admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
feb76b48c355c7d74dddfd001b502199fb01bcd7
hakril-PythonForWindows/docs/build/html/_modules/windows/syswow64.html
T
hakril 979d1bd418 Regenerate doc with sphinx 1.5.5
2017-04-13 13:11:35 +02:00

386 lines
62 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>windows.syswow64 &#8212; PythonForWindows 0.2 documentation</title>
<link rel="stylesheet" href="../../_static/classic.css" type="text/css" />
<link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: '../../',
VERSION: '0.2',
COLLAPSE_INDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true,
SOURCELINK_SUFFIX: '.txt'
};
</script>
<script type="text/javascript" src="../../_static/jquery.js"></script>
<script type="text/javascript" src="../../_static/underscore.js"></script>
<script type="text/javascript" src="../../_static/doctools.js"></script>
<link rel="index" title="Index" href="../../genindex.html" />
<link rel="search" title="Search" href="../../search.html" />
</head>
<body role="document">
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.2 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<h1>Source code for windows.syswow64</h1><div class="highlight"><pre>
<span></span><span class="kn">import</span> <span class="nn">struct</span>
<span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">from</span> <span class="nn">ctypes</span> <span class="k">import</span> <span class="n">byref</span>
<span class="kn">import</span> <span class="nn">codecs</span>
<span class="kn">import</span> <span class="nn">functools</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
<span class="kn">from</span> <span class="nn">generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">process</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">winproxy</span>
<span class="kn">from</span> <span class="nn">winproxy</span> <span class="k">import</span> <span class="n">NeededParameter</span><span class="p">,</span> <span class="n">NtdllProxy</span><span class="p">,</span> <span class="n">error_ntstatus</span>
<span class="c1"># Special code for syswow64 process</span>
<span class="n">CS_32bits</span> <span class="o">=</span> <span class="mh">0x23</span>
<span class="n">CS_64bits</span> <span class="o">=</span> <span class="mh">0x33</span>
<span class="k">def</span> <span class="nf">generate_64bits_execution_stub_from_syswow</span><span class="p">(</span><span class="n">x64shellcode</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;shellcode must NOT end by a ret&quot;&quot;&quot;</span>
<span class="n">current_process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Calling generate_64bits_execution_stub_from_syswow from non-syswow process&quot;</span><span class="p">)</span>
<span class="n">transition64</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">transition64</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Call</span><span class="p">(</span><span class="s2">&quot;:TOEXEC&quot;</span><span class="p">)</span>
<span class="n">transition64</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s2">&quot;RDX&quot;</span><span class="p">,</span> <span class="s2">&quot;RAX&quot;</span><span class="p">)</span>
<span class="n">transition64</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Shr</span><span class="p">(</span><span class="s2">&quot;RDX&quot;</span><span class="p">,</span> <span class="mi">32</span><span class="p">)</span>
<span class="n">transition64</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Retf32</span><span class="p">()</span> <span class="c1"># 32 bits return addr</span>
<span class="n">transition64</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Label</span><span class="p">(</span><span class="s2">&quot;:TOEXEC&quot;</span><span class="p">)</span>
<span class="n">x64shellcodeaddr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">allocator</span><span class="o">.</span><span class="n">write_code</span><span class="p">(</span><span class="n">transition64</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span> <span class="o">+</span> <span class="n">x64shellcode</span><span class="p">)</span>
<span class="n">transition</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">transition</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Call</span><span class="p">(</span><span class="n">CS_64bits</span><span class="p">,</span> <span class="n">x64shellcodeaddr</span><span class="p">)</span>
<span class="n">transition</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">stubaddr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">allocator</span><span class="o">.</span><span class="n">write_code</span><span class="p">(</span><span class="n">transition</span><span class="o">.</span><span class="n">get_code</span><span class="p">())</span>
<span class="n">exec_stub</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">CFUNCTYPE</span><span class="p">(</span><span class="n">ULONG64</span><span class="p">)(</span><span class="n">stubaddr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">exec_stub</span>
<div class="viewcode-block" id="execute_64bits_code_from_syswow"><a class="viewcode-back" href="../../internals.html#windows.syswow64.execute_64bits_code_from_syswow">[docs]</a><span class="k">def</span> <span class="nf">execute_64bits_code_from_syswow</span><span class="p">(</span><span class="n">x64shellcode</span><span class="p">):</span>
<span class="k">return</span> <span class="n">generate_64bits_execution_stub_from_syswow</span><span class="p">(</span><span class="n">x64shellcode</span><span class="p">)()</span></div>
<div class="viewcode-block" id="generate_syswow64_call"><a class="viewcode-back" href="../../internals.html#windows.syswow64.generate_syswow64_call">[docs]</a><span class="k">def</span> <span class="nf">generate_syswow64_call</span><span class="p">(</span><span class="n">target</span><span class="p">):</span>
<span class="n">nb_args</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">prototype</span><span class="o">.</span><span class="n">_argtypes_</span><span class="p">)</span>
