def show(search = None, wide = True):
'show a table with the list of services'
# Take a snapshot of the running processes.
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort()
if not pid_list:
print "Unknown error enumerating processes!"
return
# Get the filename of each process.
filenames = dict()
for pid in pid_list:
p = s.get_process(pid)
# Special process IDs.
# PID 0: System Idle Process. Also has a special meaning to the
# toolhelp APIs (current process).
# PID 4: System Integrity Group. See this forum post for more info:
# http://tinyurl.com/ycza8jo
# (points to social.technet.microsoft.com)
# Only on XP and above
# PID 8: System (?) only in Windows 2000 and below AFAIK.
# It's probably the same as PID 4 in XP and above.
if pid in (0, 4, 8):
fileName = ""
# Get the filename for all other processes.
else:
fileName = p.get_filename()
if fileName:
fileName = PathOperations.pathname_to_filename(fileName)
else:
fileName = ""
# Remember the filename.
filenames[pid] = fileName
# Make the search string lowercase if given.
if search is not None:
search = search.lower()
# Get the list of services.
try:
services = System.get_services()
except WindowsError, e:
print str(e)
return
def show(search=None, wide=True):
'show a table with the list of services'
# Take a snapshot of the running processes.
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort()
if not pid_list:
print "Unknown error enumerating processes!"
return
# Get the filename of each process.
filenames = dict()
for pid in pid_list:
p = s.get_process(pid)
# Special process IDs.
# PID 0: System Idle Process. Also has a special meaning to the
# toolhelp APIs (current process).
# PID 4: System Integrity Group. See this forum post for more info:
# http://tinyurl.com/ycza8jo
# (points to social.technet.microsoft.com)
# Only on XP and above
# PID 8: System (?) only in Windows 2000 and below AFAIK.
# It's probably the same as PID 4 in XP and above.
if pid in (0, 4, 8):
fileName = ""
# Get the filename for all other processes.
else:
fileName = p.get_filename()
if fileName:
fileName = PathOperations.pathname_to_filename(fileName)
else:
fileName = ""
# Remember the filename.
filenames[pid] = fileName
# Make the search string lowercase if given.
if search is not None:
search = search.lower()
# Get the list of services.
try:
services = System.get_services()
except WindowsError, e:
print str(e)
return
def find_hook_pid( procname ):
global gpid
global xp
global oldpid
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort(reverse=True)
if not pid_list:
print "Unknown error enumerating processes!"
# s = raw_input()
sys.exit(1)
for pid in pid_list:
p = s.get_process(pid)
fileName = p.get_filename()
fname = str(fileName).lower()
if dev:
print "Process:", fname, "Pid:", pid
if fname.find(procname) >= 0:
if int(pid) != int(gpid):
oldpid = gpid
gpid = pid
if procname.find("svchost.exe") >= 0:
gpid = int(get_svchost_pid())
return gpid
elif procname.find("explorer.exe") >= 0:
gpid = int(get_explorer_pid())
return gpid
else:
return pid
return 0
class Main(object):
def __init__(self, argv):
self.argv = argv
def parse_cmdline(self):
# An empty command line causes the help message to be shown
if len(self.argv) == 1:
self.argv = self.argv + ['-h']
# Usage string
usage = "%prog [options] <target process IDs or names...>"
self.parser = optparse.OptionParser(usage=usage)
# Options to set the search method
search = optparse.OptionGroup(
self.parser, "What to search",
"(at least one of these switches must be used)")
search.add_option("-s",
"--string",
action="append",
metavar="VALUE",
help="where VALUE is case sensitive text")
search.add_option("-i",
"--istring",
action="append",
metavar="VALUE",
help="where VALUE is case insensitive text")
search.add_option("-x",
"--hexa",
action="append",
metavar="VALUE",
help="where VALUE is hexadecimal data")
search.add_option("-p",
"--pattern",
action="append",
metavar="VALUE",
help="where VALUE is an hexadecimal pattern")
self.parser.add_option_group(search)
# Options to control the search internals
engine = optparse.OptionGroup(self.parser, "How to search")
engine.add_option("-m", "--memory-pages",
action="store", type="int", metavar="NUMBER",
help="maximum number of consecutive memory pages" \
" to read (matches larger than this won't" \
" be found) " \
"[default: 2, use 0 for no limit]")
self.parser.add_option_group(engine)
# Options to set the output type
output = optparse.OptionGroup(self.parser, "What to show")
output.add_option("-v",
"--verbose",
action="store_true",
dest="verbose",
help="verbose output")
output.add_option("-q",
"--quiet",
action="store_false",
dest="verbose",
help="brief output [default]")
self.parser.add_option_group(output)
# Default values
self.parser.set_defaults(
string=[],
istring=[],
hexa=[],
pattern=[],
regexp=[],
memory_pages=2,
verbose=False,
)
# Parse the command line and check for validity
(self.options, self.targets) = self.parser.parse_args(self.argv)
# Our script's filename is not a target, skip it
self.targets = self.targets[1:]
# Fail if no search query was entered
if not self.options.string and \
not self.options.istring and \
not self.options.hexa and \
not self.options.pattern:
self.parser.error("at least one search switch must be used")
def prepare_input(self):
# Build the lists of search objects
self.build_searchers_list(StringSearch)
self.build_searchers_list(TextSearch)
self.build_searchers_list(HexSearch)
self.build_searchers_list(PatternSearch)
# Build the list of target pids
self.build_targets_list()
def build_searchers_list(self, cls):
searchers = getattr(self.options, cls.name)
for index in range(len(searchers)):
try:
searchers[index] = cls(searchers[index], index)
except Exception as e:
msg = cls.init_error_msg(index, searchers[index], e)
self.parser.error(msg)
def build_targets_list(self):
# Take a process snapshot
self.system = System()
self.system.request_debug_privileges()
self.system.scan_processes()
# If no targets were given, search on all processes
if not self.targets:
self.targets = self.system.get_process_ids()
# If targets were given, search only on those processes
else:
expanded_targets = set()
for token in self.targets:
try:
pid = HexInput.integer(token)
if not self.system.has_process(pid):
self.parser.error("process not found: %s" % token)
expanded_targets.add(pid)
except ValueError:
found = self.system.find_processes_by_filename(token)
pidlist = [process.get_pid() for (process, _) in found]
if not pidlist:
self.parser.error("process not found: %s" % token)
expanded_targets.update(pidlist)
self.targets = list(expanded_targets)
# Sort the targets list
self.targets.sort()
def do_search(self):
# For each target process...
for self.pid in self.targets:
# Try to open the process, skip on error
try:
self.process = Process(self.pid)
self.process.get_handle()
except WindowsError:
print("Can't open process %d, skipping" % self.pid)
if self.options.verbose:
print
continue
# Get a list of allocated memory regions
memory = list()
for mbi in self.process.get_memory_map():
if mbi.State == win32.MEM_COMMIT and \
not mbi.Protect & win32.PAGE_GUARD:
memory.append((mbi.BaseAddress, mbi.RegionSize))
# If no allocation limit is set,
# read entire regions and search on them
if self.options.memory_pages <= 0:
for (address, size) in memory:
try:
data = self.process.read(address, size)
except WindowsError as e:
begin = HexDump.address(address)
end = HexDump.address(address + size)
msg = "Error reading %s-%s: %s"
msg = msg % (begin, end, str(e))
print(msg)
if self.options.verbose:
print
continue
self.search_block(data, address, 0)
# If an allocation limit is set,
# read blocks within regions to search
else:
step = self.system.pageSize
size = step * self.options.memory_pages
for (address, total_size) in memory:
try:
end = address + total_size
shift = 0
buffer = self.process.read(address,
min(size, total_size))
while 1:
self.search_block(buffer, address, shift)
shift = step
address = address + step
if address >= end:
break
buffer = buffer[step:]
buffer = buffer + self.process.read(address, step)
except WindowsError as e:
begin = HexDump.address(address)
end = HexDump.address(address + total_size)
msg = "Error reading %s-%s: %s"
msg = msg % (begin, end, str(e))
print(msg)
if self.options.verbose:
print
def search_block(self, data, address, shift):
self.search_block_with(self.options.string, data, address, shift)
self.search_block_with(self.options.istring, data, address, shift)
self.search_block_with(self.options.hexa, data, address, shift)
self.search_block_with(self.options.pattern, data, address, shift)
def search_block_with(self, searchers_list, data, address, shift):
for searcher in searchers_list:
if shift == 0:
searcher.restart()
else:
searcher.shift(shift)
while 1:
searcher.search(data)
if not searcher.found():
break
if self.options.verbose:
print(searcher.message(self.pid, address - shift, data))
print
else:
print(searcher.message(self.pid, address - shift))
def run(self):
# Banner
print("Process memory finder")
print("by Mario Vilas (mvilas at gmail.com)")
print
# Parse the command line
self.parse_cmdline()
# Prepare the input
self.prepare_input()
# Perform the search on the selected targets
self.do_search()
def main(argv):
'Main function.'
# Print the banner.
print "Process enumerator"
print "by Mario Vilas (mvilas at gmail.com)"
print
# Parse the command line options.
(options, argv) = parse_cmdline(argv)
showFilenameOnly = not options.full_path
searchString = options.search
# Windows filenames are case insensitive.
if searchString:
searchString = searchString.lower()
# Take a snapshot of the running processes.
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
if not showFilenameOnly:
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort()
if not pid_list:
print "Unknown error enumerating processes!"
return
# Get the filename of each process.
filenames = dict()
for pid in pid_list:
p = s.get_process(pid)
fileName = p.get_filename()
# Special process IDs.
# PID 0: System Idle Process. Also has a special meaning to the
# toolhelp APIs (current process).
# PID 4: System Integrity Group. See this forum post for more info:
# http://tinyurl.com/ycza8jo
# (points to social.technet.microsoft.com)
# Only on XP and above
# PID 8: System (?) only in Windows 2000 and below AFAIK.
# It's probably the same as PID 4 in XP and above.
if pid == 0:
fileName = "[System Idle Process]"
elif pid == 4:
fileName = "[System Integrity Group]"
elif pid == 8:
fileName = "[System]"
# Filename not available.
elif not fileName:
fileName = ""
# Get the process pathname instead, if requested.
elif showFilenameOnly:
fileName = PathOperations.pathname_to_filename(fileName)
# Filter the output with the search string.
if searchString and searchString not in fileName.lower():
continue
# Remember the filename.
filenames[pid] = fileName
# Get the window captions if requested.
# TODO: show window handles too if possible
captions = dict()
if options.windows:
for w in s.get_windows():
try:
pid = w.get_pid()
text = w.get_text()
except WindowsError:
continue
try:
captions[pid].add(text)
except KeyError:
capset = set()
capset.add(text)
captions[pid] = capset
# Get the services if requested.
services = dict()
if options.services:
try:
for descriptor in s.get_services():
try:
services[descriptor.ProcessId].add(descriptor.ServiceName)
except KeyError:
srvset = set()
srvset.add(descriptor.ServiceName)
services[descriptor.ProcessId] = srvset
except WindowsError, e:
print "Error getting the list of services: %s" % str(e)
return
def main(argv):
'Main function.'
# Print the banner.
print "Process enumerator"
print "by Mario Vilas (mvilas at gmail.com)"
print
# Parse the command line options.
(options, argv) = parse_cmdline(argv)
showFilenameOnly = not options.full_path
searchString = options.search
# Windows filenames are case insensitive.
if searchString:
searchString = searchString.lower()
# Take a snapshot of the running processes.
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
if not showFilenameOnly:
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort()
if not pid_list:
print "Unknown error enumerating processes!"
return
# Get the filename of each process.
filenames = dict()
for pid in pid_list:
p = s.get_process(pid)
fileName = p.get_filename()
# Special process IDs.
# PID 0: System Idle Process. Also has a special meaning to the
# toolhelp APIs (current process).
# PID 4: System Integrity Group. See this forum post for more info:
# http://tinyurl.com/ycza8jo
# (points to social.technet.microsoft.com)
# Only on XP and above
# PID 8: System (?) only in Windows 2000 and below AFAIK.
# It's probably the same as PID 4 in XP and above.
if pid == 0:
fileName = "[System Idle Process]"
elif pid == 4:
fileName = "[System Integrity Group]"
elif pid == 8:
fileName = "[System]"
# Filename not available.
elif not fileName:
fileName = ""
# Get the process pathname instead, if requested.
elif showFilenameOnly:
fileName = PathOperations.pathname_to_filename(fileName)
# Filter the output with the search string.
if searchString and searchString not in fileName.lower():
continue
# Remember the filename.
filenames[pid] = fileName
# Get the window captions if requested.
# TODO: show window handles too if possible
captions = dict()
if options.windows:
for w in s.get_windows():
try:
pid = w.get_pid()
text = w.get_text()
except WindowsError:
continue
try:
captions[pid].add(text)
except KeyError:
capset = set()
capset.add(text)
captions[pid] = capset
# Get the services if requested.
services = dict()
if options.services:
try:
for descriptor in s.get_services():
try:
services[descriptor.ProcessId].add(descriptor.ServiceName)
except KeyError:
srvset = set()
srvset.add(descriptor.ServiceName)
services[descriptor.ProcessId] = srvset
except WindowsError, e:
print "Error getting the list of services: %s" % str(e)
return
def main(argv):
'Main function.'
# Print the banner.
print("Process enumerator")
print("by Mario Vilas (mvilas at gmail.com)")
print()
# Parse the command line options.
(options, argv) = parse_cmdline(argv)
showFilenameOnly = not options.full_path
searchString = options.search
# Windows filenames are case insensitive.
if searchString:
searchString = searchString.lower()
# Take a snapshot of the running processes.
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
if not showFilenameOnly:
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort()
if not pid_list:
print("Unknown error enumerating processes!")
return
# Get the filename of each process.
filenames = dict()
for pid in pid_list:
p = s.get_process(pid)
fileName = p.get_filename()
# Special process IDs.
# PID 0: System Idle Process. Also has a special meaning to the
# toolhelp APIs (current process).
# PID 4: System Integrity Group. See this forum post for more info:
# http://tinyurl.com/ycza8jo
# (points to social.technet.microsoft.com)
# Only on XP and above
# PID 8: System (?) only in Windows 2000 and below AFAIK.
# It's probably the same as PID 4 in XP and above.
if pid == 0:
fileName = "[System Idle Process]"
elif pid == 4:
fileName = "[System Integrity Group]"
elif pid == 8:
fileName = "[System]"
# Filename not available.
elif not fileName:
fileName = ""
# Get the process pathname instead, if requested.
elif showFilenameOnly:
fileName = PathOperations.pathname_to_filename(fileName)
# Filter the output with the search string.
if searchString and searchString not in fileName.lower():
continue
# Remember the filename.
filenames[pid] = fileName
# Get the window captions if requested.
# TODO: show window handles too if possible
captions = dict()
if options.windows:
for w in s.get_windows():
try:
pid = w.get_pid()
text = w.get_text()
except WindowsError:
continue
try:
captions[pid].add(text)
except KeyError:
capset = set()
capset.add(text)
captions[pid] = capset
# Get the services if requested.
services = dict()
if options.services:
try:
for descriptor in s.get_services():
try:
services[descriptor.ProcessId].add(descriptor.ServiceName)
except KeyError:
srvset = set()
srvset.add(descriptor.ServiceName)
services[descriptor.ProcessId] = srvset
except WindowsError as e:
print("Error getting the list of services: %s" % str(e))
return
if options.format == "auto":
if options.windows or options.services:
options.format = "long"
if options.format != "long":
headers = [" PID", "Filename"]
if options.windows:
headers.append("Windows")
if options.services:
headers.append("Services")
table = Table()
table.addRow(*headers)
for pid in pid_list:
if pid in filenames:
fileName = filenames[pid]
caplist = sorted(captions.get(pid, set()))
srvlist = sorted(services.get(pid, set()))
if options.windows and options.services:
if len(caplist) < len(srvlist):
caplist.extend([''] * (len(srvlist) - len(caplist)))
elif len(srvlist) < len(caplist):
srvlist.extend([''] * (len(caplist) - len(srvlist)))
if len(caplist):
table.addRow(' %d' % pid, fileName, caplist[0],
srvlist[0])
for i in range(1, len(caplist)):
table.addRow('', '', caplist[i], srvlist[i])
else:
table.addRow(' %d' % pid, fileName, '', '')
elif options.windows:
if len(caplist):
table.addRow(' %d' % pid, fileName, caplist[0])
for i in range(1, len(caplist)):
table.addRow('', '', caplist[i])
else:
table.addRow(' %d' % pid, fileName, '')
elif options.services:
if len(srvlist):
table.addRow(' %d' % pid, fileName, srvlist[0])
for i in range(1, len(srvlist)):
table.addRow('', '', srvlist[i])
else:
table.addRow(' %d' % pid, fileName, '')
else:
table.addRow(' %d' % pid, fileName)
table.justify(0, 1)
if options.format == "auto" and table.getWidth() >= 80:
options.format = "long"
else:
table.show()
if options.format == "long":
# If it doesn't fit, build a new table of only two rows. The first row
# contains the headers and the second row the data. Insert an empty row
# between each process.
need_empty_row = False
table = Table()
for pid in pid_list:
if pid in filenames:
if need_empty_row:
table.addRow()
else:
need_empty_row = True
table.addRow("PID:", pid)
fileName = filenames[pid]
if fileName:
table.addRow("Filename:", fileName)
caplist = sorted(captions.get(pid, set()))
if caplist:
caption = caplist.pop(0)
table.addRow("Windows:", caption)
for caption in caplist:
table.addRow('', caption)
srvlist = sorted(services.get(pid, set()))
if srvlist:
srvname = srvlist.pop(0)
table.addRow("Services:", srvname)
for srvname in srvlist:
table.addRow('', srvname)
table.justify(0, 1)
table.show()
def show(search=None, wide=True):
'show a table with the list of services'
# Take a snapshot of the running processes.
s = System()
s.request_debug_privileges()
try:
s.scan_processes()
s.scan_process_filenames()
except WindowsError:
s.scan_processes_fast()
pid_list = s.get_process_ids()
pid_list.sort()
if not pid_list:
print("Unknown error enumerating processes!")
return
# Get the filename of each process.
filenames = dict()
for pid in pid_list:
p = s.get_process(pid)
# Special process IDs.
# PID 0: System Idle Process. Also has a special meaning to the
# toolhelp APIs (current process).
# PID 4: System Integrity Group. See this forum post for more info:
# http://tinyurl.com/ycza8jo
# (points to social.technet.microsoft.com)
# Only on XP and above
# PID 8: System (?) only in Windows 2000 and below AFAIK.
# It's probably the same as PID 4 in XP and above.
if pid in (0, 4, 8):
fileName = ""
# Get the filename for all other processes.
else:
fileName = p.get_filename()
if fileName:
fileName = PathOperations.pathname_to_filename(fileName)
else:
fileName = ""
# Remember the filename.
filenames[pid] = fileName
# Make the search string lowercase if given.
if search is not None:
search = search.lower()
# Get the list of services.
try:
services = System.get_services()
except WindowsError as e:
print(str(e))
return
# Convert the list of services to a list of rows.
data = []
for descriptor in services:
# Filter out services that don't match the search string if given.
if search is not None and \
not search in descriptor.ServiceName.lower() and \
not search in descriptor.DisplayName.lower():
continue
# Status.
if descriptor.CurrentState == win32.SERVICE_CONTINUE_PENDING:
status = "Resuming..."
elif descriptor.CurrentState == win32.SERVICE_PAUSE_PENDING:
status = "Pausing..."
elif descriptor.CurrentState == win32.SERVICE_PAUSED:
status = "Paused"
elif descriptor.CurrentState == win32.SERVICE_RUNNING:
status = "Running"
elif descriptor.CurrentState == win32.SERVICE_START_PENDING:
status = "Starting..."
elif descriptor.CurrentState == win32.SERVICE_STOP_PENDING:
status = "Stopping..."
elif descriptor.CurrentState == win32.SERVICE_STOPPED:
status = "Stopped"
# Type.
if descriptor.ServiceType & win32.SERVICE_INTERACTIVE_PROCESS:
type = 'Win32 GUI'
elif descriptor.ServiceType & win32.SERVICE_WIN32:
type = 'Win32'
elif descriptor.ServiceType & win32.SERVICE_DRIVER:
type = 'Driver'
else:
type = 'Unknown'
# Process ID.
try:
pid = descriptor.ProcessId
if pid:
pidStr = str(pid)
else:
pidStr = ""
except AttributeError:
pid = None
pidStr = ""
# Filename.
fileName = filenames.get(pid, "")
# Append the row.
data.append((descriptor.ServiceName, descriptor.DisplayName, status,
type, pidStr, fileName))
# Sort the rows.
data = sorted(data)
# Build the table and print it.
if wide:
headers = ("Service", "Display name", "Status", "Type", "PID", "Path")
table = Table()
table.addRow(*headers)
separator = ['-' * len(x) for x in headers]
table.addRow(*separator)
for row in data:
table.addRow(*row)
table.show()
else:
need_empty_line = False
for (name, disp, status, type, pidStr, path) in data:
if need_empty_line:
print()
else:
need_empty_line = True
print("Service name: %s" % name)
if disp:
print("Display name: %s" % disp)
print("Current status: %s" % status)
print("Service type: %s" % type)
if pidStr:
pid = int(pidStr)
print("Process ID: %d (0x%x)" % (pid, pid))
if path:
print("Host filename: %s" % path)