o
    Žõ±jÃ[  ã                   @   sŽ  d dl T d ZdZdZdZdZdZdZdZd	Z	d
Z
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZeZd Z dZ!dZ"G dd „ d e#ƒZ$G d!d"„ d"e%ƒZ&d#d$„ Z'G d%d&„ d&e(ƒZ)e*e)ƒZ+d'd(„ Z,d)d*„ Z-d+d,„ Z.dXd.d/„Z/d0d1„ Z0d2d3„ Z1d4d5„ Z2d6d7„ Z3d8d9„ Z4G d:d;„ d;e(ƒZ5e*e5ƒZ6e7Z8e8Z9d<Z:dZ;dZ<dZ=d-Z>d Z?dZ@d=ZAdZBd>ZCd?ZDd@ZEdZFe>e<B ZGe?e<B e=B ZHe@e<B ZIeAe;B e<B ZJeBe<B ZKeCe;B e<B ZLeDe;B e<B ZMeEe<B ZNd ZOdZPdZQG dAdB„ dBe(ƒZRe*eRƒZSG dCdD„ dDe(ƒZTe*eTƒZUG dEdF„ dFe(ƒZVe*eVƒZWG dGdH„ dHe(ƒZXe*eXƒZYG dIdJ„ dJe(ƒZZe*eZƒZ[efdKdL„Z\d-efdMdN„Z]d-deeB efdOdP„Z^dQdR„ Z_dSdT„ Z`dUdV„ ZadWS )Yé   )Ú*é   é   é   é   é    é@   é€   é   i   i   é   i    i @  i €  i   i   i   i   i   i    i  @ i    l        i  € i   i   i   i   i  c                   @   s^   e Zd ZdZeZdd„ Zedd„ ƒZe	dd„ ƒZ
edd	„ ƒZed
d„ ƒZdd„ Zddd„ZdS )ÚUserModeHandleab  
	Base class for non-kernel handles. Generally this means they are closed
	by special Win32 API functions instead of CloseHandle() and some standard
	operations (synchronizing, duplicating, inheritance) are not supported.
	@type _TYPE: C type
	@cvar _TYPE: C type to translate this handle to.
		Subclasses should override this.
		Defaults to L{HANDLE}.
	c                 C   ó   t ƒ ‚©N©ÚNotImplementedError©Úself© r   ú§/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/local/function_defs/kernel32.pyÚ_closeU   ó   zUserModeHandle._closec                 C   s   |   | j¡S r   )Ú_TYPEÚvaluer   r   r   r   Ú_as_parameter_Y   ó   zUserModeHandle._as_parameter_c                 C   s   t  t j¡S r   )r   r   r   )r   r   r   r   Ú
from_param^   r   zUserModeHandle.from_paramc                 C   ó   dS ©NFr   r   r   r   r   Úinheritc   ó   zUserModeHandle.inheritc                 C   r   r   r   r   r   r   r   ÚprotectFromCloseh   r   zUserModeHandle.protectFromClosec                 C   r   r   r   r   r   r   r   Údupm   r   zUserModeHandle.dupNc                 C   r   r   r   )r   ÚdwMillisecondsr   r   r   Úwaitq   r   zUserModeHandle.waitr   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚHANDLEr   r   Úpropertyr   Ústaticmethodr   r   r    r!   r#   r   r   r   r   r   F   s    



r   c                   @   sÒ   e Zd ZdZeeB eB eB eB e	B Z
eeB eB e	B Zee	B ZeeB eB eB ZeeB Zd!dd„Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ ZdS )"ÚMemoryBasicInformationz<
	Memory information object returned by L{VirtualQueryEx}.
	Nc                 C   sš   |du rd| _ d| _d| _d| _d| _d| _d| _dS |j | _ |j| _|j| _|j| _|j| _|j| _|j| _t|dƒr@|j| _t|dƒrK|j	| _dS dS )z¹
		@type  mbi: L{MEMORY_BASIC_INFORMATION} or L{MemoryBasicInformation}
		@param mbi: Either a L{MEMORY_BASIC_INFORMATION} structure or another
			L{MemoryBasicInformation} instance.