<span class="n">target_addr</span> <span class="o">=</span> <span class="n">get_syswow_ntdll_exports</span><span class="p">()[</span><span class="n">target</span><span class="o">.</span><span class="vm">__name__</span><span class="p">]</span>
<span class="n">argument_buffer_len</span> <span class="o">=</span> <span class="p">(</span><span class="n">nb_args</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span>
<span class="n">argument_buffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">allocator</span><span class="o">.</span><span class="n">reserve_size</span><span class="p">(</span><span class="n">argument_buffer_len</span><span class="p">)</span>
<span class="n">alignement_information</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">allocator</span><span class="o">.</span><span class="n">reserve_size</span><span class="p">(</span><span class="mi">8</span><span class="p">)</span>
<span class="n">nb_args_on_stack</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">nb_args</span> <span class="o">-</span> <span class="mi">4</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="c1"># Save registers</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RBX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RCX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RDX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RSI&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RDI&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R8&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R9&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R10&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R11&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R12&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R13&#39;</span><span class="p">)</span>
<span class="c1"># Alignment stuff :)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RCX&#39;</span><span class="p">,</span> <span class="s1">&#39;RSP&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">And</span><span class="p">(</span><span class="s1">&#39;RCX&#39;</span><span class="p">,</span> <span class="mh">0x0f</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="n">x64</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">alignement_information</span><span class="p">),</span> <span class="s1">&#39;RCX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Sub</span><span class="p">(</span><span class="s1">&#39;RSP&#39;</span><span class="p">,</span> <span class="s1">&#39;RCX&#39;</span><span class="p">)</span>
<span class="c1"># retrieve argument from the argument buffer</span>
<span class="k">if</span> <span class="n">nb_args</span> <span class="o">&gt;=</span> <span class="mi">1</span><span class="p">:</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RCX&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">create_displacement</span><span class="p">(</span><span class="n">disp</span><span class="o">=</span><span class="n">argument_buffer</span><span class="p">))</span>
<span class="k">if</span> <span class="n">nb_args</span> <span class="o">&gt;=</span> <span class="mi">2</span><span class="p">:</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RDX&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">create_displacement</span><span class="p">(</span><span class="n">disp</span><span class="o">=</span><span class="n">argument_buffer</span> <span class="o">+</span> <span class="p">(</span><span class="mi">8</span> <span class="o">*</span> <span class="mi">1</span><span class="p">)))</span>
<span class="k">if</span> <span class="n">nb_args</span> <span class="o">&gt;=</span> <span class="mi">3</span><span class="p">:</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;R8&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">create_displacement</span><span class="p">(</span><span class="n">disp</span><span class="o">=</span><span class="n">argument_buffer</span> <span class="o">+</span> <span class="p">(</span><span class="mi">8</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)))</span>
<span class="k">if</span> <span class="n">nb_args</span> <span class="o">&gt;=</span> <span class="mi">4</span><span class="p">:</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;R9&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">create_displacement</span><span class="p">(</span><span class="n">disp</span><span class="o">=</span><span class="n">argument_buffer</span> <span class="o">+</span> <span class="p">(</span><span class="mi">8</span> <span class="o">*</span> <span class="mi">3</span><span class="p">)))</span>
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">nb_args_on_stack</span><span class="p">):</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RAX&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">create_displacement</span><span class="p">(</span><span class="n">disp</span><span class="o">=</span><span class="n">argument_buffer</span> <span class="o">+</span> <span class="mi">8</span> <span class="o">*</span> <span class="p">(</span><span class="n">nb_args</span> <span class="o">-</span> <span class="mi">1</span> <span class="o">-</span> <span class="n">i</span><span class="p">)))</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RAX&#39;</span><span class="p">)</span>
<span class="c1"># reserve space for register (calling convention)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R9&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;R8&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RDX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Push</span><span class="p">(</span><span class="s1">&#39;RCX&#39;</span><span class="p">)</span>
<span class="c1"># Call</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;R13&#39;</span><span class="p">,</span> <span class="n">target_addr</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Call</span><span class="p">(</span><span class="s1">&#39;R13&#39;</span><span class="p">)</span>
<span class="c1"># Realign stack :)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s1">&#39;RSP&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">deref</span><span class="p">(</span><span class="n">alignement_information</span><span class="p">))</span>
