span class="n">names</span> <span class="n">are</span><span class="p">:</span>
<span class="p">[</span><span class="s1">&#39;AppEvents&#39;</span><span class="p">,</span>
<span class="s1">&#39;AppXBackupContentType&#39;</span><span class="p">,</span>
<span class="s1">&#39;Console&#39;</span><span class="p">,</span>
<span class="s1">&#39;Control Panel&#39;</span><span class="p">,</span>
<span class="s1">&#39;Environment&#39;</span><span class="p">,</span>
<span class="s1">&#39;EUDC&#39;</span><span class="p">,</span>
<span class="s1">&#39;Identities&#39;</span><span class="p">,</span>
<span class="s1">&#39;Keyboard Layout&#39;</span><span class="p">,</span>
<span class="s1">&#39;Network&#39;</span><span class="p">,</span>
<span class="s1">&#39;Printers&#39;</span><span class="p">,</span>
<span class="s1">&#39;Software&#39;</span><span class="p">,</span>
<span class="s1">&#39;System&#39;</span><span class="p">,</span>
<span class="s1">&#39;Volatile Environment&#39;</span><span class="p">]</span>
<span class="n">Opening</span> <span class="s1">&#39;Software&#39;</span> <span class="ow">in</span> <span class="n">HKEY_CURRENT_USER</span><span class="p">:</span> <span class="o">&lt;</span><span class="n">PyHKey</span> <span class="s2">&quot;HKEY_CURRENT_USER\Software&quot;</span><span class="o">&gt;</span>
<span class="n">We</span> <span class="n">can</span> <span class="n">also</span> <span class="nb">open</span> <span class="n">it</span> <span class="ow">in</span> <span class="n">one</span> <span class="n">access</span><span class="p">:</span> <span class="o">&lt;</span><span class="n">PyHKey</span> <span class="s2">&quot;HKEY_CURRENT_USER\Sofware&quot;</span><span class="o">&gt;</span>
<span class="n">Looking</span> <span class="n">at</span> <span class="n">CurrentVersion</span>
<span class="n">Key</span> <span class="ow">is</span> <span class="o">&lt;</span><span class="n">PyHKey</span> <span class="s2">&quot;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion&quot;</span><span class="o">&gt;</span>
<span class="n">values</span> <span class="n">are</span><span class="p">:</span>
<span class="p">[</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">&#39;SoftwareType&#39;</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="s1">u&#39;System&#39;</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">),</span>
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">&#39;RegisteredOwner&#39;</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="s1">u&#39;hakril&#39;</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">),</span>
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">&#39;InstallDate&#39;</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">4</span><span class="p">),</span>
<span class="o">...</span>
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">&#39;PathName&#39;</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="s1">u&#39;C:</span><span class="se">\\</span><span class="s1">Windows&#39;</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">)]</span>
<span class="n">registered</span> <span class="n">owner</span> <span class="o">=</span> <span class="o">&lt;</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">&#39;RegisteredOwner&#39;</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="s1">u&#39;hakril&#39;</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span><span class="o">&gt;</span>
</pre></div>
</div>
</div>
<div class="section" id="windows-wintrust">
<span id="sample-wintrust"></span><h2>12.8. <code class="docutils literal"><span class="pre">windows.wintrust</span></code><a class="headerlink" href="#windows-wintrust" title="Permalink to this headline"></a></h2>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows.wintrust</span>
<span class="n">TARGET_FILE</span> <span class="o">=</span> <span class="s2">r&quot;C:\windows\system32\ntdll.dll&quot;</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Checking signature of &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; is_signed: &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">is_signed</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; check_signature: &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">check_signature</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)))</span>
<span class="n">sign_info</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">full_signature_information</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; full_signature_information:&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * signed &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">signed</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * catalog &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">catalog</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * catalogsigned &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">catalogsigned</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * additionalinfo &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">additionalinfo</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Checking signature of some loaded DLL&quot;</span><span class="p">)</span>
<span class="k">for</span> <span class="n">module</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span><span class="p">[:</span><span class="mi">5</span><span class="p">]:</span>
<span class="n">path</span> <span class="o">=</span> <span class="n">module</span><span class="o">.</span><span class="n">fullname</span>
<span class="n">is_signed</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">is_signed</span><span class="p">(</span><span class="n">path</span><span class="p">)</span>
<span class="k">if</span> <span class="n">is_signed</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;</span><span class="si">{0}</span><span class="s2">&gt; : </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">is_signed</span><span class="p">))</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">sign_info</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">full_signature_information</span><span class="p">(</span><span class="n">path</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;</span><span class="si">{0}</span><span class="s2">&gt; : </span><span class="si">{1}</span><span class="s2"> (</span><span class="si">{2}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">is_signed</span><span class="p">,</span> <span class="n">sign_info</span><span class="p">[</span><span class="mi">3</span><span class="p">]))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="o">.</span>\<span class="n">wintrust</span><span class="o">.</span><span class="n">py</span>
<span class="n">Checking</span> <span class="n">signature</span> <span class="n">of</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">ntdll</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">is_signed</span><span class="p">:</span> <span class="o">&lt;</span><span class="kc">True</span><span class="o">&gt;</span>
