def test_getset_syswow_context(self, proc32):
        addr = proc32.virtual_alloc(0x1000)
        remote_python_code = """
        import windows
        import windows.native_exec.simple_x64 as x64
        x64_code = x64.assemble("mov r11, 0x1122334455667788; mov rax, 0x8877665544332211; mov [{0}], rax ;label :loop; jmp :loop; nop; nop; ret")
        res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
        windows.current_process.write_qword({0},  res)
        """.format(addr)

        t = proc32.execute_python_unsafe(textwrap.dedent(remote_python_code))
        # Wait for python execution
        while proc32.read_qword(addr) != 0x8877665544332211:
            pass
        ctx = t.context_syswow
        # Check the get context
        assert ctx.R11 == 0x1122334455667788
        assert proc32.read_memory(ctx.Rip,
                                  2) == x64.assemble("label :loop; jmp :loop")
        t.suspend()
        proc32.write_memory(ctx.Rip, "\x90\x90")
        # Check the set context
        RETURN_VALUE = 0x4041424344454647
        ctx.Rax = RETURN_VALUE
        ctx.Rip += 2
        t.set_syswow_context(ctx)
        t.resume()
        t.wait()
        assert RETURN_VALUE == proc32.read_qword(addr)
Beispiel #2
0
def test_code_x64(code, regs=None, raw=False, **kwargs):
    print("Testing x64 code")
    if windows.current_process.bitness == 32:
        raise ValueError("Cannot debug a 64b process from 32b python")
    process = windows.test.pop_proc_64(dwCreationFlags=DEBUG_PROCESS)
    if raw:
        code = code.replace(" ", "").decode('hex')
    else:
        code = x64.assemble(code)

    start_register = {}
    if regs:
        for name_value in regs.split(";"):
            name, value = name_value.split("=")
            name = name.strip().capitalize()
            if name == "Eflags":
                name = "EFlags"
            value = int(value.strip(), 0)
            start_register[name] = value

    x = CodeTesteur(process, code, start_register)
    x.loop()
Beispiel #3
0
def test_code_x64(raw=False):
    print("Testing x64 code")
    if windows.current_process.bitness == 32:
        raise ValueError("Cannot debug a 64b process from 32b python")
    process = windows.test.pop_calc_64(dwCreationFlags=DEBUG_PROCESS)
    if raw:
        code = sys.argv[1].replace(" ", "").decode('hex')
    else:
        code = x64.assemble(sys.argv[1])

    start_register = {}
    if len(sys.argv) > 2:
        for name_value in sys.argv[2].split(";"):
            name, value = name_value.split("=")
            name = name.strip().capitalize()
            if name == "Eflags":
                name = "EFlags"
            value = int(value.strip(), 0)
            start_register[name] = value


    x = CodeTesteur(process, code, start_register)
    x.loop()
def test_x64_32b_register_lower_upper():
    assert x64.assemble("mov eax, 42") == x64.assemble("mov EAX, 42")
    assert x64.Mov("eax", 42).get_code() == x64.Mov("EAX", 42).get_code()
    assert x64.assemble("mov Eax, [eAx + eaX * 4 + 12]")
 def test_exec_syswow(self):
     x64_code = x64.assemble(
         "mov rax, 0x4040404040404040; mov r11, 0x0202020202020202; add rax, r11; ret"
     )
     res = windows.syswow64.execute_64bits_code_from_syswow(x64_code)
     assert res == 0x4242424242424242
Beispiel #6
0
def get_current_process_syswow_peb_addr():
    get_peb_64_code = x64.assemble("mov rax, gs:[0x60]; ret")
    return execute_64bits_code_from_syswow(get_peb_64_code)
Beispiel #7
0
      )  ## Replaced calc.exe by notepad.exe cause of windows 10.
notepad = windows.utils.create_process(r"C:\windows\system32\notepad.exe")
# You don't need to do that in our case, but it's useful to now

print("Priting threads")
for th in notepad.threads:
    print("    * {0}".format(th))

print("Writing some code in memory")

if notepad.bitness == 32:
    code = "mov eax, 0x42424242; label :start ; jmp :start; nop; nop; ret"
    rawcode = x86.assemble(code)
else:
    code = "mov rax, 0x4242424242424242; label :start ; jmp :start; nop; nop; ret"
    rawcode = x64.assemble(code)

print("Allocating memory")
with notepad.allocated_memory(0x1000) as addr:
    print("Writing code at <{0:#x}>".format(addr))
    notepad.write_memory(addr, rawcode)

    print("Creating thread on injected code")
    t = notepad.create_thread(addr, 0x11223344)
    print("New thread is {0}".format(t))

    print("Suspending thread")
    t.suspend()

    ctx = t.context
    print("Thread context is {0}".format(ctx))
Beispiel #8
0
def get_current_process_syswow_peb_addr():
    get_peb_64_code = x64.assemble("mov rax, gs:[0x60]; ret")
    return execute_64bits_code_from_syswow(get_peb_64_code)