mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
74 lines
2.5 KiB
Python
74 lines
2.5 KiB
Python
import pytest
|
|
import textwrap
|
|
|
|
import windows
|
|
import windows.generated_def as gdef
|
|
import windows.native_exec.simple_x86 as x86
|
|
import windows.native_exec.simple_x64 as x64
|
|
|
|
from pfwtest import *
|
|
|
|
pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
|
|
|
|
|
|
|
|
@process_syswow_only
|
|
class TestSyswowCurrentProcess(object):
|
|
def test_exec_syswow(self):
|
|
x64_code = x64.assemble("mov rax, 0x4040404040404040; mov r11, 0x0202020202020202; add rax, r11; ret")
|
|
res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
|
|
assert res == 0x4242424242424242
|
|
|
|
def test_self_pebsyswow(self):
|
|
peb64 = windows.current_process.peb_syswow
|
|
modules_names = [m.name for m in peb64.modules]
|
|
assert "wow64.dll" in modules_names
|
|
# Parsing
|
|
wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0]
|
|
assert "Wow64LdrpInitialize" in wow64.pe.exports
|
|
|
|
|
|
@windows_64bit_only
|
|
class TestSyswowRemoteProcess(object):
|
|
def test_remote_pebsyswow(self, proc32):
|
|
peb64 = proc32.peb_syswow
|
|
modules_names = [m.name for m in peb64.modules]
|
|
assert "wow64.dll" in modules_names
|
|
# Parsing
|
|
wow64 = [m for m in peb64.modules if m.name == "wow64.dll"][0]
|
|
assert "Wow64LdrpInitialize" in wow64.pe.exports
|
|
|
|
|
|
def test_getset_syswow_context(self, proc32):
|
|
addr = proc32.virtual_alloc(0x1000)
|
|
remote_python_code = """
|
|
import windows
|
|
import windows.native_exec.simple_x64 as x64
|
|
windows.utils.create_console()
|
|
x64_code = x64.assemble("mov r11, 0x1122334455667788; mov rax, 0x8877665544332211; mov [{0}], rax ;label :loop; jmp :loop; nop; nop; ret")
|
|
res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
|
|
print("res = {{0}}".format(hex(res)))
|
|
windows.current_process.write_qword({0}, res)
|
|
""".format(addr)
|
|
|
|
t = proc32.execute_python_unsafe(textwrap.dedent(remote_python_code))
|
|
# Wait for python execution
|
|
while proc32.read_qword(addr) != 0x8877665544332211:
|
|
pass
|
|
ctx = t.context_syswow
|
|
# Check the get context
|
|
assert ctx.R11 == 0x1122334455667788
|
|
assert proc32.read_memory(ctx.Rip, 2) == x64.assemble("label :loop; jmp :loop")
|
|
t.suspend()
|
|
proc32.write_memory(ctx.Rip, "\x90\x90")
|
|
# Check the set context
|
|
RETURN_VALUE = 0x4041424344454647
|
|
ctx.Rax = RETURN_VALUE
|
|
ctx.Rip += 2
|
|
t.set_syswow_context(ctx)
|
|
t.resume()
|
|
t.wait()
|
|
assert RETURN_VALUE == proc32.read_qword(addr)
|
|
|
|
|