<span class="n">check_signature</span><span class="p">:</span> <span class="o">&lt;</span><span class="mi">0</span><span class="o">&gt;</span>
<span class="n">full_signature_information</span><span class="p">:</span>
<span class="o">*</span> <span class="n">signed</span> <span class="o">&lt;</span><span class="kc">True</span><span class="o">&gt;</span>
<span class="o">*</span> <span class="n">catalog</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">CatRoot</span>\<span class="p">{</span><span class="n">F750E6C3</span><span class="o">-</span><span class="mi">38</span><span class="n">EE</span><span class="o">-</span><span class="mi">11</span><span class="n">D1</span><span class="o">-</span><span class="mi">85</span><span class="n">E5</span><span class="o">-</span><span class="mi">00</span><span class="n">C04FC295EE</span><span class="p">}</span>\<span class="n">Package_35_for_KB3128650</span><span class="o">~</span><span class="mi">31</span><span class="n">bf3856ad364e35</span><span class="o">~</span><span class="n">amd64</span><span class="o">~~</span><span class="mf">6.3</span><span class="o">.</span><span class="mf">1.2</span><span class="o">.</span><span class="n">cat</span><span class="o">&gt;</span>
<span class="o">*</span> <span class="n">catalogsigned</span> <span class="o">&lt;</span><span class="kc">True</span><span class="o">&gt;</span>
<span class="o">*</span> <span class="n">additionalinfo</span> <span class="o">&lt;</span><span class="mi">0</span><span class="o">&gt;</span>
<span class="n">Checking</span> <span class="n">signature</span> <span class="n">of</span> <span class="n">some</span> <span class="n">loaded</span> <span class="n">DLL</span>
<span class="o">&lt;</span><span class="n">c</span><span class="p">:</span>\<span class="n">python27</span>\<span class="n">python</span><span class="o">.</span><span class="n">exe</span><span class="o">&gt;</span> <span class="p">:</span> <span class="kc">False</span> <span class="p">(</span><span class="n">TRUST_E_NOSIGNATURE</span><span class="p">(</span><span class="mh">0x800b0100</span><span class="n">L</span><span class="p">))</span>
<span class="o">&lt;</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">ntdll</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span> <span class="p">:</span> <span class="kc">True</span>
<span class="o">&lt;</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span> <span class="p">:</span> <span class="kc">True</span>
<span class="o">&lt;</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span> <span class="p">:</span> <span class="kc">True</span>
<span class="o">&lt;</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">python27</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span> <span class="p">:</span> <span class="kc">False</span> <span class="p">(</span><span class="n">TRUST_E_NOSIGNATURE</span><span class="p">(</span><span class="mh">0x800b0100</span><span class="n">L</span><span class="p">))</span>
</pre></div>
</div>
</div>
<div class="section" id="vectoredexception">
<span id="sample-vectoredexception"></span><h2>12.9. <code class="xref py py-func docutils literal"><span class="pre">VectoredException()</span></code><a class="headerlink" href="#vectoredexception" title="Permalink to this headline"></a></h2>
<div class="section" id="in-local-process">
<h3>12.9.1. In local process<a class="headerlink" href="#in-local-process" title="Permalink to this headline"></a></h3>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">from</span> <span class="nn">windows.winobject.exception</span> <span class="k">import</span> <span class="n">VectoredException</span>
<span class="kn">import</span> <span class="nn">windows.generated_def.windef</span> <span class="k">as</span> <span class="nn">windef</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="nd">@VectoredException</span>
<span class="k">def</span> <span class="nf">handler</span><span class="p">(</span><span class="n">exc</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;==Entry of VEH handler==&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionCode</span> <span class="o">==</span> <span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">:</span>
<span class="n">target_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionInformation</span><span class="p">[</span><span class="mi">1</span><span class="p">],</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Instr at </span><span class="si">{0}</span><span class="s2"> accessed to addr </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionAddress</span><span class="p">),</span> <span class="nb">hex</span><span class="p">(</span><span class="n">target_addr</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Resetting page protection to &lt;PAGE_READWRITE&gt;&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_READWRITE</span><span class="p">)</span>
<span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ContextRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span> <span class="o">=</span> <span class="mi">1</span>
<span class="k">return</span> <span class="n">windef</span><span class="o">.</span><span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
<span class="k">else</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Exception of type </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionCode</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Resetting page protection to &lt;PAGE_NOACCESS&gt;&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_NOACCESS</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windef</span><span class="o">.</span><span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">AddVectoredExceptionHandler</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">handler</span><span class="p">)</span>
<span class="n">target_page</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Protected page is at &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">target_page</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Setting page protection to &lt;PAGE_NOACCESS&gt;&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_NOACCESS</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">target_page</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Value 1 read&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">target_page</span> <span class="o">+</span> <span class="mh">0x10</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Value 2 read&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">veh_segv</span><span class="o">.</span><span class="n">py</span>
<span class="n">Protected</span> <span class="n">page</span> <span class="ow">is</span> <span class="n">at</span> <span class="o">&lt;</span><span class="mh">0x1db0000</span><span class="o">&gt;</span>
<span class="n">Setting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o">&lt;</span><span class="n">PAGE_NOACCESS</span><span class="o">&gt;</span>
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
<span class="n">Instr</span> <span class="n">at</span> <span class="mh">0x1d1ab574</span> <span class="n">accessed</span> <span class="n">to</span> <span class="n">addr</span> <span class="mh">0x1db0000</span>
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o">&lt;</span><span class="n">PAGE_READWRITE</span><span class="o">&gt;</span>
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
<span class="ne">Exception</span> <span class="n">of</span> <span class="nb">type</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span>
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o">&lt;</span><span class="n">PAGE_NOACCESS</span><span class="o">&gt;</span>
<span class="n">Value</span> <span class="mi">1</span> <span class="n">read</span>
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
<span class="n">Instr</span> <span class="n">at</span> <span class="mh">0x1d1ab574</span> <span class="n">accessed</span> <span class="n">to</span> <span class="n">addr</span> <span class="mh">0x1db0010</span>
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o">&lt;</span><span class="n">PAGE_READWRITE</span><span class="o">&gt;</span>
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
<span class="ne">Exception</span> <span class="n">of</span> <span class="nb">type</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span>
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o">&lt;</span><span class="n">PAGE_NOACCESS</span><span class="o">&gt;</span>
<span class="n">Value</span> <span class="mi">2</span> <span class="n">read</span>
</pre></div>
</div>
</div>
<div class="section" id="in-remote-process">
<h3>12.9.2. In remote process<a class="headerlink" href="#in-remote-process" title="Permalink to this headline"></a></h3>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.test</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="n">python_code</span> <span class="o">=</span> <span class="s2">&quot;&quot;&quot;</span>
<span class="s2">import windows</span>
<span class="s2">import ctypes</span>
<span class="s2">import windows</span>
<span class="s2">from windows.winobject.exception import VectoredException</span>
<span class="s2">import windows.generated_def.windef as windef</span>
<span class="s2">from windows.generated_def.winstructs import *</span>
<span class="s2">windows.utils.create_console()</span>
<span class="s2">module_to_trace = &quot;gdi32.dll&quot;</span>
<span class="s2">nb_repeat = [5]</span>
<span class="s2">@VectoredException</span>
<span class="s2">def handler(exc):</span>
<span class="s2"> if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:</span>
<span class="s2"> print(&quot;&quot;)</span>
<span class="s2"> target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value</span>
<span class="s2"> print(&quot;Instr at </span><span class="si">{0}</span><span class="s2"> accessed to addr </span><span class="si">{1}</span><span class="s2"> (</span><span class="si">{2}</span><span class="s2">)&quot;.format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr), module_to_trace))</span>
<span class="s2"> windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_EXECUTE_READWRITE)</span>
<span class="s2"> nb_repeat[0] -= 1</span>
<span class="s2"> if nb_repeat[0]:</span>
<span class="s2"> exc[0].ContextRecord[0].EEFlags.TF = 1</span>
<span class="s2"> else:</span>
<span class="s2"> print(&quot;No more tracing !&quot;)</span>
<span class="s2"> return windef.EXCEPTION_CONTINUE_EXECUTION</span>
<span class="s2"> else:</span>
<span class="s2"> print(&quot;Exception of type </span><span class="si">{0}</span><span class="s2">&quot;.format(exc[0].ExceptionRecord[0].ExceptionCode))</span>
<span class="s2"> print(&quot;Resetting page protection to &lt;PAGE_READWRITE&gt;&quot;)</span>
<span class="s2"> windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)</span>
<span class="s2"> return windef.EXCEPTION_CONTINUE_EXECUTION</span>
<span class="s2">windows.winproxy.AddVectoredExceptionHandler(0, handler)</span>
<span class="s2">print(&quot;Tracing execution in module: &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;.format(module_to_trace))</span>
<span class="s2">module = [x for x in windows.current_process.peb.modules if x.name == module_to_trace][0]</span>
<span class="s2">target_page = module.baseaddr</span>
<span class="s2">code_size = module.pe.get_OptionalHeader().SizeOfCode</span>
<span class="s2">print(&quot;Protected page is at </span><span class="si">{0}</span><span class="s2">&quot;.format(hex(target_page)))</span>
<span class="s2">windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)</span>
<span class="s2">&quot;&quot;&quot;</span>
<span class="n">c</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_calc_64</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">)</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">c</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">python_code</span><span class="p">)</span>
<span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
<span class="kn">import</span> <span class="nn">time</span>
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.1</span><span class="p">)</span>
<span class="k">for</span> <span class="n">t</span> <span class="ow">in</span> <span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">:</span>
<span class="n">t</span><span class="o">.</span><span class="n">suspend</span><span class="p">()</span>
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
<span class="n">c</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python .exe.\samples\remote_veh_segv.py
(In another console)
Tracing execution in module: &lt;gdi32.dll&gt;
Protected page is at 0x7ffa3c700000L
Instr at 0x7ffa3c70f0f0L accessed to addr 0x7ffa3c70f0f0L (gdi32.dll)
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
Resetting page protection to &lt;PAGE_READWRITE&gt;
Instr at 0x7ffa3c70f0f5L accessed to addr 0x7ffa3c70f0f5L (gdi32.dll)
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
Resetting page protection to &lt;PAGE_READWRITE&gt;
Instr at 0x7ffa3c70f0faL accessed to addr 0x7ffa3c70f0faL (gdi32.dll)
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
Resetting page protection to &lt;PAGE_READWRITE&gt;
Instr at 0x7ffa3c70f0ffL accessed to addr 0x7ffa3c70f0ffL (gdi32.dll)
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
Resetting page protection to &lt;PAGE_READWRITE&gt;
Instr at 0x7ffa3c70f100L accessed to addr 0x7ffa3c70f100L (gdi32.dll)
No more tracing !
