mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
4469 lines
674 KiB
HTML
4469 lines
674 KiB
HTML
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<title>18. Samples of code — PythonForWindows 0.6 documentation</title>
|
|
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
|
|
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
|
|
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css" />
|
|
|
|
<script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
|
|
<script type="text/javascript" src="_static/jquery.js"></script>
|
|
<script type="text/javascript" src="_static/underscore.js"></script>
|
|
<script type="text/javascript" src="_static/doctools.js"></script>
|
|
<script type="text/javascript" src="_static/language_data.js"></script>
|
|
|
|
<link rel="index" title="Index" href="genindex.html" />
|
|
<link rel="search" title="Search" href="search.html" />
|
|
<link rel="prev" title="17. Internals" href="internals.html" />
|
|
</head><body>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="genindex.html" title="General Index"
|
|
accesskey="I">index</a></li>
|
|
<li class="right" >
|
|
<a href="py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="right" >
|
|
<a href="internals.html" title="17. Internals"
|
|
accesskey="P">previous</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> »</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<div class="document">
|
|
<div class="documentwrapper">
|
|
<div class="bodywrapper">
|
|
<div class="body" role="main">
|
|
|
|
<div class="section" id="samples-of-code">
|
|
<span id="sample-of-code"></span><h1>18. Samples of code<a class="headerlink" href="#samples-of-code" title="Permalink to this headline">¶</a></h1>
|
|
<div class="section" id="processes">
|
|
<h2>18.1. Processes<a class="headerlink" href="#processes" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="windows-current-process">
|
|
<span id="sample-current-process"></span><h3>18.1.1. <code class="docutils literal notranslate"><span class="pre">windows.current_process</span></code><a class="headerlink" href="#windows-current-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
|
|
<span class="c1"># Here is our current process</span>
|
|
<span class="n">cp</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process is </span><span class="si">{cp}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process is a <</span><span class="si">{cp.bitness}</span><span class="s2">> bits process"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process is a SysWow64 process ? <</span><span class="si">{cp.is_wow_64}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"current process pid <</span><span class="si">{cp.pid}</span><span class="s2">> and ppid <</span><span class="si">{cp.ppid}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Here are the current process threads: <</span><span class="si">{cp.threads}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cp</span><span class="o">=</span><span class="n">cp</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Let's execute some native code ! (0x41 + 1)"</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="c1"># Let's generate some native code</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"Eax"</span><span class="p">,</span> <span class="mh">0x41</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Inc</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"RAX"</span><span class="p">,</span> <span class="mh">0x41</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Inc</span><span class="p">(</span><span class="s2">"RAX"</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
|
|
<span class="n">native_code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
|
|
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">native_code</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Native code returned <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocating memory in current process"</span><span class="p">)</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">cp</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span> <span class="c1"># Default alloc is RWX (so secure !)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocated memory is at <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Writing 'SOME STUFF' in allocation memory"</span><span class="p">)</span>
|
|
<span class="n">cp</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="s2">"SOME STUFF"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">cp</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python process\current_process.py
|
|
current process is <windows.winobject.process.CurrentProcess object at 0x06407430>
|
|
current process is a <32> bits process
|
|
current process is a SysWow64 process ? <True>
|
|
current process pid <11344> and ppid <14984>
|
|
Here are the current process threads: <[<WinThread 17288 owner "CurrentProcess" at 0x6a68870>, <WinThread 15176 owner "CurrentProcess" at 0x6a687b0>, <WinThread 8972 owner "CurrentProcess" at 0x6a68bf0>, <WinThread 5568 owner "CurrentProcess" at 0x6a68dd0>]>
|
|
Let's execute some native code ! (0x41 + 1)
|
|
Native code returned <0x42>
|
|
Allocating memory in current process
|
|
Allocated memory is at <0x5510000>
|
|
Writing 'SOME STUFF' in allocation memory
|
|
Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="remote-process-winprocess">
|
|
<span id="sample-remote-process"></span><h3>18.1.2. Remote process : <code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code><a class="headerlink" href="#remote-process-winprocess" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating a notepad"</span><span class="p">)</span> <span class="c1">## Replaced calc.exe by notepad.exe cause of windows 10.</span>
|
|
<span class="n">notepad</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_process</span><span class="p">(</span><span class="sa">r</span><span class="s2">"C:\windows\system32\notepad.exe"</span><span class="p">)</span>
|
|
<span class="c1"># You don't need to do that in our case, but it's useful to now</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for notepads in the processes"</span><span class="p">)</span>
|
|
<span class="n">all_notepads</span> <span class="o">=</span> <span class="p">[</span><span class="n">proc</span> <span class="k">for</span> <span class="n">proc</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span> <span class="k">if</span> <span class="n">proc</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"notepad.exe"</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"They are currently <</span><span class="si">{0}</span><span class="s2">> notepads running on the system"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">all_notepads</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Let's play with our notepad: <</span><span class="si">{notepad}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad pid is </span><span class="si">{notepad.pid}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad is a <</span><span class="si">{notepad.bitness}</span><span class="s2">> bits process"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad is a SysWow64 process ? <</span><span class="si">{notepad.is_wow_64}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our notepad have threads ! <</span><span class="si">{notepad.threads}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">notepad</span><span class="o">=</span><span class="n">notepad</span><span class="p">))</span>
|
|
|
|
<span class="c1"># PEB STUFF</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">notepad</span><span class="o">.</span><span class="n">peb</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exploring our notepad PEB ! </span><span class="si">{peb}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="o">=</span><span class="n">peb</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Command line is </span><span class="si">{peb.commandline}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="o">=</span><span class="n">peb</span><span class="p">))</span>
|
|
<span class="n">modules</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Here are 3 loaded modules: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">modules</span><span class="p">[:</span><span class="mi">3</span><span class="p">]))</span>
|
|
<span class="c1"># See iat_hook.py for module exploration</span>
|
|
|
|
|
|
<span class="c1"># Remote alloc / read / write</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocating memory in our notepad"</span><span class="p">)</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">notepad</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Allocated memory is at <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Writing 'SOME STUFF' in allocated memory"</span><span class="p">)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="s2">"SOME STUFF"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading allocated memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">notepad</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
|
|
<span class="c1"># Remote Execution</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)"</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">notepad</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="c1"># Let's generate some native code</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">addr</span><span class="p">),</span> <span class="mh">0x42424242</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mh">0x1337</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">'RAX'</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s2">"[RAX]"</span><span class="p">),</span> <span class="mh">0x42424242</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"RAX"</span><span class="p">,</span> <span class="mh">0x1337</span><span class="p">)</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Executing native code !"</span><span class="p">)</span>
|
|
<span class="n">t</span> <span class="o">=</span> <span class="n">notepad</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">code</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
|
|
<span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Return code = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">t</span><span class="o">.</span><span class="n">exit_code</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading allocated memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">notepad</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Executing python code !"</span><span class="p">)</span>
|
|
<span class="c1"># Make 'windows' importable in remote python</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"import sys; sys.path.append(r'</span><span class="si">{0}</span><span class="s2">')"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="p">[</span><span class="o">-</span><span class="mi">1</span><span class="p">]))</span>
|
|
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"import windows"</span><span class="p">)</span>
|
|
<span class="c1"># Let's write in the notepad 'current_process' memory :)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"addr = </span><span class="si">{addr}</span><span class="s2">; windows.current_process.write_memory(addr, 'HELLO FROM notepad')"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">addr</span><span class="o">=</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Reading allocated memory : <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">notepad</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="mi">20</span><span class="p">))))</span>
|
|
|
|
<span class="c1"># python_execute is 'safe':</span>
|
|
<span class="c1"># - it waits for the thread completion</span>
|
|
<span class="c1"># - it raise an error if remote code raised some</span>
|
|
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Trying to import in remote module 'FAKE_MODULE'"</span><span class="p">)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">"def func():</span><span class="se">\n</span><span class="s2"> import FAKE_MODULE</span><span class="se">\n</span><span class="s2">func()"</span><span class="p">)</span>
|
|
<span class="k">except</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">RemotePythonError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exception in remote process!"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"That's all ! killing the notepad"</span><span class="p">)</span>
|
|
<span class="n">notepad</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python process\remote_process.py
|
|
Creating a notepad
|
|
Looking for notepads in the processes
|
|
They are currently <1> notepads running on the system
|
|
Let's play with our notepad: <<WinProcess "notepad.exe" pid 8400 at 0x6238510>>
|
|
Our notepad pid is 8400
|
|
Our notepad is a <32> bits process
|
|
Our notepad is a SysWow64 process ? <True>
|
|
Our notepad have threads ! <[<WinThread 16028 owner "notepad.exe" at 0x6238f10>, <WinThread 5924 owner "notepad.exe" at 0x6238a10>, <WinThread 11620 owner "notepad.exe" at 0x6238fb0>, <WinThread 3480 owner "notepad.exe" at 0x6238ff0>, <WinThread 200 owner "notepad.exe" at 0x62389b0>, <WinThread 16804 owner "notepad.exe" at 0x62389f0>, <WinThread 13340 owner "notepad.exe" at 0x6238930>]>
|
|
Exploring our notepad PEB ! <windows.winobject.process.RemotePEB object at 0x061BDA80>
|
|
Command line is <Remote_LSA_UNICODE_STRING ""C:\windows\system32\notepad.exe"" at 0x61bdb20>
|
|
Here are 3 loaded modules: [<RemoteLoadedModule "notepad.exe" at 0x61bdad0>, <RemoteLoadedModule "ntdll.dll" at 0x61bd940>, <RemoteLoadedModule "kernel32.dll" at 0x61bd8f0>]
|
|
Allocating memory in our notepad
|
|
Allocated memory is at <0x6f00000>
|
|
Writing 'SOME STUFF' in allocated memory
|
|
Reading allocated memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)
|
|
Executing native code !
|
|
Return code = 0x1337L
|
|
Reading allocated memory : <'BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
|
|
Executing python code !
|
|
Reading allocated memory : <'HELLO FROM notepad\x00\x00'>
|
|
Trying to import in remote module 'FAKE_MODULE'
|
|
Exception in remote process!
|
|
Traceback (most recent call last):
|
|
File "<string>", line 3, in <module>
|
|
File "<string>", line 2, in func
|
|
ImportError: No module named FAKE_MODULE
|
|
|
|
That's all ! killing the notepad
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="peb-exploration">
|
|
<span id="sample-peb-exploration"></span><h3>18.1.3. <code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code> exploration<a class="headerlink" href="#peb-exploration" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exploring the current process PEB"</span><span class="p">)</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"PEB is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">peb</span><span class="p">))</span>
|
|
<span class="n">commandline</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">commandline</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Commandline object is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">commandline</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Commandline string is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">commandline</span><span class="o">.</span><span class="n">Buffer</span><span class="p">)))</span>
|
|
|
|
<span class="n">imagepath</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">imagepath</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Imagepath </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">imagepath</span><span class="p">))</span>
|
|
|
|
<span class="n">modules</span> <span class="o">=</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Printing some modules: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="nb">str</span><span class="p">(</span><span class="n">m</span><span class="p">)</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">modules</span><span class="p">[:</span><span class="mi">6</span><span class="p">])))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"=== K32 ==="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for kernel32.dll"</span><span class="p">)</span>
|
|
<span class="n">k32</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"kernel32.dll"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Kernel32 module: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Module name = <</span><span class="si">{0}</span><span class="s2">> | Fullname = <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">k32</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Kernel32 is loaded at address </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">k32</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"=== K32 PE ==="</span><span class="p">)</span>
|
|
<span class="n">k32pe</span> <span class="o">=</span> <span class="n">k32</span><span class="o">.</span><span class="n">pe</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"PE Representation of k32: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32pe</span><span class="p">))</span>
|
|
<span class="n">exports</span> <span class="o">=</span> <span class="n">k32pe</span><span class="o">.</span><span class="n">exports</span>
|
|
<span class="n">some_exports</span> <span class="o">=</span> <span class="nb">dict</span><span class="p">((</span><span class="n">k</span><span class="p">,</span><span class="n">v</span><span class="p">)</span> <span class="k">for</span> <span class="n">k</span><span class="p">,</span><span class="n">v</span> <span class="ow">in</span> <span class="n">exports</span><span class="o">.</span><span class="n">items</span><span class="p">()</span> <span class="k">if</span> <span class="n">k</span> <span class="ow">in</span> <span class="p">[</span><span class="mi">0</span><span class="p">,</span> <span class="mi">42</span><span class="p">,</span> <span class="s2">"VirtualAlloc"</span><span class="p">,</span> <span class="s2">"CreateFileA"</span><span class="p">])</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Here are some exports </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">some_exports</span><span class="p">))</span>
|
|
|
|
<span class="n">imports</span> <span class="o">=</span> <span class="n">k32pe</span><span class="o">.</span><span class="n">imports</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Import DLL dependancies are (without api-*): </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">imports</span><span class="o">.</span><span class="n">keys</span><span class="p">()</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">x</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">"api-"</span><span class="p">)]))</span>
|
|
|
|
<span class="n">NtCreateFile_iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">imports</span><span class="p">[</span><span class="s2">"ntdll.dll"</span><span class="p">]</span> <span class="k">if</span> <span class="n">x</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"NtCreateFile"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"IAT Entry for ntdll!NtCreateFile = </span><span class="si">{0}</span><span class="s2"> | addr = </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">NtCreateFile_iat</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="n">NtCreateFile_iat</span><span class="o">.</span><span class="n">addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Sections: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">k32pe</span><span class="o">.</span><span class="n">sections</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python process\peb.py
|
|
Exploring the current process PEB
|
|
PEB is <<windows.winobject.process.PEB object at 0x05A6F710>>
|
|
Commandline object is <_LSA_UNICODE_STRING "C:\Python27\python.exe process\peb.py" at 0x5a6f8a0>
|
|
Commandline string is 47063282
|
|
Imagepath <_LSA_UNICODE_STRING "C:\Python27\python.exe" at 0x5a6f990>
|
|
Printing some modules: <LoadedModule "python.exe" at 0x60d2080>
|
|
<LoadedModule "ntdll.dll" at 0x60d2030>
|
|
<LoadedModule "kernel32.dll" at 0x60d2b20>
|
|
<LoadedModule "kernelbase.dll" at 0x60d2b70>
|
|
<LoadedModule "python27.dll" at 0x60d2bc0>
|
|
<LoadedModule "msvcr90.dll" at 0x60d2c10>
|
|
=== K32 ===
|
|
Looking for kernel32.dll
|
|
Kernel32 module: <LoadedModule "kernel32.dll" at 0x60d2b20>
|
|
Module name = <kernel32.dll> | Fullname = <c:\windows\system32\kernel32.dll>
|
|
Kernel32 is loaded at address 0x76930000
|
|
=== K32 PE ===
|
|
PE Representation of k32: <windows.pe_parse.PEFile object at 0x060CCA10>
|
|
Here are some exports {0: 1989445168L, 'CreateFileA': 1989795280L, 42: 1989636592L, 'VirtualAlloc': 1989437552L}
|
|
Import DLL dependancies are (without api-*): ['kernelbase.dll', 'ntdll.dll']
|
|
IAT Entry for ntdll!NtCreateFile = <IATEntry "NtCreateFile" ordinal 272> | addr = 0x769a1a28L
|
|
Sections: [<PESection ".text">, <PESection ".rdata">, <PESection ".data">, <PESection ".rsrc">, <PESection ".reloc">]
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="apisetmap">
|
|
<span id="sample-apisetmap"></span><h3>18.1.4. ApiSetMap<a class="headerlink" href="#apisetmap" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Computer is a <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version_name</span><span class="p">))</span>
|
|
|
|
<span class="n">cp</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
|
|
<span class="n">apism</span> <span class="o">=</span> <span class="n">cp</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">apisetmap</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"ApiSetMap: </span><span class="si">{0}</span><span class="s2"> (version = </span><span class="si">{1}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">apism</span><span class="p">,</span> <span class="n">apism</span><span class="o">.</span><span class="n">version</span><span class="p">))</span>
|
|
|
|
<span class="n">dll_demos_fullname</span> <span class="o">=</span> <span class="s1">'api-ms-win-core-processthreads-l1-1-3'</span>
|
|
<span class="n">dll_demos_utilname</span> <span class="o">=</span> <span class="s1">'api-ms-win-core-processthreads-l1-1-'</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Entries in 'apisetmap_dict' are the full api-dll path extracted"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * apisetmap.apisetmap_dict['</span><span class="si">{0}</span><span class="s2">'] -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dll_demos_fullname</span><span class="p">,</span> <span class="n">apism</span><span class="o">.</span><span class="n">apisetmap_dict</span><span class="p">[</span><span class="n">dll_demos_fullname</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Entries in 'resolution_dict' are the contains the util-part check by windows"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * apisetmap.resolution_dict['</span><span class="si">{0}</span><span class="s2">'] -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dll_demos_utilname</span><span class="p">,</span> <span class="n">apism</span><span class="o">.</span><span class="n">resolution_dict</span><span class="p">[</span><span class="n">dll_demos_utilname</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"ApiSetMap.resolve resolve a api-dll based on the util part"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">suffix</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"1"</span><span class="p">,</span> <span class="s2">"2"</span><span class="p">,</span> <span class="s2">"PART_IS_IGNORED"</span><span class="p">]:</span>
|
|
<span class="n">testname</span> <span class="o">=</span> <span class="n">dll_demos_utilname</span> <span class="o">+</span> <span class="n">suffix</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * apisetmap.resolve('</span><span class="si">{0}</span><span class="s2">') -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">testname</span><span class="p">,</span> <span class="n">apism</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="n">testname</span><span class="p">)))</span>
|
|
|
|
<span class="n">testname</span> <span class="o">=</span> <span class="s2">"BAD_DLL-3.dll"</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * apisetmap.resolve('</span><span class="si">{0}</span><span class="s2">') -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">testname</span><span class="p">,</span> <span class="n">apism</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="n">testname</span><span class="p">)))</span>
|
|
<span class="k">except</span> <span class="ne">KeyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * apisetmap.resolve('</span><span class="si">{0}</span><span class="s2">') -> raised: </span><span class="si">{1!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">testname</span><span class="p">,</span> <span class="n">e</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">process</span>\<span class="n">apisetmap</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Computer</span> <span class="ow">is</span> <span class="n">a</span> <span class="o"><</span><span class="n">Windows</span> <span class="mi">10</span><span class="o">></span>
|
|
<span class="n">ApiSetMap</span><span class="p">:</span> <span class="o"><</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">apisetmap</span><span class="o">.</span><span class="n">ApiSetMapVersion6</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x0645ECB0</span><span class="o">></span> <span class="p">(</span><span class="n">version</span> <span class="o">=</span> <span class="mi">6</span><span class="p">)</span>
|
|
<span class="n">Entries</span> <span class="ow">in</span> <span class="s1">'apisetmap_dict'</span> <span class="n">are</span> <span class="n">the</span> <span class="n">full</span> <span class="n">api</span><span class="o">-</span><span class="n">dll</span> <span class="n">path</span> <span class="n">extracted</span>
|
|
<span class="o">*</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">apisetmap_dict</span><span class="p">[</span><span class="s1">'api-ms-win-core-processthreads-l1-1-3'</span><span class="p">]</span> <span class="o">-></span> <span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span>
|
|
<span class="n">Entries</span> <span class="ow">in</span> <span class="s1">'resolution_dict'</span> <span class="n">are</span> <span class="n">the</span> <span class="n">contains</span> <span class="n">the</span> <span class="n">util</span><span class="o">-</span><span class="n">part</span> <span class="n">check</span> <span class="n">by</span> <span class="n">windows</span>
|
|
<span class="o">*</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">resolution_dict</span><span class="p">[</span><span class="s1">'api-ms-win-core-processthreads-l1-1-'</span><span class="p">]</span> <span class="o">-></span> <span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span>
|
|
<span class="n">ApiSetMap</span><span class="o">.</span><span class="n">resolve</span> <span class="n">resolve</span> <span class="n">a</span> <span class="n">api</span><span class="o">-</span><span class="n">dll</span> <span class="n">based</span> <span class="n">on</span> <span class="n">the</span> <span class="n">util</span> <span class="n">part</span>
|
|
<span class="o">*</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s1">'api-ms-win-core-processthreads-l1-1-1'</span><span class="p">)</span> <span class="o">-></span> <span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span>
|
|
<span class="o">*</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s1">'api-ms-win-core-processthreads-l1-1-2'</span><span class="p">)</span> <span class="o">-></span> <span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span>
|
|
<span class="o">*</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s1">'api-ms-win-core-processthreads-l1-1-PART_IS_IGNORED'</span><span class="p">)</span> <span class="o">-></span> <span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span>
|
|
<span class="o">*</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s1">'BAD_DLL-3.dll'</span><span class="p">)</span> <span class="o">-></span> <span class="n">raised</span><span class="p">:</span> <span class="ne">KeyError</span><span class="p">(</span><span class="s1">'BAD_DLL-'</span><span class="p">,)</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="iat-hooking">
|
|
<span id="sample-iat-hook"></span><h3>18.1.5. IAT hooking<a class="headerlink" href="#iat-hooking" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">_winreg</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="c1"># Here is a demo of IAT hooking in python</span>
|
|
<span class="c1"># We will hook the 'RegOpenKeyExA' entry of Python27.dll because it is easy to trigger !</span>
|
|
|
|
<span class="c1"># First: let's create our hook</span>
|
|
<span class="c1"># windows.hooks.RegOpenKeyExACallback is generated based on windows.generated_def.winfuncs</span>
|
|
<span class="nd">@windows</span><span class="o">.</span><span class="n">hooks</span><span class="o">.</span><span class="n">RegOpenKeyExACallback</span>
|
|
<span class="k">def</span> <span class="nf">open_reg_hook</span><span class="p">(</span><span class="n">hKey</span><span class="p">,</span> <span class="n">lpSubKey</span><span class="p">,</span> <span class="n">ulOptions</span><span class="p">,</span> <span class="n">samDesired</span><span class="p">,</span> <span class="n">phkResult</span><span class="p">,</span> <span class="n">real_function</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Hook called | hKey = </span><span class="si">{0}</span><span class="s2"> | lpSubKey = <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">hKey</span><span class="p">),</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="c1"># Our hook can choose to call the real_function or not</span>
|
|
<span class="k">if</span> <span class="s2">"SECRET"</span> <span class="ow">in</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Secret key asked, returning magic handle 0x12345678"</span><span class="p">)</span>
|
|
<span class="c1"># We must respect the hooked method return-value interface</span>
|
|
<span class="n">phkResult</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="mh">0x12345678</span>
|
|
<span class="k">return</span> <span class="mi">0</span>
|
|
<span class="k">if</span> <span class="s2">"FAIL"</span> <span class="ow">in</span> <span class="n">lpSubKey</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Asked for a failing key: returning 0x2a"</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="mi">42</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<in hook> Non-secret key : calling normal function"</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">real_function</span><span class="p">()</span>
|
|
|
|
|
|
<span class="c1"># Get the peb of our process</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
|
|
|
|
<span class="c1"># Get the pythonxx.dll module</span>
|
|
<span class="n">pythondll_module</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">"python"</span><span class="p">)</span> <span class="ow">and</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">".dll"</span><span class="p">)][</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="c1"># Get the iat entries for DLL advapi32.dll</span>
|
|
<span class="n">adv_imports</span> <span class="o">=</span> <span class="n">pythondll_module</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">imports</span><span class="p">[</span><span class="s1">'advapi32.dll'</span><span class="p">]</span>
|
|
|
|
<span class="c1"># Get RegOpenKeyExA iat entry</span>
|
|
<span class="n">RegOpenKeyExA_iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">n</span> <span class="k">for</span> <span class="n">n</span> <span class="ow">in</span> <span class="n">adv_imports</span> <span class="k">if</span> <span class="n">n</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">"RegOpenKeyExA"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="c1"># Setup our hook</span>
|
|
<span class="n">RegOpenKeyExA_iat</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">open_reg_hook</span><span class="p">)</span>
|
|
|
|
<span class="c1">### !!!! You must keep the iat_entry alive !!!!</span>
|
|
<span class="c1">### If the hook is garbage collected while active -> python will crash</span>
|
|
|
|
<span class="c1"># Use python native module _winreg that call 'RegOpenKeyExA'</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Asking for <MY_SECRET_KEY>"</span><span class="p">)</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">"MY_SECRET_KEY"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Result = "</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Asking for <MY_FAIL_KEY>"</span><span class="p">)</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">"MY_FAIL_KEY"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Result = "</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
|
|
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Asking for <HKEY_CURRENT_USER/Software>"</span><span class="p">)</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="n">_winreg</span><span class="o">.</span><span class="n">HKEY_CURRENT_USER</span><span class="p">,</span> <span class="s2">"Software"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Result = "</span> <span class="o">+</span> <span class="nb">hex</span><span class="p">(</span><span class="n">v</span><span class="o">.</span><span class="n">handle</span><span class="p">))</span>
|
|
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">process</span>\<span class="n">iat_hook</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Asking</span> <span class="k">for</span> <span class="o"><</span><span class="n">MY_SECRET_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x12d687</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o"><</span><span class="n">MY_SECRET_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Secret</span> <span class="n">key</span> <span class="n">asked</span><span class="p">,</span> <span class="n">returning</span> <span class="n">magic</span> <span class="n">handle</span> <span class="mh">0x12345678</span>
|
|
<span class="n">Result</span> <span class="o">=</span> <span class="mh">0x12345678</span>
|
|
|
|
<span class="n">Asking</span> <span class="k">for</span> <span class="o"><</span><span class="n">MY_FAIL_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x12d687</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o"><</span><span class="n">MY_FAIL_KEY</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Asked</span> <span class="k">for</span> <span class="n">a</span> <span class="n">failing</span> <span class="n">key</span><span class="p">:</span> <span class="n">returning</span> <span class="mh">0x2a</span>
|
|
<span class="ne">WindowsError</span><span class="p">(</span><span class="mi">42</span><span class="p">,</span> <span class="s1">'Windows Error 0x2A'</span><span class="p">)</span>
|
|
|
|
<span class="n">Asking</span> <span class="k">for</span> <span class="o"><</span><span class="n">HKEY_CURRENT_USER</span><span class="o">/</span><span class="n">Software</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Hook</span> <span class="n">called</span> <span class="o">|</span> <span class="n">hKey</span> <span class="o">=</span> <span class="mh">0x80000001</span><span class="n">L</span> <span class="o">|</span> <span class="n">lpSubKey</span> <span class="o">=</span> <span class="o"><</span><span class="n">Software</span><span class="o">></span>
|
|
<span class="o"><</span><span class="ow">in</span> <span class="n">hook</span><span class="o">></span> <span class="n">Non</span><span class="o">-</span><span class="n">secret</span> <span class="n">key</span> <span class="p">:</span> <span class="n">calling</span> <span class="n">normal</span> <span class="n">function</span>
|
|
<span class="n">Result</span> <span class="o">=</span> <span class="mh">0x428</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="token">
|
|
<span id="token-sample"></span><h2>18.2. Token<a class="headerlink" href="#token" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="n">tok</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our process token is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">tok</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Retrieving some infos"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Username: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">tok</span><span class="o">.</span><span class="n">username</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"User: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">tok</span><span class="o">.</span><span class="n">user</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - lookup : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">lookup_sid</span><span class="p">(</span><span class="n">tok</span><span class="o">.</span><span class="n">user</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Primary group: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">tok</span><span class="o">.</span><span class="n">primary_group</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - lookup : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">lookup_sid</span><span class="p">(</span><span class="n">tok</span><span class="o">.</span><span class="n">primary_group</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">groups</span> <span class="o">=</span> <span class="n">tok</span><span class="o">.</span><span class="n">groups</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Token Groups is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">groups</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"First group SID is </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">groups</span><span class="o">.</span><span class="n">sids</span><span class="p">[</span><span class="mi">0</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some sid and attributes:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">group</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="nb">range</span><span class="p">(</span><span class="mi">3</span><span class="p">),</span> <span class="n">groups</span><span class="o">.</span><span class="n">sids_and_attributes</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - </span><span class="si">{0}</span><span class="s2">: </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">group</span><span class="o">.</span><span class="n">Sid</span><span class="p">,</span> <span class="n">group</span><span class="o">.</span><span class="n">Attributes</span><span class="p">))</span>
|
|
|
|
<span class="c1"># Let's play with duplicate !</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">imp_tok</span> <span class="o">=</span> <span class="n">tok</span><span class="o">.</span><span class="n">duplicate</span><span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">TokenImpersonation</span><span class="p">,</span> <span class="n">impersonation_level</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">SecurityImpersonation</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Duplicate token is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">imp_tok</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Enabling <SeShutDownPrivilege>"</span><span class="p">)</span>
|
|
<span class="n">imp_tok</span><span class="o">.</span><span class="n">enable_privilege</span><span class="p">(</span><span class="s2">"SeShutDownPrivilege"</span><span class="p">)</span>
|
|
|
|
<span class="n">cur_thread</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_thread</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Current thread token is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cur_thread</span><span class="o">.</span><span class="n">token</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Setting impersonation token !"</span><span class="p">)</span>
|
|
<span class="n">cur_thread</span><span class="o">.</span><span class="n">token</span> <span class="o">=</span> <span class="n">imp_tok</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Current thread token is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cur_thread</span><span class="o">.</span><span class="n">token</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python token\token_demo.py
|
|
Our process token is <Token TokenId=0x3f1f98fd Type=TokenPrimary(0x1L)>
|
|
Retrieving some infos
|
|
Username: <hakril>
|
|
User: <PSID "S-1-5-21-184905214-2723199098-2761450773-1001">
|
|
- lookup : ('WILLIE', 'hakril')
|
|
Primary group: <PSID "S-1-5-21-184905214-2723199098-2761450773-513">
|
|
- lookup : ('WILLIE', 'Aucun')
|
|
|
|
Token Groups is <TokenGroups count=15>
|
|
First group SID is <PSID "S-1-5-21-184905214-2723199098-2761450773-513">
|
|
Some sid and attributes:
|
|
- S-1-5-21-184905214-2723199098-2761450773-513: 7
|
|
- S-1-1-0: 7
|
|
- S-1-5-114: 16
|
|
|
|
Duplicate token is <Token TokenId=0x3f1fac85 Type=TokenImpersonation(0x2L) ImpersonationLevel=SecurityImpersonation(0x2L)>
|
|
Enabling <SeShutDownPrivilege>
|
|
Current thread token is <None>
|
|
Setting impersonation token !
|
|
Current thread token is <Token TokenId=0x3f1fac85 Type=TokenImpersonation(0x2L) ImpersonationLevel=SecurityImpersonation(0x2L)>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-system">
|
|
<span id="sample-system"></span><h2>18.3. <code class="docutils literal notranslate"><span class="pre">windows.system</span></code><a class="headerlink" href="#windows-system" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="n">system</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Basic system infos:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" version = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" bitness = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" computer_name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">computer_name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" product_type = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">product_type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" version_name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">version_name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"There is </span><span class="si">{0}</span><span class="s2"> processes"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"There is </span><span class="si">{0}</span><span class="s2"> threads"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">system</span><span class="o">.</span><span class="n">threads</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Dumping first logical drive:"</span><span class="p">)</span>
|
|
<span class="n">drive</span> <span class="o">=</span> <span class="n">system</span><span class="o">.</span><span class="n">logicaldrives</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">drive</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"type = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"path = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">drive</span><span class="o">.</span><span class="n">path</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Dumping first service:"</span><span class="p">)</span>
|
|
<span class="n">serv</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">serv</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"description = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"status = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">status</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"process = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">process</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Finding a service in a user process:"</span><span class="p">)</span>
|
|
<span class="n">serv</span> <span class="o">=</span> <span class="p">[</span><span class="n">s</span> <span class="k">for</span> <span class="n">s</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span> <span class="k">if</span> <span class="n">s</span><span class="o">.</span><span class="n">process</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">serv</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"description = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"status = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">status</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"process = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">serv</span><span class="o">.</span><span class="n">process</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Enumerating handles:"</span><span class="p">)</span>
|
|
<span class="n">handles</span> <span class="o">=</span> <span class="n">system</span><span class="o">.</span><span class="n">handles</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" There are </span><span class="si">{0}</span><span class="s2"> handles:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">handles</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" First handle is: "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">handles</span><span class="p">[</span><span class="mi">0</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Enumerating handles of the current process:"</span><span class="p">)</span>
|
|
<span class="n">cp_handles</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" There are </span><span class="si">{0}</span><span class="s2"> handles for this process"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">cp_handles</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Looking for a File handle:"</span><span class="p">)</span>
|
|
<span class="n">file_h</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">cp_handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">type</span> <span class="o">==</span> <span class="s2">"File"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Handle is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">file_h</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Name is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">file_h</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Dumping the first system module"</span><span class="p">)</span>
|
|
<span class="n">kmod</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">modules</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">(</span><span class="n">kmod</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"ImageName = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">kmod</span><span class="o">.</span><span class="n">ImageName</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"Base = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">kmod</span><span class="o">.</span><span class="n">Base</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"Size = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">kmod</span><span class="o">.</span><span class="n">Size</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"Flags = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">kmod</span><span class="o">.</span><span class="n">Flags</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">((</span><span class="s2">" "</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span> <span class="o">+</span> <span class="s2">"LoadCount = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">kmod</span><span class="o">.</span><span class="n">LoadCount</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">system</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Basic</span> <span class="n">system</span> <span class="n">infos</span><span class="p">:</span>
|
|
<span class="n">version</span> <span class="o">=</span> <span class="p">(</span><span class="mi">10</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
|
|
<span class="n">computer_name</span> <span class="o">=</span> <span class="n">WILLIE</span>
|
|
<span class="n">product_type</span> <span class="o">=</span> <span class="mi">1</span>
|
|
<span class="n">version_name</span> <span class="o">=</span> <span class="n">Windows</span> <span class="mi">10</span>
|
|
|
|
<span class="n">There</span> <span class="ow">is</span> <span class="mi">331</span> <span class="n">processes</span>
|
|
<span class="n">There</span> <span class="ow">is</span> <span class="mi">4010</span> <span class="n">threads</span>
|
|
|
|
<span class="n">Dumping</span> <span class="n">first</span> <span class="n">logical</span> <span class="n">drive</span><span class="p">:</span>
|
|
<span class="o"><</span><span class="n">LogicalDrive</span> <span class="s2">"B:</span><span class="se">\"</span><span class="s2"> (DRIVE_FIXED)></span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">B</span><span class="p">:</span>\
|
|
<span class="nb">type</span> <span class="o">=</span> <span class="mi">3</span>
|
|
<span class="n">path</span> <span class="o">=</span> \<span class="n">Device</span>\<span class="n">HarddiskVolume7</span>
|
|
|
|
<span class="n">Dumping</span> <span class="n">first</span> <span class="n">service</span><span class="p">:</span>
|
|
<span class="o"><</span><span class="n">Service</span> <span class="s2">"1394ohci"</span> <span class="n">SERVICE_STOPPED</span><span class="p">(</span><span class="mh">0x1</span><span class="p">)</span><span class="o">></span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="mi">1394</span><span class="n">ohci</span>
|
|
<span class="n">description</span> <span class="o">=</span> <span class="mi">1394</span> <span class="n">OHCI</span> <span class="n">Compliant</span> <span class="n">Host</span> <span class="n">Controller</span>
|
|
<span class="n">status</span> <span class="o">=</span> <span class="o"><</span><span class="n">_SERVICE_STATUS_PROCESS</span> <span class="nb">type</span><span class="o">=</span><span class="n">SERVICE_KERNEL_DRIVER</span><span class="p">(</span><span class="mh">0x1</span><span class="p">)</span> <span class="n">state</span><span class="o">=</span><span class="n">SERVICE_STOPPED</span><span class="p">(</span><span class="mh">0x1</span><span class="p">)</span><span class="o">></span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="kc">None</span>
|
|
|
|
<span class="n">Finding</span> <span class="n">a</span> <span class="n">service</span> <span class="ow">in</span> <span class="n">a</span> <span class="n">user</span> <span class="n">process</span><span class="p">:</span>
|
|
<span class="o"><</span><span class="n">Service</span> <span class="s2">"AppIDSvc"</span> <span class="n">SERVICE_RUNNING</span><span class="p">(</span><span class="mh">0x4</span><span class="p">)</span><span class="o">></span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">AppIDSvc</span>
|
|
<span class="n">description</span> <span class="o">=</span> <span class="n">Application</span> <span class="n">Identity</span>
|
|
<span class="n">status</span> <span class="o">=</span> <span class="o"><</span><span class="n">_SERVICE_STATUS_PROCESS</span> <span class="nb">type</span><span class="o">=</span><span class="mi">48</span><span class="n">L</span> <span class="n">state</span><span class="o">=</span><span class="n">SERVICE_RUNNING</span><span class="p">(</span><span class="mh">0x4</span><span class="p">)</span><span class="o">></span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"!cannot-retrieve-name"</span> <span class="n">pid</span> <span class="mi">6060</span> <span class="n">at</span> <span class="mh">0x35851d0</span><span class="o">></span>
|
|
|
|
<span class="n">Enumerating</span> <span class="n">handles</span><span class="p">:</span>
|
|
<span class="n">There</span> <span class="n">are</span> <span class="mi">208332</span> <span class="n">handles</span><span class="p">:</span>
|
|
<span class="n">First</span> <span class="n">handle</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">HandleWow64</span> <span class="n">value</span><span class="o">=<</span><span class="mh">0x4</span><span class="o">></span> <span class="ow">in</span> <span class="n">process</span> <span class="n">pid</span><span class="o">=</span><span class="mi">4</span><span class="o">></span>
|
|
<span class="n">Enumerating</span> <span class="n">handles</span> <span class="n">of</span> <span class="n">the</span> <span class="n">current</span> <span class="n">process</span><span class="p">:</span>
|
|
<span class="n">There</span> <span class="n">are</span> <span class="mi">275</span> <span class="n">handles</span> <span class="k">for</span> <span class="n">this</span> <span class="n">process</span>
|
|
<span class="n">Looking</span> <span class="k">for</span> <span class="n">a</span> <span class="n">File</span> <span class="n">handle</span><span class="p">:</span>
|
|
<span class="n">Handle</span> <span class="ow">is</span> <span class="o"><</span><span class="n">HandleWow64</span> <span class="n">value</span><span class="o">=<</span><span class="mh">0x4</span><span class="o">></span> <span class="ow">in</span> <span class="n">process</span> <span class="n">pid</span><span class="o">=</span><span class="mi">15236</span><span class="o">></span>
|
|
<span class="n">Name</span> <span class="ow">is</span> <span class="o"><</span>\<span class="n">Device</span>\<span class="n">ConDrv</span><span class="o">></span>
|
|
|
|
<span class="n">Dumping</span> <span class="n">the</span> <span class="n">first</span> <span class="n">system</span> <span class="n">module</span>
|
|
<span class="o"><</span><span class="n">SystemModuleWow64</span> <span class="n">name</span><span class="o">=</span><span class="s2">"\SystemRoot\system32</span><span class="se">\n</span><span class="s2">toskrnl.exe"</span> <span class="n">base</span><span class="o">=</span><span class="mh">0xfffff80023000000</span><span class="o">></span>
|
|
<span class="n">ImageName</span> <span class="o">=</span> \<span class="n">SystemRoot</span>\<span class="n">system32</span>\<span class="n">ntoskrnl</span><span class="o">.</span><span class="n">exe</span>
|
|
<span class="n">Base</span> <span class="o">=</span> <span class="mh">0xfffff80023000000</span>
|
|
<span class="n">Size</span> <span class="o">=</span> <span class="mh">0xab7000</span>
|
|
<span class="n">Flags</span> <span class="o">=</span> <span class="mh">0x8804000</span>
|
|
<span class="n">LoadCount</span> <span class="o">=</span> <span class="mi">240</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="services">
|
|
<span id="sample-services-demo"></span><h2>18.4. Services<a class="headerlink" href="#services" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing the first 3 services:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">service</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span><span class="p">[:</span><span class="mi">3</span><span class="p">]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="n">TARGET_SERVICE</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">"TapiSrv"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Retriving service <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_SERVICE</span><span class="p">))</span>
|
|
<span class="n">service</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">services</span><span class="p">[</span><span class="n">TARGET_SERVICE</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - name: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - description: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">description</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - state: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">status</span><span class="o">.</span><span class="n">state</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - type: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">status</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - process: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">process</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - security-description: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">security_descriptor</span><span class="p">))</span>
|
|
|
|
<span class="k">if</span> <span class="n">service</span><span class="o">.</span><span class="n">status</span><span class="o">.</span><span class="n">state</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SERVICE_RUNNING</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Service already running, not trying to start it"</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Trying to start the service"</span><span class="p">)</span>
|
|
<span class="n">service</span><span class="o">.</span><span class="n">start</span><span class="p">()</span>
|
|
<span class="k">while</span> <span class="n">service</span><span class="o">.</span><span class="n">status</span><span class="o">.</span><span class="n">state</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SERVICE_RUNNING</span><span class="p">:</span>
|
|
<span class="k">pass</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Service started !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - state: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">status</span><span class="o">.</span><span class="n">state</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - process: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">service</span><span class="o">.</span><span class="n">process</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python service\service_demo.py
|
|
Listing the first 3 services:
|
|
* <Service "1394ohci" SERVICE_STOPPED(0x1)>
|
|
* <Service "3ware" SERVICE_STOPPED(0x1)>
|
|
* <Service "ACPI" SERVICE_RUNNING(0x4)>
|
|
|
|
Retriving service <TapiSrv>
|
|
<Service "TapiSrv" SERVICE_STOPPED(0x1)>
|
|
- name: 'TapiSrv'
|
|
- description: 'Telephony'
|
|
- state: SERVICE_STOPPED(0x1)
|
|
- type: 48L
|
|
- process: None
|
|
- security-description: O:SYG:SYD:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)
|
|
Trying to start the service
|
|
Service started !
