mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
214 lines
24 KiB
HTML
214 lines
24 KiB
HTML
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|
<title>windows.hooks — PythonForWindows 0.6 documentation</title>
|
|
<link rel="stylesheet" href="../../_static/classic.css" type="text/css" />
|
|
<link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
|
|
<link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css" />
|
|
|
|
<script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
|
|
<script type="text/javascript" src="../../_static/jquery.js"></script>
|
|
<script type="text/javascript" src="../../_static/underscore.js"></script>
|
|
<script type="text/javascript" src="../../_static/doctools.js"></script>
|
|
<script type="text/javascript" src="../../_static/language_data.js"></script>
|
|
|
|
<link rel="index" title="Index" href="../../genindex.html" />
|
|
<link rel="search" title="Search" href="../../search.html" />
|
|
</head><body>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="../../genindex.html" title="General Index"
|
|
accesskey="I">index</a></li>
|
|
<li class="right" >
|
|
<a href="../../py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.6 documentation</a> »</li>
|
|
<li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> »</li>
|
|
</ul>
|
|
</div>
|
|
|
|
<div class="document">
|
|
<div class="documentwrapper">
|
|
<div class="bodywrapper">
|
|
<div class="body" role="main">
|
|
|
|
<h1>Source code for windows.hooks</h1><div class="highlight"><pre>
|
|
<span></span><span class="kn">import</span> <span class="nn">sys</span>
|
|
<span class="kn">import</span> <span class="nn">ctypes</span>
|
|
|
|
<span class="kn">import</span> <span class="nn">windows</span>
|
|
<span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
|
|
<span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">native_exec</span>
|
|
<span class="kn">from</span> <span class="nn">.generated_def</span> <span class="kn">import</span> <span class="n">winfuncs</span>
|
|
<span class="kn">from</span> <span class="nn">.generated_def.windef</span> <span class="kn">import</span> <span class="n">PAGE_EXECUTE_READWRITE</span>
|
|
<span class="kn">from</span> <span class="nn">.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
|
|
|
|
<span class="c1"># TODO Not a big fan of importing 'meta' every load</span>
|
|
<span class="c1"># Should do an Hook API that take the winproxy function (not generate every hook possible)</span>
|
|
<span class="kn">import</span> <span class="nn">windows.generated_def.meta</span>
|
|
|
|
|
|
<div class="viewcode-block" id="Callback"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.Callback">[docs]</a><span class="k">class</span> <span class="nc">Callback</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="sd">"""Give type information to hook callback"""</span>
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">types</span><span class="p">):</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">types</span> <span class="o">=</span> <span class="n">types</span>
|
|
|
|
<span class="k">def</span> <span class="fm">__call__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">func</span><span class="p">):</span>
|
|
<span class="n">func</span><span class="o">.</span><span class="n">_types_info</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">types</span>
|
|
<span class="k">return</span> <span class="n">func</span></div>
|
|
|
|
|
|
<span class="k">class</span> <span class="nc">KnownCallback</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="n">types</span> <span class="o">=</span> <span class="p">()</span>
|
|
|
|
<span class="k">def</span> <span class="fm">__call__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">func</span><span class="p">):</span>
|
|
<span class="n">func</span><span class="o">.</span><span class="n">_types_info</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">types</span>
|
|
<span class="k">return</span> <span class="n">func</span>
|
|
|
|
|
|
<span class="k">def</span> <span class="nf">add_callback_to_module</span><span class="p">(</span><span class="n">callback</span><span class="p">):</span>
|
|
<span class="nb">setattr</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">modules</span><span class="p">[</span><span class="vm">__name__</span><span class="p">],</span> <span class="nb">type</span><span class="p">(</span><span class="n">callback</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">callback</span><span class="p">)</span>
|
|
|
|
<span class="c1"># Generate IATCallback decorator for all known functions</span>
|
|
|
|
|
|
|
|
<span class="k">for</span> <span class="n">func</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">generated_def</span><span class="o">.</span><span class="n">meta</span><span class="o">.</span><span class="n">functions</span><span class="p">:</span>
|
|
<span class="n">prototype</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">winfuncs</span><span class="p">,</span> <span class="n">func</span> <span class="o">+</span> <span class="s2">"Prototype"</span><span class="p">)</span>
|
|
<span class="n">callback_name</span> <span class="o">=</span> <span class="n">func</span> <span class="o">+</span> <span class="s2">"Callback"</span>
|
|
|
|
<span class="k">class</span> <span class="nc">CallBackDeclaration</span><span class="p">(</span><span class="n">KnownCallback</span><span class="p">):</span>
|
|
<span class="n">types</span> <span class="o">=</span> <span class="p">(</span><span class="n">prototype</span><span class="o">.</span><span class="n">_restype_</span><span class="p">,)</span> <span class="o">+</span> <span class="n">prototype</span><span class="o">.</span><span class="n">_argtypes_</span>
|
|
|
|
<span class="n">CallBackDeclaration</span><span class="o">.</span><span class="vm">__name__</span> <span class="o">=</span> <span class="n">callback_name</span>
|
|
<span class="n">add_callback_to_module</span><span class="p">(</span><span class="n">CallBackDeclaration</span><span class="p">())</span>
|
|
|
|
|
|
<div class="viewcode-block" id="IATHook"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook">[docs]</a><span class="k">class</span> <span class="nc">IATHook</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
|
|
<span class="sd">"""Look at my hook <3"""</span>
|
|
|
|
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">IAT_entry</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">types</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">callback</span><span class="p">,</span> <span class="s2">"_types_info"</span><span class="p">):</span>
|
|
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">"Callback for IATHook has no type infomations"</span><span class="p">)</span>
|
|
<span class="n">types</span> <span class="o">=</span> <span class="n">callback</span><span class="o">.</span><span class="n">_types_info</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">original_types</span> <span class="o">=</span> <span class="n">types</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">callback_types</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transform_arguments</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">original_types</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span> <span class="o">=</span> <span class="n">IAT_entry</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">callback</span> <span class="o">=</span> <span class="n">callback</span>
|
|
<span class="c1">## No more circular ref -> but stub is destroyed -> segv :(</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">stub</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="bp">self</span><span class="o">.</span><span class="n">callback_types</span><span class="p">)(</span><span class="bp">self</span><span class="o">.</span><span class="n">hook_callback</span><span class="p">)</span>
|
|
<span class="c1"># stub = ctypes.WINFUNCTYPE(*self.callback_types)(self.hook_callback)</span>
|
|
<span class="c1"># self.stub_addr = ctypes.cast(stub, PVOID) # Same problem as keep stub... (GC..)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">stub</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span> <span class="c1"># Same problem as keep stub... (GC..)</span>
|
|
<span class="c1"># IAT_entry.stub = stub</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">realfunction</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="n">types</span><span class="p">)(</span><span class="n">IAT_entry</span><span class="o">.</span><span class="n">nonhookvalue</span><span class="p">)</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span>
|
|
|
|
<span class="k">def</span> <span class="nf">transform_arguments</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">types</span><span class="p">):</span>
|
|
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="k">for</span> <span class="nb">type</span> <span class="ow">in</span> <span class="n">types</span><span class="p">:</span>
|
|
<span class="k">if</span> <span class="nb">type</span> <span class="ow">in</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar_p</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">):</span>
|
|
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="nb">type</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">res</span>
|
|
|
|
<div class="viewcode-block" id="IATHook.enable"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook.enable">[docs]</a> <span class="k">def</span> <span class="nf">enable</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
|
<span class="sd">"""Enable the IAT hook: you MUST keep a reference to the IATHook while the hook is enabled"""</span>
|
|
<span class="k">with</span> <span class="n">utils</span><span class="o">.</span><span class="n">VirtualProtected</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">),</span> <span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">True</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span></div>
|
|
|
|
<div class="viewcode-block" id="IATHook.disable"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook.disable">[docs]</a> <span class="k">def</span> <span class="nf">disable</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
|
|
<span class="sd">"""Disable the IAT hook"""</span>
|
|
<span class="k">with</span> <span class="n">utils</span><span class="o">.</span><span class="n">VirtualProtected</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">),</span> <span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">nonhookvalue</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span>
|
|
<span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span></div>
|
|
|
|
<span class="k">def</span> <span class="nf">hook_callback</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
|
|
<span class="n">adapted_args</span> <span class="o">=</span> <span class="p">[]</span>
|
|
<span class="k">for</span> <span class="n">value</span><span class="p">,</span> <span class="nb">type</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">original_types</span><span class="p">[</span><span class="mi">1</span><span class="p">:]):</span>
|
|
<span class="k">if</span> <span class="nb">type</span> <span class="o">==</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar_p</span><span class="p">:</span>
|
|
<span class="n">adapted_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar_p</span><span class="p">(</span><span class="n">value</span><span class="p">))</span>
|
|
<span class="k">elif</span> <span class="nb">type</span> <span class="o">==</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">:</span>
|
|
<span class="n">adapted_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char_p</span><span class="p">((</span><span class="n">value</span><span class="p">)))</span>
|
|
<span class="k">else</span><span class="p">:</span>
|
|
<span class="n">adapted_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">value</span><span class="p">)</span>
|
|
|
|
<span class="k">def</span> <span class="nf">real_function</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">):</span>
|
|
<span class="k">if</span> <span class="n">args</span> <span class="o">==</span> <span class="p">():</span>
|
|
<span class="n">args</span> <span class="o">=</span> <span class="n">adapted_args</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">realfunction</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">callback</span><span class="p">(</span><span class="o">*</span><span class="n">adapted_args</span><span class="p">,</span> <span class="n">real_function</span><span class="o">=</span><span class="n">real_function</span><span class="p">)</span></div>
|
|
|
|
<span class="c1">## New simple hook API based on winproxy</span>
|
|
<span class="k">def</span> <span class="nf">setup_hook</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">hook</span><span class="p">,</span> <span class="n">dll_to_hook</span><span class="p">):</span>
|
|
<span class="s2">"TODO: Test and doc :D"</span>
|
|
<span class="n">dll_name</span><span class="p">,</span> <span class="n">api_name</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">get_target</span><span class="p">(</span><span class="n">target</span><span class="p">)</span>
|
|
<span class="n">prototype</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">prototype</span>
|
|
<span class="n">hook</span><span class="o">.</span><span class="n">_types_info</span> <span class="o">=</span> <span class="p">(</span><span class="n">prototype</span><span class="o">.</span><span class="n">_restype_</span><span class="p">,)</span> <span class="o">+</span> <span class="n">prototype</span><span class="o">.</span><span class="n">_argtypes_</span>
|
|
|
|
<span class="k">if</span> <span class="ow">not</span> <span class="n">dll_name</span><span class="o">.</span><span class="n">endswith</span><span class="p">(</span><span class="s2">".dll"</span><span class="p">):</span>
|
|
<span class="n">dll_name</span> <span class="o">+=</span> <span class="s2">".dll"</span>
|
|
<span class="c1"># Get the peb of our process</span>
|
|
<span class="n">peb</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">peb</span>
|
|
<span class="c1"># Get the dll_to_hook</span>
|
|
<span class="n">module_to_hook</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span> <span class="o">==</span> <span class="n">dll_to_hook</span><span class="o">.</span><span class="n">lower</span><span class="p">()][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="c1"># Get the iat entries for DLL dll_name</span>
|
|
<span class="n">adv_imports</span> <span class="o">=</span> <span class="n">module_to_hook</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">imports</span><span class="p">[</span><span class="n">dll_name</span><span class="p">]</span>
|
|
<span class="c1"># Get RegOpenKeyExA iat entry</span>
|
|
<span class="n">iat</span> <span class="o">=</span> <span class="p">[</span><span class="n">n</span> <span class="k">for</span> <span class="n">n</span> <span class="ow">in</span> <span class="n">adv_imports</span> <span class="k">if</span> <span class="n">n</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="n">api_name</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>
|
|
<span class="n">iat</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">hook</span><span class="p">)</span>
|
|
<span class="k">return</span> <span class="n">iat</span>
|
|
</pre></div>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
|
<div class="sphinxsidebarwrapper">
|
|
<div id="searchbox" style="display: none" role="search">
|
|
<h3>Quick search</h3>
|
|
<div class="searchformwrapper">
|
|
<form class="search" action="../../search.html" method="get">
|
|
<input type="text" name="q" />
|
|
<input type="submit" value="Go" />
|
|
<input type="hidden" name="check_keywords" value="yes" />
|
|
<input type="hidden" name="area" value="default" />
|
|
</form>
|
|
</div>
|
|
</div>
|
|
<script type="text/javascript">$('#searchbox').show(0);</script>
|
|
</div>
|
|
</div>
|
|
<div class="clearer"></div>
|
|
</div>
|
|
<div class="related" role="navigation" aria-label="related navigation">
|
|
<h3>Navigation</h3>
|
|
<ul>
|
|
<li class="right" style="margin-right: 10px">
|
|
<a href="../../genindex.html" title="General Index"
|
|
>index</a></li>
|
|
<li class="right" >
|
|
<a href="../../py-modindex.html" title="Python Module Index"
|
|
>modules</a> |</li>
|
|
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.6 documentation</a> »</li>
|
|
<li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> »</li>
|
|
</ul>
|
|
</div>
|
|
<div class="footer" role="contentinfo">
|
|
© Copyright 2015-2020, Clement Rouault.
|
|
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.8.5.
|
|
</div>
|
|
</body>
|
|
</html> |