		NÚcontentÚfilename)
ÚBaseAddressÚAllocationBaseÚAllocationProtectÚ
RegionSizeÚStateÚProtectÚTypeÚhasattrr,   r-   )r   Úmbir   r   r   Ú__init__›   s(   


ÿzMemoryBasicInformation.__init__c                 C   s"   | j |  ko| j | j k S   S )zþ
		Test if the given memory address falls within this memory region.
		@type  address: int
		@param address: Memory address to test.
		@rtype:  bool
		@return: C{True} if the given memory address falls within this memory
			region, C{False} otherwise.
		)r.   r1   )r   Úaddressr   r   r   Ú__contains__¹   s   "	z#MemoryBasicInformation.__contains__c                 C   ó
   | j tkS )zL
		@rtype:  bool
		@return: C{True} if the memory in this region is free.
		)r2   ÚMEM_FREEr   r   r   r   Úis_freeÄ   ó   
zMemoryBasicInformation.is_freec                 C   r:   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is reserved.
		)r2   ÚMEM_RESERVEr   r   r   r   Úis_reservedË   r=   z"MemoryBasicInformation.is_reservedc                 C   r:   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is commited.
		)r2   Ú
MEM_COMMITr   r   r   r   Úis_commitedÒ   r=   z"MemoryBasicInformation.is_commitedc                 C   r:   )zf
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to an executable
			image.
		)r4   Ú	MEM_IMAGEr   r   r   r   Úis_imageÙ   s   
zMemoryBasicInformation.is_imagec                 C   r:   )z]
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to a mapped file.
		)r4   Ú
MEM_MAPPEDr   r   r   r   Ú	is_mappedá   r=   z MemoryBasicInformation.is_mappedc                 C   r:   )zO
		@rtype:  bool
		@return: C{True} if the memory in this region is private.
		)r4   ÚMEM_PRIVATEr   r   r   r   Ú
is_privateè   r=   z!MemoryBasicInformation.is_privatec                 C   s   |   ¡ o
t| jt@ ƒS )zS
		@rtype:  bool
		@return: C{True} if all pages in this region are guard pages.
		)rA   Úboolr3   Ú
PAGE_GUARDr   r   r   r   Úis_guardï   s   zMemoryBasicInformation.is_guardc                 C   s   |   ¡ ot| jttB @ ƒ S )zW
		@rtype:  bool
		@return: C{True} if the memory in this region has any data in it.
		)rA   rH   r3   rI   ÚPAGE_NOACCESSr   r   r   r   Úhas_contentö   s   z"MemoryBasicInformation.has_contentc                 C   ó   |   ¡ ot| j| j@ ƒS )zP
		@rtype:  bool
		@return: C{True} if all pages in this region are readable.
		)rL   rH   r3   ÚREADABLEr   r   r   r   Úis_readableý   ó   z"MemoryBasicInformation.is_readablec                 C   rM   )zQ
		@rtype:  bool
		@return: C{True} if all pages in this region are writeable.
		)rL   rH   r3   Ú	WRITEABLEr   r   r   r   Úis_writeable  rP   z#MemoryBasicInformation.is_writeablec                 C   rM   )a   
		@rtype:  bool
		@return: C{True} if all pages in this region are marked as
			copy-on-write. This means the pages are writeable, but changes
			are not propagated to disk.
		@note:
			Tipically data sections in executable images are marked like this.
		)rL   rH   r3   ÚCOPY_ON_WRITEr   r   r   r   Úis_copy_on_write  s   	z'MemoryBasicInformation.is_copy_on_writec                 C   rM   )z�
		@rtype:  bool
		@return: C{True} if all pages in this region are executable.
		@note: Executable pages are always readable.
		)rL   rH   r3   Ú
EXECUTABLEr   r   r   r   Úis_executable  s   z$MemoryBasicInformation.is_executablec                 C   rM   )zÉ
		@rtype:  bool
		@return: C{True} if all pages in this region are executable and
			writeable.
		@note: The presence of such pages make memory corruption
			vulnerabilities much easier to exploit.
		)rL   rH   r3   ÚEXECUTABLE_AND_WRITEABLEr   r   r   r   Úis_executable_and_writeable  s   z2MemoryBasicInformation.is_executable_and_writeabler   )r$   r%   r&   r'   ÚPAGE_EXECUTE_READÚPAGE_EXECUTE_READWRITEÚPAGE_EXECUTE_WRITECOPYÚPAGE_READONLYÚPAGE_READWRITEÚPAGE_WRITECOPYrN   rQ   rS   ÚPAGE_EXECUTErU   rW   r7   r9   r<   r?   rA   rC   rE   rG   rJ   rL   rO   rR   rT   rV   rX   r   r   r   r   r+   u   sj    ÿþýüûÿ
ÿþýÿÿÿÿþýÿÿÿ
r+   c                  C   ó   t jj} g | _t| _| ƒ S r   )ÚwindllÚkernel32ÚGetLastErrorÚargtypesÚDWORDÚrestype)Ú_GetLastErrorr   r   r   rc   *  ó   rc   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	ÚMEMORY_BASIC_INFORMATIONr.   r/   r0   r1   r2   r3   r4   N)r$   r%   r&   ÚSIZE_Tre   Ú_fields_r   r   r   r   ri   9  s    ùri   c                 C   s<   t | dƒr
|  ¡  ntjj}tg|_t|_t	|_
|| ƒ d S )NÚclose)r5   rl   ra   rb   ÚCloseHandler(   rd   rH   rf   ÚRaiseIfZeroÚerrcheck)ÚhHandleÚ_CloseHandler   r   r   rm   I  s   

rm   c                  C   r`   r   )ra   rb   ÚGetCurrentProcessIdrd   re   rf   )Ú_GetCurrentProcessIdr   r   r   rr   V  rh   rr   c                  C   r`   r   )ra   rb   ÚGetCurrentProcessrd   r(   rf   )Ú_GetCurrentProcessr   r   r   rt   ]  s   rt   é    c                 C   s¤   t jj}ttttg|_t|_	t
}	 t|ƒ}t d|jd ¡}|| ||t|ƒƒ}|r8d|j  k r7|k r8	 |jS  tƒ }|tkrDt |¡‚|d }|dkrQt |¡‚q)Nr   Ú rv   r
   r   )ra   rb   ÚQueryFullProcessImageNameWr(   re   ÚLPWSTRÚPDWORDrd   rH   rf   ÚMAX_PATHÚctypesÚcreate_unicode_bufferr   Úbyrefrc   ÚERROR_INSUFFICIENT_BUFFERÚWinError)ÚhProcessÚdwFlagsÚ_QueryFullProcessImageNameWÚdwSizeÚlpdwSizeÚ	lpExeNameÚsuccessÚerrorr   r   r   rx   j  s&   	ö

órx   c                 C   s>   t jj}tttg|_t|_|| t|ƒ|ƒ}|t	krt
 ¡ ‚|S r   )ra   rb   ÚOpenProcessre   ÚBOOLrd   r(   rf   rH   ÚNULLr|   r€   )ÚdwDesiredAccessÚbInheritHandleÚdwProcessIdÚ_OpenProcessr�   r   r   r   r‰   …  s   r‰   c                 C   sn   t jj}ttttttƒg|_t|_	t
 |¡}tdƒ}|| |||t|ƒƒ}|s/tƒ tkr/t
 ¡ ‚|jd |j… S ©Nrv   )ra   rb   ÚReadProcessMemoryr(   ÚLPVOIDrj   ÚPOINTERrd   rH   rf   r|   Úcreate_string_bufferr~   rc   ÚERROR_PARTIAL_COPYr€   Úrawr   )r�   ÚlpBaseAddressÚnSizeÚ_ReadProcessMemoryÚlpBufferÚlpNumberOfBytesReadr‡   r   r   r   r‘   —  s   
r‘   c                 C   sl   t jj}ttttttƒg|_t|_	t
|ƒ}t |¡}tdƒ}|| |||t|ƒƒ}|s3tƒ tkr3t ¡ ‚|jS r�   )ra   rb   ÚWriteProcessMemoryr(   r’   rj   r“   rd   rH   rf   Úlenr|   r”   r~   rc   r•   r€   r   )r�   r—   rš   Ú_WriteProcessMemoryr˜   ÚlpNumberOfBytesWrittenr‡   r   r   r   rœ   ª  s   
rœ   c                 C   sT   t jj}ttttg|_t|_t	ƒ }t
t	ƒ}|| |t|ƒ|ƒ}|dkr&t ¡ ‚t|ƒS r�   )ra   rb   ÚVirtualQueryExr(   r’   ÚPMEMORY_BASIC_INFORMATIONrj   rd   rf   ri   Úsizeofr~   r|   r€   r+   )r�   Ú	lpAddressÚ_VirtualQueryExrš   ÚdwLengthr‡   r   r   r   r    ¾  s   r    c                 C   s6   t jj}tg|_t|_|| ƒ}|tkrt ¡  d S d S r   )	ra   rb   Ú	LocalFreeÚHLOCALrd   rf   r‹   r|   r€   )ÚhMemÚ
_LocalFreeÚresultr   r   r   r¦   Í  s   ÿr¦   c                   @   s"   e Zd ZdefdefdefgZdS )ÚSECURITY_ATTRIBUTESÚnLengthÚlpSecurityDescriptorr�   N)r$   r%   r&   re   r’   rŠ   rk   r   r   r   r   r«   Þ  s
    ýr«   iÿÿ  é   é   é   é   c                   @   s(   e Zd ZdefdefdefdefgZdS )ÚPROCESS_INFORMATIONr�   ÚhThreadrŽ   Ú
dwThreadIdN)r$   r%   r&   r(   re   rk   r   r   r   r   r²     s    ür²   c                   @   ó|   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefgZdS )ÚSTARTUPINFOÚcbÚ
lpReservedÚ	lpDesktopÚlpTitleÚdwXÚdwYÚdwXSizeÚdwYSizeÚdwXCountCharsÚdwYCountCharsÚdwFillAttributer‚   ÚwShowWindowÚcbReserved2ÚlpReserved2Ú	hStdInputÚ
hStdOutputÚ	hStdErrorN)	r$   r%   r&   re   ÚLPSTRÚWORDr’   r(   rk   r   r   r   r   r¶   /  ó(    îr¶   c                   @   ó   e Zd ZdefdefgZdS )ÚSTARTUPINFOEXÚStartupInfoÚlpAttributeListN)r$   r%   r&   r¶   ÚPPROC_THREAD_ATTRIBUTE_LISTrk   r   r   r   r   rÌ   J  ó    þrÌ   c                   @   rµ   )ÚSTARTUPINFOWr·   r¸   r¹   rº   r»   r¼   r½   r¾   r¿   rÀ   rÁ   r‚   rÂ   rÃ   rÄ   rÅ   rÆ   rÇ   N)	r$   r%   r&   re   ry   rÉ   r’   r(   rk   r   r   r   r   rÑ   Q  rÊ   rÑ   c                   @   rË   )ÚSTARTUPINFOEXWrÍ   rÎ   N)r$   r%   r&   rÑ   rÏ   rk   r   r   r   r   rÒ   h  rÐ   rÒ   c                 C   sF   t jj}tttttg|_t	|_
t|_tdƒ}|| |||t|ƒƒ |jS r�   )ra   rb   ÚVirtualProtectExr(   r’   rj   re   rz   rd   rH   rf   rn   ro   r~   r   )r�   r£   r„   ÚflNewProtectÚ_VirtualProtectExÚflOldProtectr   r   r   rÓ   x  s   rÓ   c                 C   s4   t jj}ttttg|_t|_	t
|_|| |||ƒ d S r   )ra   rb   ÚVirtualFreeExr(   r’   rj   re   rd   rH   rf   rn   ro   )r�   r£   r„   Ú
dwFreeTypeÚ_VirtualFreeExr   r   r   r×   ˆ  s
   r×   c                 C   sB   t jj}tttttg|_t|_|| ||||ƒ}|t	krt
 ¡ ‚|S r   )ra   rb   ÚVirtualAllocExr(   r’   rj   re   rd   rf   r‹   r|   r€   )r�   r£   r„   ÚflAllocationTypeÚ	flProtectÚ_VirtualAllocExr   r   r   rÚ   –  s   rÚ   c           	   	   C   sj   t jj}tttttttg|_	t|_
|sd }nt|ƒ}tdƒ}|| |||||t|ƒƒ}|s0t ¡ ‚||jfS r�   )ra   rb   ÚCreateRemoteThreadr(   ÚLPSECURITY_ATTRIBUTESrj   r’   re   ÚLPDWORDrd   rf   r~   r|   r€   r   )	r�   ÚlpThreadAttributesÚdwStackSizeÚlpStartAddressÚlpParameterÚdwCreationFlagsÚ_CreateRemoteThreadr´   r³   r   r   r   rÞ   ª  s   
rÞ   c                 C   sª   t jj}ttg|_t|_t|ƒtdƒtdƒfv r)t|ƒ}|jd@ r(t	d|j ƒ‚n't|ƒtdƒkr:t
 | d¡¡}nt|ƒtdƒkrHt
 |¡}nttt|ƒƒƒ‚|| |ƒS )Nrv   i  ÿÿzOrdinal number too large: %drw   Úasciió    )ra   rb   ÚGetProcAddressÚHMODULEr’   rd   rf   Útyper   Ú
ValueErrorr|   r”   ÚencodeÚc_char_pÚ	TypeErrorÚstr)ÚhModuleÚ
lpProcNameÚ_GetProcAddressr   r   r   ÚGetProcAddressW¹  s   

ÿ
rô   c                 C   s2   t jj}tg|_t|_|| ƒ}|tkrt 	¡ ‚|S r   )
ra   rb   ÚLoadLibraryWry   rd   rê   rf   r‹   r|   r€   )Ú
pszLibraryÚ_LoadLibraryWrñ   r   r   r   rõ   Ë  s   rõ   N)rv   )bÚdefinesrK   r\   r]   r^   r_   rY   rZ   r[   rI   ÚPAGE_NOCACHEÚPAGE_WRITECOMBINEr@   r>   ÚMEM_DECOMMITÚMEM_RELEASEr;   rF   rD   Ú	MEM_RESETÚMEM_TOP_DOWNÚMEM_WRITE_WATCHÚMEM_PHYSICALÚMEM_LARGE_PAGESÚMEM_4MB_PAGESÚSEC_FILEÚ	SEC_IMAGEÚSEC_RESERVEÚ
SEC_COMMITÚSEC_NOCACHEÚSEC_LARGE_PAGESrB   ÚWRITE_WATCH_FLAG_RESETÚFILE_MAP_ALL_ACCESSÚPROCESS_DUP_HANDLEr(   r   Úobjectr+   rc   Ú	Structureri   r“   r¡   rm   rr   rt   rx   r‰   r‘   rœ   r    r¦   r«   rß   r’   rÏ   ÚLPPROC_THREAD_ATTRIBUTE_LISTÚPROC_THREAD_ATTRIBUTE_NUMBERÚPROC_THREAD_ATTRIBUTE_THREADÚPROC_THREAD_ATTRIBUTE_INPUTÚPROC_THREAD_ATTRIBUTE_ADDITIVEÚ ProcThreadAttributeParentProcessÚ ProcThreadAttributeExtendedFlagsÚProcThreadAttributeHandleListÚ ProcThreadAttributeGroupAffinityÚ ProcThreadAttributePreferredNodeÚ!ProcThreadAttributeIdealProcessorÚProcThreadAttributeUmsThreadÚ#ProcThreadAttributeMitigationPolicyÚProcThreadAttributeMaxÚ$PROC_THREAD_ATTRIBUTE_PARENT_PROCESSÚ$PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGSÚ!PROC_THREAD_ATTRIBUTE_HANDLE_LISTÚ$PROC_THREAD_ATTRIBUTE_GROUP_AFFINITYÚ$PROC_THREAD_ATTRIBUTE_PREFERRED_NODEÚ%PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSORÚ PROC_THREAD_ATTRIBUTE_UMS_THREADÚ'PROC_THREAD_ATTRIBUTE_MITIGATION_POLICYÚ-PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLEÚ7PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLEÚ/PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLEr²   ÚLPPROCESS_INFORMATIONr¶   ÚLPSTARTUPINFOrÌ   ÚLPSTARTUPINFOEXrÑ   ÚLPSTARTUPINFOWrÒ   ÚLPSTARTUPINFOEXWrÓ   r×   rÚ   rÞ   rô   rõ   r   r   r   r   Ú<module>   s¼   / 6