|
|
<Service "TapiSrv" SERVICE_RUNNING(0x4)>
|
|
- state: SERVICE_RUNNING(0x4)
|
|
- process: <WinProcess "!cannot-retrieve-name" pid 14700 at 0x4a2c4f0>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="network-socket-exploration">
|
|
<span id="sample-network-exploration"></span><h2>18.5. <code class="xref py py-class docutils literal notranslate"><span class="pre">Network</span></code> - socket exploration<a class="headerlink" href="#network-socket-exploration" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">socket</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">check_is_elevated</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"!!! Demo will fail because closing a connection require elevated process !!!"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Working on ipv4"</span><span class="p">)</span>
|
|
<span class="n">conns</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">ipv4</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== Listening =="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some listening connections: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">][:</span><span class="mi">3</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listening ports are : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span><span class="o">.</span><span class="n">local_port</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== Established =="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some established connections: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">([</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">conns</span> <span class="k">if</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span><span class="p">][:</span><span class="mi">3</span><span class="p">]))</span>
|
|
|
|
<span class="n">TARGET_HOST</span> <span class="o">=</span> <span class="s2">"localhost"</span>
|
|
<span class="n">TARGET_PORT</span> <span class="o">=</span> <span class="mi">80</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== connection to </span><span class="si">{0}</span><span class="s2">:</span><span class="si">{1}</span><span class="s2"> =="</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_HOST</span><span class="p">,</span> <span class="n">TARGET_PORT</span><span class="p">))</span>
|
|
<span class="n">s</span> <span class="o">=</span> <span class="n">socket</span><span class="o">.</span><span class="n">create_connection</span><span class="p">((</span><span class="n">TARGET_HOST</span><span class="p">,</span> <span class="n">TARGET_PORT</span><span class="p">))</span>
|
|
|
|
<span class="n">our_connection</span> <span class="o">=</span> <span class="p">[</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">ipv4</span> <span class="k">if</span> <span class="n">c</span><span class="o">.</span><span class="n">established</span> <span class="ow">and</span> <span class="n">c</span><span class="o">.</span><span class="n">remote_port</span> <span class="o">==</span> <span class="n">TARGET_PORT</span> <span class="ow">and</span> <span class="n">c</span><span class="o">.</span><span class="n">remote_addr</span> <span class="o">==</span> <span class="n">s</span><span class="o">.</span><span class="n">getpeername</span><span class="p">()[</span><span class="mi">0</span><span class="p">]]</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Our connection is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">our_connection</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Sending YOP"</span><span class="p">)</span>
|
|
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">"YOP"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Closing socket"</span><span class="p">)</span>
|
|
<span class="n">our_connection</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Sending LAIT"</span><span class="p">)</span>
|
|
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">"LAIT"</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output-New</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">network</span>\<span class="n">network</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Working</span> <span class="n">on</span> <span class="n">ipv4</span>
|
|
<span class="o">==</span> <span class="n">Listening</span> <span class="o">==</span>
|
|
<span class="n">Some</span> <span class="n">listening</span> <span class="n">connections</span><span class="p">:</span> <span class="p">[</span><span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">80</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">135</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Listening</span> <span class="n">socket</span> <span class="n">on</span> <span class="mf">0.0</span><span class="o">.</span><span class="mf">0.0</span><span class="p">:</span><span class="mi">445</span><span class="o">></span><span class="p">]</span>
|
|
<span class="n">Listening</span> <span class="n">ports</span> <span class="n">are</span> <span class="p">:</span> <span class="p">[</span><span class="mi">80</span><span class="p">,</span> <span class="mi">135</span><span class="p">,</span> <span class="mi">445</span><span class="p">,</span> <span class="mi">902</span><span class="p">,</span> <span class="mi">912</span><span class="p">,</span> <span class="mi">27036</span><span class="p">,</span> <span class="mi">49664</span><span class="p">,</span> <span class="mi">49665</span><span class="p">,</span> <span class="mi">49666</span><span class="p">,</span> <span class="mi">49667</span><span class="p">,</span> <span class="mi">49671</span><span class="p">,</span> <span class="mi">49673</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">1120</span><span class="p">,</span> <span class="mi">5556</span><span class="p">,</span> <span class="mi">6463</span><span class="p">,</span> <span class="mi">22885</span><span class="p">,</span> <span class="mi">22886</span><span class="p">,</span> <span class="mi">27060</span><span class="p">,</span> <span class="mi">49330</span><span class="p">,</span> <span class="mi">49331</span><span class="p">,</span> <span class="mi">49794</span><span class="p">,</span> <span class="mi">49795</span><span class="p">,</span> <span class="mi">49867</span><span class="p">,</span> <span class="mi">52541</span><span class="p">,</span> <span class="mi">57125</span><span class="p">,</span> <span class="mi">57138</span><span class="p">,</span> <span class="mi">65000</span><span class="p">,</span> <span class="mi">65001</span><span class="p">,</span> <span class="mi">139</span><span class="p">,</span> <span class="mi">5556</span><span class="p">,</span> <span class="mi">57046</span><span class="p">,</span> <span class="mi">57109</span><span class="p">,</span> <span class="mi">57110</span><span class="p">,</span> <span class="mi">57143</span><span class="p">,</span> <span class="mi">57144</span><span class="p">,</span> <span class="mi">139</span><span class="p">,</span> <span class="mi">5556</span><span class="p">,</span> <span class="mi">139</span><span class="p">,</span> <span class="mi">5556</span><span class="p">]</span>
|
|
<span class="o">==</span> <span class="n">Established</span> <span class="o">==</span>
|
|
<span class="n">Some</span> <span class="n">established</span> <span class="n">connections</span><span class="p">:</span> <span class="p">[</span><span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">912</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49488</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">912</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">52332</span><span class="o">></span><span class="p">,</span> <span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">49488</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">912</span><span class="o">></span><span class="p">]</span>
|
|
<span class="o">==</span> <span class="n">connection</span> <span class="n">to</span> <span class="n">localhost</span><span class="p">:</span><span class="mi">80</span> <span class="o">==</span>
|
|
<span class="n">Our</span> <span class="n">connection</span> <span class="ow">is</span> <span class="p">[</span><span class="o"><</span><span class="n">TCP</span> <span class="n">IPV4</span> <span class="n">Connection</span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">57167</span> <span class="o">-></span> <span class="mf">127.0</span><span class="o">.</span><span class="mf">0.1</span><span class="p">:</span><span class="mi">80</span><span class="o">></span><span class="p">]</span>
|
|
<span class="n">Sending</span> <span class="n">YOP</span>
|
|
<span class="n">Closing</span> <span class="n">socket</span>
|
|
<span class="n">Sending</span> <span class="n">LAIT</span>
|
|
<span class="n">Traceback</span> <span class="p">(</span><span class="n">most</span> <span class="n">recent</span> <span class="n">call</span> <span class="n">last</span><span class="p">):</span>
|
|
<span class="n">File</span> <span class="s2">"network</span><span class="se">\n</span><span class="s2">etwork.py"</span><span class="p">,</span> <span class="n">line</span> <span class="mi">34</span><span class="p">,</span> <span class="ow">in</span> <span class="o"><</span><span class="n">module</span><span class="o">></span>
|
|
<span class="n">s</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="s2">"LAIT"</span><span class="p">)</span>
|
|
<span class="n">socket</span><span class="o">.</span><span class="n">error</span><span class="p">:</span> <span class="p">[</span><span class="n">Errno</span> <span class="mi">10054</span><span class="p">]</span> <span class="n">An</span> <span class="n">existing</span> <span class="n">connection</span> <span class="n">was</span> <span class="n">forcibly</span> <span class="n">closed</span> <span class="n">by</span> <span class="n">the</span> <span class="n">remote</span> <span class="n">host</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="registry">
|
|
<span id="sample-registry"></span><h2>18.6. <code class="xref py py-class docutils literal notranslate"><span class="pre">Registry</span></code><a class="headerlink" href="#registry" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="n">registry</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">registry</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Registry is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registry</span><span class="p">))</span>
|
|
|
|
<span class="n">current_user</span> <span class="o">=</span> <span class="n">registry</span><span class="p">(</span><span class="s2">"HKEY_CURRENT_USER"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"HKEY_CURRENT_USER is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">current_user</span><span class="p">))</span>
|
|
<span class="n">subkeys_name</span> <span class="o">=</span> <span class="p">[</span><span class="n">s</span><span class="o">.</span><span class="n">name</span> <span class="k">for</span> <span class="n">s</span> <span class="ow">in</span> <span class="n">current_user</span><span class="o">.</span><span class="n">subkeys</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"HKEY_CURRENT_USER subkeys names are:"</span><span class="p">)</span>
|
|
<span class="n">pprint</span><span class="o">.</span><span class="n">pprint</span><span class="p">(</span><span class="n">subkeys_name</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Opening 'Software' in HKEY_CURRENT_USER: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">current_user</span><span class="p">(</span><span class="s2">"Software"</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"We can also open it in one access: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registry</span><span class="p">(</span><span class="sa">r</span><span class="s2">"HKEY_CURRENT_USER\Sofware"</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking at CurrentVersion"</span><span class="p">)</span>
|
|
|
|
<span class="n">windows_info</span> <span class="o">=</span> <span class="n">registry</span><span class="p">(</span><span class="s2">"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Key is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows_info</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"values are:"</span><span class="p">)</span>
|
|
<span class="n">pprint</span><span class="o">.</span><span class="n">pprint</span><span class="p">(</span><span class="n">windows_info</span><span class="o">.</span><span class="n">values</span><span class="p">)</span>
|
|
|
|
<span class="n">registered_owner</span> <span class="o">=</span> <span class="n">windows_info</span><span class="p">[</span><span class="s2">"RegisteredOwner"</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"registered owner = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">registered_owner</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">registry</span>\<span class="n">registry</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Registry</span> <span class="ow">is</span> <span class="o"><<</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">registry</span><span class="o">.</span><span class="n">Registry</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x061F89F0</span><span class="o">>></span>
|
|
<span class="n">HKEY_CURRENT_USER</span> <span class="ow">is</span> <span class="o"><<</span><span class="n">PyHKey</span> <span class="s2">"HKEY_CURRENT_USER"</span><span class="o">>></span>
|
|
<span class="n">HKEY_CURRENT_USER</span> <span class="n">subkeys</span> <span class="n">names</span> <span class="n">are</span><span class="p">:</span>
|
|
<span class="p">[</span><span class="s1">'AppEvents'</span><span class="p">,</span>
|
|
<span class="s1">'AppXBackupContentType'</span><span class="p">,</span>
|
|
<span class="s1">'Console'</span><span class="p">,</span>
|
|
<span class="s1">'Control Panel'</span><span class="p">,</span>
|
|
<span class="s1">'Environment'</span><span class="p">,</span>
|
|
<span class="s1">'EUDC'</span><span class="p">,</span>
|
|
<span class="s1">'Keyboard Layout'</span><span class="p">,</span>
|
|
<span class="s1">'Network'</span><span class="p">,</span>
|
|
<span class="s1">'Printers'</span><span class="p">,</span>
|
|
<span class="s1">'Software'</span><span class="p">,</span>
|
|
<span class="s1">'System'</span><span class="p">,</span>
|
|
<span class="s1">'Uninstall'</span><span class="p">,</span>
|
|
<span class="s1">'Volatile Environment'</span><span class="p">]</span>
|
|
<span class="n">Opening</span> <span class="s1">'Software'</span> <span class="ow">in</span> <span class="n">HKEY_CURRENT_USER</span><span class="p">:</span> <span class="o"><</span><span class="n">PyHKey</span> <span class="s2">"HKEY_CURRENT_USER\Software"</span><span class="o">></span>
|
|
<span class="n">We</span> <span class="n">can</span> <span class="n">also</span> <span class="nb">open</span> <span class="n">it</span> <span class="ow">in</span> <span class="n">one</span> <span class="n">access</span><span class="p">:</span> <span class="o"><</span><span class="n">PyHKey</span> <span class="s2">"HKEY_CURRENT_USER\Sofware"</span><span class="o">></span>
|
|
<span class="n">Looking</span> <span class="n">at</span> <span class="n">CurrentVersion</span>
|
|
<span class="n">Key</span> <span class="ow">is</span> <span class="o"><</span><span class="n">PyHKey</span> <span class="s2">"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion"</span><span class="o">></span>
|
|
<span class="n">values</span> <span class="n">are</span><span class="p">:</span>
|
|
<span class="p">[</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'SoftwareType'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'System'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">),</span>
|
|
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'RegisteredOwner'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'hakril'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">),</span>
|
|
<span class="o">...</span>
|
|
<span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'PathName'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'C:</span><span class="se">\\</span><span class="s1">WINDOWS'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">)]</span>
|
|
<span class="n">registered</span> <span class="n">owner</span> <span class="o">=</span> <span class="o"><</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">name</span><span class="o">=</span><span class="s1">'RegisteredOwner'</span><span class="p">,</span> <span class="n">value</span><span class="o">=</span><span class="sa">u</span><span class="s1">'hakril'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="mi">1</span><span class="p">)</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="scheduled-tasks">
|
|
<span id="sample-scheduled-task"></span><h2>18.7. Scheduled tasks<a class="headerlink" href="#scheduled-tasks" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="n">tscheduler</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">task_scheduler</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Task scheduler is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">tscheduler</span><span class="p">))</span>
|
|
<span class="n">root</span> <span class="o">=</span> <span class="n">tscheduler</span><span class="o">.</span><span class="n">root</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Root folder is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">root</span><span class="p">))</span>
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">"Listing sub folders"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">subfolder</span> <span class="ow">in</span> <span class="n">root</span><span class="o">.</span><span class="n">folders</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">subfolder</span><span class="p">))</span>
|
|
<span class="n">last_name</span> <span class="o">=</span> <span class="n">subfolder</span><span class="o">.</span><span class="n">name</span>
|
|
|
|
<span class="n">demo_folder</span> <span class="o">=</span> <span class="s2">"\Microsoft\Windows\AppID"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Manually opening subfolder <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">demo_folder</span><span class="p">))</span>
|
|
<span class="n">subfolder</span> <span class="o">=</span> <span class="n">root</span><span class="p">(</span><span class="n">demo_folder</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Working into </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">subfolder</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">task</span> <span class="ow">in</span> <span class="n">subfolder</span><span class="o">.</span><span class="n">tasks</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{task.name}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">task</span><span class="o">=</span><span class="n">task</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Analysing task </span><span class="si">{task}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">task</span><span class="o">=</span><span class="n">task</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Name: <</span><span class="si">{task.name}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">task</span><span class="o">=</span><span class="n">task</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Path: <</span><span class="si">{task.path}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">task</span><span class="o">=</span><span class="n">task</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Definition: <</span><span class="si">{task.definition}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">task</span><span class="o">=</span><span class="n">task</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing actions:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">action</span> <span class="ow">in</span> <span class="n">task</span><span class="o">.</span><span class="n">definition</span><span class="o">.</span><span class="n">actions</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Action: <</span><span class="si">{action}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">action</span><span class="o">=</span><span class="n">action</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Type: <</span><span class="si">{action.type!r}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">action</span><span class="o">=</span><span class="n">action</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">action</span><span class="p">,</span> <span class="s2">"path"</span><span class="p">,</span> <span class="kc">None</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * path: <</span><span class="si">{action.path}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">action</span><span class="o">=</span><span class="n">action</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * arguments: <</span><span class="si">{action.arguments}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">action</span><span class="o">=</span><span class="n">action</span><span class="p">))</span>
|
|
|
|
<span class="c1"># import pdb;pdb.set_trace()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing triggers:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">trigger</span> <span class="ow">in</span> <span class="n">task</span><span class="o">.</span><span class="n">definition</span><span class="o">.</span><span class="n">triggers</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Trigger type: <</span><span class="si">{trigger.type!r}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">trigger</span><span class="o">=</span><span class="n">trigger</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">DEMO_FOLDER_NAME</span> <span class="o">=</span> <span class="s2">"PFW_DEMO_FOLDER"</span>
|
|
<span class="n">DEMO_TASK_NAME</span> <span class="o">=</span> <span class="s2">"PFW_DEMO_TASK"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating folder <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">DEMO_FOLDER_NAME</span><span class="p">))</span>
|
|
<span class="n">demo_folder</span> <span class="o">=</span> <span class="n">root</span><span class="o">.</span><span class="n">create_folder</span><span class="p">(</span><span class="n">DEMO_FOLDER_NAME</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Demo folder is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">demo_folder</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating Task definition"</span><span class="p">)</span>
|
|
<span class="c1"># Create a Task definition</span>
|
|
<span class="n">new_task_definition</span> <span class="o">=</span> <span class="n">tscheduler</span><span class="o">.</span><span class="n">create</span><span class="p">()</span>
|
|
<span class="n">actions</span> <span class="o">=</span> <span class="n">new_task_definition</span><span class="o">.</span><span class="n">actions</span>
|
|
<span class="c1"># Add an TASK_ACTION_EXEC action to the task def</span>
|
|
<span class="n">new_action</span> <span class="o">=</span> <span class="n">actions</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TASK_ACTION_EXEC</span><span class="p">)</span>
|
|
<span class="n">new_action</span><span class="o">.</span><span class="n">path</span> <span class="o">=</span> <span class="n">sys</span><span class="o">.</span><span class="n">executable</span>
|
|
<span class="n">new_action</span><span class="o">.</span><span class="n">arguments</span> <span class="o">=</span> <span class="s2">"-c 'Hello !'"</span>
|
|
<span class="c1"># Register the new task under 'DEMO_TASK_NAME'</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Registering task definition as <</span><span class="si">{0}</span><span class="s2">> in <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">DEMO_TASK_NAME</span><span class="p">,</span> <span class="n">demo_folder</span><span class="p">))</span>
|
|
<span class="n">new_task</span> <span class="o">=</span> <span class="n">demo_folder</span><span class="o">.</span><span class="n">register</span><span class="p">(</span><span class="n">DEMO_TASK_NAME</span><span class="p">,</span> <span class="n">new_task_definition</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Created task is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">new_task</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Deleting the demo task"</span><span class="p">)</span>
|
|
<span class="k">del</span> <span class="n">demo_folder</span><span class="p">[</span><span class="n">DEMO_TASK_NAME</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Deleting the demo folder"</span><span class="p">)</span>
|
|
<span class="n">root</span><span class="o">.</span><span class="n">delete_folder</span><span class="p">(</span><span class="n">DEMO_FOLDER_NAME</span><span class="p">)</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">scheduled_tasks</span>\<span class="n">scheduled_task</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Task</span> <span class="n">scheduler</span> <span class="ow">is</span> <span class="o"><</span><span class="n">TaskService</span> <span class="n">at</span> <span class="mh">0x6f2a1c0</span><span class="o">></span>
|
|
<span class="n">Root</span> <span class="n">folder</span> <span class="ow">is</span> <span class="o"><</span><span class="n">TaskFolder</span> <span class="s2">"</span><span class="se">\"</span><span class="s2"> at 0x6f2a2b0></span>
|
|
<span class="n">Listing</span> <span class="n">sub</span> <span class="n">folders</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">TaskFolder</span> <span class="s2">"\ASUS"</span> <span class="n">at</span> <span class="mh">0x6f2a350</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">TaskFolder</span> <span class="s2">"\Intel"</span> <span class="n">at</span> <span class="mh">0x6f2a300</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">TaskFolder</span> <span class="s2">"\Microsoft"</span> <span class="n">at</span> <span class="mh">0x6f2a3a0</span><span class="o">></span>
|
|
<span class="n">Manually</span> <span class="n">opening</span> <span class="n">subfolder</span> <span class="o"><</span>\<span class="n">Microsoft</span>\<span class="n">Windows</span>\<span class="n">AppID</span><span class="o">></span>
|
|
<span class="n">Working</span> <span class="n">into</span> <span class="o"><</span><span class="n">TaskFolder</span> <span class="s2">"\Microsoft\Windows\AppID"</span> <span class="n">at</span> <span class="mh">0x6f2a3f0</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">PolicyConverter</span>
|
|
<span class="o">*</span> <span class="n">SmartScreenSpecific</span>
|
|
<span class="o">*</span> <span class="n">VerifiedPublisherCertStoreCheck</span>
|
|
|
|
<span class="n">Analysing</span> <span class="n">task</span> <span class="o"><</span><span class="n">Task</span> <span class="s2">"VerifiedPublisherCertStoreCheck"</span> <span class="n">at</span> <span class="mh">0x6f2a300</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Name</span><span class="p">:</span> <span class="o"><</span><span class="n">VerifiedPublisherCertStoreCheck</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Path</span><span class="p">:</span> <span class="o"><</span>\<span class="n">Microsoft</span>\<span class="n">Windows</span>\<span class="n">AppID</span>\<span class="n">VerifiedPublisherCertStoreCheck</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Definition</span><span class="p">:</span> <span class="o"><<</span><span class="n">TaskDefinition</span> <span class="n">at</span> <span class="mh">0x6f2a3a0</span><span class="o">>></span>
|
|
<span class="n">Listing</span> <span class="n">actions</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">Action</span><span class="p">:</span> <span class="o"><<</span><span class="n">ExecAction</span> <span class="n">at</span> <span class="mh">0x6f2a350</span><span class="o">>></span>
|
|
<span class="o">*</span> <span class="n">Type</span><span class="p">:</span> <span class="o"><</span><span class="n">TASK_ACTION_EXEC</span><span class="p">(</span><span class="mh">0x0</span><span class="n">L</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">path</span><span class="p">:</span> <span class="o"><%</span><span class="n">windir</span><span class="o">%</span>\<span class="n">system32</span>\<span class="n">appidcertstorecheck</span><span class="o">.</span><span class="n">exe</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">arguments</span><span class="p">:</span> <span class="o"><</span><span class="kc">None</span><span class="o">></span>
|
|
<span class="n">Listing</span> <span class="n">triggers</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">Trigger</span> <span class="nb">type</span><span class="p">:</span> <span class="o"><</span><span class="n">TASK_TRIGGER_BOOT</span><span class="p">(</span><span class="mh">0x8</span><span class="n">L</span><span class="p">)</span><span class="o">></span>
|
|
|
|
<span class="n">Creating</span> <span class="n">folder</span> <span class="o"><</span><span class="n">PFW_DEMO_FOLDER</span><span class="o">></span>
|
|
<span class="n">Demo</span> <span class="n">folder</span> <span class="ow">is</span> <span class="o"><</span><span class="n">TaskFolder</span> <span class="s2">"\PFW_DEMO_FOLDER"</span> <span class="n">at</span> <span class="mh">0x6f2a3a0</span><span class="o">></span>
|
|
<span class="n">Creating</span> <span class="n">Task</span> <span class="n">definition</span>
|
|
<span class="n">Registering</span> <span class="n">task</span> <span class="n">definition</span> <span class="k">as</span> <span class="o"><</span><span class="n">PFW_DEMO_TASK</span><span class="o">></span> <span class="ow">in</span> <span class="o"><<</span><span class="n">TaskFolder</span> <span class="s2">"\PFW_DEMO_FOLDER"</span> <span class="n">at</span> <span class="mh">0x6f2a3a0</span><span class="o">>></span>
|
|
<span class="n">Created</span> <span class="n">task</span> <span class="ow">is</span> <span class="o"><</span><span class="n">Task</span> <span class="s2">"PFW_DEMO_TASK"</span> <span class="n">at</span> <span class="mh">0x6f2a530</span><span class="o">></span>
|
|
<span class="n">Deleting</span> <span class="n">the</span> <span class="n">demo</span> <span class="n">task</span>
|
|
<span class="n">Deleting</span> <span class="n">the</span> <span class="n">demo</span> <span class="n">folder</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="event-log">
|
|
<span id="sample-event-log"></span><h2>18.8. Event Log<a class="headerlink" href="#event-log" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="n">evtlogmgr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">event_log</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Event log Manager is: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtlogmgr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"They are <</span><span class="si">{0}</span><span class="s2">> channels"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="nb">list</span><span class="p">(</span><span class="n">evtlogmgr</span><span class="o">.</span><span class="n">channels</span><span class="p">))))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"They are <</span><span class="si">{0}</span><span class="s2">> publishers"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="nb">list</span><span class="p">(</span><span class="n">evtlogmgr</span><span class="o">.</span><span class="n">publishers</span><span class="p">))))</span>
|
|
|
|
|
|
<span class="n">FIREWALL_CHANNEL</span> <span class="o">=</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Openning channel <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">FIREWALL_CHANNEL</span><span class="p">))</span>
|
|
<span class="n">evtchan</span> <span class="o">=</span> <span class="n">evtlogmgr</span><span class="p">[</span><span class="n">FIREWALL_CHANNEL</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Channel is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtchan</span><span class="p">))</span>
|
|
<span class="c1"># Note that `evtchan.events` is an alias for `evtchan.query().all()`</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"The channel contains <</span><span class="si">{0}</span><span class="s2">> events"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">evtchan</span><span class="o">.</span><span class="n">events</span><span class="p">)))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">EVT_QUERY</span> <span class="o">=</span> <span class="s2">"Event/EventData[Data='C:</span><span class="se">\\</span><span class="s2">WINDOWS</span><span class="se">\\</span><span class="s2">System32</span><span class="se">\\</span><span class="s2">svchost.exe'] and Event/System[EventID=2006]"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"""Querying "</span><span class="si">{0}</span><span class="s2">">"""</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">EVT_QUERY</span><span class="p">))</span>
|
|
<span class="n">query</span> <span class="o">=</span> <span class="n">evtchan</span><span class="o">.</span><span class="n">query</span><span class="p">(</span><span class="n">EVT_QUERY</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Query is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">query</span><span class="p">))</span>
|
|
<span class="n">event_list</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">query</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"List contains </span><span class="si">{0}</span><span class="s2"> event"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">event_list</span><span class="p">)))</span>
|
|
<span class="n">event</span> <span class="o">=</span> <span class="n">event_list</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"First event is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"System values:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * ID: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">id</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * version: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">version</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * level: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">level</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * opcode: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">opcode</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * time_created: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">time_created</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * ID: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">id</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Event specific values:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">event</span><span class="o">.</span><span class="n">data</span><span class="o">.</span><span class="n">items</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * <</span><span class="si">{0}</span><span class="s2">> -> <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">value</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">evtmeta</span> <span class="o">=</span> <span class="n">event</span><span class="o">.</span><span class="n">metadata</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Event metadata is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * id : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="o">.</span><span class="n">id</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * channel_id : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="o">.</span><span class="n">channel_id</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message_id : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="o">.</span><span class="n">message_id</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * event_data : </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="o">.</span><span class="n">event_data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * EventData template :</span><span class="se">\n</span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="o">.</span><span class="n">template</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">"</span><span class="se">\r\n</span><span class="s2">"</span><span class="p">,</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span><span class="p">)))</span>
|
|
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exploring complex Evt types:"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Channel is still </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtchan</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Channel config is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtchan</span><span class="o">.</span><span class="n">config</span><span class="p">))</span>
|
|
<span class="n">publisher</span> <span class="o">=</span> <span class="n">evtchan</span><span class="o">.</span><span class="n">config</span><span class="o">.</span><span class="n">publisher</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Channel publisher is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">publisher</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Channel publisher metadata is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">publisher</span><span class="o">.</span><span class="n">metadata</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Publisher's channels are:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">chan</span> <span class="ow">in</span> <span class="n">publisher</span><span class="o">.</span><span class="n">metadata</span><span class="o">.</span><span class="n">channels</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">chan</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some publisher's event metadata are:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">evtmeta</span> <span class="ow">in</span> <span class="nb">list</span><span class="p">(</span><span class="n">publisher</span><span class="o">.</span><span class="n">metadata</span><span class="o">.</span><span class="n">events_metadata</span><span class="p">)[:</span><span class="mi">3</span><span class="p">]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">: id=</span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">evtmeta</span><span class="p">,</span> <span class="n">evtmeta</span><span class="o">.</span><span class="n">id</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">event_log</span>\<span class="n">eventlog</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Event</span> <span class="n">log</span> <span class="n">Manager</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">event_log</span><span class="o">.</span><span class="n">EvtlogManager</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x0592DB70</span><span class="o">></span>
|
|
<span class="n">They</span> <span class="n">are</span> <span class="o"><</span><span class="mi">1155</span><span class="o">></span> <span class="n">channels</span>
|
|
<span class="n">They</span> <span class="n">are</span> <span class="o"><</span><span class="mi">1179</span><span class="o">></span> <span class="n">publishers</span>
|
|
<span class="n">Openning</span> <span class="n">channel</span> <span class="o"><</span><span class="n">Microsoft</span><span class="o">-</span><span class="n">Windows</span><span class="o">-</span><span class="n">Windows</span> <span class="n">Firewall</span> <span class="n">With</span> <span class="n">Advanced</span> <span class="n">Security</span><span class="o">/</span><span class="n">Firewall</span><span class="o">></span>
|
|
<span class="n">Channel</span> <span class="ow">is</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"</span><span class="o">></span>
|
|
<span class="n">The</span> <span class="n">channel</span> <span class="n">contains</span> <span class="o"><</span><span class="mi">1037</span><span class="o">></span> <span class="n">events</span>
|
|
|
|
<span class="n">Querying</span> <span class="s2">"Event/EventData[Data='C:\WINDOWS\System32\svchost.exe'] and Event/System[EventID=2006]"</span><span class="o">></span>
|
|
<span class="n">Query</span> <span class="ow">is</span> <span class="o"><</span><span class="n">EvtQuery</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x06E9F440</span><span class="o">></span>
|
|
<span class="n">List</span> <span class="n">contains</span> <span class="mi">304</span> <span class="n">event</span>
|
|
|
|
<span class="n">First</span> <span class="n">event</span> <span class="ow">is</span> <span class="o"><</span><span class="n">EvtEvent</span> <span class="nb">id</span><span class="o">=</span><span class="s2">"2006"</span> <span class="n">time</span><span class="o">=</span><span class="s2">"2018-05-06 08:03:06.210109"</span><span class="o">></span>
|
|
<span class="n">System</span> <span class="n">values</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">ID</span><span class="p">:</span> <span class="mi">2006</span>
|
|
<span class="o">*</span> <span class="n">version</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="o">*</span> <span class="n">level</span><span class="p">:</span> <span class="mi">4</span>
|
|
<span class="o">*</span> <span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="o">*</span> <span class="n">time_created</span><span class="p">:</span> <span class="mi">131700673862101088</span>
|
|
<span class="o">*</span> <span class="n">ID</span><span class="p">:</span> <span class="mi">2006</span>
|
|
<span class="n">Event</span> <span class="n">specific</span> <span class="n">values</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">ModifyingUser</span><span class="o">></span> <span class="o">-></span> <span class="o"><</span><span class="mi">108703760</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">RuleName</span><span class="o">></span> <span class="o">-></span> <span class="o"><</span><span class="n">ByteCodeGeneration</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">ModifyingApplication</span><span class="o">></span> <span class="o">-></span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">WINDOWS</span>\<span class="n">System32</span>\<span class="n">svchost</span><span class="o">.</span><span class="n">exe</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">RuleId</span><span class="o">></span> <span class="o">-></span> <span class="o"><</span><span class="p">{</span><span class="mi">318</span><span class="n">EF1CF</span><span class="o">-</span><span class="n">A3FA</span><span class="o">-</span><span class="mi">4</span><span class="n">B04</span><span class="o">-</span><span class="mi">8</span><span class="n">AAC</span><span class="o">-</span><span class="mi">712276661117</span><span class="p">}</span><span class="o">></span>
|
|
|
|
<span class="n">Event</span> <span class="n">metadata</span> <span class="ow">is</span> <span class="o"><</span><span class="n">EventMetadata</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x06EB96C0</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="nb">id</span> <span class="p">:</span> <span class="mi">2006</span>
|
|
<span class="o">*</span> <span class="n">channel_id</span> <span class="p">:</span> <span class="mi">16</span>
|
|
<span class="o">*</span> <span class="n">message_id</span> <span class="p">:</span> <span class="mi">2986346454</span>
|
|
<span class="o">*</span> <span class="n">event_data</span> <span class="p">:</span> <span class="p">[</span><span class="sa">u</span><span class="s1">'RuleId'</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'RuleName'</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'ModifyingUser'</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'ModifyingApplication'</span><span class="p">]</span>
|
|
<span class="o">*</span> <span class="n">EventData</span> <span class="n">template</span> <span class="p">:</span>
|
|
<span class="o"><</span><span class="n">template</span> <span class="n">xmlns</span><span class="o">=</span><span class="s2">"http://schemas.microsoft.com/win/2004/08/events"</span><span class="o">></span>
|
|
<span class="o"><</span><span class="n">data</span> <span class="n">name</span><span class="o">=</span><span class="s2">"RuleId"</span> <span class="n">inType</span><span class="o">=</span><span class="s2">"win:UnicodeString"</span> <span class="n">outType</span><span class="o">=</span><span class="s2">"xs:string"</span><span class="o">/></span>
|
|
<span class="o"><</span><span class="n">data</span> <span class="n">name</span><span class="o">=</span><span class="s2">"RuleName"</span> <span class="n">inType</span><span class="o">=</span><span class="s2">"win:UnicodeString"</span> <span class="n">outType</span><span class="o">=</span><span class="s2">"xs:string"</span><span class="o">/></span>
|
|
<span class="o"><</span><span class="n">data</span> <span class="n">name</span><span class="o">=</span><span class="s2">"ModifyingUser"</span> <span class="n">inType</span><span class="o">=</span><span class="s2">"win:SID"</span> <span class="n">outType</span><span class="o">=</span><span class="s2">"xs:string"</span><span class="o">/></span>
|
|
<span class="o"><</span><span class="n">data</span> <span class="n">name</span><span class="o">=</span><span class="s2">"ModifyingApplication"</span> <span class="n">inType</span><span class="o">=</span><span class="s2">"win:UnicodeString"</span> <span class="n">outType</span><span class="o">=</span><span class="s2">"xs:string"</span><span class="o">/></span>
|
|
<span class="o"></</span><span class="n">template</span><span class="o">></span>
|
|
|
|
|
|
<span class="n">Exploring</span> <span class="nb">complex</span> <span class="n">Evt</span> <span class="n">types</span><span class="p">:</span>
|
|
<span class="n">Channel</span> <span class="ow">is</span> <span class="n">still</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"</span><span class="o">></span>
|
|
<span class="n">Channel</span> <span class="n">config</span> <span class="ow">is</span> <span class="o"><</span><span class="n">ChannelConfig</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"</span><span class="o">></span>
|
|
<span class="n">Channel</span> <span class="n">publisher</span> <span class="ow">is</span> <span class="o"><</span><span class="n">EvtPublisher</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security"</span><span class="o">></span>
|
|
<span class="n">Channel</span> <span class="n">publisher</span> <span class="n">metadata</span> <span class="ow">is</span> <span class="o"><</span><span class="n">PublisherMetadata</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security"</span><span class="o">></span>
|
|
<span class="n">Publisher</span><span class="s1">'s channels are:</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EvtChannel</span> <span class="s2">"Network Isolation Operational"</span><span class="o">></span>
|
|