</pre></div>
</div>
</div>
</div>
<div class="section" id="debugging">
<span id="sample-debugger"></span><h2>12.10. Debugging<a class="headerlink" href="#debugging" title="Permalink to this headline"></a></h2>
<div class="section" id="debugger">
<h3>12.10.1. <code class="xref py py-class docutils literal"><span class="pre">Debugger</span></code><a class="headerlink" href="#debugger" title="Permalink to this headline"></a></h3>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.test</span>
<span class="kn">import</span> <span class="nn">windows.debug</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="k">class</span> <span class="nc">MyDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Got exception </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
<span class="k">class</span> <span class="nc">PrintUnicodeString</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Breakpoint</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">argument_position</span><span class="p">):</span>
<span class="nb">super</span><span class="p">(</span><span class="n">PrintUnicodeString</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="n">__init__</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">arg_pos</span> <span class="o">=</span> <span class="n">argument_position</span>
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
<span class="n">p</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span>
<span class="n">t</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span>
<span class="n">esp</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">Esp</span>
<span class="n">unicode_string_addr</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">esp</span> <span class="o">+</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">arg_pos</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">*</span> <span class="mi">4</span><span class="p">)</span>
<span class="n">wstring_addr</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">unicode_string_addr</span> <span class="o">+</span> <span class="mi">4</span><span class="p">)</span>
<span class="n">dll_loaded</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_wstring</span><span class="p">(</span><span class="n">wstring_addr</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Loading &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dll_loaded</span><span class="p">))</span>
<span class="k">if</span> <span class="n">dll_loaded</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">&quot;ole32.dll&quot;</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Ask to load &lt;ole32.dll&gt;: exiting process&quot;</span><span class="p">)</span>
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_calc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
<span class="n">d</span> <span class="o">=</span> <span class="n">MyDebugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">PrintUnicodeString</span><span class="p">(</span><span class="s2">&quot;ntdll!LdrLoadDll&quot;</span><span class="p">,</span> <span class="n">argument_position</span><span class="o">=</span><span class="mi">2</span><span class="p">))</span>
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
</pre></div>
</div>
<p>Ouput:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">debugger_print_LdrLoaddll</span><span class="o">.</span><span class="n">py</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">KERNEL32</span><span class="o">.</span><span class="n">DLL</span><span class="o">&gt;</span>
<span class="n">Got</span> <span class="n">exception</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x77a73bad</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">IMM32</span><span class="o">.</span><span class="n">DLL</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">WinSxS</span>\<span class="n">x86_microsoft</span><span class="o">.</span><span class="n">windows</span><span class="o">.</span><span class="n">gdiplus_6595b64144ccf1df_1</span><span class="o">.</span><span class="mf">1.9600</span><span class="o">.</span><span class="mi">17415</span><span class="n">_none_dad8722c5bcc2d8f</span>\<span class="n">gdiplus</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">shell32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SYSTEM32</span>\<span class="n">WINMM</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Loading</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">Ask</span> <span class="n">to</span> <span class="n">load</span> <span class="o">&lt;</span><span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span><span class="p">:</span> <span class="n">exiting</span> <span class="n">process</span>
</pre></div>
</div>
<div class="section" id="single-stepping">
<h4>12.10.1.1. Single stepping<a class="headerlink" href="#single-stepping" title="Permalink to this headline"></a></h4>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.test</span>
<span class="kn">import</span> <span class="nn">windows.debug</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="k">class</span> <span class="nc">MyDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
<span class="nb">super</span><span class="p">(</span><span class="n">MyDebugger</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="n">__init__</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">=</span> <span class="mi">0</span>
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Got exception </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">on_single_step</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Got single_step </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
<span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">-=</span> <span class="mi">1</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">&gt;</span> <span class="mi">0</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;No more single step: exiting&quot;</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
<span class="k">class</span> <span class="nc">SingleStepOnWrite</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">MemoryBreakpoint</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Check that BP/dbg can trigger single step and that instruction follows&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
<span class="n">fault_addr</span> <span class="o">=</span> <span class="n">exc</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionInformation</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span>
<span class="n">eip</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">pc</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Instruction at &lt;</span><span class="si">{0:#x}</span><span class="s2">&gt; wrote at &lt;</span><span class="si">{1:#x}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">eip</span><span class="p">,</span> <span class="n">fault_addr</span><span class="p">))</span>
<span class="n">dbg</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">=</span> <span class="mi">4</span>
<span class="k">return</span> <span class="n">dbg</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_calc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
<span class="n">d</span> <span class="o">=</span> <span class="n">MyDebugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
<span class="n">data</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="s2">&quot;EAX&quot;</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="mi">4</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span> <span class="o">+</span> <span class="mi">4</span><span class="p">),</span> <span class="s2">&quot;EAX&quot;</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s2">&quot;EAX&quot;</span><span class="p">,</span> <span class="mi">8</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span> <span class="o">+</span> <span class="mi">8</span><span class="p">),</span> <span class="s2">&quot;EAX&quot;</span><span class="p">)</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Nop</span><span class="p">()</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Nop</span><span class="p">()</span>
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">calc</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">injected</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">SingleStepOnWrite</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="n">size</span><span class="o">=</span><span class="mi">8</span><span class="p">,</span> <span class="n">events</span><span class="o">=</span><span class="s2">&quot;W&quot;</span><span class="p">))</span>
<span class="n">calc</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
</pre></div>
</div>
<p>Ouput:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">debugger_membp_singlestep</span><span class="o">.</span><span class="n">py</span>
<span class="n">Got</span> <span class="n">exception</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x77ae3c7d</span>
<span class="n">Instruction</span> <span class="n">at</span> <span class="o">&lt;</span><span class="mh">0x8d0006</span><span class="o">&gt;</span> <span class="n">wrote</span> <span class="n">at</span> <span class="o">&lt;</span><span class="mh">0x8e0000</span><span class="o">&gt;</span>
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d000c</span>
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0011</span>
<span class="n">Instruction</span> <span class="n">at</span> <span class="o">&lt;</span><span class="mh">0x8d0011</span><span class="o">&gt;</span> <span class="n">wrote</span> <span class="n">at</span> <span class="o">&lt;</span><span class="mh">0x8e0004</span><span class="o">&gt;</span>
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0017</span>
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d001c</span>
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0022</span>
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x8d0023</span>
<span class="n">No</span> <span class="n">more</span> <span class="n">single</span> <span class="n">step</span><span class="p">:</span> <span class="n">exiting</span>
</pre></div>
</div>
</div>
<div class="section" id="windows-debug-functionbp">
<h4>12.10.1.2. <a class="reference internal" href="debug.html#windows.debug.FunctionBP" title="windows.debug.FunctionBP"><code class="xref py py-class docutils literal"><span class="pre">windows.debug.FunctionBP</span></code></a><a class="headerlink" href="#windows-debug-functionbp" title="Permalink to this headline"></a></h4>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.test</span>
<span class="kn">import</span> <span class="nn">windows.debug</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="k">class</span> <span class="nc">MyFunctionBP</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">FunctionBP</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="nb">super</span><span class="p">(</span><span class="n">MyFunctionBP</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="n">__init__</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target_name</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">target_func</span>
<span class="bp">self</span><span class="o">.</span><span class="n">counter</span> <span class="o">=</span> <span class="mi">3</span>
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">counter</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Exiting process&quot;</span><span class="p">)</span>
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
<span class="k">return</span>
<span class="n">params</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">extract_arguments</span><span class="p">(</span><span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="p">,</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="p">)</span>
<span class="n">filename</span> <span class="o">=</span> <span class="n">params</span><span class="p">[</span><span class="s2">&quot;ObjectAttributes&quot;</span><span class="p">]</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">ObjectName</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Buffer</span>
<span class="n">handle_addr</span> <span class="o">=</span> <span class="n">params</span><span class="p">[</span><span class="s2">&quot;FileHandle&quot;</span><span class="p">]</span><span class="o">.</span><span class="n">value</span>
<span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">handle_addr</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">break_on_ret</span><span class="p">(</span><span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">ret_trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
<span class="n">filename</span><span class="p">,</span> <span class="n">handle_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">data</span>
<span class="n">ret_value</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">func_result</span> <span class="c1"># EAX / RAX depending of bitness</span>
<span class="n">handle_value</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">handle_addr</span><span class="p">)</span>
<span class="k">if</span> <span class="n">ret_value</span><span class="p">:</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;NtCreateFile of &lt;</span><span class="si">{0}</span><span class="s2">&gt; FAILED (result=</span><span class="si">{1:#x}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">ret_value</span><span class="p">))</span>
<span class="k">return</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;NtCreateFile of &lt;</span><span class="si">{0}</span><span class="s2">&gt;: handle = </span><span class="si">{1:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">handle_value</span><span class="p">))</span>
<span class="c1"># Manual verification</span>
<span class="n">fhandle</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span> <span class="ow">and</span> <span class="n">h</span><span class="o">.</span><span class="n">wValue</span> <span class="o">==</span> <span class="n">handle_value</span><span class="p">]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">fhandle</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;handle not found!&quot;</span><span class="p">)</span>
<span class="n">fhandle</span> <span class="o">=</span> <span class="n">fhandle</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Handle manually found! typename=&lt;</span><span class="si">{0}</span><span class="s2">&gt;, name=&lt;</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">fhandle</span><span class="o">.</span><span class="n">type</span><span class="p">,</span> <span class="n">fhandle</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">counter</span> <span class="o">-=</span> <span class="mi">1</span>
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_calc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
<span class="n">d</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">MyFunctionBP</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateFile</span><span class="p">))</span>
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
</pre></div>
</div>
<p>Ouput:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe .\samples\debug_functionbp.py
NtCreateFile of &lt;\??\C:\Windows\syswow64\en-US\calc.exe.mui&gt;: handle = 0xac
Handle manually found! typename=&lt;File&gt;, name=&lt;\Device\HarddiskVolume2\Windows\SysWOW64\en-US\calc.exe.mui&gt;
NtCreateFile of &lt;\Device\DeviceApi\CMApi&gt;: handle = 0x108
Handle manually found! typename=&lt;File&gt;, name=&lt;\Device\DeviceApi&gt;
NtCreateFile of &lt;\??\C:\Windows\Fonts\staticcache.dat&gt;: handle = 0x154
Handle manually found! typename=&lt;File&gt;, name=&lt;\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat&gt;
Exiting process
</pre></div>
</div>
</div>
</div>
<div class="section" id="localdebugger">
<span id="sample-local-debugger"></span><h3>12.10.2. <code class="xref py py-class docutils literal"><span class="pre">LocalDebugger</span></code><a class="headerlink" href="#localdebugger" title="Permalink to this headline"></a></h3>
<div class="section" id="in-current-process">
<h4>12.10.2.1. In current process<a class="headerlink" href="#in-current-process" title="Permalink to this headline"></a></h4>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="k">class</span> <span class="nc">SingleSteppingDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">LocalDebugger</span><span class="p">):</span>
<span class="n">SINGLE_STEP_COUNT</span> <span class="o">=</span> <span class="mi">4</span>
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
<span class="n">code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_code</span><span class="p">()</span>
<span class="n">context</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_context</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;EXCEPTION !!!! Got a </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">context</span><span class="o">.</span><span class="n">pc</span><span class="p">))</span>
<span class="bp">self</span><span class="o">.</span><span class="n">SINGLE_STEP_COUNT</span> <span class="o">-=</span> <span class="mi">1</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">SINGLE_STEP_COUNT</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
<span class="k">return</span> <span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
<span class="k">class</span> <span class="nc">RewriteBreakpoint</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">HXBreakpoint</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
<span class="n">context</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">get_exception_context</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;GOT AN HXBP at 0x</span><span class="si">{0:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">context</span><span class="o">.</span><span class="n">pc</span><span class="p">))</span>
<span class="c1"># Rewrite the infinite loop with 2 nop</span>
<span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="s2">&quot;</span><span class="se">\x90\x90</span><span class="s2">&quot;</span><span class="p">)</span>
<span class="c1"># Ask for a single stepping</span>
<span class="k">return</span> <span class="n">dbg</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
<span class="n">d</span> <span class="o">=</span> <span class="n">SingleSteppingDebugger</span><span class="p">()</span>
<span class="c1"># Infinite loop + nop + ret</span>
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;label :begin; jmp :begin; nop; ret&quot;</span><span class="p">)</span>
<span class="n">func</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Code addr = 0x</span><span class="si">{0:x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
<span class="c1"># Create a thread that will infinite loop</span>
<span class="n">t</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
<span class="c1"># Add a breakpoint on the infitine loop</span>
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">RewriteBreakpoint</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
<span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Done!&quot;</span><span class="p">)</span>
</pre></div>
</div>
<p>Ouput:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span>(cmd λ) python.exe .\samples\local_debugger.py
Code addr = 0xcf0002
GOT AN HXBP at 0xcf0002
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0003
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0004
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0005
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x770d7c04
Done!
</pre></div>
</div>
</div>
<div class="section" id="id1">
<h4>12.10.2.2. In remote process<a class="headerlink" href="#id1" title="Permalink to this headline"></a></h4>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.test</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="n">remote_code</span> <span class="o">=</span> <span class="s2">&quot;&quot;&quot;</span>
<span class="s2">import windows</span>
<span class="s2">from windows.generated_def.winstructs import *</span>
<span class="s2">windows.utils.create_console()</span>
<span class="s2">class YOLOHXBP(windows.debug.HXBreakpoint):</span>
<span class="s2"> def trigger(self, dbg, exc):</span>
<span class="s2"> p = windows.current_process</span>
<span class="s2"> arg_pos = 2</span>
<span class="s2"> context = dbg.get_exception_context()</span>
<span class="s2"> esp = context.Esp</span>
<span class="s2"> unicode_string_addr = p.read_ptr(esp + (arg_pos + 1) * 4)</span>
<span class="s2"> wstring_addr = p.read_ptr(unicode_string_addr + 4)</span>
<span class="s2"> dll_loaded = p.read_wstring(wstring_addr)</span>
<span class="s2"> print(&quot;I AM LOADING &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;.format(dll_loaded))</span>
<span class="s2">d = windows.debug.LocalDebugger()</span>
<span class="s2">exp = windows.current_process.peb.modules[1].pe.exports</span>
<span class="s2">#windows.utils.FixedInteractiveConsole(locals()).interact()</span>
<span class="s2">ldr = exp[&quot;LdrLoadDll&quot;]</span>
<span class="s2">d.add_bp(YOLOHXBP(ldr))</span>
<span class="s2">&quot;&quot;&quot;</span>
<span class="n">c</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_calc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">)</span>
<span class="n">c</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">remote_code</span><span class="p">)</span>
<span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
<span class="kn">import</span> <span class="nn">time</span>
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">2</span><span class="p">)</span>
<span class="n">c</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
</pre></div>
</div>
<p>Ouput:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">local_debugger_remote_process</span><span class="o">.</span><span class="n">py</span>
<span class="p">(</span><span class="n">In</span> <span class="n">another</span> <span class="n">console</span><span class="p">)</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">WinSxS</span>\<span class="n">x86_microsoft</span><span class="o">.</span><span class="n">windows</span><span class="o">.</span><span class="n">gdiplus_6595b64144ccf1df_1</span><span class="o">.</span><span class="mf">1.9600</span><span class="o">.</span><span class="mi">17415</span><span class="n">_none_dad8722c5bcc2d8f</span>\<span class="n">gdiplus</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">comctl32</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SysWOW64</span>\<span class="n">oleacc</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">OLEAUT32</span><span class="o">.</span><span class="n">DLL</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">MSCTF</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SysWOW64</span>\<span class="n">msxml6</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">shell32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SYSTEM32</span>\<span class="n">WINMM</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o">&lt;</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">&gt;</span>
</pre></div>
</div>
</div>
</div>
<div class="section" id="make-wmi-requests">
<span id="wmi-request"></span><h3>12.10.3. Make WMI requests<a class="headerlink" href="#make-wmi-requests" title="Permalink to this headline"></a></h3>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;WMI requester is </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Selecting * from &#39;Win32_Process&#39;&quot;</span><span class="p">)</span>
<span class="n">result</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">select</span><span class="p">(</span><span class="s2">&quot;Win32_Process&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;They are &lt;</span><span class="si">{0}</span><span class="s2">&gt; processes&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">result</span><span class="p">)))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Looking for ourself via pid&quot;</span><span class="p">)</span>
<span class="n">us</span> <span class="o">=</span> <span class="p">[</span><span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">result</span> <span class="k">if</span> <span class="nb">int</span><span class="p">(</span><span class="n">p</span><span class="p">[</span><span class="s2">&quot;ProcessId&quot;</span><span class="p">])</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Some info about our process:&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;Name&quot;</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">&quot;Name&quot;</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;ProcessId&quot;</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">&quot;ProcessId&quot;</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;OSName&quot;</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">&quot;OSName&quot;</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;UserModeTime&quot;</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">&quot;UserModeTime&quot;</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;WindowsVersion&quot;</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">&quot;WindowsVersion&quot;</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">&quot;CommandLine&quot;</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">&quot;CommandLine&quot;</span><span class="p">]))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&lt;Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk&gt;:&quot;</span><span class="p">)</span>
<span class="k">for</span> <span class="n">vol</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">select</span><span class="p">(</span><span class="s2">&quot;Win32_LogicalDisk&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;Caption&quot;</span><span class="p">,</span> <span class="s2">&quot;FileSystem&quot;</span><span class="p">,</span> <span class="s2">&quot;FreeSpace&quot;</span><span class="p">]):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * &quot;</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">vol</span><span class="p">))</span>
</pre></div>
</div>
<p>Ouput:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">wmi_request</span><span class="o">.</span><span class="n">py</span>
<span class="n">WMI</span> <span class="n">requester</span> <span class="ow">is</span> <span class="o">&lt;</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">WmiRequester</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02B37EF0</span><span class="o">&gt;</span>
<span class="n">Selecting</span> <span class="o">*</span> <span class="kn">from</span> <span class="s1">&#39;Win32_Process&#39;</span>
<span class="n">They</span> <span class="n">are</span> <span class="o">&lt;</span><span class="mi">92</span><span class="o">&gt;</span> <span class="n">processes</span>
<span class="n">Looking</span> <span class="k">for</span> <span class="n">ourself</span> <span class="n">via</span> <span class="n">pid</span>
<span class="n">Some</span> <span class="n">info</span> <span class="n">about</span> <span class="n">our</span> <span class="n">process</span><span class="p">:</span>
<span class="o">*</span> <span class="n">Name</span> <span class="o">-&gt;</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span>
<span class="o">*</span> <span class="n">ProcessId</span> <span class="o">-&gt;</span> <span class="mi">7968</span>
<span class="o">*</span> <span class="n">OSName</span> <span class="o">-&gt;</span> <span class="n">Microsoft</span> <span class="n">Windows</span> <span class="mf">8.1</span> <span class="n">Pro</span><span class="o">|</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span><span class="o">|</span>\<span class="n">Device</span>\<span class="n">Harddisk0</span>\<span class="n">Partition2</span>
<span class="o">*</span> <span class="n">UserModeTime</span> <span class="o">-&gt;</span> <span class="mi">2812500</span>
<span class="o">*</span> <span class="n">WindowsVersion</span> <span class="o">-&gt;</span> <span class="mf">6.3</span><span class="o">.</span><span class="mi">9600</span>
<span class="o">*</span> <span class="n">CommandLine</span> <span class="o">-&gt;</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">wmi_request</span><span class="o">.</span><span class="n">py</span>
<span class="o">&lt;</span><span class="n">Select</span> <span class="n">Caption</span><span class="p">,</span><span class="n">FileSystem</span><span class="p">,</span><span class="n">FreeSpace</span> <span class="kn">from</span> <span class="nn">Win32_LogicalDisk</span><span class="o">&gt;</span><span class="p">:</span>
<span class="o">*</span> <span class="p">{</span><span class="s1">&#39;Caption&#39;</span><span class="p">:</span> <span class="s1">u&#39;C:&#39;</span><span class="p">,</span> <span class="s1">&#39;FreeSpace&#39;</span><span class="p">:</span> <span class="s1">u&#39;43991547904&#39;</span><span class="p">,</span> <span class="s1">&#39;FileSystem&#39;</span><span class="p">:</span> <span class="s1">u&#39;NTFS&#39;</span><span class="p">}</span>
<span class="o">*</span> <span class="p">{</span><span class="s1">&#39;Caption&#39;</span><span class="p">:</span> <span class="s1">u&#39;E:&#39;</span><span class="p">,</span> <span class="s1">&#39;FreeSpace&#39;</span><span class="p">:</span> <span class="s1">u&#39;82776027136&#39;</span><span class="p">,</span> <span class="s1">&#39;FileSystem&#39;</span><span class="p">:</span> <span class="s1">u&#39;NTFS&#39;</span><span class="p">}</span>
<span class="o">*</span> <span class="p">{</span><span class="s1">&#39;Caption&#39;</span><span class="p">:</span> <span class="s1">u&#39;F:&#39;</span><span class="p">,</span> <span class="s1">&#39;FreeSpace&#39;</span><span class="p">:</span> <span class="s1">u&#39;5711265792&#39;</span><span class="p">,</span> <span class="s1">&#39;FileSystem&#39;</span><span class="p">:</span> <span class="s1">u&#39;FAT32&#39;</span><span class="p">}</span>
<span class="o">*</span> <span class="p">{</span><span class="s1">&#39;Caption&#39;</span><span class="p">:</span> <span class="s1">u&#39;G:&#39;</span><span class="p">,</span> <span class="s1">&#39;FreeSpace&#39;</span><span class="p">:</span> <span class="kc">None</span><span class="p">,</span> <span class="s1">&#39;FileSystem&#39;</span><span class="p">:</span> <span class="kc">None</span><span class="p">}</span>
</pre></div>
</div>
</div>
<div class="section" id="using-com-inetfwpolicy2">
<span id="sample-com-firewall"></span><h3>12.10.4. using COM: <code class="docutils literal"><span class="pre">INetFwPolicy2</span></code><a class="headerlink" href="#using-com-inetfwpolicy2" title="Permalink to this headline"></a></h3>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">os.path</span>
<span class="kn">import</span> <span class="nn">pprint</span>
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="n">__file__</span> <span class="o">+</span> <span class="s2">&quot;\..\..&quot;</span><span class="p">))</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">interfaces</span>
<span class="c1"># This code is a simple version of the firewall code in windows.winoject.network</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Initialisation of COM&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">init</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Creating INetFwPolicy2 variable&quot;</span><span class="p">)</span>
<span class="n">firewall</span> <span class="o">=</span> <span class="n">interfaces</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="p">()</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> (value = </span><span class="si">{1}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">firewall</span><span class="p">,</span> <span class="n">firewall</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Generating CLSID&quot;</span><span class="p">)</span>
<span class="n">NetFwPolicy2CLSID</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">IID</span><span class="o">.</span><span class="n">from_string</span><span class="p">(</span><span class="s2">&quot;E2B3C97F-6AE1-41AC-817A-F6F92166D7DD&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="n">NetFwPolicy2CLSID</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Creating COM instance&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">create_instance</span><span class="p">(</span><span class="n">NetFwPolicy2CLSID</span><span class="p">,</span> <span class="n">firewall</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> (value = 0x</span><span class="si">{1:0}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">firewall</span><span class="p">,</span> <span class="n">firewall</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Checking for enabled profiles&quot;</span><span class="p">)</span>
<span class="k">for</span> <span class="n">profile</span> <span class="ow">in</span> <span class="p">[</span><span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_DOMAIN</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_PRIVATE</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_PUBLIC</span><span class="p">]:</span>
<span class="n">enabled</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VARIANT_BOOL</span><span class="p">()</span>
<span class="n">firewall</span><span class="o">.</span><span class="n">get_FirewallEnabled</span><span class="p">(</span><span class="n">profile</span><span class="p">,</span> <span class="n">enabled</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * </span><span class="si">{0}</span><span class="s2"> -&gt; </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">profile</span><span class="p">,</span> <span class="n">enabled</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
</pre></div>
</div>
<p>Output:</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="o">.</span>\<span class="n">samples</span>\<span class="n">com_inetfwpolicy2</span><span class="o">.</span><span class="n">py</span>
<span class="n">Initialisation</span> <span class="n">of</span> <span class="n">COM</span>
<span class="n">Creating</span> <span class="n">INetFwPolicy2</span> <span class="n">variable</span>
<span class="o">&lt;</span><span class="n">INetFwPolicy2</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02DC8210</span><span class="o">&gt;</span> <span class="p">(</span><span class="n">value</span> <span class="o">=</span> <span class="kc">None</span><span class="p">)</span>
<span class="n">Generating</span> <span class="n">CLSID</span>
<span class="o">&lt;</span><span class="n">IID</span> <span class="s2">&quot;E2B3C97F-6AE1-41AC-817A-F6F92166D7DD&quot;</span><span class="o">&gt;</span>
<span class="n">Creating</span> <span class="n">COM</span> <span class="n">instance</span>
<span class="o">&lt;</span><span class="n">INetFwPolicy2</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x02DC8210</span><span class="o">&gt;</span> <span class="p">(</span><span class="n">value</span> <span class="o">=</span> <span class="mh">0x8984848</span><span class="p">)</span>
<span class="n">Checking</span> <span class="k">for</span> <span class="n">enabled</span> <span class="n">profiles</span>
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_DOMAIN</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span> <span class="o">-&gt;</span> <span class="kc">True</span>
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_PRIVATE</span><span class="p">(</span><span class="mh">0x2</span><span class="n">L</span><span class="p">)</span> <span class="o">-&gt;</span> <span class="kc">True</span>
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_PUBLIC</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">)</span> <span class="o">-&gt;</span> <span class="kc">True</span>
</pre></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<h3><a href="index.html">Table Of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">12. Samples of code</a><ul>
<li><a class="reference internal" href="#windows-current-process">12.1. <code class="docutils literal"><span class="pre">windows.current_process</span></code></a></li>
<li><a class="reference internal" href="#remote-process-winprocess">12.2. Remote process : <code class="docutils literal"><span class="pre">WinProcess</span></code></a></li>
<li><a class="reference internal" href="#peb-exploration">12.3. <code class="docutils literal"><span class="pre">PEB</span></code> exploration</a></li>
<li><a class="reference internal" href="#windows-system">12.4. <code class="docutils literal"><span class="pre">windows.system</span></code></a></li>
<li><a class="reference internal" href="#iat-hooking">12.5. IAT hooking</a></li>
<li><a class="reference internal" href="#network-socket-exploration">12.6. <code class="docutils literal"><span class="pre">Network</span></code> - socket exploration</a></li>
<li><a class="reference internal" href="#registry">12.7. <code class="docutils literal"><span class="pre">Registry</span></code></a></li>
<li><a class="reference internal" href="#windows-wintrust">12.8. <code class="docutils literal"><span class="pre">windows.wintrust</span></code></a></li>
<li><a class="reference internal" href="#vectoredexception">12.9. <code class="docutils literal"><span class="pre">VectoredException()</span></code></a><ul>
<li><a class="reference internal" href="#in-local-process">12.9.1. In local process</a></li>
<li><a class="reference internal" href="#in-remote-process">12.9.2. In remote process</a></li>
</ul>
</li>
<li><a class="reference internal" href="#debugging">12.10. Debugging</a><ul>
<li><a class="reference internal" href="#debugger">12.10.1. <code class="docutils literal"><span class="pre">Debugger</span></code></a><ul>
<li><a class="reference internal" href="#single-stepping">12.10.1.1. Single stepping</a></li>
<li><a class="reference internal" href="#windows-debug-functionbp">12.10.1.2. <code class="docutils literal"><span class="pre">windows.debug.FunctionBP</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#localdebugger">12.10.2. <code class="docutils literal"><span class="pre">LocalDebugger</span></code></a><ul>
<li><a class="reference internal" href="#in-current-process">12.10.2.1. In current process</a></li>
<li><a class="reference internal" href="#id1">12.10.2.2. In remote process</a></li>
</ul>
</li>
<li><a class="reference internal" href="#make-wmi-requests">12.10.3. Make WMI requests</a></li>
<li><a class="reference internal" href="#using-com-inetfwpolicy2">12.10.4. using COM: <code class="docutils literal"><span class="pre">INetFwPolicy2</span></code></a></li>
</ul>
</li>
</ul>
</li>
</ul>
<h4>Previous topic</h4>
<p class="topless"><a href="internals.html"
title="previous chapter">11. Internals</a></p>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/sample.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<form class="search" action="search.html" method="get">
<div><input type="text" name="q" /></div>
<div><input type="submit" value="Go" /></div>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="internals.html" title="11. Internals"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.2 documentation</a> &raquo;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&copy; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.4.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink