mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Clement Rouault
85 lines
2.7 KiB
Python
85 lines
2.7 KiB
Python
import ctypes
|
|
import k32testing as kernel32proxy
|
|
import generated_def.windef as windef
|
|
import winobject
|
|
import copy
|
|
import native_exec
|
|
import generated_def.winstructs as winstructs
|
|
|
|
# Function resolution !
|
|
|
|
def swallow_ctypes_copy(ctypes_object):
|
|
new_copy = type(ctypes_object)()
|
|
ctypes.memmove(ctypes.byref(new_copy), ctypes.byref(ctypes_object), ctypes.sizeof(new_copy))
|
|
return new_copy
|
|
|
|
def get_func_addr(dll_name, func_name):
|
|
dll = ctypes.WinDLL(dll_name)
|
|
return kernel32proxy.GetProcAddress(dll._handle, func_name)
|
|
|
|
def enumerate_processes():
|
|
process_entry = winobject.WinProcess()
|
|
#process_entry = winstructs.PROCESSENTRY32()
|
|
process_entry.dwSize = ctypes.sizeof(process_entry)
|
|
snap = kernel32proxy.CreateToolhelp32Snapshot(windef.TH32CS_SNAPPROCESS, 0)
|
|
kernel32proxy.Process32First(snap, process_entry)
|
|
res = []
|
|
res.append(swallow_ctypes_copy(process_entry))
|
|
while kernel32proxy.Process32Next(snap, process_entry):
|
|
res.append(swallow_ctypes_copy(process_entry))
|
|
return res
|
|
|
|
def enumerate_threads():
|
|
thread_entry = winobject.WinThread()
|
|
thread_entry.dwSize = ctypes.sizeof(thread_entry)
|
|
snap = kernel32proxy.CreateToolhelp32Snapshot(windef.TH32CS_SNAPTHREAD, 0)
|
|
threads = []
|
|
kernel32proxy.Thread32First(snap, thread_entry)
|
|
threads.append(copy.copy(thread_entry))
|
|
while kernel32proxy.Thread32Next(snap, thread_entry):
|
|
threads.append(copy.copy(thread_entry))
|
|
return threads
|
|
|
|
class System(object):
|
|
|
|
@property
|
|
def processes(self):
|
|
return enumerate_processes()
|
|
|
|
@property
|
|
def threads(self):
|
|
return enumerate_threads()
|
|
|
|
class CurrentProcess(object):
|
|
get_peb = None
|
|
|
|
get_peb_32_code = '64a130000000c3'.decode('hex')
|
|
|
|
def get_peb_builtin(self):
|
|
if self.get_peb is not None:
|
|
return self.get_peb
|
|
get_peb = native_exec.create_function(self.get_peb_32_code, [winstructs.PVOID])
|
|
self.get_peb = get_peb
|
|
return get_peb
|
|
|
|
@property
|
|
def peb(self):
|
|
return winobject.PEB.from_address(self.get_peb_builtin()())
|
|
|
|
|
|
class VirtualProtected(object):
|
|
def __init__(self, addr, size, new_protect):
|
|
if (addr % 0x1000):
|
|
addr = addr - addr % 0x1000
|
|
self.addr = addr
|
|
self.size = size
|
|
self.new_protect = new_protect
|
|
|
|
def __enter__(self):
|
|
self.old_protect = winstructs.DWORD()
|
|
kernel32proxy.VirtualProtect(self.addr, self.size, self.new_protect, ctypes.byref(self.old_protect))
|
|
return self
|
|
|
|
def __exit__(self, exc_type, exc_value, traceback):
|
|
kernel32proxy.VirtualProtect(self.addr, self.size, self.old_protect.value, ctypes.byref(self.old_protect))
|
|
return False |