<span class="c1"># Clean stack</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Add</span><span class="p">(</span><span class="s1">&#39;RSP&#39;</span><span class="p">,</span> <span class="p">(</span><span class="mi">4</span> <span class="o">+</span> <span class="n">nb_args_on_stack</span><span class="p">)</span> <span class="o">*</span> <span class="mi">8</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;R13&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;R12&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;R11&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;R10&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;R9&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;R8&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;RDI&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;RSI&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;RDX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;RCX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Pop</span><span class="p">(</span><span class="s1">&#39;RBX&#39;</span><span class="p">)</span>
<span class="n">code_64b</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="k">return</span> <span class="n">try_generate_stub_target</span><span class="p">(</span><span class="n">code_64b</span><span class="o">.</span><span class="n">get_code</span><span class="p">(),</span> <span class="n">argument_buffer</span><span class="p">,</span> <span class="n">target</span><span class="p">)</span></div>
<div class="viewcode-block" id="try_generate_stub_target"><a class="viewcode-back" href="../../internals.html#windows.syswow64.try_generate_stub_target">[docs]</a><span class="k">def</span> <span class="nf">try_generate_stub_target</span><span class="p">(</span><span class="n">shellcode</span><span class="p">,</span> <span class="n">argument_buffer</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;shellcode must NOT end by a ret&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Calling execute_64bits_code_from_syswow from non-syswow process&quot;</span><span class="p">)</span>
<span class="n">native_caller</span> <span class="o">=</span> <span class="n">generate_64bits_execution_stub_from_syswow</span><span class="p">(</span><span class="n">shellcode</span><span class="p">)</span>
<span class="n">native_caller</span><span class="o">.</span><span class="n">errcheck</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">errcheck</span>
<span class="c1"># Generate the wrapper function that fill the argument_buffer</span>
<span class="n">expected_arguments_number</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="n">prototype</span><span class="o">.</span><span class="n">_argtypes_</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">wrapper</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">):</span>
<span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">args</span><span class="p">)</span> <span class="o">!=</span> <span class="n">expected_arguments_number</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> syswow accept </span><span class="si">{1}</span><span class="s2"> args (</span><span class="si">{2}</span><span class="s2"> given)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">expected_arguments_number</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">args</span><span class="p">)))</span>
<span class="c1"># Transform args (ctypes byref possibly) to int</span>
<span class="n">writable_args</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">value</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">args</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">value</span><span class="p">,</span> <span class="p">(</span><span class="nb">int</span><span class="p">,</span> <span class="n">long</span><span class="p">)):</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">value</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">value</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">except</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">ArgumentError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">raise</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">ArgumentError</span><span class="p">(</span><span class="s2">&quot;Argument </span><span class="si">{0}</span><span class="s2">: wrong type &lt;</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">i</span><span class="p">,</span> <span class="nb">type</span><span class="p">(</span><span class="n">value</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
<span class="n">writable_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">value</span><span class="p">)</span>
<span class="c1"># Build buffer</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;&quot;</span> <span class="o">+</span> <span class="s2">&quot;Q&quot;</span> <span class="o">*</span> <span class="nb">len</span><span class="p">(</span><span class="n">writable_args</span><span class="p">),</span> <span class="o">*</span><span class="n">writable_args</span><span class="p">)</span>
<span class="n">ctypes</span><span class="o">.</span><span class="n">memmove</span><span class="p">(</span><span class="n">argument_buffer</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">))</span>
<span class="k">return</span> <span class="n">native_caller</span><span class="p">()</span>
<span class="n">wrapper</span><span class="o">.</span><span class="vm">__name__</span> <span class="o">=</span> <span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">&lt;syswow64&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,)</span>
<span class="n">wrapper</span><span class="o">.</span><span class="vm">__doc__</span> <span class="o">=</span> <span class="s2">&quot;This is a wrapper to </span><span class="si">{0}</span><span class="s2"> in 64b mode, it accept &lt;</span><span class="si">{1}</span><span class="s2">&gt; args&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">target</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">expected_arguments_number</span><span class="p">)</span>
<span class="k">return</span> <span class="n">wrapper</span></div>