<span class="n">Some</span> <span class="n">publisher</span><span class="s1">'s event metadata are:</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EventMetadata</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x06EBE710</span><span class="o">></span><span class="p">:</span> <span class="nb">id</span><span class="o">=</span><span class="mi">2000</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EventMetadata</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x06EBE7B0</span><span class="o">></span><span class="p">:</span> <span class="nb">id</span><span class="o">=</span><span class="mi">2001</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EventMetadata</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x06EBE3F0</span><span class="o">></span><span class="p">:</span> <span class="nb">id</span><span class="o">=</span><span class="mi">2002</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="object-manager">
|
|
<span id="sample-object-manager"></span><h2>18.9. Object manager<a class="headerlink" href="#object-manager" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="n">object_manager</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">object_manager</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Object manager is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">object_manager</span><span class="p">))</span>
|
|
<span class="n">root</span> <span class="o">=</span> <span class="n">object_manager</span><span class="o">.</span><span class="n">root</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Root object is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">root</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing some of root-subobject:"</span><span class="p">)</span>
|
|
<span class="c1"># Kernel object of type 'Directory' are iterable</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">obj</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">root</span><span class="o">.</span><span class="n">items</span><span class="p">()):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">: </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">obj</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">i</span> <span class="o">==</span> <span class="mi">3</span><span class="p">:</span>
|
|
<span class="k">break</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="sa">r</span><span class="s2">"Retrieving <\Rpc Control\lsasspirpc>:"</span><span class="p">)</span>
|
|
<span class="c1"># You can retrieve this value in one request</span>
|
|
<span class="n">x1</span> <span class="o">=</span> <span class="n">root</span><span class="p">[</span><span class="sa">r</span><span class="s2">"\Rpc Control\lsasspirpc"</span><span class="p">]</span>
|
|
<span class="c1"># Sub-directory also allow __getitem__</span>
|
|
<span class="n">x2</span> <span class="o">=</span> <span class="n">root</span><span class="p">[</span><span class="s2">"Rpc Control"</span><span class="p">][</span><span class="s2">"lsasspirpc"</span><span class="p">]</span>
|
|
<span class="c1"># You can directly request the object manager that will request `root`</span>
|
|
<span class="n">x3</span> <span class="o">=</span> <span class="n">object_manager</span><span class="p">[</span><span class="sa">r</span><span class="s2">"\Rpc Control\lsasspirpc"</span><span class="p">]</span>
|
|
<span class="k">assert</span> <span class="n">x1</span><span class="o">.</span><span class="n">fullname</span> <span class="o">==</span> <span class="n">x2</span><span class="o">.</span><span class="n">fullname</span> <span class="o">==</span> <span class="n">x3</span><span class="o">.</span><span class="n">fullname</span>
|
|
|
|
<span class="n">lsasspirpc</span> <span class="o">=</span> <span class="n">x1</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Object is: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lsasspirpc</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lsasspirpc</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * path: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lsasspirpc</span><span class="o">.</span><span class="n">path</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * fullname: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lsasspirpc</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * type: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lsasspirpc</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * target: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lsasspirpc</span><span class="o">.</span><span class="n">target</span><span class="p">))</span> <span class="c1"># None on non-symlink</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for a SymbolicLink in <ArcName>"</span><span class="p">)</span>
|
|
<span class="n">slo</span> <span class="o">=</span> <span class="p">[</span><span class="n">o</span> <span class="k">for</span> <span class="n">o</span> <span class="ow">in</span> <span class="n">root</span><span class="p">[</span><span class="s2">"ArcName"</span><span class="p">]</span><span class="o">.</span><span class="n">values</span><span class="p">()</span> <span class="k">if</span> <span class="n">o</span><span class="o">.</span><span class="n">type</span> <span class="o">==</span> <span class="s2">"SymbolicLink"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Object is: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">slo</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">slo</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * target: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">slo</span><span class="o">.</span><span class="n">target</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">object_manager</span>\<span class="n">object_manager</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Object</span> <span class="n">manager</span> <span class="ow">is</span> <span class="o"><</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">object_manager</span><span class="o">.</span><span class="n">ObjectManager</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x0370ED10</span><span class="o">></span>
|
|
<span class="n">Root</span> <span class="nb">object</span> <span class="ow">is</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"</span><span class="se">\"</span><span class="s2"> (type="</span><span class="n">Directory</span><span class="s2">")></span>
|
|
|
|
<span class="n">Listing</span> <span class="n">some</span> <span class="n">of</span> <span class="n">root</span><span class="o">-</span><span class="n">subobject</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">PendingRenameMutex</span><span class="p">:</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\PendingRenameMutex"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"Mutant"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">ObjectTypes</span><span class="p">:</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\ObjectTypes"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"Directory"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">storqosfltport</span><span class="p">:</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\storqosfltport"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"FilterConnectionPort"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">MicrosoftMalwareProtectionRemoteIoPortWD</span><span class="p">:</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\MicrosoftMalwareProtectionRemoteIoPortWD"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"FilterConnectionPort"</span><span class="p">)</span><span class="o">></span>
|
|
|
|
<span class="n">Retrieving</span> <span class="o"><</span>\<span class="n">Rpc</span> <span class="n">Control</span>\<span class="n">lsasspirpc</span><span class="o">></span><span class="p">:</span>
|
|
<span class="n">Object</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\Rpc Control\lsasspirpc"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"ALPC Port"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">name</span><span class="p">:</span> <span class="o"><</span><span class="n">lsasspirpc</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">path</span><span class="p">:</span> <span class="o"><</span>\<span class="n">Rpc</span> <span class="n">Control</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">fullname</span><span class="p">:</span> <span class="o"><</span>\<span class="n">Rpc</span> <span class="n">Control</span>\<span class="n">lsasspirpc</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="nb">type</span><span class="p">:</span> <span class="o"><</span><span class="n">ALPC</span> <span class="n">Port</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">target</span><span class="p">:</span> <span class="o"><</span><span class="kc">None</span><span class="o">></span>
|
|
|
|
<span class="n">Looking</span> <span class="k">for</span> <span class="n">a</span> <span class="n">SymbolicLink</span> <span class="ow">in</span> <span class="o"><</span><span class="n">ArcName</span><span class="o">></span>
|
|
<span class="n">Object</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\ArcName\multi(0)disk(0)rdisk(0)"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"SymbolicLink"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">name</span><span class="p">:</span> <span class="o"><</span><span class="n">multi</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span><span class="n">disk</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span><span class="n">rdisk</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">target</span><span class="p">:</span> <span class="o"><</span>\<span class="n">Device</span>\<span class="n">Harddisk0</span>\<span class="n">Partition0</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
<div class="section" id="find-objects">
|
|
<h3>18.9.1. find objects<a class="headerlink" href="#find-objects" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="k">def</span> <span class="nf">obj_with_link</span><span class="p">(</span><span class="n">obj</span><span class="p">):</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="n">obj</span><span class="o">.</span><span class="n">target</span>
|
|
<span class="k">if</span> <span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="k">return</span> <span class="nb">str</span><span class="p">(</span><span class="n">obj</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="s2">"</span><span class="si">{0}</span><span class="s2"> -> <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">obj</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">find_name</span><span class="p">(</span><span class="n">root</span><span class="p">,</span> <span class="n">findname</span><span class="p">):</span>
|
|
<span class="n">TODO</span> <span class="o">=</span> <span class="p">[</span><span class="n">root</span><span class="p">]</span>
|
|
<span class="k">while</span> <span class="n">TODO</span><span class="p">:</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">obj</span> <span class="ow">in</span> <span class="n">TODO</span><span class="o">.</span><span class="n">pop</span><span class="p">()</span><span class="o">.</span><span class="n">items</span><span class="p">():</span>
|
|
<span class="k">if</span> <span class="n">findname</span> <span class="ow">in</span> <span class="n">name</span> <span class="ow">or</span> <span class="n">findname</span> <span class="ow">in</span> <span class="n">obj</span><span class="o">.</span><span class="n">type</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"* </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">obj_with_link</span><span class="p">(</span><span class="n">obj</span><span class="p">)))</span>
|
|
<span class="k">if</span> <span class="n">obj</span><span class="o">.</span><span class="n">type</span> <span class="o">==</span> <span class="s2">"Directory"</span><span class="p">:</span>
|
|
<span class="n">TODO</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">obj</span><span class="p">)</span>
|
|
<span class="k">except</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">obj</span><span class="o">.</span><span class="n">fullname</span><span class="p">,</span> <span class="n">e</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'name'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="s2">"ls"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The name of the object to find'</span><span class="p">)</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
|
|
<span class="n">objmanag</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">object_manager</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for object name containing <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">res</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="n">find_name</span><span class="p">(</span><span class="n">objmanag</span><span class="o">.</span><span class="n">root</span><span class="p">,</span> <span class="n">res</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">object_manager</span>\<span class="n">findobj</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Looking</span> <span class="k">for</span> <span class="nb">object</span> <span class="n">name</span> <span class="n">containing</span> <span class="o"><</span><span class="n">ls</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\KnownDlls32"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"Directory"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\Win32kCrossSessionGlobals"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"Section"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\KnownDlls"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"Directory"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o"><</span>\<span class="n">DriverStores</span>\<span class="n">SYSTEM</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\Device\MailslotRedirector"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"SymbolicLink"</span><span class="p">)</span><span class="o">></span> <span class="o">-></span> <span class="o"><</span>\<span class="n">Device</span>\<span class="n">Mup</span>\<span class="p">;</span><span class="n">MailslotRedirector</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\Device\Mailslot"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"Device"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o"><</span>\<span class="n">Device</span>\<span class="mi">00000020</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Device</span>\<span class="mi">00000020</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Device</span>\<span class="mi">00000020</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Device</span>\<span class="mi">00000020</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Device</span>\<span class="mi">00000020</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">KernelObjects</span>\<span class="n">PrefetchTracesReady</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">KnownDlls</span>\<span class="n">powrprof</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\RPC Control\lsapolicylookup"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"ALPC Port"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\RPC Control\lsacap"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"ALPC Port"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">KernelObject</span> <span class="s2">"\RPC Control\lsasspirpc"</span> <span class="p">(</span><span class="nb">type</span><span class="o">=</span><span class="s2">"ALPC Port"</span><span class="p">)</span><span class="o">></span>
|
|
<span class="o"><</span>\<span class="n">Windows</span>\<span class="n">SbApiPort</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Windows</span>\<span class="n">SbApiPort</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Sessions</span>\<span class="n">BNOLINKS</span>\<span class="mi">1</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Sessions</span>\<span class="n">BNOLINKS</span>\<span class="mi">1</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
<span class="o"><</span>\<span class="n">Sessions</span>\<span class="n">BNOLINKS</span>\<span class="mi">1</span><span class="o">></span> <span class="o">-></span> <span class="n">STATUS_ACCESS_DENIED</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="device-manager">
|
|
<span id="sample-device-manager"></span><h2>18.10. Device manager<a class="headerlink" href="#device-manager" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="n">devmgr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">device_manager</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Device manager is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">devmgr</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Enumerating the first 3 device classes"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="bp">cls</span> <span class="ow">in</span> <span class="n">devmgr</span><span class="o">.</span><span class="n">classes</span><span class="p">[:</span><span class="mi">3</span><span class="p">]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">cls</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Finding device class 'System'"</span><span class="p">)</span>
|
|
<span class="c1"># Allow devmgr.classes["name"] ?</span>
|
|
<span class="n">system_cls</span> <span class="o">=</span> <span class="p">[</span><span class="bp">cls</span> <span class="k">for</span> <span class="bp">cls</span> <span class="ow">in</span> <span class="n">devmgr</span><span class="o">.</span><span class="n">classes</span> <span class="k">if</span> <span class="bp">cls</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="sa">b</span><span class="s2">"System"</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">system_cls</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Enumerating some devices of 'System'"</span><span class="p">)</span>
|
|
<span class="n">devices</span> <span class="o">=</span> <span class="n">system_cls</span><span class="o">.</span><span class="n">devices</span><span class="o">.</span><span class="n">all</span><span class="p">()</span>
|
|
|
|
<span class="k">for</span> <span class="n">devinst</span> <span class="ow">in</span> <span class="p">(</span><span class="n">devices</span><span class="p">[</span><span class="mi">0</span><span class="p">],</span> <span class="n">devices</span><span class="p">[</span><span class="mi">25</span><span class="p">],</span> <span class="n">devices</span><span class="p">[</span><span class="mi">35</span><span class="p">]):</span> <span class="c1"># Some "random" devices to have interesting ones</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">devinst</span><span class="p">))</span>
|
|
<span class="n">devconf</span> <span class="o">=</span> <span class="n">devinst</span><span class="o">.</span><span class="n">allocated_configuration</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">devconf</span><span class="p">:</span>
|
|
<span class="k">continue</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Enumerating allocated resources:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">resource</span> <span class="ow">in</span> <span class="n">devconf</span><span class="o">.</span><span class="n">resources</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">resource</span><span class="p">))</span>
|
|
|
|
|
|
<span class="c1"># python64 samples\device\device_manager.py</span>
|
|
|
|
<span class="c1"># Device manager is <windows.winobject.device_manager.DeviceManager object at 0x0000000003669908></span>
|
|
<span class="c1"># Enumerating the first 3 device classes</span>
|
|
<span class="c1"># * <DeviceClass name="XboxComposite" guid=05F5CFE2-4733-4950-A6BB-07AAD01A3A84></span>
|
|
<span class="c1"># * <DeviceClass name="DXGKrnl" guid=1264760F-A5C8-4BFE-B314-D56A7B44A362></span>
|
|
<span class="c1"># * <DeviceClass name="RemotePosDevice" guid=13E42DFA-85D9-424D-8646-28A70F864F9C></span>
|
|
<span class="c1"># Finding device class 'System'</span>
|
|
<span class="c1"># * <DeviceClass name="System" guid=4D36E97D-E325-11CE-BFC1-08002BE10318></span>
|
|
<span class="c1"># Enumerating some devices of 'System'</span>
|
|
<span class="c1"># * <DeviceInstance "Motherboard resources" (id=1)></span>
|
|
<span class="c1"># * <DeviceInstance "Microsoft ACPI-Compliant Embedded Controller" (id=26)></span>
|
|
<span class="c1"># Enumerating allocated resources:</span>
|
|
<span class="c1"># * <IoResource : [0x00000000000062-0x00000000000062]></span>
|
|
<span class="c1"># * <IoResource : [0x00000000000066-0x00000000000066]></span>
|
|
<span class="c1"># * <DeviceInstance "High Definition Audio Controller" (id=36)></span>
|
|
<span class="c1"># Enumerating allocated resources:</span>
|
|
<span class="c1"># * <MemoryResource : [0x000000f7080000-0x000000f7083fff]></span>
|
|
<span class="c1"># * <DevicePrivateResource type=ResType_DevicePrivate(0x8001)></span>
|
|
<span class="c1"># * <IrqResource : [0x00000000000011]></span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python device_manager\device_manager.py
|
|
Device manager is <windows.winobject.device_manager.DeviceManager object at 0x00000000033442E8>
|
|
Enumerating the first 3 device classes
|
|
* <DeviceClass name="XboxComposite" guid=05F5CFE2-4733-4950-A6BB-07AAD01A3A84>
|
|
* <DeviceClass name="DXGKrnl" guid=1264760F-A5C8-4BFE-B314-D56A7B44A362>
|
|
* <DeviceClass name="RemotePosDevice" guid=13E42DFA-85D9-424D-8646-28A70F864F9C>
|
|
Finding device class 'System'
|
|
* <DeviceClass name="System" guid=4D36E97D-E325-11CE-BFC1-08002BE10318>
|
|
Enumerating some devices of 'System'
|
|
* <DeviceInstance "Motherboard resources" (id=1)>
|
|
* <DeviceInstance "Microsoft ACPI-Compliant Embedded Controller" (id=26)>
|
|
Enumerating allocated resources:
|
|
* <IoResource : [0x00000000000062-0x00000000000062]>
|
|
* <IoResource : [0x00000000000066-0x00000000000066]>
|
|
* <DeviceInstance "High Definition Audio Controller" (id=36)>
|
|
Enumerating allocated resources:
|
|
* <MemoryResource : [0x000000f7080000-0x000000f7083fff]>
|
|
* <DevicePrivateResource type=ResType_DevicePrivate(0x8001)>
|
|
* <IrqResource : [0x00000000000011]>
|
|
</pre></div>
|
|
</div>
|
|
<div class="section" id="enumerate-devices">
|
|
<h3>18.10.1. Enumerate devices<a class="headerlink" href="#enumerate-devices" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="n">devmgr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">device_manager</span>
|
|
|
|
<span class="k">def</span> <span class="nf">class_generator</span><span class="p">(</span><span class="nb">filter</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
|
<span class="k">for</span> <span class="bp">cls</span> <span class="ow">in</span> <span class="n">devmgr</span><span class="o">.</span><span class="n">classes</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="nb">filter</span> <span class="ow">and</span> <span class="bp">cls</span><span class="o">.</span><span class="n">name</span> <span class="o">!=</span> <span class="nb">filter</span><span class="o">.</span><span class="n">encode</span><span class="p">():</span>
|
|
<span class="k">continue</span>
|
|
<span class="k">yield</span> <span class="bp">cls</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">main</span><span class="p">(</span><span class="n">clsfilter</span><span class="p">,</span> <span class="n">enumerate_devices</span><span class="p">,</span> <span class="n">print_devinst_resources</span><span class="p">,</span> <span class="n">attributes</span><span class="p">):</span>
|
|
<span class="k">for</span> <span class="n">devcls</span> <span class="ow">in</span> <span class="n">class_generator</span><span class="p">(</span><span class="n">clsfilter</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">devcls</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">enumerate_devices</span><span class="p">:</span>
|
|
<span class="k">continue</span>
|
|
<span class="c1"># Enumerate devices</span>
|
|
<span class="k">for</span> <span class="n">devinst</span> <span class="ow">in</span> <span class="n">devcls</span><span class="o">.</span><span class="n">devices</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">devinst</span><span class="p">))</span>
|
|
|
|
<span class="c1"># Print attributes</span>
|
|
<span class="k">if</span> <span class="n">attributes</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" Attributes:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">attr</span> <span class="ow">in</span> <span class="n">attributes</span><span class="p">:</span>
|
|
<span class="n">value</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">devinst</span><span class="p">,</span> <span class="n">attr</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">=</span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">attr</span><span class="p">,</span> <span class="n">value</span><span class="p">))</span>
|
|
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">print_devinst_resources</span><span class="p">:</span>
|
|
<span class="k">continue</span>
|
|
<span class="c1"># Device resources</span>
|
|
<span class="n">devconf</span> <span class="o">=</span> <span class="n">devinst</span><span class="o">.</span><span class="n">allocated_configuration</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">devconf</span><span class="p">:</span>
|
|
<span class="c1"># No allocated configuration</span>
|
|
<span class="c1"># Check boot conf ?</span>
|
|
<span class="k">continue</span>
|
|
|
|
<span class="k">for</span> <span class="n">resource</span> <span class="ow">in</span> <span class="n">devconf</span><span class="o">.</span><span class="n">resources</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">resource</span><span class="p">))</span>
|
|
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s2">"--class"</span><span class="p">,</span> <span class="n">dest</span><span class="o">=</span><span class="s2">"clsfilter"</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"The classe to list: default all"</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s2">"--no-print-devices"</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s2">"store_true"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Prevent the listing of devices in the matching classes"</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s2">"--print-resources"</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s2">"store_true"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"Print the resources allocated to the device instance"</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s2">"--attributes"</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s2">"+"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"The list of attributes to print for each discovered device instance"</span><span class="p">)</span>
|
|
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">args</span><span class="p">)</span>
|
|
<span class="n">main</span><span class="p">(</span><span class="n">args</span><span class="o">.</span><span class="n">clsfilter</span><span class="p">,</span>
|
|
<span class="n">enumerate_devices</span><span class="o">=</span><span class="ow">not</span> <span class="n">args</span><span class="o">.</span><span class="n">no_print_devices</span><span class="p">,</span>
|
|
<span class="n">print_devinst_resources</span><span class="o">=</span><span class="n">args</span><span class="o">.</span><span class="n">print_resources</span><span class="p">,</span>
|
|
<span class="n">attributes</span><span class="o">=</span><span class="n">args</span><span class="o">.</span><span class="n">attributes</span><span class="p">)</span>
|
|
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ python64 device_manager\enum_devices.py --no-print-devices
|
|
Namespace(clsfilter=None, no_print_devices=True, print_resources=False)
|
|
<DeviceClass name="XboxComposite" guid=05F5CFE2-4733-4950-A6BB-07AAD01A3A84>
|
|
<DeviceClass name="DXGKrnl" guid=1264760F-A5C8-4BFE-B314-D56A7B44A362>
|
|
<DeviceClass name="RemotePosDevice" guid=13E42DFA-85D9-424D-8646-28A70F864F9C>
|
|
<DeviceClass name="DigitalMediaDevices" guid=14B62F50-3F15-11DD-AE16-0800200C9A66>
|
|
<DeviceClass name="PrintQueue" guid=1ED2BBF9-11F0-4084-B21F-AD83A8E6DCDC>
|
|
<DeviceClass name="WCEUSBS" guid=25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835>
|
|
<DeviceClass name="SecurityAccelerator" guid=268C95A1-EDFE-11D3-95C3-0010DC4050A5>
|
|
<DeviceClass name="HidMsr" guid=2A9FE532-0CDC-44F9-9827-76192F2CA2FB>
|
|
<DeviceClass name="SystemRecovery" guid=2DB15374-706E-4131-A0C7-D7C78EB0289A>
|
|
....
|
|
|
|
$ python64 device_manager\enum_devices.py --class Processor --attributes name manufacturer device_object_name location_paths
|
|
Namespace(attributes=['name', 'manufacturer', 'device_object_name', 'location_paths'], clsfilter='Processor', no_print_devices=False, print_resources=False)
|
|
<DeviceClass name="Processor" guid=50127DC3-0F36-415E-A6CC-4CB3BE910B65>
|
|
* <DeviceInstance "Intel Processor" (id=1)>
|
|
Attributes:
|
|
* name=Intel(R) Core(TM) i5-6600 CPU @ 3.30GHz
|
|
* manufacturer=Intel
|
|
* device_object_name=\Device\00000017
|
|
* location_paths=[u'ACPI(_SB_)#ACPI(CPU0)']
|
|
* <DeviceInstance "Intel Processor" (id=2)>
|
|
Attributes:
|
|
* name=Intel(R) Core(TM) i5-6600 CPU @ 3.30GHz
|
|
* manufacturer=Intel
|
|
* device_object_name=\Device\00000018
|
|
* location_paths=[u'ACPI(_SB_)#ACPI(CPU1)']
|
|
* <DeviceInstance "Intel Processor" (id=3)>
|
|
Attributes:
|
|
* name=Intel(R) Core(TM) i5-6600 CPU @ 3.30GHz
|
|
* manufacturer=Intel
|
|
* device_object_name=\Device\00000019
|
|
* location_paths=[u'ACPI(_SB_)#ACPI(CPU2)']
|
|
* <DeviceInstance "Intel Processor" (id=4)>
|
|
Attributes:
|
|
* name=Intel(R) Core(TM) i5-6600 CPU @ 3.30GHz
|
|
* manufacturer=Intel
|
|
* device_object_name=\Device\0000001a
|
|
* location_paths=[u'ACPI(_SB_)#ACPI(CPU3)']
|
|
|
|
|
|
$ python64 device_manager\enum_devices.py --class Display --print-resources
|
|
Namespace(clsfilter='Display', no_print_devices=False, print_resources=True)
|
|
<DeviceClass name="Display" guid=4D36E968-E325-11CE-BFC1-08002BE10318>
|
|
* <DeviceInstance "NVIDIA GeForce GTX 1070" (id=1)>
|
|
* <MemoryResource : [0x000000f6000000-0x000000f6ffffff]>
|
|
* <DevicePrivateResource type=ResType_DevicePrivate(0x8001)>
|
|
* <MemoryResource : [0x000000e0000000-0x000000efffffff]>
|
|
* <DevicePrivateResource type=ResType_DevicePrivate(0x8001)>
|
|
* <MemoryResource : [0x000000f0000000-0x000000f1ffffff]>
|
|
* <DevicePrivateResource type=ResType_DevicePrivate(0x8001)>
|
|
* <IoResource : [0x0000000000e000-0x0000000000e07f]>
|
|
...
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-wintrust">
|
|
<span id="sample-wintrust"></span><h2>18.11. <code class="docutils literal notranslate"><span class="pre">windows.wintrust</span></code><a class="headerlink" href="#windows-wintrust" title="Permalink to this headline">¶</a></h2>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.wintrust</span>
|
|
|
|
<span class="n">TARGET_FILE</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"C:\windows\system32\ntdll.dll"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Checking signature of <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" is_signed: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">is_signed</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" check_signature: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">check_signature</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)))</span>
|
|
|
|
<span class="n">sign_info</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">full_signature_information</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" full_signature_information:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * signed <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">signed</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * catalog <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">catalog</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * catalogsigned <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">catalogsigned</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * additionalinfo <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sign_info</span><span class="o">.</span><span class="n">additionalinfo</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Checking signature of some loaded DLL"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">module</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span><span class="p">[:</span><span class="mi">5</span><span class="p">]:</span>
|
|
<span class="n">path</span> <span class="o">=</span> <span class="n">module</span><span class="o">.</span><span class="n">fullname</span>
|
|
<span class="n">is_signed</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">is_signed</span><span class="p">(</span><span class="n">path</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">is_signed</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> : </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">is_signed</span><span class="p">))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">sign_info</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">wintrust</span><span class="o">.</span><span class="n">full_signature_information</span><span class="p">(</span><span class="n">path</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> : </span><span class="si">{1}</span><span class="s2"> (</span><span class="si">{2}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">is_signed</span><span class="p">,</span> <span class="n">sign_info</span><span class="p">[</span><span class="mi">3</span><span class="p">]))</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">crypto</span>\<span class="n">wintrust</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Checking</span> <span class="n">signature</span> <span class="n">of</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">ntdll</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">is_signed</span><span class="p">:</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="n">check_signature</span><span class="p">:</span> <span class="o"><</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">full_signature_information</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">signed</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">catalog</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">WINDOWS</span>\<span class="n">system32</span>\<span class="n">CatRoot</span>\<span class="p">{</span><span class="n">F750E6C3</span><span class="o">-</span><span class="mi">38</span><span class="n">EE</span><span class="o">-</span><span class="mi">11</span><span class="n">D1</span><span class="o">-</span><span class="mf">85E5</span><span class="o">-</span><span class="mi">00</span><span class="n">C04FC295EE</span><span class="p">}</span>\<span class="n">Package_802_for_KB4054517</span><span class="o">~</span><span class="mi">31</span><span class="n">bf3856ad364e35</span><span class="o">~</span><span class="n">amd64</span><span class="o">~~</span><span class="mf">10.0</span><span class="o">.</span><span class="mf">1.6</span><span class="o">.</span><span class="n">cat</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">catalogsigned</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">additionalinfo</span> <span class="o"><</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">Checking</span> <span class="n">signature</span> <span class="n">of</span> <span class="n">some</span> <span class="n">loaded</span> <span class="n">DLL</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">python27</span>\<span class="n">python</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="p">:</span> <span class="kc">False</span> <span class="p">(</span><span class="n">TRUST_E_NOSIGNATURE</span><span class="p">(</span><span class="mh">0x800b0100</span><span class="n">L</span><span class="p">))</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">ntdll</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">kernelbase</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
<span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">winsxs</span>\<span class="n">x86_microsoft</span><span class="o">.</span><span class="n">vc90</span><span class="o">.</span><span class="n">crt_1fc8b3b9a1e18e3b_9</span><span class="o">.</span><span class="mf">0.30729</span><span class="o">.</span><span class="mi">9317</span><span class="n">_none_508dca76bcbcfe81</span>\<span class="n">msvcr90</span><span class="o">.</span><span class="n">dll</span><span class="o">></span> <span class="p">:</span> <span class="kc">True</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="vectoredexception">
|
|
<span id="sample-vectoredexception"></span><h2>18.12. <code class="xref py py-func docutils literal notranslate"><span class="pre">VectoredException()</span></code><a class="headerlink" href="#vectoredexception" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="in-local-process">
|
|
<h3>18.12.1. In local process<a class="headerlink" href="#in-local-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">from</span> <span class="nn">windows.winobject.exception</span> <span class="kn">import</span> <span class="n">VectoredException</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def.windef</span> <span class="k">as</span> <span class="nn">windef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
|
|
<span class="nd">@VectoredException</span>
|
|
<span class="k">def</span> <span class="nf">handler</span><span class="p">(</span><span class="n">exc</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"==Entry of VEH handler=="</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionCode</span> <span class="o">==</span> <span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">:</span>
|
|
<span class="n">target_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionInformation</span><span class="p">[</span><span class="mi">1</span><span class="p">],</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Instr at </span><span class="si">{0}</span><span class="s2"> accessed to addr </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionAddress</span><span class="p">),</span> <span class="nb">hex</span><span class="p">(</span><span class="n">target_addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Resetting page protection to <PAGE_READWRITE>"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_READWRITE</span><span class="p">)</span>
|
|
<span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ContextRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span> <span class="o">=</span> <span class="mi">1</span>
|
|
<span class="k">return</span> <span class="n">windef</span><span class="o">.</span><span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exception of type </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">ExceptionCode</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Resetting page protection to <PAGE_NOACCESS>"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_NOACCESS</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">windef</span><span class="o">.</span><span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
|
|
|
|
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">AddVectoredExceptionHandler</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">handler</span><span class="p">)</span>
|
|
|
|
<span class="n">target_page</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Protected page is at <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">target_page</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Setting page protection to <PAGE_NOACCESS>"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtect</span><span class="p">(</span><span class="n">target_page</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">windef</span><span class="o">.</span><span class="n">PAGE_NOACCESS</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">target_page</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Value 1 read"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">v</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">target_page</span> <span class="o">+</span> <span class="mh">0x10</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Value 2 read"</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">process</span>\<span class="n">veh_segv</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Protected</span> <span class="n">page</span> <span class="ow">is</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x7270000</span><span class="o">></span>
|
|
<span class="n">Setting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_NOACCESS</span><span class="o">></span>
|
|
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="n">Instr</span> <span class="n">at</span> <span class="mh">0x6a54c166</span> <span class="n">accessed</span> <span class="n">to</span> <span class="n">addr</span> <span class="mh">0x7270000</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_READWRITE</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="ne">Exception</span> <span class="n">of</span> <span class="nb">type</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_NOACCESS</span><span class="o">></span>
|
|
<span class="n">Value</span> <span class="mi">1</span> <span class="n">read</span>
|
|
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="n">Instr</span> <span class="n">at</span> <span class="mh">0x6a54c166</span> <span class="n">accessed</span> <span class="n">to</span> <span class="n">addr</span> <span class="mh">0x7270010</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_READWRITE</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">Entry</span> <span class="n">of</span> <span class="n">VEH</span> <span class="n">handler</span><span class="o">==</span>
|
|
<span class="ne">Exception</span> <span class="n">of</span> <span class="nb">type</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="n">Resetting</span> <span class="n">page</span> <span class="n">protection</span> <span class="n">to</span> <span class="o"><</span><span class="n">PAGE_NOACCESS</span><span class="o">></span>
|
|
<span class="n">Value</span> <span class="mi">2</span> <span class="n">read</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="in-remote-process">
|
|
<h3>18.12.2. In remote process<a class="headerlink" href="#in-remote-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="n">python_code</span> <span class="o">=</span> <span class="s2">"""</span>
|
|
<span class="s2">import windows</span>
|
|
<span class="s2">import ctypes</span>
|
|
<span class="s2">import windows</span>
|
|
<span class="s2">from windows.winobject.exception import VectoredException</span>
|
|
<span class="s2">import windows.generated_def.windef as windef</span>
|
|
<span class="s2">from windows.generated_def.winstructs import *</span>
|
|
|
|
<span class="s2">windows.utils.create_console()</span>
|
|
|
|
<span class="s2">module_to_trace = "gdi32.dll"</span>
|
|
<span class="s2">nb_repeat = [5]</span>
|
|
|
|
<span class="s2">@VectoredException</span>
|
|
<span class="s2">def handler(exc):</span>
|
|
<span class="s2"> if exc[0].ExceptionRecord[0].ExceptionCode == EXCEPTION_ACCESS_VIOLATION:</span>
|
|
<span class="s2"> print("")</span>
|
|
<span class="s2"> target_addr = ctypes.cast(exc[0].ExceptionRecord[0].ExceptionInformation[1], ctypes.c_void_p).value</span>
|
|
<span class="s2"> print("Instr at </span><span class="si">{0}</span><span class="s2"> accessed to addr </span><span class="si">{1}</span><span class="s2"> (</span><span class="si">{2}</span><span class="s2">)".format(hex(exc[0].ExceptionRecord[0].ExceptionAddress), hex(target_addr), module_to_trace))</span>
|
|
<span class="s2"> windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_EXECUTE_READWRITE)</span>
|
|
<span class="s2"> nb_repeat[0] -= 1</span>
|
|
<span class="s2"> if nb_repeat[0]:</span>
|
|
<span class="s2"> exc[0].ContextRecord[0].EEFlags.TF = 1</span>
|
|
<span class="s2"> else:</span>
|
|
<span class="s2"> print("No more tracing !")</span>
|
|
<span class="s2"> return windef.EXCEPTION_CONTINUE_EXECUTION</span>
|
|
<span class="s2"> else:</span>
|
|
<span class="s2"> print("Exception of type </span><span class="si">{0}</span><span class="s2">".format(exc[0].ExceptionRecord[0].ExceptionCode))</span>
|
|
<span class="s2"> print("Resetting page protection to <PAGE_READWRITE>")</span>
|
|
<span class="s2"> windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)</span>
|
|
<span class="s2"> return windef.EXCEPTION_CONTINUE_EXECUTION</span>
|
|
|
|
|
|
<span class="s2">windows.winproxy.AddVectoredExceptionHandler(0, handler)</span>
|
|
|
|
<span class="s2">print("Tracing execution in module: <</span><span class="si">{0}</span><span class="s2">>".format(module_to_trace))</span>
|
|
|
|
<span class="s2">module = [x for x in windows.current_process.peb.modules if x.name == module_to_trace][0]</span>
|
|
<span class="s2">target_page = module.baseaddr</span>
|
|
<span class="s2">code_size = module.pe.get_OptionalHeader().SizeOfCode</span>
|
|
|
|
<span class="s2">print("Protected page is at </span><span class="si">{0}</span><span class="s2">".format(hex(target_page)))</span>
|
|
<span class="s2">windows.winproxy.VirtualProtect(target_page, code_size, windef.PAGE_READWRITE)</span>
|
|
<span class="s2">"""</span>
|
|
|
|
<span class="n">c</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">)</span>
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">c</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">python_code</span><span class="p">)</span>
|
|
|
|
<span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">time</span>
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.1</span><span class="p">)</span>
|
|
|
|
<span class="k">for</span> <span class="n">t</span> <span class="ow">in</span> <span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">:</span>
|
|
<span class="n">t</span><span class="o">.</span><span class="n">suspend</span><span class="p">()</span>
|
|
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd λ) python.exe process\remote_veh_segv.py
|
|
(In another console)
|
|
|
|
Tracing execution in module: <gdi32.dll>
|
|
Protected page is at 0x7ffa3c700000L
|
|
|
|
Instr at 0x7ffa3c70f0f0L accessed to addr 0x7ffa3c70f0f0L (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0f5L accessed to addr 0x7ffa3c70f0f5L (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0faL accessed to addr 0x7ffa3c70f0faL (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f0ffL accessed to addr 0x7ffa3c70f0ffL (gdi32.dll)
|
|
Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
|
|
Resetting page protection to <PAGE_READWRITE>
|
|
|
|
Instr at 0x7ffa3c70f100L accessed to addr 0x7ffa3c70f100L (gdi32.dll)
|
|
No more tracing !
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="debugging">
|
|
<span id="sample-debugger"></span><h2>18.13. Debugging<a class="headerlink" href="#debugging" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="debugger">
|
|
<h3>18.13.1. <code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code><a class="headerlink" href="#debugger" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">MyDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Got exception </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">PrintUnicodeString</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Breakpoint</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">argument_position</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">PrintUnicodeString</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">arg_pos</span> <span class="o">=</span> <span class="n">argument_position</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">p</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span>
|
|
<span class="n">t</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span>
|
|
<span class="n">esp</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">Esp</span>
|
|
|
|
<span class="n">unicode_string_addr</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">esp</span> <span class="o">+</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">arg_pos</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">*</span> <span class="mi">4</span><span class="p">)</span>
|
|
<span class="n">wstring_addr</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">unicode_string_addr</span> <span class="o">+</span> <span class="mi">4</span><span class="p">)</span>
|
|
<span class="n">dll_loaded</span> <span class="o">=</span> <span class="n">p</span><span class="o">.</span><span class="n">read_wstring</span><span class="p">(</span><span class="n">wstring_addr</span><span class="p">)</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Loading <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dll_loaded</span><span class="p">))</span>
|
|
|
|
<span class="k">if</span> <span class="n">dll_loaded</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">"comctl32.dll"</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Ask to load <comctl32.dll>: exiting process"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">MyDebugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">PrintUnicodeString</span><span class="p">(</span><span class="s2">"ntdll!LdrLoadDll"</span><span class="p">,</span> <span class="n">argument_position</span><span class="o">=</span><span class="mi">2</span><span class="p">))</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">debug</span>\<span class="n">debugger_print_LdrLoaddll</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Got</span> <span class="n">exception</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x77e0dadf</span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">synch</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">2</span><span class="o">-</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">fibers</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">fibers</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">synch</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">2</span><span class="o">-</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">localization</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">2</span><span class="o">-</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">kernel32</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">string</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">datetime</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">localization</span><span class="o">-</span><span class="n">obsolete</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">2</span><span class="o">-</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">imm32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">api</span><span class="o">-</span><span class="n">ms</span><span class="o">-</span><span class="n">win</span><span class="o">-</span><span class="n">core</span><span class="o">-</span><span class="n">processthreads</span><span class="o">-</span><span class="n">l1</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mf">2.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">mrmcorer</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">windows</span><span class="o">.</span><span class="n">storage</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">efswrt</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">twinapi</span><span class="o">.</span><span class="n">appcore</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">rpcrt4</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">system32</span>\<span class="n">wintypes</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">c</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">syswow64</span>\<span class="n">wintypes</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Loading</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">Ask</span> <span class="n">to</span> <span class="n">load</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span><span class="p">:</span> <span class="n">exiting</span> <span class="n">process</span>
|
|
</pre></div>
|
|
</div>
|
|
<div class="section" id="on-setup">
|
|
<span id="sample-debugger-on-setup"></span><h4>18.13.1.1. on_setup<a class="headerlink" href="#on-setup" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="k">class</span> <span class="nc">MySetupDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">on_setup</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">MySetupDebugger</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="n">on_setup</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Setup called: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="p">))</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exception: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span><span class="p">))</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exit_process</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">evt</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Process exit: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="p">))</span>
|
|
|
|
<span class="k">class</span> <span class="nc">SimpleDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exception: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span><span class="p">))</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exit_process</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">evt</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Process exit: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="p">))</span>
|
|
|
|
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== With on_setup =="</span><span class="p">)</span>
|
|
<span class="n">dbg</span> <span class="o">=</span> <span class="n">MySetupDebugger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\whoami.exe"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="se">\n</span><span class="s2">== Without on_setup =="</span><span class="p">)</span>
|
|
<span class="n">dbg</span> <span class="o">=</span> <span class="n">SimpleDebugger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\whoami.exe"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">debug</span>\<span class="n">debugger_on_setup</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="o">==</span> <span class="n">With</span> <span class="n">on_setup</span> <span class="o">==</span>
|
|
<span class="n">Setup</span> <span class="n">called</span><span class="p">:</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"whoami.exe"</span> <span class="n">pid</span> <span class="mi">29796</span> <span class="n">at</span> <span class="mh">0x4ccb790</span><span class="o">></span>
|
|
<span class="o"><</span><span class="n">whoami</span> <span class="n">output</span><span class="o">></span>
|
|
<span class="n">Process</span> <span class="n">exit</span><span class="p">:</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"whoami.exe"</span> <span class="n">pid</span> <span class="mi">29796</span> <span class="p">(</span><span class="n">DEAD</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x4ccb790</span><span class="o">></span>
|
|
|
|
<span class="o">==</span> <span class="n">Without</span> <span class="n">on_setup</span> <span class="o">==</span>
|
|
<span class="ne">Exception</span><span class="p">:</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o"><</span><span class="n">whoami</span> <span class="n">output</span><span class="o">></span>
|
|
<span class="n">Process</span> <span class="n">exit</span><span class="p">:</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"whoami.exe"</span> <span class="n">pid</span> <span class="mi">33328</span> <span class="p">(</span><span class="n">DEAD</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x4ccbdb0</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="single-stepping">
|
|
<h4>18.13.1.2. Single stepping<a class="headerlink" href="#single-stepping" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">MyDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">MyDebugger</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">=</span> <span class="mi">0</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Got exception </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_single_step</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Got single_step </span><span class="si">{0}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">addr</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">-=</span> <span class="mi">1</span>
|
|
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">></span> <span class="mi">0</span><span class="p">:</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"No more single step: exiting"</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">SingleStepOnWrite</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">MemoryBreakpoint</span><span class="p">):</span>
|
|
<span class="sd">"""Check that BP/dbg can trigger single step and that instruction follows"""</span>
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">fault_addr</span> <span class="o">=</span> <span class="n">exc</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionInformation</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span>
|
|
<span class="n">eip</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">pc</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Instruction at <</span><span class="si">{0:#x}</span><span class="s2">> wrote at <</span><span class="si">{1:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">eip</span><span class="p">,</span> <span class="n">fault_addr</span><span class="p">))</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">single_step_counter</span> <span class="o">=</span> <span class="mi">4</span>
|
|
<span class="k">return</span> <span class="n">dbg</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">MyDebugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
|
|
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
<span class="n">data</span> <span class="o">=</span> <span class="n">calc</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span>
|
|
|
|
<span class="n">injected</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mi">4</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span> <span class="o">+</span> <span class="mi">4</span><span class="p">),</span> <span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s2">"EAX"</span><span class="p">,</span> <span class="mi">8</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x86</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">data</span> <span class="o">+</span> <span class="mi">8</span><span class="p">),</span> <span class="s2">"EAX"</span><span class="p">)</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Nop</span><span class="p">()</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Nop</span><span class="p">()</span>
|
|
<span class="n">injected</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
|
|
|
|
<span class="n">calc</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">injected</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">SingleStepOnWrite</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="n">size</span><span class="o">=</span><span class="mi">8</span><span class="p">,</span> <span class="n">events</span><span class="o">=</span><span class="s2">"W"</span><span class="p">))</span>
|
|
<span class="n">calc</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">debug</span>\<span class="n">debugger_membp_singlestep</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Got</span> <span class="n">exception</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">(</span><span class="mh">0x80000003</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x77e0dadf</span>
|
|
<span class="n">Instruction</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x520006</span><span class="o">></span> <span class="n">wrote</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x530000</span><span class="o">></span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x52000c</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x520011</span>
|
|
<span class="n">Instruction</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x520011</span><span class="o">></span> <span class="n">wrote</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x530004</span><span class="o">></span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x520017</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x52001c</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x520022</span>
|
|
<span class="n">Got</span> <span class="n">single_step</span> <span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">(</span><span class="mh">0x80000004</span><span class="n">L</span><span class="p">)</span> <span class="n">at</span> <span class="mh">0x520023</span>
|
|
<span class="n">No</span> <span class="n">more</span> <span class="n">single</span> <span class="n">step</span><span class="p">:</span> <span class="n">exiting</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-debug-functioncallbp">
|
|
<span id="sample-debugger-bp-functioncallbp"></span><h4>18.13.1.3. <a class="reference internal" href="debug.html#windows.debug.FunctionCallBP" title="windows.debug.FunctionCallBP"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.FunctionCallBP</span></code></a><a class="headerlink" href="#windows-debug-functioncallbp" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="kn">import</span> <span class="nn">threading</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="c1"># The debugge python will just print the result of</span>
|
|
<span class="c1"># 3 call to IsDebuggerPresent</span>
|
|
<span class="n">TARGET_PYTHON_CODE</span> <span class="o">=</span> <span class="s1">'"</span><span class="se">\</span>
|
|
<span class="s1">import ctypes;</span><span class="se">\</span>
|
|
<span class="s1">import time;</span><span class="se">\</span>
|
|
<span class="s1">IsDebuggerPresent = ctypes.windll.kernel32.IsDebuggerPresent;</span><span class="se">\</span>
|
|
<span class="s1">print(</span><span class="se">\'</span><span class="s1">[DEBUGGE] IsDebuggerPresent=</span><span class="si">{0}</span><span class="se">\'</span><span class="s1">.format(IsDebuggerPresent()));</span><span class="se">\</span>
|
|
<span class="s1">time.sleep(1);</span><span class="se">\</span>
|
|
<span class="s1">print(</span><span class="se">\'</span><span class="s1">[DEBUGGE] IsDebuggerPresent=</span><span class="si">{0}</span><span class="se">\'</span><span class="s1">.format(IsDebuggerPresent()));</span><span class="se">\</span>
|
|
<span class="s1">time.sleep(1);</span><span class="se">\</span>
|
|
<span class="s1">print(</span><span class="se">\'</span><span class="s1">[DEBUGGE] IsDebuggerPresent=</span><span class="si">{0}</span><span class="se">\'</span><span class="s1">.format(IsDebuggerPresent()));</span><span class="se">\</span>
|
|
<span class="s1">"'</span>
|
|
|
|
<span class="c1"># This breakpoint now nothing about its target argument</span>
|
|
<span class="c1"># It only now how to break at the return of the function</span>
|
|
<span class="c1"># This allow us to change the return value of any function</span>
|
|
<span class="k">class</span> <span class="nc">IncrementReturnValue</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">FunctionCallBP</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">initialvalue</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">IncrementReturnValue</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">initialvalue</span> <span class="o">=</span> <span class="n">initialvalue</span>
|
|
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="c1"># Ask to break a the return of the function</span>
|
|
<span class="c1"># callback is ret_trigger</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">break_on_ret</span><span class="p">(</span><span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">ret_trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">ctx</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span>
|
|
<span class="c1"># Func result is an alias to EAX/RAX</span>
|
|
<span class="n">ctx</span><span class="o">.</span><span class="n">func_result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">initialvalue</span>
|
|
<span class="c1"># Set the new context for the target thread</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">set_context</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">initialvalue</span> <span class="o">+=</span> <span class="mi">1</span>
|
|
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">executable</span><span class="p">,</span> <span class="p">[</span><span class="n">sys</span><span class="o">.</span><span class="n">executable</span><span class="p">,</span> <span class="s2">"-c"</span><span class="p">,</span> <span class="n">TARGET_PYTHON_CODE</span><span class="p">])</span>
|
|
<span class="c1"># We could also give the direct address of the function</span>
|
|
<span class="c1"># But it would require to wait for the module to be loaded</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">IncrementReturnValue</span><span class="p">(</span><span class="s2">"kernelbase!IsDebuggerPresent"</span><span class="p">,</span> <span class="mi">42</span><span class="p">))</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">debug</span>\<span class="n">change_function_ret_value</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="p">[</span><span class="n">DEBUGGE</span><span class="p">]</span> <span class="n">IsDebuggerPresent</span><span class="o">=</span><span class="mi">42</span>
|
|
<span class="p">[</span><span class="n">DEBUGGE</span><span class="p">]</span> <span class="n">IsDebuggerPresent</span><span class="o">=</span><span class="mi">43</span>
|
|
<span class="p">[</span><span class="n">DEBUGGE</span><span class="p">]</span> <span class="n">IsDebuggerPresent</span><span class="o">=</span><span class="mi">44</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-debug-functionbp">
|
|
<span id="sample-debugger-bp-functionbp"></span><h4>18.13.1.4. <a class="reference internal" href="debug.html#windows.debug.FunctionBP" title="windows.debug.FunctionBP"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.debug.FunctionBP</span></code></a><a class="headerlink" href="#windows-debug-functionbp" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="k">class</span> <span class="nc">FollowNtCreateFile</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">FunctionBP</span><span class="p">):</span>
|
|
<span class="n">TARGET</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateFile</span>
|
|
<span class="n">COUNTER</span> <span class="o">=</span> <span class="mi">3</span>
|
|
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">COUNTER</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Exiting process"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
<span class="k">return</span>
|
|
<span class="n">params</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">extract_arguments</span><span class="p">(</span><span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="p">,</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="p">)</span>
|
|
<span class="n">filename</span> <span class="o">=</span> <span class="n">params</span><span class="p">[</span><span class="s2">"ObjectAttributes"</span><span class="p">]</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">ObjectName</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Buffer</span>
|
|
<span class="n">handle_addr</span> <span class="o">=</span> <span class="n">params</span><span class="p">[</span><span class="s2">"FileHandle"</span><span class="p">]</span><span class="o">.</span><span class="n">value</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">handle_addr</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">break_on_ret</span><span class="p">(</span><span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">ret_trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">filename</span><span class="p">,</span> <span class="n">handle_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">data</span>
|
|
<span class="n">ret_value</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">func_result</span> <span class="c1"># EAX / RAX depending of bitness</span>
|
|
<span class="n">handle_value</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_ptr</span><span class="p">(</span><span class="n">handle_addr</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">ret_value</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"NtCreateFile of <</span><span class="si">{0}</span><span class="s2">> FAILED (result=</span><span class="si">{1:#x}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">ret_value</span><span class="p">))</span>
|
|
<span class="k">return</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"NtCreateFile of <</span><span class="si">{0}</span><span class="s2">>: handle = </span><span class="si">{1:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">filename</span><span class="p">,</span> <span class="n">handle_value</span><span class="p">))</span>
|
|
<span class="c1"># Manual verification</span>
|
|
<span class="n">fhandle</span> <span class="o">=</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span> <span class="ow">and</span> <span class="n">h</span><span class="o">.</span><span class="n">wValue</span> <span class="o">==</span> <span class="n">handle_value</span><span class="p">]</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">fhandle</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"handle not found!"</span><span class="p">)</span>
|
|
<span class="n">fhandle</span> <span class="o">=</span> <span class="n">fhandle</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Handle manually found! typename=<</span><span class="si">{0}</span><span class="s2">>, name=<</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">fhandle</span><span class="o">.</span><span class="n">type</span><span class="p">,</span> <span class="n">fhandle</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">COUNTER</span> <span class="o">-=</span> <span class="mi">1</span>
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="p">(</span><span class="n">calc</span><span class="p">)</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">FollowNtCreateFile</span><span class="p">())</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python debug\debug_functionbp.py
|
|
NtCreateFile of <86250608>: handle = 0x124
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui>
|
|
|
|
NtCreateFile of <1996168876>: handle = 0x150
|
|
Handle manually found! typename=<File>, name=<\Device\DeviceApi>
|
|
|
|
NtCreateFile of <86206640>: handle = 0x280
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
|
|
|
|
Exiting process
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="debugger-attach">
|
|
<span id="sample-debugger-attach"></span><h4>18.13.1.5. <a class="reference internal" href="debug.html#windows.debug.Debugger.attach" title="windows.debug.Debugger.attach"><code class="xref py py-func docutils literal notranslate"><span class="pre">Debugger.attach</span></code></a><a class="headerlink" href="#debugger-attach" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="c1"># Just a debugger that follow NtCreateFile and print filename & handler</span>
|
|
<span class="kn">from</span> <span class="nn">debug_functionbp</span> <span class="kn">import</span> <span class="n">FollowNtCreateFile</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">follow_create_file</span><span class="p">(</span><span class="n">pid</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Finding process with pid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="p">[</span><span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span> <span class="k">if</span> <span class="n">p</span><span class="o">.</span><span class="n">pid</span> <span class="o">==</span> <span class="n">pid</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Target is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="p">))</span>
|
|
<span class="n">dbg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Debugger</span><span class="o">.</span><span class="n">attach</span><span class="p">(</span><span class="n">target</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Debugger attached: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dbg</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">FollowNtCreateFile</span><span class="p">())</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="c1"># Create a non-debugged process safe to debug</span>
|
|
<span class="n">calc</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">)</span>
|
|
<span class="c1"># Give ovnly the PID to follow_create_file</span>
|
|
<span class="n">follow_create_file</span><span class="p">(</span><span class="n">calc</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python debug\attach.py
|
|
Finding process with pid <12252>
|
|
Target is <WinProcess "notepad.exe" pid 12252 at 0x66971b0>
|
|
Debugger attached: <windows.debug.debugger.Debugger object at 0x0667CFD0>
|
|
|
|
NtCreateFile of <10573272>: handle = 0x144
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui>
|
|
|
|
NtCreateFile of <1996168876>: handle = 0x170
|
|
Handle manually found! typename=<File>, name=<\Device\DeviceApi>
|
|
|
|
NtCreateFile of <10504328>: handle = 0x2a8
|
|
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
|
|
|
|
Exiting process
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="native-code-tester">
|
|
<h4>18.13.1.6. Native code tester<a class="headerlink" href="#native-code-tester" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">argparse</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span> <span class="k">as</span> <span class="nn">dbg</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">hexdump</span><span class="p">(</span><span class="n">string</span><span class="p">,</span> <span class="n">start_addr</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
|
|
<span class="n">result</span> <span class="o">=</span> <span class="s2">""</span>
|
|
<span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
|
|
<span class="k">return</span>
|
|
<span class="n">ascii</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="s2">"."</span><span class="o">*</span><span class="mi">256</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">1</span><span class="p">,</span><span class="mh">0x7f</span><span class="p">):</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="nb">chr</span><span class="p">(</span><span class="n">i</span><span class="p">)</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x0</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x7</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x8</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x9</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0xa</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0x1b</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0xd</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"."</span>
|
|
<span class="n">ascii</span><span class="p">[</span><span class="mh">0xff</span><span class="p">]</span> <span class="o">=</span> <span class="s2">"</span><span class="se">\x13</span><span class="s2">"</span>
|
|
<span class="n">ascii</span> <span class="o">=</span> <span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">ascii</span><span class="p">)</span>
|
|
<span class="n">offset</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="k">while</span> <span class="p">(</span><span class="n">offset</span><span class="o">+</span><span class="mh">0x10</span><span class="p">)</span> <span class="o"><=</span> <span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">):</span>
|
|
<span class="n">line</span> <span class="o">=</span> <span class="n">string</span><span class="p">[</span><span class="n">offset</span><span class="p">:(</span><span class="n">offset</span><span class="o">+</span><span class="mh">0x10</span><span class="p">)]</span>
|
|
<span class="n">linebuf</span> <span class="o">=</span> <span class="s2">" </span><span class="si">%08X</span><span class="s2"> "</span> <span class="o">%</span> <span class="p">(</span><span class="n">offset</span> <span class="o">+</span> <span class="n">start_addr</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="mi">16</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">i</span> <span class="o">==</span> <span class="mi">8</span><span class="p">:</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">"</span><span class="si">%02X</span><span class="s2"> "</span> <span class="o">%</span> <span class="nb">ord</span><span class="p">(</span><span class="n">line</span><span class="p">[</span><span class="n">i</span><span class="p">])</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="mi">16</span><span class="p">):</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="n">ascii</span><span class="p">[</span><span class="nb">ord</span><span class="p">(</span><span class="n">line</span><span class="p">[</span><span class="n">i</span><span class="p">])]</span>
|
|
<span class="n">result</span> <span class="o">+=</span> <span class="n">linebuf</span><span class="o">+</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
|
|
<span class="n">offset</span> <span class="o">+=</span> <span class="mh">0x10</span>
|
|
<span class="k">if</span> <span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">)</span> <span class="o">></span> <span class="mi">0</span><span class="p">:</span>
|
|
<span class="n">linebuf</span> <span class="o">=</span> <span class="s2">" </span><span class="si">%08X</span><span class="s2"> "</span> <span class="o">%</span> <span class="p">(</span><span class="n">offset</span> <span class="o">+</span> <span class="n">start_addr</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">((</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span><span class="o">-</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">)),(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">))):</span>
|
|
<span class="k">if</span> <span class="n">i</span> <span class="o">==</span> <span class="mi">8</span><span class="p">:</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">"</span><span class="si">%02X</span><span class="s2"> "</span> <span class="o">%</span> <span class="nb">ord</span><span class="p">(</span><span class="n">string</span><span class="p">[</span><span class="n">i</span><span class="p">])</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span><span class="o">*</span><span class="p">(</span><span class="mh">0x10</span><span class="o">-</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">))</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="s2">" "</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">((</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span><span class="o">-</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">)</span> <span class="o">%</span> <span class="mh">0x10</span><span class="p">)),(</span><span class="nb">len</span><span class="p">(</span><span class="n">string</span><span class="p">))):</span>
|
|
<span class="n">linebuf</span> <span class="o">+=</span> <span class="n">ascii</span><span class="p">[</span><span class="nb">ord</span><span class="p">(</span><span class="n">string</span><span class="p">[</span><span class="n">i</span><span class="p">])]</span>
|
|
<span class="n">result</span> <span class="o">+=</span> <span class="n">linebuf</span><span class="o">+</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
|
|
<span class="k">return</span> <span class="n">result</span>
|
|
|
|
<span class="k">class</span> <span class="nc">StartStepBP</span><span class="p">(</span><span class="n">dbg</span><span class="o">.</span><span class="n">breakpoints</span><span class="o">.</span><span class="n">HXBreakpoint</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">del_bp</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">on_single_step</span><span class="p">(</span><span class="n">exc</span><span class="p">)</span> <span class="c1"># Trigger single step processing</span>
|
|
|
|
<span class="k">class</span> <span class="nc">CodeTesteur</span><span class="p">(</span><span class="n">dbg</span><span class="o">.</span><span class="n">Debugger</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">register_start</span><span class="o">=</span><span class="p">{},</span> <span class="n">steps</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
|
|
<span class="nb">super</span><span class="p">(</span><span class="n">CodeTesteur</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="n">process</span><span class="p">)</span>
|
|
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">initial_code</span> <span class="o">=</span> <span class="n">code</span>
|
|
<span class="n">code</span> <span class="o">+=</span> <span class="s2">"</span><span class="se">\xcc</span><span class="s2">"</span>
|
|
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">code_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_code_in_target</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
|
|
<span class="n">register_start</span><span class="p">[</span><span class="s2">"pc"</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">code_addr</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">context</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">setup_target_context</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="p">,</span> <span class="n">register_start</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Startup context is:"</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="o">.</span><span class="n">dump</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="o">.</span><span class="n">EEFlags</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">suspend</span><span class="p">()</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">set_context</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">thread_exec</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">init_breakpoint</span> <span class="o">=</span> <span class="kc">False</span>
|
|
<span class="c1"># Test code</span>
|
|
<span class="k">if</span> <span class="n">steps</span><span class="p">:</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">steps</span> <span class="o">=</span> <span class="kc">True</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">StartStepBP</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">last_context</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">last_code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">initial_code</span>
|
|
|
|
<span class="k">def</span> <span class="nf">write_code_in_target</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">):</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">code</span><span class="p">))</span>
|
|
<span class="n">process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">addr</span>
|
|
|
|
<span class="k">def</span> <span class="nf">setup_target_context</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ctx</span><span class="p">,</span> <span class="n">register_start</span><span class="p">):</span>
|
|
<span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">register_start</span><span class="o">.</span><span class="n">items</span><span class="p">():</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">name</span><span class="p">):</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Unknown register to setup <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">setattr</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_single_step</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">x</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"* New step !"</span><span class="p">)</span>
|
|
<span class="c1"># print("EIP = {0:#x}".format(self.current_thread.context.pc))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">report_ctx_diff</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">last_context</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">last_context</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">last_code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">report_code_diff</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">last_code</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">x</span><span class="p">):</span>
|
|
<span class="n">exc_code</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
|
|
<span class="n">exc_addr</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">init_breakpoint</span> <span class="ow">and</span> <span class="n">exc_code</span> <span class="o">==</span> <span class="n">EXCEPTION_BREAKPOINT</span><span class="p">:</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">init_breakpoint</span> <span class="o">=</span> <span class="kc">True</span>
|
|
<span class="k">return</span>
|
|
<span class="n">ctx</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"==Post-exec context=="</span><span class="p">)</span>
|
|
<span class="n">ctx</span><span class="o">.</span><span class="n">dump</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">ctx</span><span class="o">.</span><span class="n">EEFlags</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">exc_code</span> <span class="o">==</span> <span class="n">EXCEPTION_BREAKPOINT</span> <span class="ow">and</span> <span class="n">exc_addr</span> <span class="o">==</span> <span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="o">.</span><span class="n">pc</span> <span class="o">+</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">initial_code</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<Normal terminaison>"</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<</span><span class="si">{0}</span><span class="s2">> at <</span><span class="si">{1:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">exc_code</span><span class="p">,</span> <span class="n">exc_addr</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">exc_code</span> <span class="o">==</span> <span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">:</span>
|
|
<span class="n">exc_infos</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionInformation</span>
|
|
<span class="n">read_write</span> <span class="o">=</span> <span class="s2">"write"</span> <span class="k">if</span> <span class="n">exc_infos</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="k">else</span> <span class="s2">"read"</span>
|
|
<span class="n">target_addr</span> <span class="o">=</span> <span class="n">exc_infos</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Access of type <</span><span class="si">{0}</span><span class="s2">> at address <</span><span class="si">{1:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">read_write</span><span class="p">,</span> <span class="n">target_addr</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">report_ctx_diff</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">context_exec</span><span class="p">,</span> <span class="n">ctx</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">report_code_diff</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">initial_code</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
<span class="k">return</span>
|
|
|
|
<span class="k">def</span> <span class="nf">report_ctx_diff</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">start</span><span class="p">,</span> <span class="n">now</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== DIFF =="</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">start_value</span> <span class="ow">in</span> <span class="n">start</span><span class="o">.</span><span class="n">regs</span><span class="p">():</span>
|
|
<span class="n">now_value</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">now</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">start_value</span> <span class="o">!=</span> <span class="n">now_value</span><span class="p">:</span>
|
|
<span class="n">diff</span> <span class="o">=</span> <span class="n">now_value</span> <span class="o">-</span> <span class="n">start_value</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2">: </span><span class="si">{1:#x}</span><span class="s2"> -> </span><span class="si">{2:#x}</span><span class="s2"> (</span><span class="si">{3:+#x}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">start_value</span><span class="p">,</span> <span class="n">now_value</span><span class="p">,</span> <span class="n">diff</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">start</span><span class="o">.</span><span class="n">sp</span> <span class="o">></span> <span class="n">now</span><span class="o">.</span><span class="n">sp</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Negative Stack: dumping:"</span><span class="p">)</span>
|
|
<span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">now</span><span class="o">.</span><span class="n">sp</span><span class="p">,</span> <span class="n">start</span><span class="o">.</span><span class="n">sp</span> <span class="o">-</span> <span class="n">now</span><span class="o">.</span><span class="n">sp</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">hexdump</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="n">start</span><span class="o">.</span><span class="n">sp</span><span class="p">))</span>
|
|
|
|
<span class="k">def</span> <span class="nf">report_code_diff</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">initial_code</span><span class="p">):</span>
|
|
<span class="n">code_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">initial_code</span><span class="p">)</span>
|
|
<span class="n">final_code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">code_addr</span><span class="p">,</span> <span class="n">code_size</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">final_code</span> <span class="o">==</span> <span class="n">initial_code</span><span class="p">:</span>
|
|
<span class="k">return</span> <span class="n">initial_code</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"== Executable code DIFF == "</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Before:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">hexdump</span><span class="p">(</span><span class="n">initial_code</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"After:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">hexdump</span><span class="p">(</span><span class="n">final_code</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="k">return</span> <span class="n">final_code</span>
|
|
|
|
<span class="k">def</span> <span class="nf">test_code_x86</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">regs</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">raw</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="n">steps</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Testing x86 code"</span><span class="p">)</span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">raw</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">" "</span><span class="p">,</span> <span class="s2">""</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'hex'</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="n">code</span><span class="p">)</span>
|
|
|
|
<span class="n">start_register</span> <span class="o">=</span> <span class="p">{}</span>
|
|
<span class="k">if</span> <span class="n">regs</span><span class="p">:</span>
|
|
<span class="k">for</span> <span class="n">name_value</span> <span class="ow">in</span> <span class="n">regs</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">";"</span><span class="p">):</span>
|
|
<span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="o">=</span> <span class="n">name_value</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"="</span><span class="p">)</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">name</span><span class="o">.</span><span class="n">strip</span><span class="p">()</span><span class="o">.</span><span class="n">capitalize</span><span class="p">()</span>
|
|
<span class="k">if</span> <span class="n">name</span> <span class="o">==</span> <span class="s2">"Eflags"</span><span class="p">:</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="s2">"EFlags"</span>
|
|
<span class="n">value</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">value</span><span class="o">.</span><span class="n">strip</span><span class="p">(),</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">start_register</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="n">value</span>
|
|
|
|
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">CodeTesteur</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">start_register</span><span class="p">,</span> <span class="n">steps</span><span class="p">)</span>
|
|
<span class="n">x</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
<span class="k">def</span> <span class="nf">test_code_x64</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">regs</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">raw</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Testing x64 code"</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Cannot debug a 64b process from 32b python"</span><span class="p">)</span>
|
|
<span class="n">process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">DEBUG_PROCESS</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">raw</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">" "</span><span class="p">,</span> <span class="s2">""</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">'hex'</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="n">code</span><span class="p">)</span>
|
|
|
|
<span class="n">start_register</span> <span class="o">=</span> <span class="p">{}</span>
|
|
<span class="k">if</span> <span class="n">regs</span><span class="p">:</span>
|
|
<span class="k">for</span> <span class="n">name_value</span> <span class="ow">in</span> <span class="n">regs</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">";"</span><span class="p">):</span>
|
|
<span class="n">name</span><span class="p">,</span> <span class="n">value</span> <span class="o">=</span> <span class="n">name_value</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">"="</span><span class="p">)</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">name</span><span class="o">.</span><span class="n">strip</span><span class="p">()</span><span class="o">.</span><span class="n">capitalize</span><span class="p">()</span>
|
|
<span class="k">if</span> <span class="n">name</span> <span class="o">==</span> <span class="s2">"Eflags"</span><span class="p">:</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="s2">"EFlags"</span>
|
|
<span class="n">value</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">value</span><span class="o">.</span><span class="n">strip</span><span class="p">(),</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">start_register</span><span class="p">[</span><span class="n">name</span><span class="p">]</span> <span class="o">=</span> <span class="n">value</span>
|
|
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">CodeTesteur</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">start_register</span><span class="p">)</span>
|
|
<span class="n">x</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">)</span>
|
|
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--x64'</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s1">'store_const'</span><span class="p">,</span> <span class="n">dest</span><span class="o">=</span><span class="s2">"func"</span><span class="p">,</span> <span class="n">const</span><span class="o">=</span><span class="n">test_code_x64</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="n">test_code_x86</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Code is x64'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--raw'</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s1">'store_true'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'argument is raw assembled code (in hex)'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--steps'</span><span class="p">,</span> <span class="n">action</span><span class="o">=</span><span class="s1">'store_true'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Get all step info'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'code'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The code to execute'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'regs'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s2">"?"</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The default values of the registers'</span><span class="p">)</span>
|
|
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
|
|
<span class="n">res</span><span class="o">.</span><span class="n">func</span><span class="p">(</span><span class="o">**</span><span class="n">res</span><span class="o">.</span><span class="vm">__dict__</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">test_code</span><span class="o">.</span><span class="n">py</span> <span class="s2">"mov eax, 0x42424242"</span> <span class="s2">"eax=0x11223344"</span>
|
|
<span class="n">Testing</span> <span class="n">x86</span> <span class="n">code</span>
|
|
<span class="n">Startup</span> <span class="n">context</span> <span class="ow">is</span><span class="p">:</span>
|
|
<span class="n">Eip</span> <span class="o">-></span> <span class="mh">0x3f0000</span><span class="n">L</span>
|
|
<span class="n">Esp</span> <span class="o">-></span> <span class="mh">0x3bfae4</span><span class="n">L</span>
|
|
<span class="n">Eax</span> <span class="o">-></span> <span class="mh">0x11223344</span><span class="n">L</span>
|
|
<span class="n">Ebx</span> <span class="o">-></span> <span class="mh">0x5a6000</span><span class="n">L</span>
|
|
<span class="n">Ecx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Ebp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Esi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x202</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x202</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="p">)</span>
|
|
<span class="o">==</span><span class="n">Post</span><span class="o">-</span><span class="n">exec</span> <span class="n">context</span><span class="o">==</span>
|
|
<span class="n">Eip</span> <span class="o">-></span> <span class="mh">0x3f0007</span><span class="n">L</span>
|
|
<span class="n">Esp</span> <span class="o">-></span> <span class="mh">0x3bfae4</span><span class="n">L</span>
|
|
<span class="n">Eax</span> <span class="o">-></span> <span class="mh">0x42424242</span><span class="n">L</span>
|
|
<span class="n">Ebx</span> <span class="o">-></span> <span class="mh">0x5a6000</span><span class="n">L</span>
|
|
<span class="n">Ecx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Ebp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Edi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Esi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x202</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x202</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="p">)</span>
|
|
<span class="o"><</span><span class="n">Normal</span> <span class="n">terminaison</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">DIFF</span><span class="o">==</span>
|
|
<span class="n">Eip</span><span class="p">:</span> <span class="mh">0x3f0000</span> <span class="o">-></span> <span class="mh">0x3f0007</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x7</span><span class="p">)</span>
|
|
<span class="n">Eax</span><span class="p">:</span> <span class="mh">0x11223344</span> <span class="o">-></span> <span class="mh">0x42424242</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x31200efe</span><span class="p">)</span>
|
|
|
|
|
|
<span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python64</span> <span class="n">test_code</span><span class="o">.</span><span class="n">py</span> <span class="o">--</span><span class="n">x64</span> <span class="s2">"mov r15, 0x11223344; push r14; call r15"</span> <span class="s2">"rcx=1; r14=0x4242424243434343"</span>
|
|
<span class="n">Testing</span> <span class="n">x64</span> <span class="n">code</span>
|
|
<span class="n">Startup</span> <span class="n">context</span> <span class="ow">is</span><span class="p">:</span>
|
|
<span class="n">Rip</span> <span class="o">-></span> <span class="mh">0x205a1d60000</span><span class="n">L</span>
|
|
<span class="n">Rsp</span> <span class="o">-></span> <span class="mh">0xe24a88fa88</span><span class="n">L</span>
|
|
<span class="n">Rax</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rbx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rcx</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="n">Rdx</span> <span class="o">-></span> <span class="mh">0xe24aaf9000</span><span class="n">L</span>
|
|
<span class="n">Rbp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rdi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rsi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R8</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R9</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R10</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R11</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R12</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R13</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R14</span> <span class="o">-></span> <span class="mh">0x4242424243434343</span><span class="n">L</span>
|
|
<span class="n">R15</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x200</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x200</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="p">)</span>
|
|
<span class="o">==</span><span class="n">Post</span><span class="o">-</span><span class="n">exec</span> <span class="n">context</span><span class="o">==</span>
|
|
<span class="n">Rip</span> <span class="o">-></span> <span class="mh">0x11223344</span><span class="n">L</span>
|
|
<span class="n">Rsp</span> <span class="o">-></span> <span class="mh">0xe24a88fa78</span><span class="n">L</span>
|
|
<span class="n">Rax</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rbx</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rcx</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="n">Rdx</span> <span class="o">-></span> <span class="mh">0xe24aaf9000</span><span class="n">L</span>
|
|
<span class="n">Rbp</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rdi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">Rsi</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R8</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R9</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R10</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R11</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R12</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R13</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="n">R14</span> <span class="o">-></span> <span class="mh">0x4242424243434343</span><span class="n">L</span>
|
|
<span class="n">R15</span> <span class="o">-></span> <span class="mh">0x11223344</span><span class="n">L</span>
|
|
<span class="n">EFlags</span> <span class="o">-></span> <span class="mh">0x10202</span><span class="n">L</span>
|
|
<span class="n">EEflags</span><span class="p">(</span><span class="mh">0x10202</span><span class="n">L</span><span class="p">:</span><span class="n">IF</span><span class="o">|</span><span class="n">RF</span><span class="p">)</span>
|
|
<span class="o"><</span><span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">(</span><span class="mh">0xc0000005</span><span class="n">L</span><span class="p">)</span><span class="o">></span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x11223344</span><span class="o">></span>
|
|
<span class="o">==</span><span class="n">DIFF</span><span class="o">==</span>
|
|
<span class="n">Rip</span><span class="p">:</span> <span class="mh">0x205a1d60000</span> <span class="o">-></span> <span class="mh">0x11223344</span> <span class="p">(</span><span class="o">-</span><span class="mh">0x20590b3ccbc</span><span class="p">)</span>
|
|
<span class="n">Rsp</span><span class="p">:</span> <span class="mh">0xe24a88fa88</span> <span class="o">-></span> <span class="mh">0xe24a88fa78</span> <span class="p">(</span><span class="o">-</span><span class="mh">0x10</span><span class="p">)</span>
|
|
<span class="n">R15</span><span class="p">:</span> <span class="mh">0x0</span> <span class="o">-></span> <span class="mh">0x11223344</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x11223344</span><span class="p">)</span>
|
|
<span class="n">EFlags</span><span class="p">:</span> <span class="mh">0x200</span> <span class="o">-></span> <span class="mh">0x10202</span> <span class="p">(</span><span class="o">+</span><span class="mh">0x10002</span><span class="p">)</span>
|
|
<span class="n">Negative</span> <span class="n">Stack</span><span class="p">:</span> <span class="n">dumping</span><span class="p">:</span>
|
|
<span class="n">E24A88FA88</span> <span class="mi">0</span><span class="n">C</span> <span class="mi">00</span> <span class="n">D6</span> <span class="n">A1</span> <span class="mi">05</span> <span class="mi">02</span> <span class="mi">00</span> <span class="mi">00</span> <span class="mi">43</span> <span class="mi">43</span> <span class="mi">43</span> <span class="mi">43</span> <span class="mi">42</span> <span class="mi">42</span> <span class="mi">42</span> <span class="mi">42</span> <span class="o">........</span><span class="n">CCCCBBBB</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="symboldebugger">
|
|
<span id="sample-symbol-debugger"></span><h3>18.13.2. <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolDebugger</span></code><a class="headerlink" href="#symboldebugger" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
<span class="kn">import</span> <span class="nn">os</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--dbghelp'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The path of DBG help to use (default use env:PFW_DBGHELP_PATH)'</span><span class="p">)</span>
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">args</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">:</span>
|
|
<span class="n">symbols</span><span class="o">.</span><span class="n">set_dbghelp_path</span><span class="p">(</span><span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="s2">"PFW_DBGHELP_PATH"</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Not dbghelp path given and no environ var 'PFW_DBGHELP_PATH' sample may fail"</span><span class="p">)</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">MyInfoBP</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">Breakpoint</span><span class="p">):</span>
|
|
<span class="n">COUNT</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">cursym</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">current_resolver</span><span class="p">[</span><span class="n">exc</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Breakpoint triggered at: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cursym</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">cursym</span><span class="p">))</span>
|
|
<span class="n">MyInfoBP</span><span class="o">.</span><span class="n">COUNT</span> <span class="o">+=</span> <span class="mi">1</span>
|
|
<span class="k">if</span> <span class="n">MyInfoBP</span><span class="o">.</span><span class="n">COUNT</span> <span class="o">==</span> <span class="mi">4</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Quitting"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="n">dbg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">SymbolDebugger</span><span class="o">.</span><span class="n">debug</span><span class="p">(</span><span class="sa">b</span><span class="s2">"c:</span><span class="se">\\</span><span class="s2">windows</span><span class="se">\\</span><span class="s2">system32</span><span class="se">\\</span><span class="s2">notepad.exe"</span><span class="p">)</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">MyInfoBP</span><span class="p">(</span><span class="s2">"kernelbase!CreateFileInternal+2"</span><span class="p">))</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">MyInfoBP</span><span class="p">(</span><span class="s2">"ntdll!LdrpInitializeProcess"</span><span class="p">))</span>
|
|
<span class="n">dbg</span><span class="o">.</span><span class="n">loop</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python debug\symbol_debugger.py
|
|
Namespace(dbghelp=None)
|
|
Breakpoint triggered at: ntdll!LdrpInitializeProcess
|
|
<SymbolInfoA name="LdrpInitializeProcess" start=0x77c676c0 tag=SymTagPublicSymbol>
|
|
|
|
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
|
|
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
|
|
|
|
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
|
|
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
|
|
|
|
Breakpoint triggered at: KERNELBASE!CreateFileInternal+0x2
|
|
<SymbolInfoA name="CreateFileInternal" start=0x75be2120 displacement=0x2 tag=SymTagFunction>
|
|
Quitting
|
|
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="localdebugger">
|
|
<span id="sample-local-debugger"></span><h3>18.13.3. <code class="xref py py-class docutils literal notranslate"><span class="pre">LocalDebugger</span></code><a class="headerlink" href="#localdebugger" title="Permalink to this headline">¶</a></h3>
|
|
<div class="section" id="in-current-process">
|
|
<h4>18.13.3.1. In current process<a class="headerlink" href="#in-current-process" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
|
|
|
|
<span class="k">class</span> <span class="nc">SingleSteppingDebugger</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">LocalDebugger</span><span class="p">):</span>
|
|
<span class="n">SINGLE_STEP_COUNT</span> <span class="o">=</span> <span class="mi">4</span>
|
|
<span class="k">def</span> <span class="nf">on_exception</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_code</span><span class="p">()</span>
|
|
<span class="n">context</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_context</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"EXCEPTION !!!! Got a </span><span class="si">{0!r}</span><span class="s2"> at 0x</span><span class="si">{1:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="n">context</span><span class="o">.</span><span class="n">pc</span><span class="p">))</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">SINGLE_STEP_COUNT</span> <span class="o">-=</span> <span class="mi">1</span>
|
|
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">SINGLE_STEP_COUNT</span><span class="p">:</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
<span class="k">return</span> <span class="n">EXCEPTION_CONTINUE_EXECUTION</span>
|
|
|
|
<span class="k">class</span> <span class="nc">RewriteBreakpoint</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">HXBreakpoint</span><span class="p">):</span>
|
|
<span class="k">def</span> <span class="nf">trigger</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dbg</span><span class="p">,</span> <span class="n">exc</span><span class="p">):</span>
|
|
<span class="n">context</span> <span class="o">=</span> <span class="n">dbg</span><span class="o">.</span><span class="n">get_exception_context</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"GOT AN HXBP at 0x</span><span class="si">{0:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">context</span><span class="o">.</span><span class="n">pc</span><span class="p">))</span>
|
|
<span class="c1"># Rewrite the infinite loop with 2 nop</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="sa">b</span><span class="s2">"</span><span class="se">\x90\x90</span><span class="s2">"</span><span class="p">)</span>
|
|
<span class="c1"># Ask for a single stepping</span>
|
|
<span class="k">return</span> <span class="n">dbg</span><span class="o">.</span><span class="n">single_step</span><span class="p">()</span>
|
|
|
|
|
|
<span class="n">d</span> <span class="o">=</span> <span class="n">SingleSteppingDebugger</span><span class="p">()</span>
|
|
<span class="c1"># Infinite loop + nop + ret</span>
|
|
<span class="n">code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">"label :begin; jmp :begin; nop; ret"</span><span class="p">)</span>
|
|
<span class="n">func</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Code addr = 0x</span><span class="si">{0:x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="c1"># Create a thread that will infinite loop</span>
|
|
<span class="n">t</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
|
|
<span class="c1"># Add a breakpoint on the infitine loop</span>
|
|
<span class="n">d</span><span class="o">.</span><span class="n">add_bp</span><span class="p">(</span><span class="n">RewriteBreakpoint</span><span class="p">(</span><span class="n">func</span><span class="o">.</span><span class="n">code_addr</span><span class="p">))</span>
|
|
<span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Done!"</span><span class="p">)</span>
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python debug\local_debugger.py
|
|
Code addr = 0x5450002
|
|
GOT AN HXBP at 0x5450002
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450003
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450004
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450005
|
|
EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x76948654
|
|
Done!
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="id1">
|
|
<h4>18.13.3.2. In remote process<a class="headerlink" href="#id1" title="Permalink to this headline">¶</a></h4>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="n">remote_code</span> <span class="o">=</span> <span class="s2">"""</span>
|
|
<span class="s2">import windows</span>
|
|
<span class="s2">from windows.generated_def.winstructs import *</span>
|
|
|
|
<span class="s2">windows.utils.create_console()</span>
|
|
|
|
<span class="s2">class YOLOHXBP(windows.debug.HXBreakpoint):</span>
|
|
<span class="s2"> def trigger(self, dbg, exc):</span>
|
|
<span class="s2"> p = windows.current_process</span>
|
|
<span class="s2"> arg_pos = 2</span>
|
|
<span class="s2"> context = dbg.get_exception_context()</span>
|
|
<span class="s2"> esp = context.Esp</span>
|
|
<span class="s2"> unicode_string_addr = p.read_ptr(esp + (arg_pos + 1) * 4)</span>
|
|
<span class="s2"> wstring_addr = p.read_ptr(unicode_string_addr + 4)</span>
|
|
<span class="s2"> dll_loaded = p.read_wstring(wstring_addr)</span>
|
|
<span class="s2"> print("I AM LOADING <</span><span class="si">{0}</span><span class="s2">>".format(dll_loaded))</span>
|
|
|
|
<span class="s2">d = windows.debug.LocalDebugger()</span>
|
|
|
|
<span class="s2">exp = windows.current_process.peb.modules[1].pe.exports</span>
|
|
<span class="s2">#windows.utils.FixedInteractiveConsole(locals()).interact()</span>
|
|
<span class="s2">ldr = exp["LdrLoadDll"]</span>
|
|
<span class="s2">d.add_bp(YOLOHXBP(ldr))</span>
|
|
|
|
<span class="s2">"""</span>
|
|
|
|
<span class="n">c</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">(</span><span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">remote_code</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">time</span>
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">2</span><span class="p">)</span>
|
|
<span class="n">c</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span><span class="o">.</span><span class="n">exe</span> <span class="n">debug</span>\<span class="n">local_debugger_remote_process</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="p">(</span><span class="n">In</span> <span class="n">another</span> <span class="n">console</span><span class="p">)</span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">uxtheme</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">kernel32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">WinSxS</span>\<span class="n">x86_microsoft</span><span class="o">.</span><span class="n">windows</span><span class="o">.</span><span class="n">gdiplus_6595b64144ccf1df_1</span><span class="o">.</span><span class="mf">1.9600</span><span class="o">.</span><span class="mi">17415</span><span class="n">_none_dad8722c5bcc2d8f</span>\<span class="n">gdiplus</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">comctl32</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SysWOW64</span>\<span class="n">oleacc</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">OLEAUT32</span><span class="o">.</span><span class="n">DLL</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">MSCTF</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SysWOW64</span>\<span class="n">msxml6</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">shell32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">SYSTEM32</span>\<span class="n">WINMM</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
<span class="n">I</span> <span class="n">AM</span> <span class="n">LOADING</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">Windows</span>\<span class="n">system32</span>\<span class="n">ole32</span><span class="o">.</span><span class="n">dll</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="symbols">
|
|
<span id="sample-symbols"></span><h2>18.14. Symbols<a class="headerlink" href="#symbols" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="virtualsymbolhandler">
|
|
<h3>18.14.1. VirtualSymbolHandler<a class="headerlink" href="#virtualsymbolhandler" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">os</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.debug</span> <span class="kn">import</span> <span class="n">symbols</span>
|
|
<span class="kn">import</span> <span class="nn">argparse</span>
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--dbghelp'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The path of DBG help to use (default use env:PFW_DBGHELP_PATH)'</span><span class="p">)</span>
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">args</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">:</span>
|
|
<span class="n">symbols</span><span class="o">.</span><span class="n">set_dbghelp_path</span><span class="p">(</span><span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="s2">"PFW_DBGHELP_PATH"</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Not dbghelp path given and no environ var 'PFW_DBGHELP_PATH' sample may fail"</span><span class="p">)</span>
|
|
|
|
|
|
<span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span> <span class="o">=</span> <span class="mi">0</span> <span class="c1"># Disable defered load</span>
|
|
<span class="n">sh</span> <span class="o">=</span> <span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
|
|
|
<span class="n">ntmod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\ntdll.dll"</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="mh">0x420000</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Ntdll module is: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ntmod</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ntmod</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * addr = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ntmod</span><span class="o">.</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * path = </span><span class="si">{0:}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ntmod</span><span class="o">.</span><span class="n">path</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * type = </span><span class="si">{0:}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ntmod</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * pdb = </span><span class="si">{0:}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ntmod</span><span class="o">.</span><span class="n">pdb</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">TEST_FUNCTION</span> <span class="o">=</span> <span class="s2">"LdrLoadDll"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Resolving function <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TEST_FUNCTION</span><span class="p">))</span>
|
|
<span class="n">loaddll</span> <span class="o">=</span> <span class="n">sh</span><span class="p">[</span><span class="s2">"ntdll!"</span> <span class="o">+</span> <span class="n">TEST_FUNCTION</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Symbol found !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * __repr__: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">loaddll</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * __str__: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">loaddll</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * addr: </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">loaddll</span><span class="o">.</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">loaddll</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * fullname: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">loaddll</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * module: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">loaddll</span><span class="o">.</span><span class="n">module</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Loading kernelbase"</span><span class="p">)</span>
|
|
<span class="n">kbasemod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">"c:\windows\system32\kernelbase.dll"</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="mh">0x1230000</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Loaded modules are: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sh</span><span class="o">.</span><span class="n">modules</span><span class="p">))</span>
|
|
<span class="n">LOOKUP_ADDR</span> <span class="o">=</span> <span class="mh">0x1231242</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking up address: </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">LOOKUP_ADDR</span><span class="p">))</span>
|
|
<span class="n">lookupsym</span> <span class="o">=</span> <span class="n">sh</span><span class="p">[</span><span class="n">LOOKUP_ADDR</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Symbol resolved !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * __repr__: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * __str__: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * start: </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="o">.</span><span class="n">start</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * addr: </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="o">.</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * displacement: </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="o">.</span><span class="n">displacement</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * fullname: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * module: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">lookupsym</span><span class="o">.</span><span class="n">module</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python debug\symbols\virtsymdemo.py
|
|
Namespace(dbghelp=None)
|
|
Ntdll module is: <SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>
|
|
* name = ntdll
|
|
* addr = 0x420000
|
|
* path = c:\windows\system32\ntdll.dll
|
|
* type = <SYM_TYPE SymPdb(0x3L)>
|
|
* pdb = d:\symbols\wntdll.pdb\3D038F31BBBF51C701937460DBAB1F531\wntdll.pdb
|
|
|
|
Resolving function <LdrLoadDll>
|
|
Symbol found !
|
|
* __repr__: <SymbolInfoA name="LdrLoadDll" start=0x464d30 tag=SymTagFunction>
|
|
* __str__: ntdll!LdrLoadDll
|
|
* addr: 0x464d30
|
|
* name: LdrLoadDll
|
|
* fullname: ntdll!LdrLoadDll
|
|
* module: <SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>
|
|
|
|
Loading kernelbase
|
|
Loaded modules are: [<SymbolModule name="ntdll" type=SymPdb pdb="wntdll.pdb" addr=0x420000>, <SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x1230000>]
|
|
Looking up address: 0x1231242
|
|
Symbol resolved !
|
|
* __repr__: <SymbolInfoA name="__load_config_used" start=0x1231230 displacement=0x12 tag=SymTagPublicSymbol>
|
|
* __str__: kernelbase!__load_config_used+0x12
|
|
* start: 0x1231230
|
|
* addr: 0x1231242
|
|
* displacement: 0x12
|
|
* name: __load_config_used
|
|
* fullname: kernelbase!__load_config_used+0x12
|
|
* module: <SymbolModule name="kernelbase" type=SymPdb pdb="wkernelbase.pdb" addr=0x1230000>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="processsymbolhandler">
|
|
<h3>18.14.2. ProcessSymbolHandler<a class="headerlink" href="#processsymbolhandler" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">os</span>
|
|
<span class="kn">import</span> <span class="nn">argparse</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.debug</span> <span class="kn">import</span> <span class="n">symbols</span>
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--dbghelp'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The path of DBG help to use (default use env:PFW_DBGHELP_PATH)'</span><span class="p">)</span>
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">args</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">:</span>
|
|
<span class="n">symbols</span><span class="o">.</span><span class="n">set_dbghelp_path</span><span class="p">(</span><span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="s2">"PFW_DBGHELP_PATH"</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Not dbghelp path given and no environ var 'PFW_DBGHELP_PATH' sample may fail"</span><span class="p">)</span>
|
|
|
|
|
|
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">()</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">()</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Target is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="p">))</span>
|
|
<span class="n">sh</span> <span class="o">=</span> <span class="n">symbols</span><span class="o">.</span><span class="n">ProcessSymbolHandler</span><span class="p">(</span><span class="n">target</span><span class="p">)</span>
|
|
<span class="kn">import</span> <span class="nn">time</span><span class="p">;</span><span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.1</span><span class="p">)</span> <span class="c1"># Just wait for the process initialisation</span>
|
|
<span class="n">sh</span><span class="o">.</span><span class="n">refresh</span><span class="p">()</span> <span class="c1"># Refresh symbol list (Only meaningful for ProcessSymbolHandler)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some loaded modules are:"</span><span class="o">.</span><span class="n">format</span><span class="p">())</span>
|
|
<span class="k">for</span> <span class="n">sm</span> <span class="ow">in</span> <span class="n">sh</span><span class="o">.</span><span class="n">modules</span><span class="p">[:</span><span class="mi">3</span><span class="p">]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sm</span><span class="p">))</span>
|
|
|
|
<span class="n">createserv</span> <span class="o">=</span> <span class="n">sh</span><span class="p">[</span><span class="s2">"advapi32!CreateServiceEx"</span><span class="p">]</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">TEST_FUNCTION</span> <span class="o">=</span> <span class="s2">"advapi32!CreateServiceEx"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Resolving function <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TEST_FUNCTION</span><span class="p">))</span>
|
|
<span class="n">createserv</span> <span class="o">=</span> <span class="n">sh</span><span class="p">[</span><span class="n">TEST_FUNCTION</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Symbol found !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * __repr__: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">createserv</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * __str__: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">createserv</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * addr: </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">createserv</span><span class="o">.</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">createserv</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * fullname: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">createserv</span><span class="o">.</span><span class="n">fullname</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * module: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">createserv</span><span class="o">.</span><span class="n">module</span><span class="p">))</span>
|
|
|
|
<span class="n">target</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python debug\symbols\processsymdemo.py
|
|
Namespace(dbghelp=None)
|
|
Target is <WinProcess "notepad.exe" pid 14280 at 0x4e177b0>
|
|
Some loaded modules are:
|
|
* <SymbolModule name="notepad" type=SymDeferred pdb="" addr=0xc10000>
|
|
* <SymbolModule name="ntdll" type=SymDeferred pdb="" addr=0x77bc0000>
|
|
* <SymbolModule name="KERNEL32" type=SymDeferred pdb="" addr=0x77480000>
|
|
|
|
Resolving function <advapi32!CreateServiceEx>
|
|
Symbol found !
|
|
* __repr__: <SymbolInfoA name="CreateServiceEx" start=0x764647b0 tag=SymTagPublicSymbol>
|
|
* __str__: advapi32!CreateServiceEx
|
|
* addr: 0x764647b0
|
|
* name: CreateServiceEx
|
|
* fullname: advapi32!CreateServiceEx
|
|
* module: <SymbolModule name="advapi32" type=SymPdb pdb="advapi32.pdb" addr=0x76440000>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="symbol-search">
|
|
<h3>18.14.3. Symbol search<a class="headerlink" href="#symbol-search" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
<span class="kn">import</span> <span class="nn">os</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.debug.symbols</span> <span class="k">as</span> <span class="nn">symbols</span>
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'pattern'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'file'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"The PE file to load"</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--addr'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s2">"The load address of the PE"</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--tag'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="mi">0</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--dbghelp'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The path of DBG help to use (default use env:PFW_DBGHELP_PATH)'</span><span class="p">)</span>
|
|
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="k">if</span> <span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">:</span>
|
|
<span class="n">symbols</span><span class="o">.</span><span class="n">set_dbghelp_path</span><span class="p">(</span><span class="n">args</span><span class="o">.</span><span class="n">dbghelp</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="s2">"PFW_DBGHELP_PATH"</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Not dbghelp path given and no environ var 'PFW_DBGHELP_PATH' sample may fail"</span><span class="p">)</span>
|
|
|
|
|
|
<span class="n">sh</span> <span class="o">=</span> <span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
|
|
<span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="n">path</span><span class="o">=</span><span class="n">args</span><span class="o">.</span><span class="n">file</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="n">args</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="n">args</span><span class="o">.</span><span class="n">pattern</span><span class="p">,</span> <span class="n">mod</span><span class="o">=</span><span class="n">mod</span><span class="p">,</span> <span class="n">tag</span><span class="o">=</span><span class="n">args</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2"> symbols found:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">res</span><span class="p">)))</span>
|
|
<span class="k">for</span> <span class="n">sym</span> <span class="ow">in</span> <span class="n">res</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sym</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ python64 debug\symbols\symsearch.py "CreateFile*" c:\windows\system32\kernelbase.dll
|
|
Namespace(addr=0, dbghelp=None, file='c:\\windows\\system32\\kernelbase.dll', pattern='CreateFile*', tag=0)
|
|
16 symbols found:
|
|
* <SymbolInfoA name="CreateFileInternal" start=0x180024250 tag=SymTagFunction>
|
|
* <SymbolInfoA name="CreateFileMappingFromApp" start=0x1800809d0 tag=SymTagFunction>
|
|
* <SymbolInfoA name="CreateFileMoniker" start=0x180087e40 tag=SymTagFunction>
|
|
* <SymbolInfoA name="CreateFile2" start=0x180074550 tag=SymTagFunction>
|
|
* <SymbolInfoA name="CreateFileA" start=0x1800240d0 tag=SymTagFunction>
|
|
* <SymbolInfoA name="CreateFileMappingNumaW" start=0x18002ca40 tag=SymTagFunction>
|
|
* <SymbolInfoA name="CreateFileMapping2" start=0x1800fb6d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileInternal" start=0x180024250 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileMappingW" start=0x18002cd00 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileDowngrade_Win7" start=0x180082ff0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileDowngrade_Vista" start=0x18007eba0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileMappingFromApp" start=0x1800809d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFile2" start=0x180074550 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileW" start=0x1800241d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileA" start=0x1800240d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="CreateFileMappingNumaW" start=0x18002ca40 tag=SymTagPublicSymbol>
|
|
|
|
|
|
$ python64 debug\symbols\symsearch.py "NtCreate*" c:\windows\system32\ntdll.dll --addr 0x42000000
|
|
Namespace(addr=1107296256, dbghelp=None, file='c:\\windows\\system32\\ntdll.dll', pattern='NtCreate*', tag=0)
|
|
47 symbols found:
|
|
* <SymbolInfoA name="NtCreateProcessEx" start=0x4209ca00 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateIRTimer" start=0x4209d530 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateRegistryTransaction" start=0x4209d750 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateTimer" start=0x4209d810 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateKeyedEvent" start=0x4209d5d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateFile" start=0x4209cb00 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateSymbolicLinkObject" start=0x4209d7d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreatePrivateNamespace" start=0x4209d6d0 tag=SymTagPublicSymbol>
|
|
* <SymbolInfoA name="NtCreateKey" start=0x4209c400 tag=SymTagPublicSymbol>
|
|
...
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="wmi">
|
|
<span id="wmi-samples"></span><h2>18.15. WMI<a class="headerlink" href="#wmi" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="wmi-requests">
|
|
<h3>18.15.1. WMI requests<a class="headerlink" href="#wmi-requests" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"WMI requester is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Selecting * from 'Win32_Process'"</span><span class="p">)</span>
|
|
<span class="n">result</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">select</span><span class="p">(</span><span class="s2">"Win32_Process"</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"They are <</span><span class="si">{0}</span><span class="s2">> processes"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">result</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for ourself via pid"</span><span class="p">)</span>
|
|
<span class="n">us</span> <span class="o">=</span> <span class="p">[</span><span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">result</span> <span class="k">if</span> <span class="nb">int</span><span class="p">(</span><span class="n">p</span><span class="p">[</span><span class="s2">"ProcessId"</span><span class="p">])</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Some info about our process:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"Name"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"Name"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"ProcessId"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"ProcessId"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"OSName"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"OSName"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"UserModeTime"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"UserModeTime"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"WindowsVersion"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"WindowsVersion"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="s2">"CommandLine"</span><span class="p">,</span> <span class="n">us</span><span class="p">[</span><span class="s2">"CommandLine"</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">vol</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">query</span><span class="p">(</span><span class="s2">"select Caption,FileSystem,FreeSpace from Win32_LogicalDisk"</span><span class="p">):</span>
|
|
<span class="c1"># Filter out system-properties for the sample</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * "</span> <span class="o">+</span> <span class="nb">str</span><span class="p">({</span><span class="n">k</span><span class="p">:</span><span class="n">v</span> <span class="k">for</span> <span class="n">k</span><span class="p">,</span><span class="n">v</span> <span class="ow">in</span> <span class="n">vol</span><span class="o">.</span><span class="n">items</span><span class="p">()</span> <span class="k">if</span> <span class="ow">not</span> <span class="n">k</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">"_"</span><span class="p">)}))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="se">\n</span><span class="s2"> ==== Advanced use ===="</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing some namespaces:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">namespace</span> <span class="ow">in</span> <span class="p">[</span><span class="n">ns</span> <span class="k">for</span> <span class="n">ns</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="o">.</span><span class="n">namespaces</span> <span class="k">if</span> <span class="s2">"2"</span> <span class="ow">in</span> <span class="n">ns</span><span class="p">]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">namespace</span><span class="p">))</span>
|
|
|
|
<span class="n">security2</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">[</span><span class="s2">"root</span><span class="se">\\</span><span class="s2">SecurityCenter2"</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Querying non-default namespace: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">security2</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing some available classes:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">clsname</span> <span class="ow">in</span> <span class="p">[</span><span class="n">x</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">security2</span><span class="o">.</span><span class="n">classes</span> <span class="k">if</span> <span class="n">x</span><span class="p">[</span><span class="s2">"__CLASS"</span><span class="p">]</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">"Product"</span><span class="p">)]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">clsname</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing <AntiVirusProduct>:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">av</span> <span class="ow">in</span> <span class="n">security2</span><span class="o">.</span><span class="n">select</span><span class="p">(</span><span class="s2">"AntiVirusProduct"</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">av</span><span class="p">[</span><span class="s2">"displayName"</span><span class="p">]))</span>
|
|
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python wmi\wmi_request.py
|
|
WMI requester is <windows.winobject.wmi.WmiManager object at 0x04258918>
|
|
Selecting * from 'Win32_Process'
|
|
They are <308> processes
|
|
Looking for ourself via pid
|
|
Some info about our process:
|
|
* Name -> python.exe
|
|
* ProcessId -> 27144
|
|
* OSName -> Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2
|
|
* UserModeTime -> 2812500
|
|
* WindowsVersion -> 10.0.17134
|
|
* CommandLine -> C:\Python27\python.exe wmi\wmi_request.py
|
|
<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:
|
|
* {u'Caption': u'B:', u'FreeSpace': None, u'FileSystem': None}
|
|
* {u'Caption': u'C:', u'FreeSpace': u'5701517312', u'FileSystem': u'NTFS'}
|
|
* {u'Caption': u'D:', u'FreeSpace': u'47657324544', u'FileSystem': u'NTFS'}
|
|
* {u'Caption': u'E:', u'FreeSpace': u'89507512320', u'FileSystem': u'NTFS'}
|
|
|
|
==== Advanced use ====
|
|
Listing some namespaces:
|
|
* CIMV2
|
|
* SecurityCenter2
|
|
* StandardCimv2
|
|
Querying non-default namespace: <WmiNamespace "root\SecurityCenter2">
|
|
Listing some available classes:
|
|
* <WmiObject class "FirewallProduct">
|
|
* <WmiObject class "AntiVirusProduct">
|
|
* <WmiObject class "AntiSpywareProduct">
|
|
Listing <AntiVirusProduct>:
|
|
* Windows Defender
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="wmi-create-process">
|
|
<h3>18.15.2. WMI Create Process<a class="headerlink" href="#wmi-create-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">time</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
|
|
<span class="n">wmispace</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">[</span><span class="s2">"root</span><span class="se">\\</span><span class="s2">cimv2"</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"WMI namespace is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">wmispace</span><span class="p">))</span>
|
|
<span class="n">proc_class</span> <span class="o">=</span> <span class="n">wmispace</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="s2">"Win32_process"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Process class is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_class</span><span class="p">))</span>
|
|
|
|
<span class="n">inparam_cls</span> <span class="o">=</span> <span class="n">proc_class</span><span class="o">.</span><span class="n">get_method</span><span class="p">(</span><span class="s2">"Create"</span><span class="p">)</span><span class="o">.</span><span class="n">inparam</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Method Create InParams is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">inparam_cls</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Method Create InParams properties are <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">inparam_cls</span><span class="o">.</span><span class="n">properties</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating instance of inparam"</span><span class="p">)</span>
|
|
|
|
<span class="n">inparam</span> <span class="o">=</span> <span class="n">inparam_cls</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"InParam instance is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">inparam</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Setting <CommandLine>"</span><span class="p">)</span>
|
|
<span class="n">inparam</span><span class="p">[</span><span class="s2">"CommandLine"</span><span class="p">]</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"c:\windows\system32\notepad.exe"</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Executing method"</span><span class="p">)</span>
|
|
<span class="c1"># This API may change for something that better wraps cls/object/Parameters handling</span>
|
|
<span class="n">outparam</span> <span class="o">=</span> <span class="n">wmispace</span><span class="o">.</span><span class="n">exec_method</span><span class="p">(</span><span class="n">proc_class</span><span class="p">,</span> <span class="s2">"Create"</span><span class="p">,</span> <span class="n">inparam</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"OutParams is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">outparam</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Out params values are: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">outparam</span><span class="o">.</span><span class="n">properties</span><span class="p">))</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="nb">int</span><span class="p">(</span><span class="n">outparam</span><span class="p">[</span><span class="s2">"ProcessId"</span><span class="p">]))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Created process is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Waiting 1s"</span><span class="p">)</span>
|
|
<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Killing the process"</span><span class="p">)</span>
|
|
<span class="n">target</span><span class="o">.</span><span class="n">exit</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span>
|
|
|
|
|
|
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python wmi\create_process.py
|
|
WMI namespace is <<WmiNamespace "root\cimv2">>
|
|
Process class is <WmiObject class "Win32_Process">
|
|
Method Create InParams is <<WmiObject class "__PARAMETERS">>
|
|
Method Create InParams properties are <[u'CommandLine', u'CurrentDirectory', u'ProcessStartupInformation']>
|
|
Creating instance of inparam
|
|
InParam instance is <<WmiObject instance of "__PARAMETERS">>
|
|
Setting <CommandLine>
|
|
Executing method
|
|
OutParams is <WmiObject instance of "__PARAMETERS">
|
|
Out params values are: [u'ProcessId', u'ReturnValue']
|
|
Created process is <WinProcess "notepad.exe" pid 24036 at 0x3d04390>
|
|
Waiting 1s
|
|
Killing the process
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-com">
|
|
<span id="sample-com"></span><h2>18.16. <a class="reference internal" href="com.html#module-windows.com" title="windows.com"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.com</span></code></a><a class="headerlink" href="#windows-com" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="inetfwpolicy2">
|
|
<span id="sample-com-firewall"></span><h3>18.16.1. <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code><a class="headerlink" href="#inetfwpolicy2" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">os.path</span>
|
|
<span class="kn">import</span> <span class="nn">pprint</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">abspath</span><span class="p">(</span><span class="vm">__file__</span> <span class="o">+</span> <span class="s2">"\..\.."</span><span class="p">))</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="kn">import</span> <span class="n">interfaces</span>
|
|
|
|
<span class="c1"># This code is a simple version of the firewall code in windows.winoject.network</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Initialisation of COM"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">init</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating INetFwPolicy2 variable"</span><span class="p">)</span>
|
|
<span class="n">firewall</span> <span class="o">=</span> <span class="n">interfaces</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2"> (value = </span><span class="si">{1}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">firewall</span><span class="p">,</span> <span class="n">firewall</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Generating CLSID"</span><span class="p">)</span>
|
|
<span class="n">NetFwPolicy2CLSID</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">IID</span><span class="o">.</span><span class="n">from_string</span><span class="p">(</span><span class="s2">"E2B3C97F-6AE1-41AC-817A-F6F92166D7DD"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">NetFwPolicy2CLSID</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Creating COM instance"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">create_instance</span><span class="p">(</span><span class="n">NetFwPolicy2CLSID</span><span class="p">,</span> <span class="n">firewall</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0}</span><span class="s2"> (value = 0x</span><span class="si">{1:0}</span><span class="s2">)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">firewall</span><span class="p">,</span> <span class="n">firewall</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Checking for enabled profiles"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">profile</span> <span class="ow">in</span> <span class="p">[</span><span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_DOMAIN</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_PRIVATE</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">NET_FW_PROFILE2_PUBLIC</span><span class="p">]:</span>
|
|
<span class="n">enabled</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VARIANT_BOOL</span><span class="p">()</span>
|
|
<span class="n">firewall</span><span class="o">.</span><span class="n">get_FirewallEnabled</span><span class="p">(</span><span class="n">profile</span><span class="p">,</span> <span class="n">enabled</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2"> -> </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">profile</span><span class="p">,</span> <span class="n">enabled</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">com</span>\<span class="n">com_inetfwpolicy2</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Initialisation</span> <span class="n">of</span> <span class="n">COM</span>
|
|
<span class="n">Creating</span> <span class="n">INetFwPolicy2</span> <span class="n">variable</span>
|
|
<span class="o"><</span><span class="n">INetFwPolicy2</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x060677B0</span><span class="o">></span> <span class="p">(</span><span class="n">value</span> <span class="o">=</span> <span class="kc">None</span><span class="p">)</span>
|
|
|
|
<span class="n">Generating</span> <span class="n">CLSID</span>
|
|
<span class="o"><</span><span class="n">IID</span> <span class="s2">"E2B3C97F-6AE1-41AC-817A-F6F92166D7DD"</span><span class="o">></span>
|
|
|
|
<span class="n">Creating</span> <span class="n">COM</span> <span class="n">instance</span>
|
|
<span class="o"><</span><span class="n">INetFwPolicy2</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x060677B0</span><span class="o">></span> <span class="p">(</span><span class="n">value</span> <span class="o">=</span> <span class="mh">0x85678080</span><span class="p">)</span>
|
|
|
|
<span class="n">Checking</span> <span class="k">for</span> <span class="n">enabled</span> <span class="n">profiles</span>
|
|
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_DOMAIN</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span> <span class="o">-></span> <span class="kc">True</span>
|
|
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_PRIVATE</span><span class="p">(</span><span class="mh">0x2</span><span class="n">L</span><span class="p">)</span> <span class="o">-></span> <span class="kc">True</span>
|
|
<span class="o">*</span> <span class="n">NET_FW_PROFILE2_PUBLIC</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">)</span> <span class="o">-></span> <span class="kc">True</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="icallinterceptor">
|
|
<span id="sample-com-icallinterceptor"></span><h3>18.16.2. <code class="docutils literal notranslate"><span class="pre">ICallInterceptor</span></code><a class="headerlink" href="#icallinterceptor" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">winproxy</span>
|
|
|
|
<span class="c1"># POC of ICallInterceptor</span>
|
|
<span class="c1"># Based on works by Pavel Yosifovich</span>
|
|
<span class="c1"># http://blogs.microsoft.co.il/pavely/2018/02/28/intercepting-com-objects-with-cogetinterceptor/</span>
|
|
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">init</span><span class="p">()</span>
|
|
|
|
<span class="c1"># Create an interceptor for the firewall (INetFwPolicy2)</span>
|
|
<span class="n">interceptor</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ICallInterceptor</span><span class="p">()</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CoGetInterceptor</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">interceptor</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="n">interceptor</span><span class="p">)</span>
|
|
|
|
<span class="c1"># The PythonForWindows firewall object is a real/valid INetFwPolicy2</span>
|
|
<span class="c1"># used for demos of ICallFrameEvents.Invoke</span>
|
|
<span class="n">real_firewall</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">firewall</span>
|
|
|
|
<span class="c1"># Custom Python ICallFrameEvents implementation</span>
|
|
<span class="k">class</span> <span class="nc">MySink</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">COMImplementation</span><span class="p">):</span>
|
|
<span class="n">IMPLEMENT</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ICallFrameEvents</span>
|
|
|
|
<span class="k">def</span> <span class="nf">OnCall</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">this</span><span class="p">,</span> <span class="n">frame</span><span class="p">):</span>
|
|
<span class="n">ifname</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PWSTR</span><span class="p">()</span>
|
|
<span class="n">methodname</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PWSTR</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Hello from python sink !"</span><span class="p">)</span>
|
|
<span class="n">frame</span><span class="o">.</span><span class="n">GetNames</span><span class="p">(</span><span class="n">ifname</span><span class="p">,</span> <span class="n">methodname</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Catching call to <</span><span class="si">{0}</span><span class="s2">.</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ifname</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">methodname</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="n">param0info</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">CALLFRAMEPARAMINFO</span><span class="p">()</span>
|
|
<span class="n">param0</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">Variant</span><span class="p">()</span>
|
|
<span class="n">frame</span><span class="o">.</span><span class="n">GetParamInfo</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">param0info</span><span class="p">)</span>
|
|
<span class="n">frame</span><span class="o">.</span><span class="n">GetParam</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">param0</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Info about parameters 0:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">sprint</span><span class="p">(</span><span class="n">param0info</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="s2">" * param0info"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"param0 value = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">param0</span><span class="o">.</span><span class="n">aslong</span><span class="p">))</span>
|
|
<span class="n">frame</span><span class="o">.</span><span class="n">Invoke</span><span class="p">(</span><span class="n">real_firewall</span><span class="p">)</span>
|
|
<span class="n">frame</span><span class="o">.</span><span class="n">SetReturnValue</span><span class="p">(</span><span class="mi">1234</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Leaving the sink !"</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="mi">0</span>
|
|
|
|
<span class="c1"># Create and register our ICallFrameEvents sink</span>
|
|
<span class="n">xsink</span> <span class="o">=</span> <span class="n">MySink</span><span class="p">()</span>
|
|
<span class="n">interceptor</span><span class="o">.</span><span class="n">RegisterSink</span><span class="p">(</span><span class="n">xsink</span><span class="p">)</span>
|
|
<span class="c1"># Create the INetFwPolicy2 interceptor interface</span>
|
|
<span class="n">fakefirewall</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="p">()</span>
|
|
<span class="n">interceptor</span><span class="o">.</span><span class="n">QueryInterface</span><span class="p">(</span><span class="n">fakefirewall</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="n">fakefirewall</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Calling one of the INetFwPolicy2 function for testing</span>
|
|
<span class="c1"># Testing on https://msdn.microsoft.com/en-us/library/windows/desktop/aa365316(v=vs.85).aspx</span>
|
|
<span class="n">enabled</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VARIANT_BOOL</span><span class="p">()</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">fakefirewall</span><span class="o">.</span><span class="n">get_FirewallEnabled</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="n">enabled</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"return value = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"firewall enabled = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">enabled</span><span class="p">))</span>
|
|
|
|
<span class="c1"># Test a function taking a POINTER(ICallFrameEvents) (PTR to interface)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Testing a function taking a PTR to a COM interface"</span><span class="p">)</span>
|
|
<span class="n">sink2</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ICallFrameEvents</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Before call: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">((</span><span class="n">sink2</span><span class="p">,</span> <span class="n">sink2</span><span class="o">.</span><span class="n">value</span><span class="p">)))</span>
|
|
<span class="n">interceptor</span><span class="o">.</span><span class="n">GetRegisteredSink</span><span class="p">(</span><span class="n">sink2</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"After call: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">((</span><span class="n">sink2</span><span class="p">,</span> <span class="n">sink2</span><span class="o">.</span><span class="n">value</span><span class="p">)))</span>
|
|
|
|
|
|
<span class="c1"># (cmd) python samples\com\icallinterceptor.py</span>
|
|
<span class="c1"># Hello from python sink !</span>
|
|
<span class="c1"># Catching call to <INetFwPolicy2.FirewallEnabled></span>
|
|
<span class="c1"># Info about parameters 0:</span>
|
|
<span class="c1"># * param0info.fIn -> 0x1</span>
|
|
<span class="c1"># * param0info.fOut -> 0x0</span>
|
|
<span class="c1"># * param0info.stackOffset -> 0x4L</span>
|
|
<span class="c1"># * param0info.cbParam -> 0x4L</span>
|
|
<span class="c1"># param0 value = 2</span>
|
|
<span class="c1"># Leaving the sink !</span>
|
|
<span class="c1"># return value = 1234</span>
|
|
<span class="c1"># firewall enabled = VARIANT_BOOL(True)</span>
|
|
<span class="c1"># Testing a function taking a PTR to a COM interface</span>
|
|
<span class="c1"># Before call: (<ICallFrameEvents object at 0x066EF3F0>, None)</span>
|
|
<span class="c1"># After call: (<ICallFrameEvents object at 0x066EF3F0>, 107934504)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python com\icallinterceptor.py
|
|
Hello from python sink !
|
|
Catching call to <INetFwPolicy2.FirewallEnabled>
|
|
Info about parameters 0:
|
|
* param0info.fIn -> 0x1
|
|
* param0info.fOut -> 0x0
|
|
* param0info.stackOffset -> 0x4L
|
|
* param0info.cbParam -> 0x4L
|
|
param0 value = 2
|
|
Leaving the sink !
|
|
return value = 1234
|
|
firewall enabled = VARIANT_BOOL(True)
|
|
Testing a function taking a PTR to a COM interface
|
|
Before call: (<ICallFrameEvents object at 0x066EF3F0>, None)
|
|
After call: (<ICallFrameEvents object at 0x066EF3F0>, 107934504)
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-crypto">
|
|
<h2>18.17. <a class="reference internal" href="crypto.html#module-windows.crypto" title="windows.crypto"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.crypto</span></code></a><a class="headerlink" href="#windows-crypto" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="encryption-demo">
|
|
<span id="sample-crypto-encryption"></span><h3>18.17.1. Encryption demo<a class="headerlink" href="#encryption-demo" title="Permalink to this headline">¶</a></h3>
|
|
<p>This sample is a working POC able to generate key-pair, encrypt and decrypt file.</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
<span class="kn">import</span> <span class="nn">getpass</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.crypto</span> <span class="k">as</span> <span class="nn">crypto</span>
|
|
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">winproxy</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.crypto.generation</span> <span class="k">as</span> <span class="nn">gencrypt</span>
|
|
|
|
<span class="c1"># http://stackoverflow.com/questions/1461272/basic-questions-on-microsoft-cryptoapi</span>
|
|
|
|
<span class="k">def</span> <span class="nf">crypt</span><span class="p">(</span><span class="n">src</span><span class="p">,</span> <span class="n">dst</span><span class="p">,</span> <span class="n">certs</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="sd">"""Encrypt the content of 'src' file with the certifacts in 'certs' into 'dst'"""</span>
|
|
<span class="c1"># Open every certificates in the certs list</span>
|
|
<span class="n">certlist</span> <span class="o">=</span> <span class="p">[</span><span class="n">crypto</span><span class="o">.</span><span class="n">Certificate</span><span class="o">.</span><span class="n">from_file</span><span class="p">(</span><span class="n">x</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">certs</span><span class="p">]</span>
|
|
<span class="c1"># Encrypt the content of 'src' with all the public keys(certs)</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">encrypt</span><span class="p">(</span><span class="n">certlist</span><span class="p">,</span> <span class="n">src</span><span class="o">.</span><span class="n">read</span><span class="p">())</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Encryption done. Result:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
<span class="c1"># Write the result in 'dst'</span>
|
|
<span class="n">dst</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
|
|
<span class="n">dst</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
|
<span class="n">src</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
|
|
|
|
<span class="k">def</span> <span class="nf">decrypt</span><span class="p">(</span><span class="n">src</span><span class="p">,</span> <span class="n">pfxfile</span><span class="p">,</span> <span class="n">password</span><span class="p">,</span> <span class="n">outfile</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="sd">"""Decrypt the content of 'src' with the private key in 'pfxfile'. the 'pfxfile' is open using the 'password'"""</span>
|
|
<span class="c1"># Open the 'pfx' with the given password</span>
|
|
<span class="k">if</span> <span class="n">password</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="n">password</span> <span class="o">=</span> <span class="n">getpass</span><span class="o">.</span><span class="n">getpass</span><span class="p">()</span>
|
|
<span class="n">pfx</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">import_pfx</span><span class="p">(</span><span class="n">pfxfile</span><span class="o">.</span><span class="n">read</span><span class="p">(),</span> <span class="n">password</span><span class="p">)</span>
|
|
<span class="c1"># Decrypt the content of the file</span>
|
|
<span class="n">decrypted</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">decrypt</span><span class="p">(</span><span class="n">pfx</span><span class="p">,</span> <span class="n">src</span><span class="o">.</span><span class="n">read</span><span class="p">())</span>
|
|
<span class="k">if</span> <span class="n">outfile</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="sa">u</span><span class="s2">"Result = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">decrypted</span><span class="p">))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="s2">"wb"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">decrypted</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">decrypted</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">sign</span><span class="p">(</span><span class="n">src</span><span class="p">,</span> <span class="n">pfxfile</span><span class="p">,</span> <span class="n">password</span><span class="p">,</span> <span class="n">outfile</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">password</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="n">password</span> <span class="o">=</span> <span class="n">getpass</span><span class="o">.</span><span class="n">getpass</span><span class="p">()</span>
|
|
<span class="n">pfx</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">import_pfx</span><span class="p">(</span><span class="n">pfxfile</span><span class="o">.</span><span class="n">read</span><span class="p">(),</span> <span class="n">password</span><span class="p">)</span>
|
|
<span class="c1"># Decrypt the content of the file</span>
|
|
<span class="n">certs</span> <span class="o">=</span> <span class="n">pfx</span><span class="o">.</span><span class="n">certs</span>
|
|
<span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">certs</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">1</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"PFX containing exactly one certificate expected for signature"</span><span class="p">)</span>
|
|
<span class="n">cert</span> <span class="o">=</span> <span class="n">certs</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="n">signed</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">sign</span><span class="p">(</span><span class="n">cert</span><span class="p">,</span> <span class="n">src</span><span class="o">.</span><span class="n">read</span><span class="p">())</span>
|
|
<span class="k">if</span> <span class="n">outfile</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="sa">u</span><span class="s2">"Result = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">signed</span><span class="p">))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outfile</span><span class="p">,</span> <span class="s2">"wb"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">signed</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">signed</span>
|
|
|
|
<span class="n">PFW_TMP_KEY_CONTAINER</span> <span class="o">=</span> <span class="s2">"PythonForWindowsTMPContainer"</span>
|
|
|
|
<span class="k">def</span> <span class="nf">genkeys</span><span class="p">(</span><span class="n">common_name</span><span class="p">,</span> <span class="n">pfxpassword</span><span class="p">,</span> <span class="n">outname</span><span class="p">,</span> <span class="n">keysize</span><span class="o">=</span><span class="mi">2048</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
|
|
<span class="sd">"""Generate a SHA256/RSA key pair. A self-signed certificate with 'common_name' is stored as 'outname'.cer.</span>
|
|
<span class="sd"> The private key is stored in 'outname'.pfx protected with 'pfxpassword'"""</span>
|
|
<span class="n">cert_store</span> <span class="o">=</span> <span class="n">crypto</span><span class="o">.</span><span class="n">CertificateStore</span><span class="o">.</span><span class="n">new_in_memory</span><span class="p">()</span>
|
|
<span class="c1"># Create a TMP context that will hold our newly generated key-pair</span>
|
|
<span class="k">with</span> <span class="n">crypto</span><span class="o">.</span><span class="n">CryptContext</span><span class="p">(</span><span class="n">PFW_TMP_KEY_CONTAINER</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">PROV_RSA_FULL</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">retrycreate</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span> <span class="k">as</span> <span class="n">ctx</span><span class="p">:</span>
|
|
<span class="n">key</span> <span class="o">=</span> <span class="n">HCRYPTKEY</span><span class="p">()</span>
|
|
<span class="n">keysize_flags</span> <span class="o">=</span> <span class="n">keysize</span> <span class="o"><<</span> <span class="mi">16</span>
|
|
<span class="c1"># Generate a key-pair that is exportable</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CryptGenKey</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">AT_KEYEXCHANGE</span><span class="p">,</span> <span class="n">CRYPT_EXPORTABLE</span> <span class="o">|</span> <span class="n">keysize_flags</span><span class="p">,</span> <span class="n">key</span><span class="p">)</span>
|
|
<span class="c1"># It does NOT destroy the key-pair from the container,</span>
|
|
<span class="c1"># It only release the key handle</span>
|
|
<span class="c1"># https://msdn.microsoft.com/en-us/library/windows/desktop/aa379918(v=vs.85).aspx</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CryptDestroyKey</span><span class="p">(</span><span class="n">key</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Descrption of the key-container that will be used to generate the certificate</span>
|
|
<span class="n">KeyProvInfo</span> <span class="o">=</span> <span class="n">CRYPT_KEY_PROV_INFO</span><span class="p">()</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">pwszContainerName</span> <span class="o">=</span> <span class="n">PFW_TMP_KEY_CONTAINER</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">pwszProvName</span> <span class="o">=</span> <span class="kc">None</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">dwProvType</span> <span class="o">=</span> <span class="n">PROV_RSA_FULL</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">cProvParam</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">rgProvParam</span> <span class="o">=</span> <span class="kc">None</span>
|
|
<span class="c1">#KeyProvInfo.dwKeySpec = AT_SIGNATURE</span>
|
|
<span class="n">KeyProvInfo</span><span class="o">.</span><span class="n">dwKeySpec</span> <span class="o">=</span> <span class="n">AT_KEYEXCHANGE</span>
|
|
|
|
<span class="n">crypt_algo</span> <span class="o">=</span> <span class="n">CRYPT_ALGORITHM_IDENTIFIER</span><span class="p">()</span>
|
|
<span class="n">crypt_algo</span><span class="o">.</span><span class="n">pszObjId</span> <span class="o">=</span> <span class="n">szOID_RSA_SHA256RSA</span>
|
|
|
|
<span class="n">certif_name</span> <span class="o">=</span> <span class="s2">"CN=</span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">common_name</span><span class="p">)</span>
|
|
<span class="c1"># Generate a self-signed certificate based on the given key-container and signature algorithme</span>
|
|
<span class="n">certif</span> <span class="o">=</span> <span class="n">gencrypt</span><span class="o">.</span><span class="n">generate_selfsigned_certificate</span><span class="p">(</span><span class="n">certif_name</span><span class="p">,</span> <span class="n">key_info</span><span class="o">=</span><span class="n">KeyProvInfo</span><span class="p">,</span> <span class="n">signature_algo</span><span class="o">=</span><span class="n">crypt_algo</span><span class="p">)</span>
|
|
<span class="c1"># Add the newly created certificate to our TMP cert-store</span>
|
|
<span class="n">cert_store</span><span class="o">.</span><span class="n">add_certificate</span><span class="p">(</span><span class="n">certif</span><span class="p">)</span>
|
|
<span class="c1"># Generate a pfx from the TMP cert-store</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Password is <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">pfxpassword</span><span class="p">))</span>
|
|
<span class="n">pfx</span> <span class="o">=</span> <span class="n">gencrypt</span><span class="o">.</span><span class="n">generate_pfx</span><span class="p">(</span><span class="n">cert_store</span><span class="p">,</span> <span class="n">pfxpassword</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">outname</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="n">outname</span> <span class="o">=</span> <span class="n">common_name</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
|
|
|
|
<span class="c1"># Dump the certif (public key) and pfx (public + private keys)</span>
|
|
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outname</span> <span class="o">+</span> <span class="s2">".cer"</span><span class="p">,</span> <span class="s2">"wb"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
|
|
<span class="c1"># The encoded certif only contains the public key</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">certif</span><span class="o">.</span><span class="n">encoded</span><span class="p">)</span>
|
|
<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">outname</span> <span class="o">+</span> <span class="s2">".pfx"</span><span class="p">,</span> <span class="s2">"wb"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">pfx</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">certif</span><span class="p">)</span>
|
|
<span class="c1"># Destroy the TMP key container</span>
|
|
<span class="n">prov</span> <span class="o">=</span> <span class="n">HCRYPTPROV</span><span class="p">()</span>
|
|
<span class="n">winproxy</span><span class="o">.</span><span class="n">CryptAcquireContextW</span><span class="p">(</span><span class="n">prov</span><span class="p">,</span> <span class="n">PFW_TMP_KEY_CONTAINER</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">PROV_RSA_FULL</span><span class="p">,</span> <span class="n">CRYPT_DELETEKEYSET</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Openssl commands to check ce certif/pfx</span>
|
|
|
|
<span class="c1">## Read certificate info (.cer)</span>
|
|
<span class="c1">### openssl x509 -inform der -in {certif} -text -noout</span>
|
|
|
|
<span class="c1">## Read pfx info (ask to another password to encrypt Private key before print/export)</span>
|
|
<span class="c1">### openssl pkcs12 -info -in {pfx} -nokeys</span>
|
|
<span class="c1">## Read pfx info !!!! PRINT PRIVATE KEY !!!!</span>
|
|
<span class="c1">### openssl pkcs12 -info -in {pfx} -nodes</span>
|
|
|
|
<span class="c1">## Read ASN1 data</span>
|
|
<span class="c1">### openssl asn1parse -inform DER -in {file}</span>
|
|
|
|
|
|
|
|
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">subparsers</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">add_subparsers</span><span class="p">(</span><span class="n">description</span><span class="o">=</span><span class="s1">'valid subcommands'</span><span class="p">)</span>
|
|
|
|
<span class="n">cryptparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'crypt'</span><span class="p">)</span>
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">crypt</span><span class="p">)</span>
|
|
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'src'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'File to encrypt'</span><span class="p">)</span>
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'dst'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'wb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The encrypted file'</span><span class="p">)</span>
|
|
<span class="n">cryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'certs'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="nb">str</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'+'</span><span class="p">,</span>
|
|
<span class="n">help</span><span class="o">=</span><span class="s1">'List of certfile used to encrypt the src'</span><span class="p">)</span>
|
|
|
|
<span class="n">decryptparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'decrypt'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">decrypt</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'src'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'File to decrypt'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'pfxfile'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'PFX file to use'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--password'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Password of the PFX'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--outfile'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The outputfile default is print'</span><span class="p">)</span>
|
|
|
|
|
|
<span class="n">decryptparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'sign'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">sign</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'src'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'File to sign'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'pfxfile'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">FileType</span><span class="p">(</span><span class="s1">'rb'</span><span class="p">),</span> <span class="n">help</span><span class="o">=</span><span class="s1">'PFX file to use'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--password'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Password of the PFX'</span><span class="p">)</span>
|
|
<span class="n">decryptparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--outfile'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The outputfile default is print'</span><span class="p">)</span>
|
|
|
|
|
|
<span class="n">genkeysparse</span> <span class="o">=</span> <span class="n">subparsers</span><span class="o">.</span><span class="n">add_parser</span><span class="p">(</span><span class="s1">'genkey'</span><span class="p">,</span> <span class="n">formatter_class</span><span class="o">=</span><span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentDefaultsHelpFormatter</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">set_defaults</span><span class="p">(</span><span class="n">func</span><span class="o">=</span><span class="n">genkeys</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'common_name'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span> <span class="n">metavar</span><span class="o">=</span><span class="s1">'CommonName'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="s1">'DEFAULT'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'the common name of the certificate'</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'outname'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span><span class="n">help</span><span class="o">=</span><span class="s1">'The filename base for the generated files'</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--pfxpassword'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Password to protect the PFX'</span><span class="p">)</span>
|
|
<span class="n">genkeysparse</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--keysize'</span><span class="p">,</span> <span class="n">nargs</span><span class="o">=</span><span class="s1">'?'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="mi">2048</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The size of the RSA key'</span><span class="p">)</span>
|
|
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="n">res</span><span class="o">.</span><span class="n">func</span><span class="p">(</span><span class="o">**</span><span class="n">res</span><span class="o">.</span><span class="vm">__dict__</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Ouput:</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd λ) python crypto\encryption_demo.py genkey YOLOCERTIF mykey --pfxpassword MYPASSWORD
|
|
<CertificatContext "YOLOCERTIF" serial="1b a4 3e 17 f7 ed ec ab 4f f8 11 46 48 e9 29 25">
|
|
|
|
(cmd λ) ls
|
|
mykey.cer mykey.pfx
|
|
|
|
(cmd λ) echo|set /p="my secret message" > message.txt
|
|
|
|
(cmd λ) python crypto\encryption_demo.py crypt message.txt message.crypt mykey.cer
|
|
Encryption done. Result:
|
|
bytearray(b'0\x82\x01\x19\x06\t*\x86H\x86\xf7\r\x01\x07\x03\xa0\x82\x01\n0\x82\x01\x06\x02\x01\x001\x81\xc30\x81
|
|
\xc0\x02\x01\x000)0\x151\x130\x11\x06\x03U\x04\x03\x13\nYOLOCERTIF\x02\x10\x1b\xa4>\x17\xf7\xed\xec\xabO\xf8\x11
|
|
FH\xe9)%0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x04\x81\x80V\x89)\xf5\xaaM\x99cEA\x17^\xa2D~\x94\xe3\xf2\x1f
|
|
\x05Y\xc2\xbb\xb2\xbbYBpU6\x870\xce\xe7\xd2M{\xbb\xb9K\xa0\xf5\xe5\x93\xca\xedF\x80.x\xdc\xf2\x0c\xa6UO\x01\r\xaf
|
|
\xd0Z\xd9\xabnzR\xd4j=\xca\xc2RG\xcd\x11u\x82\x7f\x8c\xd8t\xb9\xf9\xe8%\xfal\xaaHPj;\xecKk]\t%\xfd\x91\xcc\xe0lWf
|
|
\xc6\x12x\x1am\xc8\x01t\xac\xa6\xf3#\x02\xd4J \x8eZ\xbb\x10W\xe1 0;\x06\t*\x86H\x86\xf7\r\x01\x07\x010\x14\x06\x08*
|
|
\x86H\x86\xf7\r\x03\x07\x04\x08\x14F\x04\xad\xed9\xed<\x80\x18\x80]6\xccTV\xbc\xb8*\x84QY!~\xb3\n\x1aV\xd4\rf\xd1n:')
|
|
|
|
(cmd λ) python crypto\encryption_demo.py decrypt --password BADPASS message.crypt mykey.pfx
|
|
Traceback (most recent call last):
|
|
File "..\samples\encryption_demo.py", line 103, in <module>
|
|
res.func(**res.__dict__)
|
|
File "..\samples\encryption_demo.py", line 26, in decrypt
|
|
pfx = crypto.import_pfx(pfxfile.read(), password)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\crypto\certificate.py", line 153, in import_pfx
|
|
cert_store = winproxy.PFXImportCertStore(pfx, password, flags)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\winproxy.py", line 1065, in PFXImportCertStore
|
|
return PFXImportCertStore.ctypes_function(pPFX, szPassword, dwFlags)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\winproxy.py", line 148, in perform_call
|
|
return self._cprototyped(*args)
|
|
File "c:\users\hakril\documents\work\pythonforwindows\windows\winproxy.py", line 69, in kernel32_error_check
|
|
raise WinproxyError(func_name)
|
|
windows.winproxy.error.WinproxyError: PFXImportCertStore: [Error 86] The specified network password is not correct.
|
|
|
|
(cmd λ) python crypto\encryption_demo.py decrypt --password MYPASSWORD message.crypt mykey.pfx
|
|
Result = <my secret message>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="certificate-demo">
|
|
<span id="sample-crypto-certificate"></span><h3>18.17.2. Certificate demo<a class="headerlink" href="#certificate-demo" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">hashlib</span>
|
|
<span class="kn">import</span> <span class="nn">base64</span>
|
|
<span class="kn">import</span> <span class="nn">windows.crypto</span>
|
|
|
|
<span class="n">windowscert</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">"""-----BEGIN CERTIFICATE-----</span>
|
|
<span class="s2">MIIFBDCCA+ygAwIBAgITMwAAAQZuwyXEMckYDgAAAAABBjANBgkqhkiG9w0BAQsF</span>
|
|
<span class="s2">ADCBhDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT</span>
|
|
<span class="s2">B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEuMCwGA1UE</span>
|
|
<span class="s2">AxMlTWljcm9zb2Z0IFdpbmRvd3MgUHJvZHVjdGlvbiBQQ0EgMjAxMTAeFw0xNjEw</span>
|
|
<span class="s2">MTEyMDM5MzFaFw0xODAxMTEyMDM5MzFaMHAxCzAJBgNVBAYTAlVTMRMwEQYDVQQI</span>
|
|
<span class="s2">EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv</span>
|
|
<span class="s2">ZnQgQ29ycG9yYXRpb24xGjAYBgNVBAMTEU1pY3Jvc29mdCBXaW5kb3dzMIIBIjAN</span>
|
|
<span class="s2">BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyWcaCYghNInk3ecpyu2uZ7LCV9QS</span>
|
|
<span class="s2">7GWYr41ufTkcL66ewHxlAoWjmkKG6W2Bp9BYYQok10iDeDGACE9Vjr6m4Jdh+YuN</span>
|
|
<span class="s2">RLxMnHC8JTGzk96CzmdBPAuUWdAcHNmTkIWQF6AXzsbBWsekQejvDBygAOCuIYh4</span>
|
|
<span class="s2">sBgNa5cjTxQc7Iyp9c7RxBmThV5BNFTOnSN6D9N8zU+ENgIZuyHxGvqzRdrhU4G4</span>
|
|
<span class="s2">Cg/h1CkI4TgeZQZCeUNPnWV6DMuvPCiqGEia5phOJZyENKND0Sx6eQZrYnuz1gMn</span>
|
|
<span class="s2">YaEnO+ggegtt4pWpqg8Ch0jNrkL1fb3Kzz7E34/K9dcTgaOymfF6qUKabQIDAQAB</span>
|
|
<span class="s2">o4IBgDCCAXwwHwYDVR0lBBgwFgYKKwYBBAGCNwoDBgYIKwYBBQUHAwMwHQYDVR0O</span>
|
|
<span class="s2">BBYEFBEciVg/vsVmKtr/hmHt7KM6g8lSMFIGA1UdEQRLMEmkRzBFMQ0wCwYDVQQL</span>
|
|
<span class="s2">EwRNT1BSMTQwMgYDVQQFEysyMjk4NzkrMTQ3NDQ5YmUtMTVhOC00ZWJhLTkzZjMt</span>
|
|
<span class="s2">ZDExMGE1YzQ1NTUyMB8GA1UdIwQYMBaAFKkpAjmOFsSXeM2Q+Z5PmuF8Va9TMFQG</span>
|
|
<span class="s2">A1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv</span>
|
|
<span class="s2">Y3JsL01pY1dpblByb1BDQTIwMTFfMjAxMS0xMC0xOS5jcmwwYQYIKwYBBQUHAQEE</span>
|
|
<span class="s2">VTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3Bz</span>
|
|
<span class="s2">L2NlcnRzL01pY1dpblByb1BDQTIwMTFfMjAxMS0xMC0xOS5jcnQwDAYDVR0TAQH/</span>
|
|
<span class="s2">BAIwADANBgkqhkiG9w0BAQsFAAOCAQEAvYC1iawgKoxXAotQXaN0lj1J5VX01/un</span>
|
|
<span class="s2">7JybZF4sPMG4acoFT85Ao5U6TK5ATPB7yPUulAivp8908DwTGqN+Ju6iH+UkvAb+</span>
|
|
<span class="s2">a/WcHVEMxQXK5eOFNE6yekUArBGbMNWlTFrpwklmVTnL9R+4aApTEe6ITT1KLDio</span>
|
|
<span class="s2">5uFw98n5Sqgh+In073czyiTG7MVhBexbOfhgnciXoufeyhwy1pYgjouSqSQZs4bj</span>
|
|
<span class="s2">cUwQTwGlS2Gd5a+3nblhjn+QhSszIo1K5n1udLPFWtn29BuGlSrtTXPv5OCfNtLO</span>
|
|
<span class="s2">l2ec6CyjDQc6HcQBNCsbJVq6qGtQbYNE+ih+KhIU4tO5jf25xthf2g==</span>
|
|
<span class="s2">-----END CERTIFICATE-----"""</span>
|
|
|
|
|
|
<span class="n">raw_cert</span> <span class="o">=</span> <span class="n">base64</span><span class="o">.</span><span class="n">decodestring</span><span class="p">(</span><span class="sa">b</span><span class="s2">""</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">windowscert</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="sa">b</span><span class="s2">"</span><span class="se">\n</span><span class="s2">"</span><span class="p">)[</span><span class="mi">1</span><span class="p">:</span><span class="o">-</span><span class="mi">1</span><span class="p">]))</span>
|
|
<span class="n">cert</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">Certificate</span><span class="o">.</span><span class="n">from_buffer</span><span class="p">(</span><span class="n">raw_cert</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Analysing certificate: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * issuer: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">issuer</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * raw_serial: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">raw_serial</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * serial: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">serial</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * encoded start: <</span><span class="si">{0!r}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="o">.</span><span class="n">encoded</span><span class="p">[:</span><span class="mi">20</span><span class="p">]))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">chains</span> <span class="o">=</span> <span class="n">cert</span><span class="o">.</span><span class="n">chains</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"This certificate has </span><span class="si">{0}</span><span class="s2"> certificate chain(s)"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">chains</span><span class="p">)))</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">chain</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">chains</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Chain </span><span class="si">{0}</span><span class="s2">:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">ccert</span> <span class="ow">in</span> <span class="n">chain</span><span class="p">:</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" </span><span class="si">{0}</span><span class="s2">:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ccert</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * issuer: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ccert</span><span class="o">.</span><span class="n">issuer</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="n">cert_to_verif</span> <span class="o">=</span> <span class="n">ccert</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for <</span><span class="si">{0}</span><span class="s2">> in trusted certificates"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert_to_verif</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="n">root_store</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">CertificateStore</span><span class="o">.</span><span class="n">from_system_store</span><span class="p">(</span><span class="s2">"Root"</span><span class="p">)</span>
|
|
<span class="c1"># This is not the correct way verify the validity of a certificate chain.</span>
|
|
<span class="c1"># I would say that if the goal is to verify the signature of the certificate: use wintrust.</span>
|
|
<span class="c1"># (or maybe CertVerifyCertificateChainPolicy : https://msdn.microsoft.com/en-us/library/windows/desktop/aa377163(v=vs.85).aspx)</span>
|
|
<span class="n">matchs</span> <span class="o">=</span> <span class="p">[</span><span class="n">c</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="n">root_store</span><span class="o">.</span><span class="n">certs</span> <span class="k">if</span> <span class="n">c</span> <span class="o">==</span> <span class="n">cert_to_verif</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"matches = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">matchs</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">matchs</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Found it !"</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Not found :("</span><span class="p">)</span>
|
|
|
|
<span class="c1">## Extract certificates of a PE file</span>
|
|
<span class="c1">## This code is not a fixed API and the current state of my tests</span>
|
|
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span> <span class="p">(</span><span class="s2">"== PE Analysis =="</span><span class="p">)</span>
|
|
<span class="n">TARGET_FILE</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"C:\windows\system32\ntdll.dll"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Target sha1 = <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">hashlib</span><span class="o">.</span><span class="n">sha1</span><span class="p">(</span><span class="nb">open</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">,</span> <span class="s2">"rb"</span><span class="p">)</span><span class="o">.</span><span class="n">read</span><span class="p">())</span><span class="o">.</span><span class="n">hexdigest</span><span class="p">()))</span>
|
|
<span class="n">cryptobj</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">CryptObject</span><span class="p">(</span><span class="n">TARGET_FILE</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Analysing </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cryptobj</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"File has </span><span class="si">{0}</span><span class="s2"> signer(s):"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">nb_signer</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">signer</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">signers</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Signer </span><span class="si">{0}</span><span class="s2">:"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Issuer: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">signer</span><span class="o">.</span><span class="n">Issuer</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * HashAlgorithme: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">signer</span><span class="o">.</span><span class="n">HashAlgorithm</span><span class="o">.</span><span class="n">pszObjId</span><span class="p">))</span>
|
|
<span class="n">cert</span> <span class="o">=</span> <span class="n">cryptobj</span><span class="o">.</span><span class="n">cert_store</span><span class="o">.</span><span class="n">find</span><span class="p">(</span><span class="n">signer</span><span class="o">.</span><span class="n">Issuer</span><span class="p">,</span> <span class="n">signer</span><span class="o">.</span><span class="n">SerialNumber</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Certificate: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cert</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"File embdeds </span><span class="si">{0}</span><span class="s2"> certificate(s):"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">nb_cert</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">certificate</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">cryptobj</span><span class="o">.</span><span class="n">crypt_msg</span><span class="o">.</span><span class="n">certs</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">) </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">,</span> <span class="n">certificate</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python crypto\certificate.py
|
|
Analysing certificate: <Certificate "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
|
|
* name: <Microsoft Windows>
|
|
* issuer: <Microsoft Windows Production PCA 2011>
|
|
* raw_serial: <[51, 0, 0, 1, 6, 110, 195, 37, 196, 49, 201, 24, 14, 0, 0, 0, 0, 1, 6]>
|
|
* serial: <33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06>
|
|
* encoded start: <bytearray(b'0\x82\x05\x040\x82\x03\xec\xa0\x03\x02\x01\x02\x02\x133\x00\x00\x01\x06')>
|
|
|
|
This certificate has 1 certificate chain(s)
|
|
Chain 0:
|
|
<Certificate "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">:
|
|
* issuer: <Microsoft Windows Production PCA 2011>
|
|
<Certificate "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">:
|
|
* issuer: <Microsoft Root Certificate Authority 2010>
|
|
<Certificate "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">:
|
|
* issuer: <Microsoft Root Certificate Authority 2010>
|
|
|
|
Looking for <Microsoft Root Certificate Authority 2010> in trusted certificates
|
|
matches = [<Certificate "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">]
|
|
Found it !
|
|
|
|
== PE Analysis ==
|
|
Target sha1 = <339e4c236e716d4b6f6b10359c425eb3d1478df7>
|
|
Analysing <CryptObject "C:\windows\system32\ntdll.dll" content_type=CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED(0xaL)>
|
|
File has 1 signer(s):
|
|
Signer 0:
|
|
* Issuer: bytearray(b'0\x81\x841\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\nWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\n\x13\x15Microsoft Corporation1.0,\x06\x03U\x04\x03\x13%Microsoft Windows Production PCA 2011')
|
|
* HashAlgorithme: 2.16.840.1.101.3.4.2.1
|
|
* Certificate: <Certificate "Microsoft Windows" serial="33 00 00 01 73 30 31 07 26 65 b8 b9 b3 00 00 00 00 01 73">
|
|
|
|
File embdeds 2 certificate(s):
|
|
* 0) <Certificate "Microsoft Windows" serial="33 00 00 01 73 30 31 07 26 65 b8 b9 b3 00 00 00 00 01 73">
|
|
* 1) <Certificate "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-alpc">
|
|
<h2>18.18. <a class="reference internal" href="alpc.html#module-windows.alpc" title="windows.alpc"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.alpc</span></code></a><a class="headerlink" href="#windows-alpc" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="simple-alpc-communication">
|
|
<span id="sample-alpc"></span><h3>18.18.1. simple alpc communication<a class="headerlink" href="#simple-alpc-communication" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">multiprocessing</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.alpc</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="kn">import</span> <span class="n">LPC_CONNECTION_REQUEST</span><span class="p">,</span> <span class="n">LPC_REQUEST</span>
|
|
|
|
<span class="n">PORT_NAME</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"\RPC Control\PythonForWindowsPORT"</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">alpc_server</span><span class="p">():</span>
|
|
<span class="n">server</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcServer</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">)</span> <span class="c1"># Create the ALPC Port</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] PORT <</span><span class="si">{0}</span><span class="s2">> CREATED"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">))</span>
|
|
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span> <span class="c1"># Wait for a message</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Message type = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Received data: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="k">assert</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_CONNECTION_REQUEST</span> <span class="c1"># Check that message is a connection request</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Connection request"</span><span class="p">)</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">accept_connection</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span> <span class="c1"># Wait for a real message</span>
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Received message: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] Message type = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">type</span><span class="p">))</span>
|
|
<span class="k">assert</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_REQUEST</span>
|
|
<span class="c1"># We can reply by two ways:</span>
|
|
<span class="c1"># - Send the same message with modified data</span>
|
|
<span class="c1"># - Recreate a Message and copy the MessageId</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"REQUEST '</span><span class="si">{0}</span><span class="s2">' DONE"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">)</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">alpc_client</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Client pid = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="c1"># Creation an 'AlpcClient' with a port name will connect to the port with an empty message</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcClient</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Connected: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">client</span><span class="p">))</span>
|
|
<span class="c1"># Send a message / wait for the response</span>
|
|
<span class="n">response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="s2">"Hello world !"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Response: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="c1"># You can also send message without waiting for a response with 'client.send'</span>
|
|
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">proc</span> <span class="o">=</span> <span class="n">multiprocessing</span><span class="o">.</span><span class="n">Process</span><span class="p">(</span><span class="n">target</span><span class="o">=</span><span class="n">alpc_server</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="p">())</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">start</span><span class="p">()</span>
|
|
<span class="kn">import</span> <span class="nn">time</span><span class="p">;</span> <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.5</span><span class="p">)</span>
|
|
<span class="n">alpc_client</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"BYE"</span><span class="p">)</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">terminate</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python alpc\simple_alpc.py
|
|
[SERV] PORT <\RPC Control\PythonForWindowsPORT> CREATED
|
|
Client pid = 15840
|
|
[SERV] Message type = 0x300a
|
|
[SERV] Received data: <>
|
|
[SERV] Connection request
|
|
[CLIENT] Connected: <windows.alpc.AlpcClient object at 0x06919290>
|
|
|
|
[SERV] Received message: <Hello world !>
|
|
[SERV] Message type = 0x3001
|
|
[CLIENT] Response: <REQUEST 'Hello world !' DONE>
|
|
BYE
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="advanced-alpc-communication">
|
|
<span id="sample-advanced-alpc"></span><h3>18.18.2. advanced alpc communication<a class="headerlink" href="#advanced-alpc-communication" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">multiprocessing</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.alpc</span>
|
|
<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="kn">import</span> <span class="n">LPC_CONNECTION_REQUEST</span><span class="p">,</span> <span class="n">LPC_REQUEST</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">tempfile</span>
|
|
|
|
<span class="n">PORT_NAME</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"\RPC Control\PythonForWindowsPORT_2"</span>
|
|
<span class="n">PORT_CONTEXT</span> <span class="o">=</span> <span class="mh">0x11223344</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">full_alpc_server</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"server pid = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="n">server</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcServer</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] PORT <</span><span class="si">{0}</span><span class="s2">> CREATED"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">))</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] == Message received =="</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_CONNECTION_REQUEST</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * ALPC connection request: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"Connection message response"</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">accept_connection</span><span class="p">(</span><span class="n">msg</span><span class="p">,</span> <span class="n">port_context</span><span class="o">=</span><span class="n">PORT_CONTEXT</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Expected connection"</span><span class="p">)</span>
|
|
|
|
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">server</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[SERV] == Message received =="</span><span class="p">)</span>
|
|
<span class="c1"># print(" * Data: {0}".format(msg.data))</span>
|
|
<span class="c1"># print("[SERV] RECV Message type = {0:#x}".format(msg.type))</span>
|
|
<span class="c1"># print("[SERV] RECV Message Valid ATTRS = {0:#x}".format(msg.attributes.ValidAttributes))</span>
|
|
<span class="c1"># print("[SERV] RECV Message ATTRS = {0:#x}".format(msg.attributes.AllocatedAttributes))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span> <span class="o">==</span> <span class="n">LPC_REQUEST</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * ALPC request: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * view_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_is_valid</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">view_is_valid</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message view attribute:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="p">,</span> <span class="s2">" - VIEW"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
<span class="n">view_data</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Reading view content: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">view_data</span><span class="p">))</span>
|
|
<span class="c1"># Needed in Win7 - TODO: why is there a different behavior ?</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">-=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_VIEW_ATTRIBUTE</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * security_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">security_is_valid</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * handle_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_is_valid</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_is_valid</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Handle</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message handle attribute:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="p">,</span> <span class="s2">" - HANDLE"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">ObjectType</span> <span class="o">==</span> <span class="mi">1</span><span class="p">:</span>
|
|
<span class="n">f</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_file_from_handle</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Handle</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - File: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">f</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - content: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">f</span><span class="o">.</span><span class="n">read</span><span class="p">()))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - unknow object type == </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">ObjectType</span><span class="p">))</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">-=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_HANDLE_ATTRIBUTE</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * context_is_valid <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">context_is_valid</span><span class="p">))</span>
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">context_is_valid</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message context attribute:"</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">context_attribute</span><span class="p">,</span> <span class="s2">" - CTX"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
|
|
<span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">&</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_TOKEN_ATTRIBUTE</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * message token attribute:"</span><span class="p">)</span>
|
|
<span class="n">token_struct</span> <span class="o">=</span> <span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">get_attribute</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_TOKEN_ATTRIBUTE</span><span class="p">)</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">token_struct</span><span class="p">,</span> <span class="s2">" - TOKEN"</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
|
|
<span class="c1"># We can reply by to way:</span>
|
|
<span class="c1"># - Send the same message with modified data</span>
|
|
<span class="c1"># - Recreate a Message and copy the MessageId</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"REQUEST '</span><span class="si">{0}</span><span class="s2">' DONE"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">)</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">stdout</span><span class="o">.</span><span class="n">flush</span><span class="p">()</span>
|
|
<span class="n">server</span><span class="o">.</span><span class="n">send</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="nb">print</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Unexpected message type <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">type</span> <span class="o">&</span> <span class="mh">0xfff</span><span class="p">))</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">send_message_with_handle</span><span class="p">(</span><span class="n">client</span><span class="p">):</span>
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[Client] == Sending a message with a handle =="</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Craft a file with some data</span>
|
|
<span class="n">f</span> <span class="o">=</span> <span class="n">tempfile</span><span class="o">.</span><span class="n">NamedTemporaryFile</span><span class="p">()</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="s2">"Tempfile data <3"</span><span class="p">)</span>
|
|
<span class="n">f</span><span class="o">.</span><span class="n">seek</span><span class="p">(</span><span class="mi">0</span><span class="p">)</span>
|
|
|
|
<span class="c1"># New message with a Handle</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">()</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_HANDLE_ATTRIBUTE</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Flags</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">Handle</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">get_handle_from_file</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">ObjectType</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">handle_attribute</span><span class="o">.</span><span class="n">DesiredAccess</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"some message with a file"</span>
|
|
<span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">send_message_with_view</span><span class="p">(</span><span class="n">client</span><span class="p">):</span>
|
|
<span class="nb">print</span> <span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[Client] == Sending a message with a view =="</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Create View</span>
|
|
<span class="n">section</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">create_port_section</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mh">0x4000</span><span class="p">)</span>
|
|
<span class="n">view</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">map_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="mi">0</span><span class="p">],</span> <span class="mh">0x4000</span><span class="p">)</span>
|
|
|
|
<span class="c1"># New message with a View</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">(</span><span class="mh">0x2000</span><span class="p">)</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_VIEW_ATTRIBUTE</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">Flags</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewBase</span> <span class="o">=</span> <span class="n">view</span><span class="o">.</span><span class="n">ViewBase</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">SectionHandle</span> <span class="o">=</span> <span class="n">view</span><span class="o">.</span><span class="n">SectionHandle</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewSize</span> <span class="o">=</span> <span class="mh">0x4000</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"some message with a view"</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">view</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">,</span> <span class="s2">"The content of the view :)</span><span class="se">\x00</span><span class="s2">"</span><span class="p">)</span>
|
|
<span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">alpc_client</span><span class="p">():</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Client pid = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">))</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcClient</span><span class="p">()</span>
|
|
|
|
<span class="c1"># You can create a non-connected AlpcClient and send a custom</span>
|
|
<span class="c1"># 'AlpcMessage' for complexe alpc port connection.</span>
|
|
<span class="n">connect_message</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">()</span>
|
|
<span class="n">connect_message</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"Connection request client message"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] == Connecting to port =="</span><span class="p">)</span>
|
|
<span class="n">connect_response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">connect_to_port</span><span class="p">(</span><span class="n">PORT_NAME</span><span class="p">,</span> <span class="n">connect_message</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Connected with response: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">connect_response</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
|
|
<span class="c1"># AlpcClient send/recv/send_receive methods accept both string or</span>
|
|
<span class="c1"># AlpcMessage for complexe message.</span>
|
|
<span class="nb">print</span><span class="s2">""</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] == Sending a message =="</span><span class="p">)</span>
|
|
<span class="n">msg</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">alpc</span><span class="o">.</span><span class="n">AlpcMessage</span><span class="p">()</span>
|
|
<span class="n">msg</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="s2">"Complex Message 1"</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Sending Message <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="n">response</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">send_receive</span><span class="p">(</span><span class="n">msg</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] Server response: <</span><span class="si">{0}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[CLIENT] RESP Message Valid ATTRS = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">response</span><span class="o">.</span><span class="n">valid_attributes</span><span class="p">))</span>
|
|
|
|
<span class="n">send_message_with_handle</span><span class="p">(</span><span class="n">client</span><span class="p">)</span>
|
|
<span class="n">send_message_with_view</span><span class="p">(</span><span class="n">client</span><span class="p">)</span>
|
|
<span class="n">sys</span><span class="o">.</span><span class="n">stdout</span><span class="o">.</span><span class="n">flush</span><span class="p">()</span>
|
|
|
|
|
|
<span class="k">if</span> <span class="vm">__name__</span> <span class="o">==</span> <span class="s2">"__main__"</span><span class="p">:</span>
|
|
<span class="n">proc</span> <span class="o">=</span> <span class="n">multiprocessing</span><span class="o">.</span><span class="n">Process</span><span class="p">(</span><span class="n">target</span><span class="o">=</span><span class="n">full_alpc_server</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="p">())</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">start</span><span class="p">()</span>
|
|
<span class="kn">import</span> <span class="nn">time</span><span class="p">;</span> <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.5</span><span class="p">)</span>
|
|
<span class="n">alpc_client</span><span class="p">()</span>
|
|
<span class="kn">import</span> <span class="nn">time</span><span class="p">;</span> <span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mf">0.5</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"BYE"</span><span class="p">)</span>
|
|
<span class="n">proc</span><span class="o">.</span><span class="n">terminate</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">alpc</span>\<span class="n">advanced_alpc</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">server</span> <span class="n">pid</span> <span class="o">=</span> <span class="mi">2300</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="n">PORT</span> <span class="o"><</span>\<span class="n">RPC</span> <span class="n">Control</span>\<span class="n">PythonForWindowsPORT_2</span><span class="o">></span> <span class="n">CREATED</span>
|
|
<span class="n">Client</span> <span class="n">pid</span> <span class="o">=</span> <span class="mi">14848</span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="o">==</span> <span class="n">Connecting</span> <span class="n">to</span> <span class="n">port</span> <span class="o">==</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">connection</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">Connection</span> <span class="n">request</span> <span class="n">client</span> <span class="n">message</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="n">Connected</span> <span class="k">with</span> <span class="n">response</span><span class="p">:</span> <span class="o"><</span><span class="n">Connection</span> <span class="n">message</span> <span class="n">response</span><span class="o">></span>
|
|
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="o">==</span> <span class="n">Sending</span> <span class="n">a</span> <span class="n">message</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">Sending</span> <span class="n">Message</span> <span class="o"><</span><span class="n">Complex</span> <span class="n">Message</span> <span class="mi">1</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">Complex</span> <span class="n">Message</span> <span class="mi">1</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">view_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">security_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">handle_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">context_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">context</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">PortContext</span> <span class="o">-></span> <span class="mh">0x11223344</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageContext</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">Sequence</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">CallbackId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">token</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">TokenId</span> <span class="o">-></span> <span class="mh">0x4101ef8e</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">AuthenticationId</span> <span class="o">-></span> <span class="mh">0x54177</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">ModifiedId</span> <span class="o">-></span> <span class="mh">0x4077ab89</span><span class="n">L</span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="n">Server</span> <span class="n">response</span><span class="p">:</span> <span class="o"><</span><span class="n">REQUEST</span> <span class="s1">'Complex Message 1'</span> <span class="n">DONE</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">CLIENT</span><span class="p">]</span> <span class="n">RESP</span> <span class="n">Message</span> <span class="n">Valid</span> <span class="n">ATTRS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ALPC_MESSAGE_CONTEXT_ATTRIBUTE</span><span class="p">(</span><span class="mh">0x20000000</span><span class="n">L</span><span class="p">)]</span>
|
|
|
|
<span class="p">[</span><span class="n">Client</span><span class="p">]</span> <span class="o">==</span> <span class="n">Sending</span> <span class="n">a</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">handle</span> <span class="o">==</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">some</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">file</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">view_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">security_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">handle_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">handle</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">Flags</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">Handle</span> <span class="o">-></span> <span class="mh">0x2cc</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">ObjectType</span> <span class="o">-></span> <span class="mh">0x1</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">HANDLE</span><span class="o">.</span><span class="n">DesiredAccess</span> <span class="o">-></span> <span class="mh">0x13019f</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">File</span><span class="p">:</span> <span class="o"><</span><span class="nb">open</span> <span class="n">file</span> <span class="s1">'<fdopen>'</span><span class="p">,</span> <span class="n">mode</span> <span class="s1">'r'</span> <span class="n">at</span> <span class="mh">0x049ECA18</span><span class="o">></span>
|
|
<span class="o">-</span> <span class="n">content</span><span class="p">:</span> <span class="o"><</span><span class="n">Tempfile</span> <span class="n">data</span> <span class="o"><</span><span class="mi">3</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">context_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">context</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">PortContext</span> <span class="o">-></span> <span class="mh">0x11223344</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageContext</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">Sequence</span> <span class="o">-></span> <span class="mh">0x2</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">CallbackId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">token</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">TokenId</span> <span class="o">-></span> <span class="mh">0x4101ef8e</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">AuthenticationId</span> <span class="o">-></span> <span class="mh">0x54177</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">ModifiedId</span> <span class="o">-></span> <span class="mh">0x4077ab89</span><span class="n">L</span>
|
|
|
|
<span class="p">[</span><span class="n">Client</span><span class="p">]</span> <span class="o">==</span> <span class="n">Sending</span> <span class="n">a</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">view</span> <span class="o">==</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="o">*</span> <span class="n">ALPC</span> <span class="n">request</span><span class="p">:</span> <span class="o"><</span><span class="n">some</span> <span class="n">message</span> <span class="k">with</span> <span class="n">a</span> <span class="n">view</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">view_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">view</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">Flags</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">SectionHandle</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">ViewBase</span> <span class="o">-></span> <span class="mh">0x4780000</span>
|
|
<span class="o">-</span> <span class="n">VIEW</span><span class="o">.</span><span class="n">ViewSize</span> <span class="o">-></span> <span class="mh">0x4000</span>
|
|
<span class="o">*</span> <span class="n">Reading</span> <span class="n">view</span> <span class="n">content</span><span class="p">:</span> <span class="o"><</span><span class="n">The</span> <span class="n">content</span> <span class="n">of</span> <span class="n">the</span> <span class="n">view</span> <span class="p">:)</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">security_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">handle_is_valid</span> <span class="o"><</span><span class="kc">False</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">context_is_valid</span> <span class="o"><</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">context</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">PortContext</span> <span class="o">-></span> <span class="mh">0x11223344</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageContext</span> <span class="o">-></span> <span class="kc">None</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">Sequence</span> <span class="o">-></span> <span class="mh">0x3</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">MessageId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">CTX</span><span class="o">.</span><span class="n">CallbackId</span> <span class="o">-></span> <span class="mh">0x0</span><span class="n">L</span>
|
|
<span class="o">*</span> <span class="n">message</span> <span class="n">token</span> <span class="n">attribute</span><span class="p">:</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">TokenId</span> <span class="o">-></span> <span class="mh">0x4101ef8e</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">AuthenticationId</span> <span class="o">-></span> <span class="mh">0x54177</span><span class="n">L</span>
|
|
<span class="o">-</span> <span class="n">TOKEN</span><span class="o">.</span><span class="n">ModifiedId</span> <span class="o">-></span> <span class="mh">0x4077ab89</span><span class="n">L</span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="n">Unexpected</span> <span class="n">message</span> <span class="nb">type</span> <span class="o"><</span><span class="mi">12</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="n">Unexpected</span> <span class="n">message</span> <span class="nb">type</span> <span class="o"><</span><span class="mi">5</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="n">Unexpected</span> <span class="n">message</span> <span class="nb">type</span> <span class="o"><</span><span class="mi">12</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">SERV</span><span class="p">]</span> <span class="o">==</span> <span class="n">Message</span> <span class="n">received</span> <span class="o">==</span>
|
|
<span class="n">Unexpected</span> <span class="n">message</span> <span class="nb">type</span> <span class="o"><</span><span class="mi">12</span><span class="o">></span>
|
|
<span class="n">BYE</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-rpc">
|
|
<h2>18.19. <a class="reference internal" href="rpc.html#module-windows.rpc" title="windows.rpc"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.rpc</span></code></a><a class="headerlink" href="#windows-rpc" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="manual-uac">
|
|
<span id="sample-rpc-uac"></span><h3>18.19.1. Manual UAC<a class="headerlink" href="#manual-uac" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">argparse</span>
|
|
<span class="kn">import</span> <span class="nn">sys</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows.rpc</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="kn">from</span> <span class="nn">windows.rpc</span> <span class="kn">import</span> <span class="n">ndr</span>
|
|
|
|
<span class="c1"># NDR Descriptions</span>
|
|
<span class="k">class</span> <span class="nc">NDRPoint</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
<span class="k">class</span> <span class="nc">NdrUACStartupInfo</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">NDRPoint</span><span class="p">]</span>
|
|
|
|
<span class="k">class</span> <span class="nc">RAiLaunchAdminProcessParameters</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">,</span>
|
|
<span class="n">NdrUACStartupInfo</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
<span class="k">class</span> <span class="nc">NdrProcessInformation</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span> <span class="o">*</span> <span class="mi">4</span>
|
|
|
|
<span class="c1"># Parsing args</span>
|
|
<span class="n">parser</span> <span class="o">=</span> <span class="n">argparse</span><span class="o">.</span><span class="n">ArgumentParser</span><span class="p">(</span><span class="n">prog</span><span class="o">=</span><span class="vm">__file__</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--target'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="n">sys</span><span class="o">.</span><span class="n">executable</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'Executable to launch'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--cmdline'</span><span class="p">,</span> <span class="n">default</span><span class="o">=</span><span class="s2">""</span><span class="p">,</span> <span class="n">help</span><span class="o">=</span><span class="s1">'The commandline for the process'</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--uacflags'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="mh">0x11</span><span class="p">)</span>
|
|
<span class="n">parser</span><span class="o">.</span><span class="n">add_argument</span><span class="p">(</span><span class="s1">'--creationflags'</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="nb">int</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="mi">0</span><span class="p">),</span> <span class="n">default</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">CREATE_UNICODE_ENVIRONMENT</span><span class="p">)</span>
|
|
<span class="n">params</span> <span class="o">=</span> <span class="n">parser</span><span class="o">.</span><span class="n">parse_args</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">params</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Connecting to RPC Interface.</span>
|
|
<span class="n">UAC_UIID</span> <span class="o">=</span> <span class="s2">"201ef99a-7fa0-444c-9399-19ba84f12a1a"</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">rpc</span><span class="o">.</span><span class="n">find_alpc_endpoint_and_connect</span><span class="p">(</span><span class="n">UAC_UIID</span><span class="p">)</span>
|
|
<span class="n">iid</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">bind</span><span class="p">(</span><span class="n">UAC_UIID</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Marshalling parameters.</span>
|
|
<span class="n">parameters</span> <span class="o">=</span> <span class="n">RAiLaunchAdminProcessParameters</span><span class="o">.</span><span class="n">pack</span><span class="p">([</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="c1"># Application Path</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">cmdline</span><span class="p">,</span> <span class="c1"># Commandline</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">uacflags</span><span class="p">,</span> <span class="c1"># UAC-Request Flag</span>
|
|
<span class="n">params</span><span class="o">.</span><span class="n">creationflags</span><span class="p">,</span> <span class="c1"># dwCreationFlags</span>
|
|
<span class="s2">""</span><span class="p">,</span> <span class="c1"># StartDirectory</span>
|
|
<span class="s2">"WinSta0</span><span class="se">\\</span><span class="s2">Default"</span><span class="p">,</span> <span class="c1"># Station</span>
|
|
<span class="c1"># Startup Info</span>
|
|
<span class="p">(</span><span class="kc">None</span><span class="p">,</span> <span class="c1"># Title</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwX</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwY</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwXSize</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwYSize</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwXCountChars</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwYCountChars</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwFillAttribute</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># dwFlags</span>
|
|
<span class="mi">5</span><span class="p">,</span> <span class="c1"># wShowWindow</span>
|
|
<span class="c1"># Point structure: Use MonitorFromPoint to setup StartupInfo.hStdOutput</span>
|
|
<span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">)),</span>
|
|
<span class="mi">0</span><span class="p">,</span> <span class="c1"># Window-Handle to know if UAC can steal focus</span>
|
|
<span class="mh">0xffffffff</span><span class="p">])</span> <span class="c1"># UAC Timeout</span>
|
|
|
|
<span class="n">result</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">call</span><span class="p">(</span><span class="n">iid</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">parameters</span><span class="p">)</span>
|
|
<span class="n">stream</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrStream</span><span class="p">(</span><span class="n">result</span><span class="p">)</span>
|
|
|
|
<span class="n">ph</span><span class="p">,</span> <span class="n">th</span><span class="p">,</span> <span class="n">pid</span><span class="p">,</span> <span class="n">tid</span> <span class="o">=</span> <span class="n">NdrProcessInformation</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">return_value</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Return value = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">return_value</span><span class="p">))</span>
|
|
<span class="n">target</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">ph</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Created process is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * bitness is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">bitness</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * integrity: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">integrity</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * elevated: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">is_elevated</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output:</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span> <span class="n">λ</span><span class="p">)</span> <span class="n">python</span> <span class="n">rpc</span>\<span class="n">uac</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Namespace</span><span class="p">(</span><span class="n">cmdline</span><span class="o">=</span><span class="s1">''</span><span class="p">,</span> <span class="n">creationflags</span><span class="o">=</span><span class="n">CREATE_UNICODE_ENVIRONMENT</span><span class="p">(</span><span class="mh">0x400</span><span class="n">L</span><span class="p">),</span> <span class="n">target</span><span class="o">=</span><span class="s1">'C:</span><span class="se">\\</span><span class="s1">Python27</span><span class="se">\\</span><span class="s1">python.exe'</span><span class="p">,</span> <span class="n">uacflags</span><span class="o">=</span><span class="mi">17</span><span class="p">)</span>
|
|
<span class="c1"># UAC pop - asking to execute python.exe | Clicking Yes</span>
|
|
<span class="n">Return</span> <span class="n">value</span> <span class="o">=</span> <span class="mh">0x6</span>
|
|
<span class="n">Created</span> <span class="n">process</span> <span class="ow">is</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"python.exe"</span> <span class="n">pid</span> <span class="mi">19304</span> <span class="n">at</span> <span class="mh">0x455f7d0</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">bitness</span> <span class="ow">is</span> <span class="mi">32</span>
|
|
<span class="o">*</span> <span class="n">integrity</span><span class="p">:</span> <span class="n">SECURITY_MANDATORY_HIGH_RID</span><span class="p">(</span><span class="mh">0x3000</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o">*</span> <span class="n">elevated</span><span class="p">:</span> <span class="kc">True</span>
|
|
|
|
<span class="c1"># The new python.exe in another window</span>
|
|
<span class="o">>>></span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">integrity</span>
|
|
<span class="n">SECURITY_MANDATORY_HIGH_RID</span><span class="p">(</span><span class="mh">0x3000</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o">>>></span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">is_elevated</span>
|
|
<span class="kc">True</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="manual-lsarenumerateprivileges">
|
|
<span id="sample-rpc-lsass"></span><h3>18.19.2. Manual <code class="docutils literal notranslate"><span class="pre">LsarEnumeratePrivileges</span></code><a class="headerlink" href="#manual-lsarenumerateprivileges" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows.rpc</span>
|
|
<span class="kn">from</span> <span class="nn">windows.rpc</span> <span class="kn">import</span> <span class="n">ndr</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">PLSAPR_OBJECT_ATTRIBUTES</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStructure</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">),</span> <span class="c1"># We dont care of the subtype as we will pass None</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">),</span> <span class="c1"># We dont care of the subtype as we will pass None</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">)]</span> <span class="c1"># We dont care of the subtype as we will pass None</span>
|
|
|
|
<span class="c1">## From: RPCVIEW</span>
|
|
<span class="c1"># long Proc44_LsarOpenPolicy2(</span>
|
|
<span class="c1"># [in][unique][string] wchar_t* arg_0,</span>
|
|
<span class="c1"># [in]struct Struct_364_t* arg_1,</span>
|
|
<span class="c1"># [in]long arg_2,</span>
|
|
<span class="c1"># [out][context_handle] void** arg_3);</span>
|
|
|
|
<span class="c1"># This function has a [out][context_handle] meaning it return a context_handle</span>
|
|
<span class="c1"># Context handle are represented by 5 NdrLong where the first one is always 0</span>
|
|
<span class="c1"># PythonForWindows represent context_handle using NdrContextHandle</span>
|
|
<span class="k">class</span> <span class="nc">LsarOpenPolicy2Parameter</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrUniquePTR</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrWString</span><span class="p">),</span>
|
|
<span class="n">PLSAPR_OBJECT_ATTRIBUTES</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
<span class="c1">## From: RPCVIEW</span>
|
|
<span class="c1"># long Proc2_LsarEnumeratePrivileges(</span>
|
|
<span class="c1"># [in][context_handle] void* arg_0,</span>
|
|
<span class="c1"># [in][out]long *arg_1,</span>
|
|
<span class="c1"># [out]struct Struct_110_t* arg_2,</span>
|
|
<span class="c1"># [in]long arg_3);</span>
|
|
|
|
<span class="c1"># This function has a [in][context_handle] meaning it expect a context_handle</span>
|
|
<span class="c1"># We can pass the NdrContextHandle returned by Proc44_LsarOpenPolicy2</span>
|
|
<span class="k">class</span> <span class="nc">LsarEnumeratePrivilegesParameter</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrParameters</span><span class="p">):</span>
|
|
<span class="n">MEMBERS</span> <span class="o">=</span> <span class="p">[</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrContextHandle</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">,</span>
|
|
<span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="p">]</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">LSAPR_POLICY_PRIVILEGE_DEF</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="nd">@classmethod</span>
|
|
<span class="k">def</span> <span class="nf">unpack</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">stream</span><span class="p">):</span>
|
|
<span class="n">size1</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrShort</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">ptr</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrShort</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">size2</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">luid</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrHyper</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">ptr</span><span class="p">,</span> <span class="n">luid</span>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">LSAPR_PRIVILEGE_ENUM_BUFFER</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="nd">@classmethod</span>
|
|
<span class="k">def</span> <span class="nf">unpack</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">stream</span><span class="p">):</span>
|
|
<span class="n">entries</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">array_size</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">array_ptr</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="c1"># Unpack pointed array</span>
|
|
<span class="n">array_size2</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrLong</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="k">assert</span> <span class="n">array_size</span> <span class="o">==</span> <span class="n">array_size2</span>
|
|
<span class="n">x</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="c1"># unpack each elements LSAPR_POLICY_PRIVILEGE_DEF</span>
|
|
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">array_size2</span><span class="p">):</span>
|
|
<span class="n">ptr</span><span class="p">,</span> <span class="n">luid</span> <span class="o">=</span> <span class="n">LSAPR_POLICY_PRIVILEGE_DEF</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="k">if</span> <span class="n">ptr</span><span class="p">:</span>
|
|
<span class="n">x</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">luid</span><span class="p">)</span>
|
|
<span class="c1"># unpack pointed strings</span>
|
|
<span class="n">result</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="k">for</span> <span class="n">luid</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
|
|
<span class="n">name</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrWcharConformantVaryingArrays</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">stream</span><span class="p">)</span>
|
|
<span class="n">result</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">luid</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
|
|
<span class="k">return</span> <span class="n">result</span>
|
|
|
|
|
|
<span class="c1"># Actual code</span>
|
|
|
|
<span class="c1">## LSASS alpc endpoints is fixed, no need for the epmapper</span>
|
|
<span class="n">client</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">rpc</span><span class="o">.</span><span class="n">RPCClient</span><span class="p">(</span><span class="sa">r</span><span class="s2">"\RPC Control\lsasspirpc"</span><span class="p">)</span>
|
|
<span class="c1">## Bind to the desired interface</span>
|
|
<span class="n">iid</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">bind</span><span class="p">(</span><span class="s1">'12345778-1234-abcd-ef00-0123456789ab'</span><span class="p">,</span> <span class="n">version</span><span class="o">=</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">))</span>
|
|
|
|
<span class="c1">## Craft parameters and call 'LsarOpenPolicy2'</span>
|
|
<span class="n">params</span> <span class="o">=</span> <span class="n">LsarOpenPolicy2Parameter</span><span class="o">.</span><span class="n">pack</span><span class="p">([</span><span class="kc">None</span><span class="p">,</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span><span class="p">),</span> <span class="mh">0x20000000</span><span class="p">])</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">call</span><span class="p">(</span><span class="n">iid</span><span class="p">,</span> <span class="mi">44</span><span class="p">,</span> <span class="n">params</span><span class="p">)</span>
|
|
<span class="c1">## Unpack the resulting handle</span>
|
|
<span class="n">handle</span> <span class="o">=</span> <span class="n">ndr</span><span class="o">.</span><span class="n">NdrContextHandle</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStream</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
|
|
<span class="c1"># As context_handle have 4 NdrLong of effective data</span>
|
|
<span class="c1"># We can represent them as GUID</span>
|
|
<span class="c1"># NdrContextHandle is just a wrapper packing/unpacking GUID and taking</span>
|
|
<span class="c1"># care of the leading NdrLong(0) in the actual ndr representation of context_handle</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Context Handle is: </span><span class="si">{0}</span><span class="se">\n</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">handle</span><span class="p">))</span>
|
|
|
|
<span class="c1">## Craft parameters and call 'LsarEnumeratePrivileges'</span>
|
|
<span class="n">x</span> <span class="o">=</span> <span class="n">LsarEnumeratePrivilegesParameter</span><span class="o">.</span><span class="n">pack</span><span class="p">([</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">10000</span><span class="p">]);</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="n">client</span><span class="o">.</span><span class="n">call</span><span class="p">(</span><span class="n">iid</span><span class="p">,</span> <span class="mi">2</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Privileges:"</span><span class="p">)</span>
|
|
<span class="c1">## Unpack the resulting 'LSAPR_PRIVILEGE_ENUM_BUFFER'</span>
|
|
<span class="n">priviledges</span> <span class="o">=</span> <span class="n">LSAPR_PRIVILEGE_ENUM_BUFFER</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="n">ndr</span><span class="o">.</span><span class="n">NdrStream</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">priv</span> <span class="ow">in</span> <span class="n">priviledges</span><span class="p">:</span>
|
|
<span class="nb">print</span> <span class="n">priv</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">rpc</span>\<span class="n">lsass</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreateTokenPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">3</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeAssignPrimaryTokenPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">4</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeLockMemoryPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeIncreaseQuotaPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeMachineAccountPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">7</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTcbPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSecurityPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">9</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTakeOwnershipPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">10</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeLoadDriverPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">11</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSystemProfilePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">12</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSystemtimePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">13</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeProfileSingleProcessPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">14</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeIncreaseBasePriorityPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">15</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreatePagefilePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreatePermanentPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">17</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeBackupPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">18</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeRestorePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">19</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeShutdownPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">20</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeDebugPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">21</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeAuditPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">22</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSystemEnvironmentPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">23</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeChangeNotifyPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">24</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeRemoteShutdownPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">25</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeUndockPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">26</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeSyncAgentPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">27</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeEnableDelegationPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">28</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeManageVolumePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">29</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeImpersonatePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">30</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreateGlobalPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">31</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTrustedCredManAccessPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">32</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeRelabelPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">33</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeIncreaseWorkingSetPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">34</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeTimeZonePrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">35</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeCreateSymbolicLinkPrivilege'</span><span class="p">)</span>
|
|
<span class="p">(</span><span class="mi">36</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'SeDelegateSessionUserImpersonatePrivilege'</span><span class="p">)</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-pipe">
|
|
<span id="sample-pipe"></span><h2>18.20. <a class="reference internal" href="pipe.html#module-windows.pipe" title="windows.pipe"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.pipe</span></code></a><a class="headerlink" href="#windows-pipe" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="communication-with-an-injected-process">
|
|
<h3>18.20.1. Communication with an injected process<a class="headerlink" href="#communication-with-an-injected-process" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.test</span>
|
|
|
|
<span class="n">p</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_32</span><span class="p">()</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Child is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">p</span><span class="p">))</span>
|
|
|
|
<span class="n">PIPE_NAME</span> <span class="o">=</span> <span class="s2">"PFW_Pipe"</span>
|
|
|
|
<span class="n">rcode</span> <span class="o">=</span> <span class="s2">"""</span>
|
|
<span class="s2">import windows</span>
|
|
|
|
<span class="s2">f = open('tst.txt', "w+")</span>
|
|
<span class="s2">fh = windows.utils.get_handle_from_file(f)</span>
|
|
<span class="s2">hm = windows.winproxy.CreateFileMappingA(fh, dwMaximumSizeLow=0x1000, lpName=None)</span>
|
|
<span class="s2">addr = windows.winproxy.MapViewOfFile(hm, dwNumberOfBytesToMap=0x1000)</span>
|
|
|
|
<span class="s2">windows.pipe.send_object("</span><span class="si">{pipe}</span><span class="s2">", addr)</span>
|
|
<span class="s2">"""</span>
|
|
|
|
<span class="k">with</span> <span class="n">windows</span><span class="o">.</span><span class="n">pipe</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">PIPE_NAME</span><span class="p">)</span> <span class="k">as</span> <span class="n">np</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Created pipe is </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">np</span><span class="p">))</span>
|
|
<span class="n">p</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="n">rcode</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">pipe</span><span class="o">=</span><span class="n">PIPE_NAME</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Receiving object from injected process"</span><span class="p">)</span>
|
|
<span class="n">addr</span> <span class="o">=</span> <span class="n">np</span><span class="o">.</span><span class="n">recv</span><span class="p">()</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Remote Address = </span><span class="si">{0:#x}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Querying memory in target at <</span><span class="si">{0:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">query_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Querying mapped file in target at <</span><span class="si">{0:#x}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">addr</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">get_mapped_filename</span><span class="p">(</span><span class="n">addr</span><span class="p">)))</span>
|
|
<span class="n">p</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">pipe</span>\<span class="n">child_send_object</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Child</span> <span class="ow">is</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"notepad.exe"</span> <span class="n">pid</span> <span class="mi">4316</span> <span class="n">at</span> <span class="mh">0x672fcf0</span><span class="o">></span>
|
|
<span class="n">Created</span> <span class="n">pipe</span> <span class="ow">is</span> <span class="o"><</span><span class="n">PipeConnection</span> <span class="n">name</span><span class="o">=</span><span class="s2">"</span><span class="se">\\</span><span class="s2">.\pipe\PFW_Pipe"</span> <span class="n">server</span><span class="o">=</span><span class="kc">True</span><span class="o">></span>
|
|
<span class="n">Receiving</span> <span class="nb">object</span> <span class="kn">from</span> <span class="nn">injected</span> <span class="n">process</span>
|
|
<span class="n">Remote</span> <span class="n">Address</span> <span class="o">=</span> <span class="mh">0x97a0000</span>
|
|
<span class="n">Querying</span> <span class="n">memory</span> <span class="ow">in</span> <span class="n">target</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x97a0000</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">MEMORY_BASIC_INFORMATION32</span> <span class="n">BaseAddress</span><span class="o">=</span><span class="mh">0x97a0000</span> <span class="n">RegionSize</span><span class="o">=</span><span class="mh">0x001000</span> <span class="n">State</span><span class="o">=</span><span class="n">MEM_COMMIT</span><span class="p">(</span><span class="mh">0x1000</span><span class="n">L</span><span class="p">)</span> <span class="n">Type</span><span class="o">=</span><span class="n">MEM_MAPPED</span><span class="p">(</span><span class="mh">0x40000</span><span class="n">L</span><span class="p">)</span> <span class="n">Protect</span><span class="o">=</span><span class="n">PAGE_READWRITE</span><span class="p">(</span><span class="mh">0x4</span><span class="n">L</span><span class="p">)</span><span class="o">></span>
|
|
<span class="n">Querying</span> <span class="n">mapped</span> <span class="n">file</span> <span class="ow">in</span> <span class="n">target</span> <span class="n">at</span> <span class="o"><</span><span class="mh">0x97a0000</span><span class="o">></span>
|
|
<span class="o">*</span> \<span class="n">Device</span>\<span class="n">HarddiskVolume2</span>\<span class="n">Users</span>\<span class="n">hakril</span>\<span class="n">Documents</span>\<span class="n">projets</span>\<span class="n">PythonForWindows</span>\<span class="n">samples</span>\<span class="n">tst</span><span class="o">.</span><span class="n">txt</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="windows-security">
|
|
<span id="sample-security"></span><h2>18.21. <a class="reference internal" href="security.html#module-windows.security" title="windows.security"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.security</span></code></a><a class="headerlink" href="#windows-security" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="security-descriptor">
|
|
<h3>18.21.1. Security Descriptor<a class="headerlink" href="#security-descriptor" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows.security</span>
|
|
|
|
<span class="n">SDDL</span> <span class="o">=</span> <span class="s2">"O:BAG:AND:(A;OI;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)(D;CIIO;RPWPCCDCLCSWRCWDWOGA;;;S-1-0-0)"</span>
|
|
|
|
<span class="n">sd</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">from_string</span><span class="p">(</span><span class="n">SDDL</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Security descriptor is: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sd</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Owner: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">owner</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - lookup: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">lookup_sid</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">owner</span><span class="p">)))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Group: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">group</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - lookup: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">lookup_sid</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">group</span><span class="p">)))</span>
|
|
|
|
<span class="n">dacl</span> <span class="o">=</span> <span class="n">sd</span><span class="o">.</span><span class="n">dacl</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Dacl: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">dacl</span><span class="p">))</span>
|
|
|
|
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">ace</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">dacl</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" ACE [</span><span class="si">{0}</span><span class="s2">]: </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">,</span> <span class="n">ace</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - Header-AceType: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">Header</span><span class="o">.</span><span class="n">AceType</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - Header-AceFlags: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">Header</span><span class="o">.</span><span class="n">AceFlags</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - Header-flags: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">Header</span><span class="o">.</span><span class="n">flags</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - Mask: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">Mask</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - mask: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">mask</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" - Sid: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">sid</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">security</span>\<span class="n">security_descriptor</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Security</span> <span class="n">descriptor</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">SecurityDescriptor</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x03E151C0</span><span class="o">></span>
|
|
<span class="n">Owner</span><span class="p">:</span> <span class="n">S</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">5</span><span class="o">-</span><span class="mi">32</span><span class="o">-</span><span class="mi">544</span>
|
|
<span class="o">-</span> <span class="n">lookup</span><span class="p">:</span> <span class="p">(</span><span class="sa">u</span><span class="s1">'BUILTIN'</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'Administrateurs'</span><span class="p">)</span>
|
|
<span class="n">Group</span><span class="p">:</span> <span class="n">S</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">5</span><span class="o">-</span><span class="mi">7</span>
|
|
<span class="o">-</span> <span class="n">lookup</span><span class="p">:</span> <span class="p">(</span><span class="sa">u</span><span class="s1">'AUTORITE NT'</span><span class="p">,</span> <span class="sa">u</span><span class="s1">'ANONYMOUS LOGON'</span><span class="p">)</span>
|
|
<span class="n">Dacl</span><span class="p">:</span> <span class="o"><</span><span class="n">Acl</span> <span class="n">count</span><span class="o">=</span><span class="mi">2</span><span class="o">></span>
|
|
|
|
<span class="n">ACE</span> <span class="p">[</span><span class="mi">0</span><span class="p">]:</span> <span class="o"><</span><span class="n">AccessAllowedACE</span> <span class="n">mask</span><span class="o">=</span><span class="mi">269353023</span><span class="o">></span>
|
|
<span class="o">-</span> <span class="n">Header</span><span class="o">-</span><span class="n">AceType</span><span class="p">:</span> <span class="n">ACCESS_ALLOWED_ACE_TYPE</span><span class="p">(</span><span class="mh">0x0</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o">-</span> <span class="n">Header</span><span class="o">-</span><span class="n">AceFlags</span><span class="p">:</span> <span class="mi">1</span>
|
|
<span class="o">-</span> <span class="n">Header</span><span class="o">-</span><span class="n">flags</span><span class="p">:</span> <span class="p">[</span><span class="n">OBJECT_INHERIT_ACE</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)]</span>
|
|
<span class="o">-</span> <span class="n">Mask</span><span class="p">:</span> <span class="mi">269353023</span>
|
|
<span class="o">-</span> <span class="n">mask</span><span class="p">:</span> <span class="p">[</span><span class="mi">1</span><span class="n">L</span><span class="p">,</span> <span class="mi">2</span><span class="n">L</span><span class="p">,</span> <span class="mi">4</span><span class="n">L</span><span class="p">,</span> <span class="mi">8</span><span class="n">L</span><span class="p">,</span> <span class="mi">16</span><span class="n">L</span><span class="p">,</span> <span class="mi">32</span><span class="n">L</span><span class="p">,</span> <span class="n">READ_CONTROL</span><span class="p">(</span><span class="mh">0x20000</span><span class="n">L</span><span class="p">),</span> <span class="n">WRITE_DAC</span><span class="p">(</span><span class="mh">0x40000</span><span class="n">L</span><span class="p">),</span> <span class="n">WRITE_OWNER</span><span class="p">(</span><span class="mh">0x80000</span><span class="n">L</span><span class="p">),</span> <span class="n">GENERIC_ALL</span><span class="p">(</span><span class="mh">0x10000000</span><span class="n">L</span><span class="p">)]</span>
|
|
<span class="o">-</span> <span class="n">Sid</span><span class="p">:</span> <span class="n">S</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">0</span><span class="o">-</span><span class="mi">0</span>
|
|
|
|
<span class="n">ACE</span> <span class="p">[</span><span class="mi">1</span><span class="p">]:</span> <span class="o"><</span><span class="n">AccessDeniedACE</span> <span class="n">mask</span><span class="o">=</span><span class="mi">269353023</span><span class="o">></span>
|
|
<span class="o">-</span> <span class="n">Header</span><span class="o">-</span><span class="n">AceType</span><span class="p">:</span> <span class="n">ACCESS_DENIED_ACE_TYPE</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span>
|
|
<span class="o">-</span> <span class="n">Header</span><span class="o">-</span><span class="n">AceFlags</span><span class="p">:</span> <span class="mi">10</span>
|
|
<span class="o">-</span> <span class="n">Header</span><span class="o">-</span><span class="n">flags</span><span class="p">:</span> <span class="p">[</span><span class="n">CONTAINER_INHERIT_ACE</span><span class="p">(</span><span class="mh">0x2</span><span class="n">L</span><span class="p">),</span> <span class="n">INHERIT_ONLY_ACE</span><span class="p">(</span><span class="mh">0x8</span><span class="n">L</span><span class="p">)]</span>
|
|
<span class="o">-</span> <span class="n">Mask</span><span class="p">:</span> <span class="mi">269353023</span>
|
|
<span class="o">-</span> <span class="n">mask</span><span class="p">:</span> <span class="p">[</span><span class="mi">1</span><span class="n">L</span><span class="p">,</span> <span class="mi">2</span><span class="n">L</span><span class="p">,</span> <span class="mi">4</span><span class="n">L</span><span class="p">,</span> <span class="mi">8</span><span class="n">L</span><span class="p">,</span> <span class="mi">16</span><span class="n">L</span><span class="p">,</span> <span class="mi">32</span><span class="n">L</span><span class="p">,</span> <span class="n">READ_CONTROL</span><span class="p">(</span><span class="mh">0x20000</span><span class="n">L</span><span class="p">),</span> <span class="n">WRITE_DAC</span><span class="p">(</span><span class="mh">0x40000</span><span class="n">L</span><span class="p">),</span> <span class="n">WRITE_OWNER</span><span class="p">(</span><span class="mh">0x80000</span><span class="n">L</span><span class="p">),</span> <span class="n">GENERIC_ALL</span><span class="p">(</span><span class="mh">0x10000000</span><span class="n">L</span><span class="p">)]</span>
|
|
<span class="o">-</span> <span class="n">Sid</span><span class="p">:</span> <span class="n">S</span><span class="o">-</span><span class="mi">1</span><span class="o">-</span><span class="mi">0</span><span class="o">-</span><span class="mi">0</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="query-sacl">
|
|
<span id="sample-security-sacl"></span><h3>18.21.2. Query SACL<a class="headerlink" href="#query-sacl" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">windows.security</span>
|
|
|
|
<span class="n">TARGET</span> <span class="o">=</span> <span class="sa">r</span><span class="s2">"C:\windows\notepad.exe"</span> <span class="c1"># On WIN10 (at least) notepad.exe has a AuditACE</span>
|
|
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">elevated</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="ne">ValueError</span><span class="p">(</span><span class="s2">"This sample should be run as admin to demonstration SACL access"</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[NO-PRIV] Querying <</span><span class="si">{0}</span><span class="s2">> SecurityDescriptor without SACL"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET</span><span class="p">))</span>
|
|
<span class="n">sd</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">from_filename</span><span class="p">(</span><span class="n">TARGET</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"sacl = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">sacl</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[NO-PRIV] Querying <</span><span class="si">{0}</span><span class="s2">> SecurityDescriptor with SACL"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET</span><span class="p">))</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="n">sd</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">from_filename</span><span class="p">(</span><span class="n">TARGET</span><span class="p">,</span> <span class="n">query_sacl</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"sacl = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">sacl</span><span class="p">))</span>
|
|
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Enabling <SeSecurityPrivilege>"</span><span class="p">)</span>
|
|
<span class="k">try</span><span class="p">:</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">token</span><span class="o">.</span><span class="n">enable_privilege</span><span class="p">(</span><span class="s2">"SeSecurityPrivilege"</span><span class="p">)</span>
|
|
<span class="k">except</span> <span class="ne">ValueError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[ERROR] </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
|
|
<span class="n">exit</span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"[PRIV] Querying <</span><span class="si">{0}</span><span class="s2">> SecurityDescriptor with SACL"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">TARGET</span><span class="p">))</span>
|
|
<span class="n">sd</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">from_filename</span><span class="p">(</span><span class="n">TARGET</span><span class="p">,</span> <span class="n">query_sacl</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"sacl = </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">sacl</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="nb">list</span><span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">sacl</span><span class="p">))</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">security</span>\<span class="n">query_sacl</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">This</span> <span class="n">sample</span> <span class="n">should</span> <span class="n">be</span> <span class="n">run</span> <span class="k">as</span> <span class="n">admin</span> <span class="n">to</span> <span class="n">demonstration</span> <span class="n">SACL</span> <span class="n">access</span>
|
|
|
|
<span class="p">[</span><span class="n">NO</span><span class="o">-</span><span class="n">PRIV</span><span class="p">]</span> <span class="n">Querying</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">notepad</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="n">SecurityDescriptor</span> <span class="n">without</span> <span class="n">SACL</span>
|
|
<span class="n">sacl</span> <span class="o">=</span> <span class="o"><</span><span class="n">Acl</span> <span class="n">count</span><span class="o">=</span><span class="mi">0</span><span class="o">></span>
|
|
|
|
<span class="p">[</span><span class="n">NO</span><span class="o">-</span><span class="n">PRIV</span><span class="p">]</span> <span class="n">Querying</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">notepad</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="n">SecurityDescriptor</span> <span class="k">with</span> <span class="n">SACL</span>
|
|
<span class="kc">None</span><span class="p">:</span> <span class="p">[</span><span class="n">Error</span> <span class="mi">1314</span><span class="p">]</span> <span class="n">A</span> <span class="n">required</span> <span class="n">privilege</span> <span class="ow">is</span> <span class="ow">not</span> <span class="n">held</span> <span class="n">by</span> <span class="n">the</span> <span class="n">client</span><span class="o">.</span>
|
|
|
|
<span class="n">Enabling</span> <span class="o"><</span><span class="n">SeSecurityPrivilege</span><span class="o">></span>
|
|
<span class="p">[</span><span class="n">ERROR</span><span class="p">]</span> <span class="o"><</span><span class="n">Token</span> <span class="n">TokenId</span><span class="o">=</span><span class="mh">0xd6db5cc</span> <span class="n">Type</span><span class="o">=</span><span class="n">TokenPrimary</span><span class="p">(</span><span class="mh">0x1</span><span class="n">L</span><span class="p">)</span><span class="o">></span> <span class="n">has</span> <span class="n">no</span> <span class="n">privilege</span> <span class="o"><</span><span class="n">SeSecurityPrivilege</span><span class="o">></span>
|
|
|
|
|
|
<span class="p">(</span><span class="n">cmd</span><span class="o">-</span><span class="n">admin</span><span class="p">)</span> <span class="n">python</span> <span class="n">security</span>\<span class="n">query_sacl</span><span class="o">.</span><span class="n">py</span>
|
|
|
|
<span class="p">[</span><span class="n">NO</span><span class="o">-</span><span class="n">PRIV</span><span class="p">]</span> <span class="n">Querying</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">notepad</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="n">SecurityDescriptor</span> <span class="n">without</span> <span class="n">SACL</span>
|
|
<span class="n">sacl</span> <span class="o">=</span> <span class="o"><</span><span class="n">Acl</span> <span class="n">count</span><span class="o">=</span><span class="mi">0</span><span class="o">></span>
|
|
|
|
<span class="p">[</span><span class="n">NO</span><span class="o">-</span><span class="n">PRIV</span><span class="p">]</span> <span class="n">Querying</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">notepad</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="n">SecurityDescriptor</span> <span class="k">with</span> <span class="n">SACL</span>
|
|
<span class="kc">None</span><span class="p">:</span> <span class="p">[</span><span class="n">Error</span> <span class="mi">1314</span><span class="p">]</span> <span class="n">A</span> <span class="n">required</span> <span class="n">privilege</span> <span class="ow">is</span> <span class="ow">not</span> <span class="n">held</span> <span class="n">by</span> <span class="n">the</span> <span class="n">client</span><span class="o">.</span>
|
|
|
|
<span class="n">Enabling</span> <span class="o"><</span><span class="n">SeSecurityPrivilege</span><span class="o">></span>
|
|
|
|
<span class="p">[</span><span class="n">PRIV</span><span class="p">]</span> <span class="n">Querying</span> <span class="o"><</span><span class="n">C</span><span class="p">:</span>\<span class="n">windows</span>\<span class="n">notepad</span><span class="o">.</span><span class="n">exe</span><span class="o">></span> <span class="n">SecurityDescriptor</span> <span class="k">with</span> <span class="n">SACL</span>
|
|
<span class="n">sacl</span> <span class="o">=</span> <span class="o"><</span><span class="n">Acl</span> <span class="n">count</span><span class="o">=</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="p">[</span><span class="o"><</span><span class="n">SystemAuditACE</span> <span class="n">mask</span><span class="o">=</span><span class="mi">852246</span><span class="o">></span><span class="p">]</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="etw-event-tracing-for-windows">
|
|
<span id="sample-etw"></span><h2>18.22. ETW (Event Tracing for Windows)<a class="headerlink" href="#etw-event-tracing-for-windows" title="Permalink to this headline">¶</a></h2>
|
|
<div class="section" id="trace-processing">
|
|
<h3>18.22.1. Trace processing<a class="headerlink" href="#trace-processing" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">ctypes</span>
|
|
<span class="kn">import</span> <span class="nn">struct</span>
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
|
|
<span class="n">makeg</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">GUID</span><span class="o">.</span><span class="n">from_string</span>
|
|
|
|
<span class="c1"># This sample record the ETW event of provider CBB61B6D-A2CF-471A-9A58-A4CD5C08FFBA</span>
|
|
<span class="c1"># related to the UAC (service AppInfo)</span>
|
|
<span class="c1"># The ETW session is called MY_UAC_MONITOR</span>
|
|
|
|
<span class="c1"># Is then trigger the UAC and display the retrieved event afterward</span>
|
|
|
|
<span class="k">def</span> <span class="nf">show</span><span class="p">(</span><span class="n">event</span><span class="p">):</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"</span><span class="si">{0:#x}</span><span class="s2">: </span><span class="si">{1}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">EventHeader</span><span class="o">.</span><span class="n">TimeStamp</span><span class="p">,</span> <span class="n">event</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" guid: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">guid</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" id: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">id</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" opcode: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">opcode</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" level: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">level</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" data: </span><span class="si">{0!r}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">event</span><span class="o">.</span><span class="n">user_data</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="s2">"</span><span class="se">\x00</span><span class="s2">"</span><span class="p">,</span> <span class="s2">""</span><span class="p">)))</span>
|
|
<span class="k">return</span> <span class="mi">0</span>
|
|
|
|
<span class="n">session_name</span> <span class="o">=</span> <span class="s2">"MY_UAC_MONITOR"</span>
|
|
<span class="n">logfile_name</span> <span class="o">=</span> <span class="s2">"uac.trace"</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Recording UAC event in file <</span><span class="si">{0}</span><span class="s2">> using session named <</span><span class="si">{1}</span><span class="s2">>"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">logfile_name</span><span class="p">,</span> <span class="n">session_name</span><span class="p">))</span>
|
|
|
|
<span class="n">my_trace</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">etw</span><span class="o">.</span><span class="n">open_trace</span><span class="p">(</span><span class="n">session_name</span><span class="p">,</span> <span class="n">logfile</span><span class="o">=</span><span class="n">logfile_name</span><span class="p">)</span>
|
|
<span class="n">my_trace</span><span class="o">.</span><span class="n">stop</span><span class="p">(</span><span class="n">soft</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span> <span class="c1"># Stop previous trace with this name if exists</span>
|
|
<span class="n">my_trace</span><span class="o">.</span><span class="n">start</span><span class="p">()</span>
|
|
<span class="n">my_trace</span><span class="o">.</span><span class="n">enable</span><span class="p">(</span><span class="s2">"CBB61B6D-A2CF-471A-9A58-A4CD5C08FFBA"</span><span class="p">,</span> <span class="mh">0xff</span><span class="p">,</span> <span class="mh">0xff</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Trigger UAC</span>
|
|
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">ShellExecuteA</span><span class="p">(</span><span class="kc">None</span><span class="p">,</span> <span class="s2">"runas"</span><span class="p">,</span> <span class="s2">"mmc.exe"</span><span class="p">,</span> <span class="s2">"BAD_MMC_FILENAME"</span><span class="p">,</span> <span class="kc">None</span> <span class="p">,</span> <span class="mi">5</span><span class="p">)</span>
|
|
|
|
<span class="n">my_trace</span><span class="o">.</span><span class="n">stop</span><span class="p">()</span>
|
|
<span class="n">my_trace</span><span class="o">.</span><span class="n">process</span><span class="p">(</span><span class="n">show</span><span class="p">)</span> <span class="c1">#: Process the events registered in the trace (and logfile)</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">etw</span>\<span class="n">uac_trace</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">Recording</span> <span class="n">UAC</span> <span class="n">event</span> <span class="ow">in</span> <span class="n">file</span> <span class="o"><</span><span class="n">uac</span><span class="o">.</span><span class="n">trace</span><span class="o">></span> <span class="n">using</span> <span class="n">session</span> <span class="n">named</span> <span class="o"><</span><span class="n">MY_UAC_MONITOR</span><span class="o">></span>
|
|
<span class="mh">0x1d65bb1febaceea</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"68FDD900-4A3E-11D1-84F4-0000F80464E3"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">0</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="mi">68</span><span class="n">FDD900</span><span class="o">-</span><span class="mi">4</span><span class="n">A3E</span><span class="o">-</span><span class="mi">11</span><span class="n">D1</span><span class="o">-</span><span class="mi">84</span><span class="n">F4</span><span class="o">-</span><span class="mi">0000</span><span class="n">F80464E3</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'</span><span class="se">\x01\n\x01\x05\xbb</span><span class="s1">G</span><span class="se">\x04</span><span class="s1">-D</span><span class="se">\xd5\xff\xb1</span><span class="s1">[</span><span class="se">\xd6\x01</span><span class="s1">Zb</span><span class="se">\x02\t\x01\x04\xf0\x0c\t\x06\xc4\xff\xff\xff</span><span class="s1">@tzres.dll,-302</span><span class="se">\n\x05\x03</span><span class="s1">@tzres.dll,-301</span><span class="se">\x03\x05\x02\xc4\xff\xff\xff\xc0\x92\x1c\xd2</span><span class="s1">D[</span><span class="se">\xd6\x01\x80\x96\x98\xea\xce\xba\xfe\xb1</span><span class="s1">[</span><span class="se">\xd6\x01\x01</span><span class="s1">MY_UAC_MONITORC:</span><span class="se">\\</span><span class="s1">Users</span><span class="se">\\</span><span class="s1">hakril</span><span class="se">\\</span><span class="s1">Documents</span><span class="se">\\</span><span class="s1">projets</span><span class="se">\\</span><span class="s1">PythonForWindows</span><span class="se">\\</span><span class="s1">samples</span><span class="se">\\</span><span class="s1">uac.trace'</span>
|
|
<span class="p">[</span><span class="o">...</span><span class="p">]</span>
|
|
<span class="mh">0x1d65bb1fec4c011</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"DEB74A23-5444-3F3B-924B-0E653973F55A"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">11</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="n">DEB74A23</span><span class="o">-</span><span class="mi">5444</span><span class="o">-</span><span class="mi">3</span><span class="n">F3B</span><span class="o">-</span><span class="mi">924</span><span class="n">B</span><span class="o">-</span><span class="mf">0E653973</span><span class="n">F55A</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">11</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'</span><span class="se">\x9e\x06\x04\x19\x14\x04\x08\x04\xff\xff\xff\xff</span><span class="s1">WinSta0</span><span class="se">\\</span><span class="s1">DefaultC:</span><span class="se">\\</span><span class="s1">Windows</span><span class="se">\\</span><span class="s1">System32</span><span class="se">\\</span><span class="s1">mmc.exe"C:</span><span class="se">\\</span><span class="s1">Windows</span><span class="se">\\</span><span class="s1">System32</span><span class="se">\\</span><span class="s1">mmc.exe" BAD_MMC_FILENAMEC:</span><span class="se">\\</span><span class="s1">Users</span><span class="se">\\</span><span class="s1">hakril</span><span class="se">\\</span><span class="s1">Documents</span><span class="se">\\</span><span class="s1">projets</span><span class="se">\\</span><span class="s1">PythonForWindows</span><span class="se">\\</span><span class="s1">samples'</span>
|
|
<span class="mh">0x1d65bb1fec4e48b</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"C0B508D3-5459-339F-A213-889C238CA5B1"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">10</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="n">C0B508D3</span><span class="o">-</span><span class="mi">5459</span><span class="o">-</span><span class="mi">339</span><span class="n">F</span><span class="o">-</span><span class="n">A213</span><span class="o">-</span><span class="mi">889</span><span class="n">C238CA5B1</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">10</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'C:</span><span class="se">\\</span><span class="s1">WINDOWS</span><span class="se">\\</span><span class="s1">SysWOW64</span><span class="se">\\</span><span class="s1">mmc.exe"C:</span><span class="se">\\</span><span class="s1">WINDOWS</span><span class="se">\\</span><span class="s1">SysWOW64</span><span class="se">\\</span><span class="s1">mmc.exe" BAD_MMC_FILENAME` '</span>
|
|
<span class="mh">0x1d65bb1fec7c8eb</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"C0B508D3-5459-339F-A213-889C238CA5B1"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">13</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="n">C0B508D3</span><span class="o">-</span><span class="mi">5459</span><span class="o">-</span><span class="mi">339</span><span class="n">F</span><span class="o">-</span><span class="n">A213</span><span class="o">-</span><span class="mi">889</span><span class="n">C238CA5B1</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">13</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'C:</span><span class="se">\\</span><span class="s1">WINDOWS</span><span class="se">\\</span><span class="s1">SysWOW64</span><span class="se">\\</span><span class="s1">mmc.exe'</span>
|
|
<span class="mh">0x1d65bb1fec7c8f0</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"C0B508D3-5459-339F-A213-889C238CA5B1"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">14</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="n">C0B508D3</span><span class="o">-</span><span class="mi">5459</span><span class="o">-</span><span class="mi">339</span><span class="n">F</span><span class="o">-</span><span class="n">A213</span><span class="o">-</span><span class="mi">889</span><span class="n">C238CA5B1</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">14</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'"C:</span><span class="se">\\</span><span class="s1">WINDOWS</span><span class="se">\\</span><span class="s1">SysWOW64</span><span class="se">\\</span><span class="s1">mmc.exe" BAD_MMC_FILENAME'</span>
|
|
<span class="p">[</span><span class="o">...</span><span class="p">]</span>
|
|
<span class="mh">0x1d65bb1feca018d</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"172FF31C-2D80-31A6-FCA8-EB000D380666"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">11</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="mi">172</span><span class="n">FF31C</span><span class="o">-</span><span class="mi">2</span><span class="n">D80</span><span class="o">-</span><span class="mi">31</span><span class="n">A6</span><span class="o">-</span><span class="n">FCA8</span><span class="o">-</span><span class="n">EB000D380666</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">11</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'C:</span><span class="se">\\</span><span class="s1">WINDOWS</span><span class="se">\\</span><span class="s1">SysWOW64</span><span class="se">\\</span><span class="s1">mmc.exe'</span>
|
|
<span class="mh">0x1d65bb1feca030d</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"172FF31C-2D80-31A6-FCA8-EB000D380666"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">25</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="mi">172</span><span class="n">FF31C</span><span class="o">-</span><span class="mi">2</span><span class="n">D80</span><span class="o">-</span><span class="mi">31</span><span class="n">A6</span><span class="o">-</span><span class="n">FCA8</span><span class="o">-</span><span class="n">EB000D380666</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">25</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'C:</span><span class="se">\\</span><span class="s1">WINDOWS</span><span class="se">\\</span><span class="s1">SysWOW64</span><span class="se">\\</span><span class="s1">mmc.exe</span><span class="se">\x08\x02</span><span class="s1">TRUEFALSE</span><span class="se">\x10</span><span class="s1">'</span>
|
|
<span class="mh">0x1d65bb1fecfcdc0</span><span class="p">:</span> <span class="o"><</span><span class="n">EventRecord</span> <span class="n">provider</span><span class="o">=</span><span class="s2">"172FF31C-2D80-31A6-FCA8-EB000D380666"</span> <span class="nb">id</span><span class="o">=</span><span class="mi">27</span><span class="o">></span>
|
|
<span class="n">guid</span><span class="p">:</span> <span class="mi">172</span><span class="n">FF31C</span><span class="o">-</span><span class="mi">2</span><span class="n">D80</span><span class="o">-</span><span class="mi">31</span><span class="n">A6</span><span class="o">-</span><span class="n">FCA8</span><span class="o">-</span><span class="n">EB000D380666</span>
|
|
<span class="nb">id</span><span class="p">:</span> <span class="mi">27</span>
|
|
<span class="n">opcode</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">level</span><span class="p">:</span> <span class="mi">0</span>
|
|
<span class="n">data</span><span class="p">:</span> <span class="s1">'</span><span class="se">\x05</span><span class="s1">TRUETRUE'</span>
|
|
<span class="p">[</span><span class="o">...</span><span class="p">]</span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
<div class="section" id="enumeration">
|
|
<h3>18.22.2. Enumeration<a class="headerlink" href="#enumeration" title="Permalink to this headline">¶</a></h3>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
|
|
|
|
<span class="n">etwmgr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">etw</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"ETW Manager is: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">etwmgr</span><span class="p">))</span>
|
|
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Listing some ETW sessions:"</span><span class="p">)</span>
|
|
<span class="k">for</span> <span class="n">sess</span> <span class="ow">in</span> <span class="n">etwmgr</span><span class="o">.</span><span class="n">sessions</span><span class="p">[:</span><span class="mi">2</span><span class="p">]:</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sess</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * name: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sess</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * guid: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sess</span><span class="o">.</span><span class="n">guid</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * id: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sess</span><span class="o">.</span><span class="n">id</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * logfile: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sess</span><span class="o">.</span><span class="n">logfile</span><span class="p">))</span>
|
|
|
|
<span class="n">target_id</span> <span class="o">=</span> <span class="n">sess</span><span class="o">.</span><span class="n">id</span>
|
|
<span class="n">NB_MATCH</span> <span class="o">=</span> <span class="mi">0</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">""</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Looking for providers for: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sess</span><span class="p">))</span>
|
|
<span class="k">for</span> <span class="n">provider</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">etw</span><span class="o">.</span><span class="n">providers</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="n">NB_MATCH</span> <span class="o">==</span> <span class="mi">3</span><span class="p">:</span>
|
|
<span class="k">break</span>
|
|
<span class="k">for</span> <span class="n">instance</span> <span class="ow">in</span> <span class="n">provider</span><span class="o">.</span><span class="n">instances</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="n">NB_MATCH</span> <span class="o">==</span> <span class="mi">3</span><span class="p">:</span>
|
|
<span class="k">break</span>
|
|
<span class="k">for</span> <span class="n">session</span> <span class="ow">in</span> <span class="n">instance</span><span class="o">.</span><span class="n">sessions</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="n">session</span><span class="o">.</span><span class="n">LoggerId</span> <span class="o">==</span> <span class="n">target_id</span> <span class="ow">and</span> <span class="n">instance</span><span class="o">.</span><span class="n">Pid</span><span class="p">:</span>
|
|
<span class="n">proc</span> <span class="o">=</span> <span class="p">[</span><span class="n">p</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">processes</span> <span class="k">if</span> <span class="n">p</span><span class="o">.</span><span class="n">pid</span> <span class="o">==</span> <span class="n">instance</span><span class="o">.</span><span class="n">Pid</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">"Found a provider/session for target:"</span><span class="p">)</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Provider: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">provider</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Instance: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">instance</span><span class="p">))</span>
|
|
<span class="nb">print</span><span class="p">(</span><span class="s2">" * Process: </span><span class="si">{0}</span><span class="s2">"</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc</span><span class="p">))</span>
|
|
<span class="n">NB_MATCH</span> <span class="o">+=</span> <span class="mi">1</span>
|
|
<span class="k">if</span> <span class="n">NB_MATCH</span> <span class="o">==</span> <span class="mi">3</span><span class="p">:</span>
|
|
<span class="k">break</span>
|
|
<span class="k">break</span>
|
|
</pre></div>
|
|
</div>
|
|
<p>Output</p>
|
|
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span> <span class="n">python</span> <span class="n">etw</span>\<span class="n">etw_enumeration</span><span class="o">.</span><span class="n">py</span>
|
|
<span class="n">ETW</span> <span class="n">Manager</span> <span class="ow">is</span><span class="p">:</span> <span class="o"><</span><span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">event_trace</span><span class="o">.</span><span class="n">EtwManager</span> <span class="nb">object</span> <span class="n">at</span> <span class="mh">0x03AFBF70</span><span class="o">></span>
|
|
|
|
<span class="n">Listing</span> <span class="n">some</span> <span class="n">ETW</span> <span class="n">sessions</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EventTraceProperties</span> <span class="n">name</span><span class="o">=</span><span class="s2">"AppModel"</span> <span class="n">guid</span><span class="o">=</span><span class="n">A922A8BE</span><span class="o">-</span><span class="mi">2450</span><span class="o">-</span><span class="mf">438E-9520</span><span class="o">-</span><span class="n">FBCDFB46B0BD</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">name</span><span class="p">:</span> <span class="n">AppModel</span>
|
|
<span class="o">*</span> <span class="n">guid</span><span class="p">:</span> <span class="n">A922A8BE</span><span class="o">-</span><span class="mi">2450</span><span class="o">-</span><span class="mf">438E-9520</span><span class="o">-</span><span class="n">FBCDFB46B0BD</span>
|
|
<span class="o">*</span> <span class="nb">id</span><span class="p">:</span> <span class="mi">4</span>
|
|
<span class="o">*</span> <span class="n">logfile</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="o"><</span><span class="n">EventTraceProperties</span> <span class="n">name</span><span class="o">=</span><span class="s2">"LwtNetLog"</span> <span class="n">guid</span><span class="o">=</span><span class="mi">603</span><span class="n">BA31E</span><span class="o">-</span><span class="n">EC5A</span><span class="o">-</span><span class="mi">4</span><span class="n">CDE</span><span class="o">-</span><span class="n">BE87</span><span class="o">-</span><span class="n">ED0A16C3B170</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">name</span><span class="p">:</span> <span class="n">LwtNetLog</span>
|
|
<span class="o">*</span> <span class="n">guid</span><span class="p">:</span> <span class="mi">603</span><span class="n">BA31E</span><span class="o">-</span><span class="n">EC5A</span><span class="o">-</span><span class="mi">4</span><span class="n">CDE</span><span class="o">-</span><span class="n">BE87</span><span class="o">-</span><span class="n">ED0A16C3B170</span>
|
|
<span class="o">*</span> <span class="nb">id</span><span class="p">:</span> <span class="mi">14</span>
|
|
<span class="o">*</span> <span class="n">logfile</span><span class="p">:</span> <span class="n">C</span><span class="p">:</span>\<span class="n">WINDOWS</span>\<span class="n">System32</span>\<span class="n">LogFiles</span>\<span class="n">WMI</span>\<span class="n">LwtNetLog</span><span class="o">.</span><span class="n">etl</span>
|
|
|
|
<span class="n">Looking</span> <span class="k">for</span> <span class="n">providers</span> <span class="k">for</span><span class="p">:</span> <span class="o"><</span><span class="n">EventTraceProperties</span> <span class="n">name</span><span class="o">=</span><span class="s2">"LwtNetLog"</span> <span class="n">guid</span><span class="o">=</span><span class="mi">603</span><span class="n">BA31E</span><span class="o">-</span><span class="n">EC5A</span><span class="o">-</span><span class="mi">4</span><span class="n">CDE</span><span class="o">-</span><span class="n">BE87</span><span class="o">-</span><span class="n">ED0A16C3B170</span><span class="o">></span>
|
|
<span class="n">Found</span> <span class="n">a</span> <span class="n">provider</span><span class="o">/</span><span class="n">session</span> <span class="k">for</span> <span class="n">target</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">Provider</span><span class="p">:</span> <span class="o"><</span><span class="n">TraceProvider</span> <span class="k">for</span> <span class="s2">"43D1A55C-76D6-4F7E-995C-64C711E5CAFE"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Instance</span><span class="p">:</span> <span class="o"><</span><span class="n">TraceProviderInstanceInfo</span> <span class="n">Pid</span><span class="o">=</span><span class="mi">5256</span> <span class="n">EnableCount</span><span class="o">=</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Process</span><span class="p">:</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"RuntimeBroker.exe"</span> <span class="n">pid</span> <span class="mi">5256</span> <span class="n">at</span> <span class="mh">0x54c39d0</span><span class="o">></span>
|
|
<span class="n">Found</span> <span class="n">a</span> <span class="n">provider</span><span class="o">/</span><span class="n">session</span> <span class="k">for</span> <span class="n">target</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">Provider</span><span class="p">:</span> <span class="o"><</span><span class="n">TraceProvider</span> <span class="k">for</span> <span class="s2">"43D1A55C-76D6-4F7E-995C-64C711E5CAFE"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Instance</span><span class="p">:</span> <span class="o"><</span><span class="n">TraceProviderInstanceInfo</span> <span class="n">Pid</span><span class="o">=</span><span class="mi">10768</span> <span class="n">EnableCount</span><span class="o">=</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Process</span><span class="p">:</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"chrome.exe"</span> <span class="n">pid</span> <span class="mi">10768</span> <span class="n">at</span> <span class="mh">0x54c3930</span><span class="o">></span>
|
|
<span class="n">Found</span> <span class="n">a</span> <span class="n">provider</span><span class="o">/</span><span class="n">session</span> <span class="k">for</span> <span class="n">target</span><span class="p">:</span>
|
|
<span class="o">*</span> <span class="n">Provider</span><span class="p">:</span> <span class="o"><</span><span class="n">TraceProvider</span> <span class="k">for</span> <span class="s2">"43D1A55C-76D6-4F7E-995C-64C711E5CAFE"</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Instance</span><span class="p">:</span> <span class="o"><</span><span class="n">TraceProviderInstanceInfo</span> <span class="n">Pid</span><span class="o">=</span><span class="mi">10236</span> <span class="n">EnableCount</span><span class="o">=</span><span class="mi">1</span><span class="o">></span>
|
|
<span class="o">*</span> <span class="n">Process</span><span class="p">:</span> <span class="o"><</span><span class="n">WinProcess</span> <span class="s2">"YourPhone.exe"</span> <span class="n">pid</span> <span class="mi">10236</span> <span class="n">at</span> <span class="mh">0x54c37d0</span><span class="o">></span>
|
|
</pre></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
|
<div class="sphinxsidebarwrapper">
|
|
<h3><a href="index.html">Table of Contents</a></h3>
|
|
<ul>
|
|
<li><a class="reference internal" href="#">18. Samples of code</a><ul>
|
|
<li><a class="reference internal" href="#processes">18.1. Processes</a><ul>
|
|
<li><a class="reference internal" href="#windows-current-process">18.1.1. <code class="docutils literal notranslate"><span class="pre">windows.current_process</span></code></a></li>
|
|
<li><a class="reference internal" href="#remote-process-winprocess">18.1.2. Remote process : <code class="docutils literal notranslate"><span class="pre">WinProcess</span></code></a></li>
|
|
<li><a class="reference internal" href="#peb-exploration">18.1.3. <code class="docutils literal notranslate"><span class="pre">PEB</span></code> exploration</a></li>
|
|
<li><a class="reference internal" href="#apisetmap">18.1.4. ApiSetMap</a></li>
|
|
<li><a class="reference internal" href="#iat-hooking">18.1.5. IAT hooking</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#token">18.2. Token</a></li>
|
|
<li><a class="reference internal" href="#windows-system">18.3. <code class="docutils literal notranslate"><span class="pre">windows.system</span></code></a></li>
|
|
<li><a class="reference internal" href="#services">18.4. Services</a></li>
|
|
<li><a class="reference internal" href="#network-socket-exploration">18.5. <code class="docutils literal notranslate"><span class="pre">Network</span></code> - socket exploration</a></li>
|
|
<li><a class="reference internal" href="#registry">18.6. <code class="docutils literal notranslate"><span class="pre">Registry</span></code></a></li>
|
|
<li><a class="reference internal" href="#scheduled-tasks">18.7. Scheduled tasks</a></li>
|
|
<li><a class="reference internal" href="#event-log">18.8. Event Log</a></li>
|
|
<li><a class="reference internal" href="#object-manager">18.9. Object manager</a><ul>
|
|
<li><a class="reference internal" href="#find-objects">18.9.1. find objects</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#device-manager">18.10. Device manager</a><ul>
|
|
<li><a class="reference internal" href="#enumerate-devices">18.10.1. Enumerate devices</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-wintrust">18.11. <code class="docutils literal notranslate"><span class="pre">windows.wintrust</span></code></a></li>
|
|
<li><a class="reference internal" href="#vectoredexception">18.12. <code class="docutils literal notranslate"><span class="pre">VectoredException()</span></code></a><ul>
|
|
<li><a class="reference internal" href="#in-local-process">18.12.1. In local process</a></li>
|
|
<li><a class="reference internal" href="#in-remote-process">18.12.2. In remote process</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#debugging">18.13. Debugging</a><ul>
|
|
<li><a class="reference internal" href="#debugger">18.13.1. <code class="docutils literal notranslate"><span class="pre">Debugger</span></code></a><ul>
|
|
<li><a class="reference internal" href="#on-setup">18.13.1.1. on_setup</a></li>
|
|
<li><a class="reference internal" href="#single-stepping">18.13.1.2. Single stepping</a></li>
|
|
<li><a class="reference internal" href="#windows-debug-functioncallbp">18.13.1.3. <code class="docutils literal notranslate"><span class="pre">windows.debug.FunctionCallBP</span></code></a></li>
|
|
<li><a class="reference internal" href="#windows-debug-functionbp">18.13.1.4. <code class="docutils literal notranslate"><span class="pre">windows.debug.FunctionBP</span></code></a></li>
|
|
<li><a class="reference internal" href="#debugger-attach">18.13.1.5. <code class="docutils literal notranslate"><span class="pre">Debugger.attach</span></code></a></li>
|
|
<li><a class="reference internal" href="#native-code-tester">18.13.1.6. Native code tester</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#symboldebugger">18.13.2. <code class="docutils literal notranslate"><span class="pre">SymbolDebugger</span></code></a></li>
|
|
<li><a class="reference internal" href="#localdebugger">18.13.3. <code class="docutils literal notranslate"><span class="pre">LocalDebugger</span></code></a><ul>
|
|
<li><a class="reference internal" href="#in-current-process">18.13.3.1. In current process</a></li>
|
|
<li><a class="reference internal" href="#id1">18.13.3.2. In remote process</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#symbols">18.14. Symbols</a><ul>
|
|
<li><a class="reference internal" href="#virtualsymbolhandler">18.14.1. VirtualSymbolHandler</a></li>
|
|
<li><a class="reference internal" href="#processsymbolhandler">18.14.2. ProcessSymbolHandler</a></li>
|
|
<li><a class="reference internal" href="#symbol-search">18.14.3. Symbol search</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#wmi">18.15. WMI</a><ul>
|
|
<li><a class="reference internal" href="#wmi-requests">18.15.1. WMI requests</a></li>
|
|
<li><a class="reference internal" href="#wmi-create-process">18.15.2. WMI Create Process</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-com">18.16. <code class="docutils literal notranslate"><span class="pre">windows.com</span></code></a><ul>
|
|
<li><a class="reference internal" href="#inetfwpolicy2">18.16.1. <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code></a></li>
|
|
<li><a class="reference internal" href="#icallinterceptor">18.16.2. <code class="docutils literal notranslate"><span class="pre">ICallInterceptor</span></code></a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-crypto">18.17. <code class="docutils literal notranslate"><span class="pre">windows.crypto</span></code></a><ul>
|
|
<li><a class="reference internal" href="#encryption-demo">18.17.1. Encryption demo</a></li>
|
|
<li><a class="reference internal" href="#certificate-demo">18.17.2. Certificate demo</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-alpc">18.18. <code class="docutils literal notranslate"><span class="pre">windows.alpc</span></code></a><ul>
|
|
<li><a class="reference internal" href="#simple-alpc-communication">18.18.1. simple alpc communication</a></li>
|
|
<li><a class="reference internal" href="#advanced-alpc-communication">18.18.2. advanced alpc communication</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-rpc">18.19. <code class="docutils literal notranslate"><span class="pre">windows.rpc</span></code></a><ul>
|
|
<li><a class="reference internal" href="#manual-uac">18.19.1. Manual UAC</a></li>
|
|
<li><a class="reference internal" href="#manual-lsarenumerateprivileges">18.19.2. Manual <code class="docutils literal notranslate"><span class="pre">LsarEnumeratePrivileges</span></code></a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-pipe">18.20. <code class="docutils literal notranslate"><span class="pre">windows.pipe</span></code></a><ul>
|
|
<li><a class="reference internal" href="#communication-with-an-injected-process">18.20.1. Communication with an injected process</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#windows-security">18.21. <code class="docutils literal notranslate"><span class="pre">windows.security</span></code></a><ul>
|
|
<li><a class="reference internal" href="#security-descriptor">18.21.1. Security Descriptor</a></li>
|
|
<li><a class="reference internal" href="#query-sacl">18.21.2. Query SACL</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a class="reference internal" href="#etw-event-tracing-for-windows">18.22. ETW (Event Tracing for Windows)</a><ul>
|
|
<li><a class="reference internal" href="#trace-processing">18.22.1. Trace processing</a></li>
|
|
<li><a class="reference internal" href="#enumeration">18.22.2. Enumeration</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
|
|
<h4>Previous topic</h4>
|
|
<p class="topless"><a href="internals.html"
|
|
title="previous chapter">17. Internals</a></p>
|
|
<div role="note" aria-label="source link">
|
|
<h3>This Page</h3>
|
|
<ul class="this-page-menu">
|
|
<li><a href="_sources/sample.rst.txt"
|
|
rel="nofollow">Show Source</a></li>
|
|
</ul>
|
|
</div>
|
|
<div id="searchbox" style="display: none" role="search">
|
|
<h3>Quick search</h3>
|
|
<div class="searchformwrapper">
|
|
<form class="search" action="search.html" method="get">
|
|
<input type="text" name="q" />
|
|
<input type="submit" value="Go" />
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
|
<input type="hidden" name="area" value="default" />
|
|
</form>
|
|
</div>
|
|
</div>
|
|
<script type="text/javascript">$('#searchbox').show(0);</script>
|
|
</div>
|
|
</div>
|
|
<div class="clearer"></div>
|
|
</div>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="genindex.html" title="General Index"
|
|
>index</a></li>
|
|
<li class="right" >
|
|
<a href="py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="right" >
|
|
<a href="internals.html" title="17. Internals"
|
|
>previous</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> »</li>
|
|
</ul>
|
|
</div>
|
|
<div class="footer" role="contentinfo">
|
|
© Copyright 2015-2020, Clement Rouault.
|
|
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.8.5.
|
|
</div>
|
|
</body>
|
|
</html> |