<span class="k">def</span> <span class="nf">get_current_process_syswow_peb_addr</span><span class="p">():</span>
<span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov rax, gs:[0x60]; ret&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">execute_64bits_code_from_syswow</span><span class="p">(</span><span class="n">get_peb_64_code</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_current_process_syswow_peb</span><span class="p">():</span>
<span class="n">current_process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
<span class="k">class</span> <span class="nc">CurrentProcessReadSyswow</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
<span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="n">buffer_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
<span class="k">return</span> <span class="n">buffer_addr</span><span class="p">[:]</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">get_current_process_syswow_peb_addr</span><span class="p">()</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">RemotePEB64</span><span class="p">(</span><span class="n">peb_addr</span><span class="p">,</span> <span class="n">CurrentProcessReadSyswow</span><span class="p">())</span>
<span class="k">class</span> <span class="nc">ReadSyswow64Process</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="o">=</span> <span class="n">target</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_bitness</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">bitness</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="o">.</span><span class="n">handle</span>
<span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="n">buffer_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
<span class="k">return</span> <span class="n">buffer_addr</span><span class="p">[:]</span>
<span class="c1">#read_string = process.Process.read_string</span>
<span class="k">def</span> <span class="nf">get_syswow_ntdll_exports</span><span class="p">():</span>
<span class="k">if</span> <span class="n">get_syswow_ntdll_exports</span><span class="o">.</span><span class="n">value</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="n">get_syswow_ntdll_exports</span><span class="o">.</span><span class="n">value</span>
<span class="n">peb64</span> <span class="o">=</span> <span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
<span class="n">ntdll64</span> <span class="o">=</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">peb64</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">name</span> <span class="o">==</span> <span class="s2">&quot;ntdll.dll&quot;</span><span class="p">]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">ntdll64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not find ntdll.dll in syswow peb&quot;</span><span class="p">)</span>
<span class="n">ntdll64</span> <span class="o">=</span> <span class="n">ntdll64</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="n">exports</span> <span class="o">=</span> <span class="n">ntdll64</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">exports</span>
<span class="n">get_syswow_ntdll_exports</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="n">exports</span>
<span class="k">return</span> <span class="n">exports</span>
<span class="n">get_syswow_ntdll_exports</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="kc">None</span>
<div class="viewcode-block" id="Syswow64ApiProxy"><a class="viewcode-back" href="../../internals.html#windows.syswow64.Syswow64ApiProxy">[docs]</a><span class="k">class</span> <span class="nc">Syswow64ApiProxy</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Create a python wrapper around a function&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">winproxy_function</span><span class="p">):</span>
<span class="bp">self</span><span class="o">.</span><span class="n">winproxy_function</span> <span class="o">=</span> <span class="n">winproxy_function</span>
<span class="bp">self</span><span class="o">.</span><span class="n">raw_call</span> <span class="o">=</span> <span class="kc">None</span>
<span class="k">if</span> <span class="n">winproxy_function</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">params_name</span> <span class="o">=</span> <span class="p">[</span><span class="n">param</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span> <span class="k">for</span> <span class="n">param</span> <span class="ow">in</span> <span class="n">winproxy_function</span><span class="o">.</span><span class="n">params</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">__call__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">python_proxy</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">winproxy_function</span><span class="p">):</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">def</span> <span class="nf">force_resolution</span><span class="p">():</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">raw_call</span><span class="p">:</span>
<span class="k">return</span> <span class="kc">True</span>
<span class="k">try</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">raw_call</span> <span class="o">=</span> <span class="n">generate_syswow64_call</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">winproxy_function</span><span class="p">)</span>
<span class="k">except</span> <span class="ne">KeyError</span><span class="p">:</span>
<span class="k">raise</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">ExportNotFound</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">winproxy_function</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="s2">&quot;SysWow[ntdll64]&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">perform_call</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">):</span>
<span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">params_name</span><span class="p">)</span> <span class="o">!=</span> <span class="nb">len</span><span class="p">(</span><span class="n">args</span><span class="p">):</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;ERROR:&quot;</span><span class="p">)</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Expected params: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">params_name</span><span class="p">))</span>
<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Just Got params: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">))</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;I do not have all parameters: how is that possible ?&quot;</span><span class="p">)</span>
<span class="k">for</span> <span class="n">param_name</span><span class="p">,</span> <span class="n">param_value</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">params_name</span><span class="p">,</span> <span class="n">args</span><span class="p">):</span>
<span class="k">if</span> <span class="n">param_value</span> <span class="ow">is</span> <span class="n">NeededParameter</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">TypeError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">: Missing Mandatory parameter &lt;</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">winproxy_function</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">param_name</span><span class="p">))</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">raw_call</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">force_resolution</span><span class="p">()</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">raw_call</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">)</span>
<span class="nb">setattr</span><span class="p">(</span><span class="n">python_proxy</span><span class="p">,</span> <span class="s2">&quot;ctypes_function&quot;</span><span class="p">,</span> <span class="n">perform_call</span><span class="p">)</span>
<span class="nb">setattr</span><span class="p">(</span><span class="n">python_proxy</span><span class="p">,</span> <span class="s2">&quot;force_resolution&quot;</span><span class="p">,</span> <span class="n">force_resolution</span><span class="p">)</span>
<span class="k">return</span> <span class="n">python_proxy</span></div>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateThreadEx</span><span class="p">)</span>
<div class="viewcode-block" id="NtCreateThreadEx_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.NtCreateThreadEx_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">NtCreateThreadEx_32_to_64</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">DesiredAccess</span><span class="o">=</span><span class="mh">0x1fffff</span><span class="p">,</span> <span class="n">ObjectAttributes</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">ProcessHandle</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">CreateSuspended</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">dwStackSize</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">Unknown1</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">Unknown2</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">Unknown3</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="k">if</span> <span class="n">ThreadHandle</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ThreadHandle</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">HANDLE</span><span class="p">())</span>
<span class="k">return</span> <span class="n">NtCreateThreadEx_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="p">,</span> <span class="n">DesiredAccess</span><span class="p">,</span> <span class="n">ObjectAttributes</span><span class="p">,</span> <span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="p">,</span> <span class="n">lpParameter</span><span class="p">,</span> <span class="n">CreateSuspended</span><span class="p">,</span> <span class="n">dwStackSize</span><span class="p">,</span> <span class="n">Unknown1</span><span class="p">,</span> <span class="n">Unknown2</span><span class="p">,</span> <span class="n">Unknown3</span><span class="p">)</span></div>
<span class="n">ProcessBasicInformation</span> <span class="o">=</span> <span class="mi">0</span>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">)</span>
<div class="viewcode-block" id="NtQueryInformationProcess_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.NtQueryInformationProcess_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">ProcessInformationClass</span><span class="o">=</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">ProcessInformation</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">ProcessInformationLength</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="n">ProcessInformationLength</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ProcessInformation</span><span class="p">)</span>
<span class="k">if</span> <span class="nb">type</span><span class="p">(</span><span class="n">ProcessInformation</span><span class="p">)</span> <span class="o">==</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">:</span>
<span class="n">ProcessInformation</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">ProcessInformation</span><span class="p">)</span>
<span class="k">if</span> <span class="n">ReturnLength</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ReturnLength</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">ULONG</span><span class="p">())</span>
<span class="k">return</span> <span class="n">NtQueryInformationProcess_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">ProcessInformationClass</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="p">)</span></div>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">)</span>
<div class="viewcode-block" id="NtQueryInformationThread_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.NtQueryInformationThread_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="p">,</span> <span class="n">ThreadInformationClass</span><span class="p">,</span> <span class="n">ThreadInformation</span><span class="p">,</span> <span class="n">ThreadInformationLength</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">ReturnLength</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ReturnLength</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">ULONG</span><span class="p">())</span>
<span class="k">if</span> <span class="n">ThreadInformation</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">ThreadInformationLength</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="n">ThreadInformationLength</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ThreadInformation</span><span class="p">)</span>
<span class="k">return</span> <span class="n">NtQueryInformationThread_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="p">,</span> <span class="n">ThreadInformationClass</span><span class="p">,</span> <span class="n">ThreadInformation</span><span class="p">,</span> <span class="n">ThreadInformationLength</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="p">)</span></div>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryVirtualMemory</span><span class="p">)</span>
<div class="viewcode-block" id="NtQueryVirtualMemory_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.NtQueryVirtualMemory_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">MemoryInformationClass</span><span class="p">,</span> <span class="n">MemoryInformation</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">MemoryInformationLength</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">ReturnLength</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">ReturnLength</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">ULONG</span><span class="p">())</span>
<span class="k">if</span> <span class="n">MemoryInformation</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">MemoryInformationLength</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
<span class="n">MemoryInformationLength</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">MemoryInformation</span><span class="p">)</span>
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">MemoryInformation</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">MemoryInformation</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">MemoryInformation</span><span class="p">)</span>
<span class="k">return</span> <span class="n">NtQueryVirtualMemory_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">MemoryInformationClass</span><span class="p">,</span> <span class="n">MemoryInformation</span><span class="p">,</span> <span class="n">MemoryInformationLength</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="p">)</span></div>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtProtectVirtualMemory</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">NtProtectVirtualMemory_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">NumberOfBytesToProtect</span><span class="p">,</span> <span class="n">NewAccessProtection</span><span class="p">,</span> <span class="n">OldAccessProtection</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">OldAccessProtection</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">XOldAccessProtection</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">OldAccessProtection</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">XOldAccessProtection</span><span class="p">)</span>
<span class="k">return</span> <span class="n">NtProtectVirtualMemory_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">NumberOfBytesToProtect</span><span class="p">,</span> <span class="n">NewAccessProtection</span><span class="p">,</span> <span class="n">OldAccessProtection</span><span class="p">)</span>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtGetContextThread</span><span class="p">)</span>
<div class="viewcode-block" id="NtGetContextThread_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.NtGetContextThread_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">NtGetContextThread_32_to_64</span><span class="p">(</span><span class="n">hThread</span><span class="p">,</span> <span class="n">lpContext</span><span class="p">):</span>
<span class="k">if</span> <span class="nb">type</span><span class="p">(</span><span class="n">lpContext</span><span class="p">)</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="p">:</span>
<span class="n">lpContext</span> <span class="o">=</span> <span class="n">byref</span><span class="p">(</span><span class="n">lpContext</span><span class="p">)</span>
<span class="k">return</span> <span class="n">NtGetContextThread_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hThread</span><span class="p">,</span> <span class="n">lpContext</span><span class="p">)</span></div>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">LdrLoadDll</span><span class="p">)</span>
<div class="viewcode-block" id="LdrLoadDll_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.LdrLoadDll_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">LdrLoadDll_32_to_64</span><span class="p">(</span><span class="n">PathToFile</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">ModuleFileName</span><span class="p">,</span> <span class="n">ModuleHandle</span><span class="p">):</span>
<span class="k">return</span> <span class="n">LdrLoadDll_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">PathToFile</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">ModuleFileName</span><span class="p">,</span> <span class="n">ModuleHandle</span><span class="p">)</span></div>
<span class="nd">@Syswow64ApiProxy</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtSetContextThread</span><span class="p">)</span>
<div class="viewcode-block" id="NtSetContextThread_32_to_64"><a class="viewcode-back" href="../../internals.html#windows.syswow64.NtSetContextThread_32_to_64">[docs]</a><span class="k">def</span> <span class="nf">NtSetContextThread_32_to_64</span><span class="p">(</span><span class="n">hThread</span><span class="p">,</span> <span class="n">lpContext</span><span class="p">):</span>
<span class="k">return</span> <span class="n">NtSetContextThread_32_to_64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hThread</span><span class="p">,</span> <span class="n">lpContext</span><span class="p">)</span></div>
</pre></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<form class="search" action="../../search.html" method="get">
<div><input type="text" name="q" /></div>
<div><input type="submit" value="Go" /></div>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.2 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.5.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink